X is a patient of Dr. Y who has been diagnosed with Stage 2 Breast Cancer. As her condition requires urgent medical attention, X consented to schedule immediate operation on June 02, 2019 right after her business trip from abroad on May 30, 2019. While X was abroad, in an immediate preparation for the operation, Dr. Y sought data from X's biological mother (Susan) about her previous health record, genetics and other medical background. Susan is also a doctor who works as a Pediatrician in the same hospital where Dr. Y belongs. QUESTION: Did Dr. Y commit any violation of the Data Privacy Act in this case?