Text
23 June 2017
Re: COLLECTION OF DATA - PROFESSIONAL LICENSE
Dear [Redacted],
This pertains to your query received by the National Privacy Commission (NPC) on 05 April 2017, via email. You seek clarification if your company is allowed to obtain details of the professional licenses, i.e. license numbers and expiry dates, of medical practitioners, hospital personnel and hospital management who avail of seminars and workshops of the Academy.
The purpose for such collection is to ensure that the course participants have a valid professional license in the Philippines.
Lawful Processing of Personal and Sensitive Personal Information
A professional identification card issued by the Professional Regulation Commission (PRC) contains the following information:
- Full name - last name, first name, and middle name;
- Registration number;
- Registration date;
- Validity;
- Profession;
- Photo;
- Date of birth; and
- Signature.
A PRC identification card contains both personal1 and sensitive personal information2, the lawful processing of which is provided for under Sections 12 and 13 of the Data Privacy Act of 2012 (DPA).
We believe that the Academy, as a personal information controller, may lawfully process personal data contained in the professional licenses pursuant to the following provisions of the DPA:
SECTION 12. Criteria for Lawful Processing of Personal Information. — The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:
a) The data subject has given his or her consent; b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract;
xxx xxx xxx
SECTION 13. Sensitive Personal Information and Privileged Information. — The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:
a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing; xxx.
From the foregoing, the Academy may collect the license numbers and expiry dates from their course participants provided they have given their consent3 as the license number is sensitive personal information. The Academy should also implement security measures for the protection of personal data they have collected. There should also be procedures for the data subjects to exercise their rights.
For your reference.
Sincerely,
IVY D. PATDU Officer-in-Charge and Deputy Privacy Commissioner Policies and Planning
Footnotes
-
RA No. 10173, §3(g) - Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual. ↩
-
Id., §3(l) - Sensitive personal information refers to personal information: (1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; (2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and (4) Specifically established by an executive order or an act of Congress to be kept classified. ↩
-
Id., §3(b) – Consent of the data subject refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so. ↩