Flashcards Studio

A private HR consultancy, NovaCore HR, is contracted by a mid-sized firm to conduct a pre-employment medical examination of a job applicant, Leya Cruz. The applicant signs a written consent authorizing background checks that include medical information. The clinic transmits the medical results to NovaCore, which uses the health data to decide whether to hire Leya. Separately, NovaCore implements an internal analytics platform that processes Leya’s health data, age, and biometric data (fingerprint pattern captured during onboarding) to rank candidates for promotions and to tailor wellness benefits. Leya objects, arguing that the health data constitute Sensitive Personal Information and that processing beyond recruitment is unlawful. (a) Identify whether the data described are Personal Information or Sensitive Personal Information under the Data Privacy Act, and state the controlling rule. (b) Based on the facts, assess the lawfulness of the processing for recruitment and the additional processing through the analytics platform, addressing the role of consent and any limits on processing of sensitive personal information.