Text
7 August 2018
RE: EMPLOYEE’S RIGHT TO ACCESS EMPLOYMENT RECORDS
Dear [Redacted],
This is in response to your inquiry received by the National Privacy Commission (NPC) regarding the employee’s right to access his employment records, pursuant to Section 16 of Republic Act No. 10173,1 also known as the Data Privacy Act of 2012 (DPA). Specifically, you are seeking clarification on the following:
- Whether an employee can request for a copy of the results (laboratory exam results, ECG paper or x-ray film) of his annual physical exam conducted by the company for personal use;
- Whether an employee may request for a copy of his 201 file, including the trainings attended or results of performance evaluation; and
- Whether the resigned employee may request for a copy his personal data and other records retained by the company.
Discussion
Processing of personal data of employees
It is a fact that processing of personal data at work is inevitable and indispensable. The collection, use and retention of personal data of employees is necessary for the performance of a contract, compliance with a legal obligation, in furtherance of the employer’s legitimate interests or when the employee expressly gives his or her consent to the personal information controller for processing.2
Nevertheless, the employers, as personal information controllers (PICs), are directed to adhere to the principles of transparency, legitimate purpose and proportionality in the collection, processing, retention, storage and disclosure of personal information in their custody.3
Right to reasonable access of personal information
The employee as a data subject may exercise his or her right to reasonable access to the following:
- Contents of his or her personal information that were processed;
- Sources from which personal information were obtained;
- Names and addresses of recipients of the personal information;
- Manner by which such data were processed;
- Reasons for the disclosure of the personal information to recipients;
- Information on automated processes where the data will or likely to be made as the sole basis of any decision significantly affecting or will affect the data subject;
- Date when his or her personal information concerning the data subject were last accessed and modified; and
- The designation or name or identity and address of the personal information controller.
In some instances, copies of personal data retained by the employer may be requested by the employee, particularly those records that are provided by the employee upon application and those related to his or her official duties and responsibilities.4 However, some personnel files that are obtained in confidence shall be kept confidential and the employer may withhold disclosure, reproduction or viewing of the particular file.5
As an alternative, perhaps it is possible for the employer to provide a summary of the confidential information without causing prejudice to its interests or other parties involved.6
Access to results of the annual physical exam
Medical records are classified as sensitive personal information and are then treated with utmost care and strict confidentiality.
In the given scenario, we assume that the company sponsored and shouldered the cost for the annual physical exam and the attendant laboratory procedures. Nonetheless, the employee has the right to access and ask for a copy of the results and related documentation, subject to existing company protocol on accessing employee files.
Access to personnel file
Employees are generally allowed reasonable access to their files, specially those they have personally provided the employer during the recruitment and application process.
The trainings attended by the employee may be disclosed since they are part of the duties, responsibilities and privileges attached to the position and function and part of the professional development and capacity building program of the employer.
As to access to employee performance evaluation, it may be viewed in two perspectives. If the evaluative material is solely complied to determine the qualification of the employee for employment, appointment, promotion, recognition or termination, and such is given by the immediate supervisor due to the normal course of personnel evaluation, the employee is entitled to know the rating.7
On the other hand, if the evaluative material is given in confidence, in such a way that the rating and observation will not be given except for an understanding of confidentiality and anonymity, the employee shall not be permitted to access the file.8
Nonetheless, the employer may likewise provide a summary of all the ratings given to the employee without identifying the source in order to uphold the duty of confidentiality.
Access to personal data after resignation
Upon cessation of employment, the employer may retain the records and files of the employee in accordance with the retention period as may be provided for by existing laws on the matter and/or as stated in its policies.
If the request falls within the retention period of employment records, the employer shall provide reasonable access to the requested information, subject to the same limitations discussed above and its own company policies.
Please note that as part of the organizational security measures, PICs are required to develop, implement and review policies and procedures for data subjects to exercise their rights under the DPA.9
This opinion is being rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission and for other Purposes [DATA PRIVACY ACT OF 2012], Republic Act No. 10173 (2012). ↩
-
Repa, Barbara Kate. State Laws on Access to Your Personnel File, available at https://www.nolo.com/legal-encyclopedia/free-books/employee-rights-book/chapter5-2.html, last accessed on 26 July 2018. ↩
-
Privacy at Work: A Guide to the Privacy Act for employers and employees, Office of the Privacy Commissioner of New Zealand, available at https://www.privacy.org.nz/assets/Files/Brochures-and-pamphlets-and-pubs/Privacy-at-Work-2008.pdf, last accessed on 26 July 2018. ↩
-
Id. ↩
-
Supra note 5. ↩
-
Id. ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 (2016), §26(e)(4) ↩