Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Halibut Pharmacy breached the Complainant's privacy by including her medical diagnosis with a package that was sent to her based on an order she placed with the pharmacy.

Facts

The Complainant alleged that the Respondent incorrectly diagnosed her with an illness, which diagnosis was undertaken without consulting her primary doctor.

She also alleged that the wrong diagnosis bearing her personal details, insurance claim forms with similar information and the medications attached to it was handed over to a third party rider for delivery, who could access its contents. She provided photos of the package delivered to her which showed the documents attached on the outside of the package containing the medication.

The Complainant alleged that she contacted the Respondent's doctor to correct the wrong diagnosis, who promised to do so but still fowarded the forms containing the erroneous diagnosis to her insurance company.

The Respondent said that the Complainant and her family was their client for over 2 years. The Compainant placed an order for deliver to her address which was done in a sealed container. To facilitate reimbursement, the claim form and accompanying information was forwarded to the insurance company, Cigna.

The Respondent averred that the Complainant’s personal information was in the circumstances not exposed to third parties and those involved in the transaction were needed to process her claim. The Respondent did not provide any further information beside their statement made in responce to the claim.

The ODPC found that:

• Respondent processed the Complainant's health data within the meaning of the Data Protection Act, 2019. The Respondent was required to uphold the Respondent’s privacy while processing that data.
• The Complainants name, phone number and physical address was necessary in facilitating the delivery of the pharmacy order.
• The medical diagnosis was not necessary for purposes of delivering the medications sought by the Complainant which violated the Complainant's right to privacy under Section 25 of the DPA19.
• The Act of placing the medical diagnosis on top of the package for delivery, also violated the Respondents right to privacy and the provisions of sections 25 and 44 of the DPA19.