The Hospital App's Family Account
Riverside Children's Hospital in Hangzhou runs a patient app with 480,000 registered accounts. The app has three functions: core appointment booking and electronic medical record access; a “growth tracker” that collects a child's height, weight, gait video and vaccination history; and a “family account” that lets an adult child add an elderly parent and view the parent's prescriptions and lab results. The privacy notice says that agreeing to the notice covers all three functions. A parent asks the hospital to delete all data after treatment ends. The hospital says electronic medical records must be retained for at least 15 years under healthcare rules. A 13-year-old registered without a guardian. The growth tracker's gait videos are processed by a vendor in Singapore, which stores them for 30 days. The hospital is not a critical information infrastructure operator and holds no important data. It wants one consent workflow for all users.
1. How should the hospital allocate legal bases across the three functions, and why is a single consent workflow unsafe?
Read the worked answer
Treat the three functions separately. Core appointment and EMR access is processing necessary to perform statutory duties or obligations under PIPL Article 13(3), not consent. The hospital should still give Article 17 notice, but it does not need to ask for consent for the clinical record itself, and it cannot condition treatment on unrelated consent. The growth tracker is different: gait video is biometric data, vaccination and height/weight data are medical-health data, and the user is a child under 14. That is sensitive PI under Articles 28 and 31. The hospital needs a specific purpose, sufficient necessity, guardian consent, separate consent under Article 29, and a special processing rule for minors. A bundled notice cannot supply that. The family account processes the elderly parent's PI. The adult child's consent cannot substitute for the parent's consent; the hospital needs the parent's authorization, or a guardian's consent if the parent lacks capacity, plus access controls and audit logs. A single consent workflow is unsafe because it merges ordinary, sensitive, minor and third-party data into one signal. Consent must be voluntary, explicit and informed, and separate where the law requires it. Under Article 16 the hospital also cannot refuse the core service because a user declines the growth tracker. Build feature-level notices and separate toggles.
2. Can the hospital reject the deletion request? Explain the retention conflict and the correct response.
Read the worked answer
The deletion right is not absolute. Article 47 requires deletion when the purpose is achieved, the service is stopped, consent is withdrawn, processing is unlawful, or another circumstance applies, but it is subject to retention duties in laws and administrative regulations. If healthcare rules require the hospital to retain the electronic medical record for at least 15 years, the hospital may refuse deletion of the record data that is actually covered by that duty. It should explain the specific legal basis, the retention period and the scope. It must not use the retention rule to keep the growth-tracker data, marketing data, or the Singapore vendor's copies, because those are outside the medical record retention obligation. For data that must be retained but should no longer be actively processed, Article 47 permits storage only and requires the hospital to stop other processing and secure the data. The hospital should delete the growth tracker and vendor copies, instruct the vendor to delete, and confirm in writing. It should also correct the privacy notice and separate the retention notice from consent. If the parent disputes the scope, the hospital should provide access and a reasoned response, and preserve an audit trail. Good practice is a retention schedule by data category and system, not a blanket refusal.
3. What must the hospital do about the 13-year-old and the Singapore vendor?
Read the worked answer
The 13-year-old is a minor under 14, so Article 31 applies: the hospital must obtain the guardian's consent and adopt special processing rules. The child's own registration is not valid consent. The hospital should verify age, block or suspend the growth-tracker features until guardian consent is obtained, and give the guardian the Article 17 notice in clear language. It should not simply keep the data because the account exists. For the Singapore vendor, this is a cross-border transfer of sensitive PI. The hospital must first conduct a personal information protection impact assessment under Article 55, covering necessity, the vendor's security, the 30-day retention and the impact on the child. It must choose an Article 38 route. Because the data is sensitive PI, the March 2024 cross-border provisions require a security assessment if sensitive PI of more than 10,000 people is transferred cumulatively in the year; below that, a standard contract or certification may be available if the total PI is over 100,000, otherwise the small-volume exemption may apply. The hospital must still give Article 39 notice and obtain separate consent for the cross-border transfer. It needs an Article 21 entrustment agreement with the vendor, audit and deletion rights, and breach notification. If the vendor is a separate handler, Article 23 separate consent is also needed.