Flashcards Studio

PulseCare, a Philippines-based telemedicine platform, collects at sign-up: full name, date of birth, contact details, medical history, and prescription data. The privacy notice states that data will be used to provide telemedicine services and may be shared with affiliates to improve services. Six months later, PulseCare signs a contract with DataWave Analytics to build predictive health profiles to tailor wellness communications, using only data already held by PulseCare. Lina Diaz, a PulseCare user, objects, arguing that the new use is a different purpose not originally disclosed and requires separate consent. PulseCare contends the new use is within the original purpose because it helps improve services and constitutes sharing with affiliates under the Terms. (a)Identify the General Data Privacy Principle at issue and state the controlling rule. (b)Classify PulseCare’s roles as data controller or data processor with respect to DataWave, and assess whether the processing complies with the principle identified in (a). (c)Assuming the processing is not within the original purpose, outline Lina's remedies under the Data Privacy Act of 2012 and potential penalties for PulseCare.