NPC Issuance Wiki

NPC Advisory Opinion No. 2018-031 — Privacy Notice

Issued Advisory Opinion

Text

20 July 2018

Re: PRIVACY NOTICE

Dear [Redacted],

This is in response to your request for review of Metro Antipolo Hospital’s draft Notice of Privacy – Acceptance of Terms and Conditions of the Privacy Notice and Consent to Use of your Personal Health Information, taking into consideration the requirements of Republic Act No. 10173,1 otherwise known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulation (IRR), and issuances of the National Privacy Commission (NPC).

Discussion

At the outset, it must be clarified that the submitted privacy notice is a statement made to a data subject that describes how the organization collects, uses, retains and discloses personal information.2 A privacy notice is sometimes referred to as a privacy statement, a fair processing statement or sometimes a privacy policy.3

Having stated that, there is also a need to determine and clarify the distinction between privacy notice and securing the consent of the data subject for the processing of his or her personal information.

Being a mere notice, it is emphasized that the privacy notice is not equivalent to consent. This document is an embodiment of the observance of the data privacy principle of transparency and upholding the right to information of data subjects.

The principle of transparency mandated by the DPA dictates that the data subject must be aware of the nature, purpose, and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of personal information controller, his or her rights as a data subject, and how these can be exercised.4 Any information and communication relating to the processing of personal data should be easy to access and understand, using clear and plain language.5

Thus, in line with the right to information of the data subject, personal information controllers (PICs) are required to apprise the data subject of the following:

  1. Description of the personal data to be processed;
  2. Purposes for processing, including: direct marketing, profiling, or historical, statistical or scientific purpose;
  3. Basis of processing, when processing is not based on the consent;
  4. Scope and method of processing;
  5. Recipient/classes of recipients to whom the personal data are or may be disclosed;
  6. Methods utilized for automated access, if the same is allowed by the data subject, and the extent to which such access is authorized;
  7. Identity and contact details of the PIC or its representative;
  8. Retention period; and
  9. Existence of rights as data subjects, the right to lodge a complaint before the NPC.

On the other hand, obtaining consent from the data subject for the purposes of processing his or her personal data is a different requirement altogether.

Consent of the data subject refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of his or her personal, sensitive personal, or privileged information.

When the processing of personal information is based on consent, the PIC must obtain the consent in relation to the declared purpose for processing. The consent must likewise be evidenced by written, electronic or recorded means.6

From the foregoing, the following are our observations for your consideration:

USES AND DISCLOSURE OF YOUR HEALTH CARE INFORMATION:

There is a need to define or describe health care information.

Further, it is also necessary to determine what health care information will be used and disclosed for each enumerated item.

Also, kindly expound further on each item by providing a discussion on specific purpose/s, basis of processing, scope and method of processing, storage, etc.

NOT REQUIRED WRITTEN AUTHORIZATION:

Kindly clarify the statement “Not Required Written Authorization.”

We understand that there are processing of sensitive personal information which may not require consent, i.e. processing pursuant to laws and regulations.

Nonetheless, it is advisable to include a statement to the effect that the hospital will obtain the data subjects’ consent at the most opportune time should consent be the appropriate basis for processing.

RETENTION AND DISPOSAL OF HEALTH RECORDS:

It may be advisable to indicate the basis, i.e. DOH issuance, law or regulation, hospital policy, etc., of the retention periods.

SIGNATURE OVER PRINTED NAME & DATE:

To reiterate, a privacy notice is not equivalent to a consent form. Hence, requiring the signature of a patient as part of a privacy notice is not necessary.

However, we understand that the hospital may require the signature as part of the documentation that the patient was duly informed regarding the processing of his or her personal data.

If this is the case, the same must be clearly stated in the notice in order to avoid any confusion as to what the patient is signing.

It is also advisable to include statements on third party service providers and physician-patient privileged communication.

This opinion is being rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For you reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission and for other Purposes [DATA PRIVACY ACT OF 2012], Republic Act No. 10173 (2012). ↩

  2. IAPP, Glossary of Privacy Terms, available at https://iapp.org/resources/glossary/#paperwork-reduction-act-2 ↩

  3. Id. ↩

  4. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18(a) (2016). ↩

  5. Id. ↩

  6. RA No. 10173, §3(b). ↩

Backlinks