NPC Issuance Wiki

NPC Advisory Opinion No. 2018-049 — Disclosure of Personal Information to the Police and the Media

Issued Advisory Opinion

Text

26 November 2018

Re: DISCLOSURE OF PERSONAL INFORMATION TO THE POLICE AND THE MEDIA

Dear [Redacted]:

We write in response to your queries received by the National Privacy Commission (NPC) concerning the disclosure of personal information of patients to police officers and the media and how one would balance crime prevention, detection, and investigation vis-à-vis patient’s right to data privacy.

In your email, you stated that the police interview or obtain information about patients who are either alleged perpetrators of a crime or victims thereof. Also, you asked the following questions regarding disclosure to the media:

  1. When dealing with media people, how do we balance patient privacy and public’s right to know?
  2. Do we have a legal obligation to disclose information to the media?
  3. Do the media have the legal mandate to compel institutions like hospitals to disclose information?

Discussion

Disclosure to the Police in Relation to a Criminal Investigation

The Data Privacy Act of 2012 (DPA)1 is a law that involves primarily one aspect of privacy, that of information privacy. Strictly, the DPA does not include in its coverage hospital policies that pertain to hospital operations including procedures in dealing with law enforcement, except to the extent that they relate to the protection of personal data.

The DPA states that the processing of personal information shall be allowed, subject to compliance with the requirements of the DPA and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.2

In general, a hospital should not release health information about patients unless with their consent or with authority of law. For personal information, which may include the name of patient, address, date and time of admission, this may be disclosed subject to Section 12 (d)(e)(f), to wit:

“(d) The processing is necessary to protect vitally important interests of the data subject, including life and health;

(e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or

(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.”

For sensitive health information, release is generally prohibited unless it is permitted by specific provision of law. The following provisions in Section 13 of the DPA may be applicable:

“(b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;

(c) The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing;

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.”

Relative to the abovementioned provisions, the Philippine National Police (PNP) has the following powers and functions, as enumerated in Section 24 of Republic Act No. 6975:3

a. Enforce all laws and ordinances relative to the protection of lives and properties; b. Maintain peace and order and take all necessary steps to ensure public safety; c. Investigate and prevent crimes, effect the arrest of criminal offenders, bring offenders to justice and assist in their prosecution. (underscoring supplied)

Thus, the disclosure of personal information of patients to law enforcement officers may be allowed under the DPA when it is pursuant to its mandate to investigate and prevent crimes, and strictly following the existing standard operating procedures in the conduct of an investigation and law enforcement operation as stated in the Revised PNP Operational Procedures, and other pertinent laws, rules, and regulations governing the same (i.e. criminal procedures on search and seizure, etc.) Only these contexts do the exercise of a mandate becomes a lawful basis for processing.

Investigation refers to the collection of facts to accomplish a three-fold aim: (a) to identify the suspect, (b) to locate the suspect, and (c) to provide evidence of his guilt. In the performance of his duties, the investigator must seek to establish the six (6) cardinal points of investigation, namely: what specific offense has been committed; how the offense was committed; who committed it; where the offense was committed; when it was committed; and why it was committed. Taking of sworn statements of suspects and witnesses is also part of the investigation protocol.4

Further, there are reporting requirements under existing laws which requires disclosure of information about particular medical conditions to specific government agencies, such as serious and less serious physical injuries5 and suspected cases of child abuse or maltreatment.6

Nevertheless, while the DPA recognizes such mandate, the law is also categorical in stating that the processing of personal information must adhere to the principles of transparency, legitimate purpose and proportionality. Personal information must be processed for specified and legitimate purposes determined and declared before, or as soon as reasonably practicable after collection. It should also be processed in a way compatible with such declared, specified, and legitimate purposes only.

Law enforcement does not have a blanket authority to access medical records of patients in a hospital. These records may be released with patient’s consent, or when being requested pursuant to a court order, subpoena or subpoena duces tecum, search warrants, or other administrative orders authorized by law.

Section 13(f) of the DPA does not provide law enforcement agencies unrestricted access to health information being kept in a hospital. Note that under the EU General Data Protection Regulation (GDPR),7 “establishment, exercise or defense of legal claims” refers to processing of information in the context of seeking legal advice. This covers a range of activities, in the context of a criminal or administrative investigation, for the purpose of defending oneself or for obtaining a reduction or waiver of a fine legally foreseen, e.g. in anti-trust investigations. This also includes for the purpose of formal pre-trial discovery procedures in civil litigation and cover actions by the data controller to institute procedures for example commencing litigation or seeking approval of a merger.8

Section 13(f) should also be read in accordance with the 1987 Philippine Constitution, particularly Art. III, Section 2:

“Section 2. The right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures of whatever nature and for any purpose shall be inviolable, and no search warrant or warrant of arrest shall issue except upon probable cause to be determined personally by the judge after examination under oath or affirmation of the complainant and the witnesses he may produce, and particularly describing the place to be searched and the persons or things to be seized.”

