***********************************************************
Following is a question by the Dr Hon Kwok Ka-ki and a written reply by the Secretary for Health, Welfare and Food, Dr York Chow, in the Legislative Council today (November 1):
Question:
I have received several complaints about the personal data of medical practitioners published on egazette not being reasonably protected because many of them use their residential addresses as their medical practitioner's registered address, but anyone with an ordinary Internet search engine can find out the personal data of those medical practitioners, such as their registered addresses, by inputting the name of a doctor and "egazette" (the English name of the Gazette on the Internet). In this connection, will the Government inform this Council:
(a) whether it will request the Registrar of Medical Practitioners to issue a statement each year reminding medical practitioners that they may use their business addresses or post office box numbers instead of their residential addresses as their registered addresses;
(b) whether it will request Internet search engine companies to stop using and delete the personal data of medical practitioners obtained from the egazette so that the privacy of the medical practitioners concerned can be protected; and
(c) whether there are ways to guard against abuse of the personal data of medical practitioners contained in the egazette, and whether it will consider amending the Medical Registration Ordinance (Cap. 161) to provide that registered addresses of medical practitioners may not be published in the egazette in order to protect the privacy of medical practitioners?
Reply:
Madam President,
Pursuant to the Medical Registration Ordinance (Cap. 161) (the MR Ordinance), a registered medical practitioner is required to supply the Registrar of Medical Practitioners (the Registrar) with a registered address at which notices from the Medical Council may be served on him. The MR Ordinance also provides that as soon as may be after January 1 of every year, the Registrar shall publish in the Gazette a list of all persons whose names appear on Part I and Part III of the General Register on January 1 and the list shall contain the names, addresses, qualifications and dates of the qualifications of these persons. In addition, as soon as may be after July 1 of every year, the Registrar shall publish in the Gazette a list of the above-stated information of all persons whose names were added to Part I and Part III of the General Register between January 1 and July 1 of such year. From the Gazette, members of the public can ascertain if a person is a registered medical practitioner and obtain information about his registration particulars. A registered medical practitioner should apply for renewal of his practising or retention certificate annually on a prescribed form. Now my reply to the question is as follows-
(a) On the application form for practising/retention certificate, it is clearly stated that the registered address of a registered medical practitioner will be published in the Gazette and that the registered address supplied to the Medical Council may either be the business address, residential address or post office box number. All registered medical practitioners are reminded of this requirement every year as the renewal of the practising/retention certificate is an annual exercise.
A registered medical practitioner may, at any time, inform the Registrar in writing of any change in his address. Medical practitioners are reminded of this arrangement in the half-yearly Newsletter of the Medical Council. The Administration encourages the Medical Council to continue this practice of reminding medical practitioners of this arrangement on a regular basis through its Newsletter.
(b) & (c) The Gazette is a government publication for public perusal. Upon gazettal, any information therein becomes public information. Pursuant to the E-government policy and as an environment-friendly initiative, the Administration has, since December 2000, uploaded the full set of Gazette onto the Government's website for public viewing on top of the printed copies.
Under the Personal Data (Privacy) Ordinance (Cap. 486) (the PDP Ordinance), any person who collects, holds, processes or uses (including disclosure or transfer) personal data is regarded as a data user, who is subject to the requirements of the PDP Ordinance. The PDP Ordinance is applicable to personal data processed on the Internet.
It is provided under Data Protection Principle 3 (restriction on the use of personal data as to the purpose) in the PDP Ordinance that without the prescribed consent of the data subject, a data user may not use any personal data for any purpose other than the purpose for which the data were to be used at the time of the collection of the data or a purpose directly related to that purpose. Thus any person who without the prescribed consent of a registered medical practitioner listed on the Register uses the data for a purpose other than the purpose for which the data were published in the Gazette, contravenes the relevant data protection principle. The data subject can lodge a complaint with the Privacy Commissioner (the Commissioner). If, after investigation, the Commissioner is of the opinion that the data user has contravened a data protection principle of the PDP Ordinance, he may, according to section 50 of the PDP Ordinance, issue an enforcement notice to that data user, directing him to take measures to remedy the contravention. A data user who contravenes an enforcement notice commits a criminal offence and is liable on conviction to a maximum fine of $50,000 and imprisonment for 2 years and, in the case of a continuing offence, to a daily penalty of $1,000. In addition, the data subject who suffers damage by reason of the data user's contravention of a requirement under the PDP Ordinance shall be entitled to compensation from that data user for that damage through civil proceedings.
Ends/Wednesday, November 1, 2006
Issued at HKT 13:00
NNNN
