Beta

Flashcards Studio

Practice bar questions and get clear AI feedback on every answer.

Study Settings View Stats

Topic

Question Type

Essay Multiple Choice

Question Source

All Jurisprudence based

0 tracked cards Political and Public International Law

A private hospital in Cebu City collects patients’ health information and iris biometric data to diagnose and treat. It contracts a cloud analytics provider based in Singapore to process imaging and biometric data to support clinical decisions. Intake forms authorize use of data for treatment and hospital operations but do not address disclosures to third-party processors or cross-border transfers. A data processing agreement with the Singapore provider states that data will be processed to provide services and will be deleted upon contract termination, but does not specify retention beyond termination or localization. Data may be stored on local servers and in the provider’s cloud in Singapore. (a) Identify the lawful basis for processing the patient’s health information and biometric data for diagnosis and treatment. (b) Is disclosure to the Singapore-based processor permissible without a separate express consent? What is the controlling rule on processing sensitive personal information in this context? (c) If the data are transferred to Singapore, is such cross-border transfer permissible under the Data Privacy Act, and what safeguards must be in place? Apply the rule to the facts.

Choose the Best Answer

Lawful basis: consent to process SPDI; PHI may be processed under medical necessity without additional consent; cross-border transfer requires explicit patient consent and NPC-approved safeguards; adequacy of Singapore must be presumed for transfers. Express consent for SPDI; PHI used for diagnosis and treatment is necessary for medical care; disclosure to the Singapore processor requires explicit consent to disclose to a third party; cross-border transfer to Singapore is permissible only if the recipient country provides adequate data protection or there is a data processing agreement with appropriate safeguards and the data subject has consented to cross-border transfer. Lawful basis: contractual necessity between patient and hospital for treatment; SPDI may be processed as part of fulfilling the treatment contract; disclosure to a processor is allowed under the contract without separate consent; cross-border transfer is permitted if the contract contemplates service provision and there is a data protection agreement. Lawful basis: legitimate interests; disclosure to processors may proceed without consent if necessary to operate the hospital; cross-border transfer is allowed whenever service provision requires it, regardless of adequacy safeguards, since processing is for business operations.

Load another random question

Your Progress

No data Retention

Tracked Cards: 0
Accuracy: No data
Retained: 0

View Detailed Analytics

Difficulty Breakdown

Answer flashcards to build a real score-based difficulty breakdown.

Current Streak 0 Days

Start a streak with this card.

Suggested Decks

View All

Leech Cards

Review

No recent weak flashcards in your saved workbook.

More

Flashcards Studio

Question

Choose the Best Answer

Hello