The issue of companies requesting “prescriptions” from employees before providing medical benefits - Enquiry Case Notes

No： 0074/C/2011

Title： The issue of companies requesting “prescriptions” from employees before providing medical benefits

Content：

　　Resident A, who works in Company A, said that the medical benefits in the company include hospital treatment fees and medication costs. When the staff apply for these benefits, they usually only need to submit the receipts. However, in addition to the receipts, Company A also been recently requesting that Resident A provide the “prescriptions”.
　　Resident A asked whether Company A’s conduct breached the “Personal Data Protection Act”.

Result：

　　In the absence of detailed information about the case, which the inquirer could have provided, GPDP can only make the following response on the general requirements for personal data processing:
　　In accordance with the provisions in articles 4.1.(1) and 3.1 of the Personal Data Protection Act, the data processing involved in this case is within the scope of regulation by the said Act.
　　In general, and as the “drug prescriptions” might contain personal data and sensitive information, Company A can only process the relevant personal data legitimately if it observes the provisions of Article 6 of the “Personal Data Protection Act”, as well as the premises and conditions of Article 7 of the said Act. In other words, only by obtaining the consent of Resident A or in the situations permitted by law can Company A legitimately process the data in the “drug prescriptions”.
　　If applying for benefits is not obligatory, it can be considered that Company A obtained Resident A’s explicit consent to process his personal data when A submitted the respective application. If Resident A applied for benefits voluntarily but refused to submit the data to company A, then Company A may, at its sole and absolute discretion, determine whether or not to approve the application within the scope permitted by law.
　　Resident A may first ask Company A to explain the purpose of and reasons for acquiring the prescriptions. If Resident A believes that Company A has breached the “Personal Data Protection Act”, he should provide concrete evidence regarding the case to GPDP and file a complaint or report.

Reference：
Please refer to "Personal Data Protection Act", articles 3，4，6，7 .

Back

個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

News Update