Whether a statutory body could collect data from two organizations charged with providing rehabilitation programmes for the purpose of programme evaluation.
Q: We are a statutory body responsible for conducting and financing rehabilitation programmes for certain persons suffering from a particular medical condition. We have appointed two non-profit-making organizations to provide rehabilitation programmes. For the purpose of programme evaluation, we want to collect data from the two organizations about who has participated in what types of programmes. The question is whether the two organizations should first seek the written consent of the programme participants before disclosing the information to us.
A: It is our understanding that the original purpose for which the personal data of the programme participants were to be used at the time of collection of such data was for conducting the programmes. In our view, disclosure of the data to you by the two organizations for the purpose of evaluating the success of the programmes financed by you will be directly related to the original purpose of collection of such data. Hence, it appears to us that it is not necessary to obtain prior written consent from the participants. Having said that, in order to avoid any misunderstandings from the participants, it is advisable for the organizations concerned to inform the participants at the outset in the relevant Personal Data Collection Statement that their personal data will be transferred to you for the purpose of programme evaluation.