Text
26 February 2018
RE: DISCLOSURE OF THE MASTER LIST OF STUDENTS AND INDIVIDUALS WHO WERE VACCINATED WITH DENGVAXIA
Dear [Redacted],
This pertains to your request for advisory opinion received by the Privacy Policy Office of the National Privacy Commission (NPC) on 05 February 2018, which sought to clarify whether the Department of Health (DOH) could provide a copy of the master list of students and individuals who were vaccinated with Dengvaxia®, without violating the provisions of Republic Act No. 101731, also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR)2 and relevant issuances.
In your letter-request, you have stated that the Public Attorney’s Office (PAO) is seeking to obtain the following personal information for each of the children/individuals vaccinated, starting with those given in April 2016 for the purpose of extending free legal assistance in civil, criminal and administrative cases to all possible victims of Dengvaxia® related injuries, illnesses and deaths:
- a. Name;
- b. Birthday;
- c. Home address;
- d. Name of parents;
- e. Consent form;
- f. Vaccination card;
- g. Name of the vaccinator;
- h. Position of the vaccinator; and
- i. Health educator.
Furthermore, the same master list was requested by certain private organizations, i.e. Volunteers against Crime and Corruption (VACC), and some members of the media.
Discussion
It is important to establish that the personal information sought to be collected by the PAO, VACC, and the media is considered as sensitive personal information as defined in Section 3(l) of the DPA, particularly those relating to the individual’s age, health and health record (vaccination card, and status of being vaccinated). The information also relates to a vulnerable group of data subjects—minors.
In general, processing of sensitive personal information is prohibited by law except in the cases provided under Section 13 of the DPA. The release of “a copy of the master list of students and individuals who were vaccinated with Dengvaxia®” will be lawful processing if is provided for by existing laws and regulations, or has the consent of data subjects or authorized representatives, otherwise the processing might be considered as unauthorized processing under the Data Privacy Act.
The Commission is mindful that information provided to government or public authority may be processed without consent when it is done pursuant to the particular agency’s constitutional or statutory mandate, and subject to the requirements of the DPA. In this case, the information sought to be released were not provided to the Public Attorney’s Office, and were not collected for purposes of the PAO’s legal mandate.
Under Republic Act No. 9406, it is our understanding that the mandate of PAO is to extend free legal assistance to indigent persons in criminal, civil, labor, administrative and other quasi-judicial cases. Should PAO then be authorized as legal representatives of the minor data subjects, they may then be provided information regarding the particular data subject they are representing, subject to the presentation of proof of such authorization.
We take time to emphasize that the government is one of the biggest repositories of the personal data of citizens. The government or its agencies, however, do not have the blanket authority to access or use the information about private individuals under the custody of another agency.
In all cases, the processing of personal data by any personal information controller, like the DOH or the PAO when expressly authorized by the data subject or by law, should always adhere to the general data privacy principles of transparency, legitimate purpose and proportionality.3 Aside from this, personal information controllers should implement appropriate security measures for data protection. Moreover, before any personal information is transferred from one agency to another, it is highly recommended that the agencies execute a Data Sharing Agreement to ensure that there are adequate safeguards for data privacy and security implemented by both parties.4 Kindly refer to NPC Circular No. 2016-02 – Data Sharing Agreements Involving Government Agencies for additional information.
Lastly, as to the request of the media and other private organizations, the disclosure of statistical or aggregated information without involving any personal or sensitive personal information should suffice. The release of a copy of the master list of students and individuals who were vaccinated with Dengvaxia®, which contains sensitive personal information to the Requesting, to any requesting public, could constitute an unwarranted invasion of personal privacy.
We urge the DOH to be circumspect in releasing information relating to sensitive personal information of individuals. It should do so only if it is satisfied that such release is authorized under law, adheres to data privacy principles and reasonable and appropriate security measures are in place for the protection of said data. In order to fulfill its own mandate, the DOH collects health information of the Filipinos, who should be able to trust that their information will be protected and used only for the purpose by which they are collected.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
AN ACT PROTECTING INDIVIDUAL PERSONAL INFORMATION IN INFORMATION AND COMMUNICATIONS SYSTEMS IN THE GOVERNMENT AND THE PRIVATE SECTOR, CREATING FOR THIS PURPOSE A NATIONAL PRIVACY COMMISSION, AND FOR OTHER PURPOSES, “Data Privacy Act of 2012” (15 August 2012). ↩
-
Implementing Rules and Regulations of the Data Privacy Act (24 August 2016). ↩