Making a dental x-ray appointment with my local hospital, I was asked my child’s religion. As a special category of personal data, I couldn’t understand why processing my child’s religion was necessary for any of the purposes set out in the HSE’s data privacy statementwhich stated:
“We will only process special categories of personal data where it is necessary:
- for the purposes of preventative or occupational medicine
- for the assessment of the working capacity of an employee
- for medical diagnosis
- for the provision of healthcare, treatment or social care
- for the management of health or social care systems and services, or
- pursuant to a contract with a health professional.”
As explicit consent was not sought (nor provided), it is likely the recording and processing of this personal data (as it relates to a child under the age of 13) constitutes unlawful processing.
In a state where health services were once dominated by provision from the Catholic church, my suspicion is that the question is one which has always been asked. The lesson though is that a good data protection or privacy programme will ensure all business processes have been reviewed to understand precisely what categories of personal data are processed, and why.
