Text
6 June 2018
Re: PSEUDONYMIZATION OF PERSONAL AND SENSITIVE PERSONAL INFORMATION
Dear [Redacted],
We write in response to your request for advisory opinion received by the National Privacy Commission (NPC) on 25 April 2018 for a clarification on pseudonymization and the request of brokers for information.
You mentioned in your email that brokers are requesting detailed utilization reports that contain personal and sensitive personal information of policyholders from health maintenance organizations (HMOs) with pseudonymized personal information as a workaround to the statutory requirement of securing consent from the individuals.
Discussion
Lawful processing of personal data
We understand that utilization reports contain sensitive personal information, particularly health information, of policyholders. It is important to establish that these personal data entail a higher degree of protection due to the higher risks involved in its processing.
As a general rule, disclosure of sensitive personal information to third parties, such as brokers, is prohibited, unless such processing satisfies any of the conditions set forth in Section 13 of the DPA:
a. The data subject has given his or her consent; b. The processing is provided for by existing laws and regulations; c. The processing is necessary to protect the life and health of the data subject or another person; d. The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations; e. The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution; or f. The processing is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.
Absent any of the instances enumerated above, disclosure of sensitive personal information to the brokers has no lawful basis.
Pseudonymized personal data
Pseudonymization has been defined as “the processing of personal data in a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.”1
It consists of replacing one attribute (typically a unique attribute) in a record by another.2 The natural person is therefore still likely to be identified indirectly; accordingly, pseudonymization when used alone will not result in an anonymous dataset.3 The application of pseudonymization is a practical method of securing personal data since it reduces the association between a new dataset and the original dataset, which then decreases the risk of identification.4
But note that pseudonymization of personal data does not change the nature of the data — it remains to be personal data.
Thus, the HMOs and the brokers processing pseudonymized personal data are considered as personal information controllers which must have a basis for lawful processing under Sections 12 and 13 of the DPA, respectively. They must adhere to the general data privacy principles, implement reasonable and appropriate organizational, physical and technical security measures for the protection of personal data, and must at all times, uphold data subjects’ rights.
This opinion is being rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC [EU GENERAL DATA PROTECTION REGULATION], Article 4(5) (2016). ↩
-
Article 29 Data Protection Working Party, Opinion 05/2014 on Anonymization Techniques, available at http://ec.europa.eu/justice/article29/documentation/opinion-recommendation/files/2014/wp216_en.pdf (last accessed June 5, 2018). ↩
-
Id. ↩
-
GDPR Report, Data masking: anonymization or pseudonymization?, available at https://gdpr.report/news/2017/09/28/data-masking-anonymization-pseudonymization/ (last accessed June 5, 2018). ↩