Disclosure to the Media

While hospitals may disclose personal information of patients to the police in relation to a criminal investigation as discussed above, there is no similar obligation for hospitals and other healthcare facilities to disclose personal information of patients to the media.

It should be noted that the DPA provides for the criteria for lawful processing of personal information and sensitive personal information in Section 12 and 13, respectively. Based on such criteria set in the law, personal and sensitive personal information of the patient can only be disclosed to the media when the patient gives his or her consent. The media does not have the legal mandate to compel hospitals and other health care facilities to disclose the information of their patients.

If there is an overriding public interest or public health issue to disclose patient information, the same may be taken into consideration in the evaluation of balancing patient privacy vis-a-vis the public’s right to know. As a rule of thumb, whenever there is uncertainty as to whether the personal information should be disclosed or not, the PIC should strive to lean towards an interpretation that is mindful of the rights and interests of the individual about whom the personal information is processed.9

Policy for Requests for Personal Information of Patients

Considering the foregoing, it would be judicious on your part to develop a policy for requests for personal information and/or interviews from the police and the media. The policy may include guidelines on how the hospital can verify the veracity of the police investigation as well as confirm the occurrence of the alleged criminal act. This may be done through the presentation of a police blotter.10 Also, an evaluation of the personal data required to be disclosed vis-à-vis its intended purpose should be done to ensure that it is relevant, necessary, adequate, and not excessive.11

The hospital and its personnel should not obstruct an investigation, but policies or procedures must be in place for balancing the legitimate interests of the State and the rights and freedoms of individuals, and for assuring the safety and security of all those in the hospital. The policies will have to consider the different instances when law enforcement authorities will be entering the hospital premises. For instance, the police may be bringing in a patient already under their custody, whether arrested for an offense or as inmate in a correctional facility. In dealing with these situations, the hospital will have security protocols in place, where presence of law enforcement may be deemed necessary. The hospital may itself also request for law enforcement assistance when the crime occurs in the hospital, or there is a threat to security within the hospital premises.

In other cases, law enforcement authorities may request to interview patients who are either suspected of committing a crime, are alleged victims, or are material witnesses. It is in these latter situations, where hospital policies should balance crime prevention, detection and investigation and that of the patient’s rights, not only to data privacy, but to life and health. The hospital should be mindful that its first duty is to attend to patients in need of serious and emergency care, and for this purpose, access to patients may be limited if the same would put at risk the patient’s life and health. For example, a patient who is unstable may require urgent medical interventions before any interview is allowed.

Lastly, it should be noted that as data subjects, the patients should be informed that they may be interviewed by the police in relation to investigations of crimes.12 The police cannot compel an individual to agree to an interview, even if the individual is lawfully arrested.13 The hospital should put in place policies to ensure that such interviews, where allowed, will be conducted in a manner that would protect the rights of other patients in the facility, and cause minimal disruption in the hospital operations. These may include providing a specific area where the interview will be conducted, and restricting access to other areas of the hospital. Where the situation presents unique considerations or challenges, part of the policy may be to promptly inform the Chief of the Hospital or designated officer of the situation.

When the one requesting for information is from the media, consent of patients should be obtained before disclosure thereof. It is suggested that any authorized disclosures to media be coursed through a hospital officer specifically designated to provide such information.

This opinion is rendered based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) IVY D. PATDU Officer-in-Charge and Deputy Privacy Commissioner for Policies and Planning

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. Data Privacy Act of 2012, § 11. ↩

  3. An Act Establishing The Philippine National Police Under A Reorganized Department Of The Interior And Local Government, And For Other Purposes [Department of the Interior and Local Government Act of 1990] Republic Act No. 6975 (1990). ↩

  4. Philippine National Police Criminal Investigation Manual (Revised), 2011. ↩

  5. P.D. 169, amended by E.O. No. 212, “Requiring Doctors, Hospitals, Clinics, etc. to Report Treatment of Physical Injuries” July 10, 1987 ↩

  6. The Child and Youth Welfare Code [Presidential Decree No. 603] Art. 166 (1974). ↩

  7. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) Official Journal of the European Union, Vol. L119 (4 May 2016). ↩

  8. Working Party of EU Data Protection Authorities, Guidelines on Article 49 of Regulation 2016/679 (February 6, 2018). ↩

  9. Data Privacy Act of 2012, § 38. ↩

  10. As a rule, all crime incidents must be recorded in the official police blotter. See: Philippine National Police Criminal Investigation Manual (Revised), 2011. ↩

  11. See: Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (c) (2016). ↩

  12. See: Rules and Regulations Implementing the Data Privacy Act of 2012, § 34 (a). ↩

  13. PHIL. CONST. art. III, § 12. (1) Any person under investigation for the commission of an offense shall have the right to be informed of his right to remain silent and to have competent and independent counsel preferably of his own choice. If the person cannot afford the services of counsel, he must be provided with one. These rights cannot be waived except in writing and in the presence of counsel. ↩

Backlinks

  • No backlinks found