PERSONAL DATA PROTECTION
65
FOURTH SCHEDULE—continued
- (m) the personal data about the current or former patients of a healthcare institution licensed under the Private Hospitals and Medical Clinics Act (Cap. 248) or any other prescribed healthcare body is disclosed to a public agency for the purposes of policy formulation or review;
- (n) the personal data is disclosed to any officer of a prescribed law enforcement agency, upon production of written authorisation signed by the head or director of that law enforcement agency or a person of a similar rank, certifying that the personal data is necessary for the purposes of the functions or duties of the officer;
- (o) the disclosure is for the purpose of contacting the next‑of‑kin or a friend of any injured, ill or deceased individual;
- (p) subject to the conditions in paragraph 3, the personal data—
- (i) is disclosed to a party or a prospective party to a business asset transaction with the organisation;
- (ii) is about an employee, customer, director, officer or shareholder of the organisation; and
- (iii) relates directly to the part of the organisation or its business assets with which the business asset transaction is concerned;
- (q) subject to the conditions in paragraph 4, the disclosure is for a research purpose, including historical or statistical research;
- (r) the disclosure is for archival or historical purposes if a reasonable person would not consider the personal data to be too sensitive to the individual to be disclosed at the proposed time; or
- (s) subject to the conditions in paragraph 5, the personal data—
- (i) was collected by the organisation in accordance with section 17(1); and
- (ii) is disclosed by the organisation for purposes consistent with the purpose of that collection.
2. In the case of disclosure under paragraph 1(c), the organisation shall, as soon as may be practicable, notify the individual whose personal data is disclosed of the disclosure and the purposes of the disclosure.
3.—(1) The conditions in this paragraph shall apply to personal data disclosed under paragraph 1(p).
(2) In the case of disclosure to a prospective party to a business asset transaction—
