NPC Issuance Wiki

NPC Advisory Opinion No. 2018-054 — Patient Registry, Research, and the Data Privacy Act of 2012

Issued Advisory Opinion

Text

04 December 2018

RE: PATIENT REGISTRY, RESEARCH, AND THE DATA PRIVACY ACT OF 2012

Dear [Redacted],

We write in response to your letters which sought to clarify the development and use of health information registries, particularly patient registries, for research studies.

Discussion

Specifically for ‘’’’’’’’ ‘’’’’’’’’’’’’’’’’’’’’’’’’s query, it sought advice regarding the linkage of cancer incidence data of the Department of Health (DOH) - Rizal Cancer Registry and Philippine Cancer Society (PCS)

  • Manila Cancer Registry (Registries) with mortality data from the Philippine Statistics Authority (PSA), and the possibility of an exemption or a special policy coverage under Republic Act No. 10173,1 also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations2 (IRR), and relevant issuances of the National Privacy Commission (NPC).

DPA and research

Section 4 of the Data Privacy Act enumerates categories of information outside the scope of the law. This includes processing of personal information for research purposes.3 This exemption, however, is not absolute, but only to the minimum extent necessary to achieve the specific purpose, function, or activity,4 and subject to the requirements of applicable laws, regulations, or ethical standards.5

First, research purpose is strictly interpreted to refer to processing intended for a public benefit.6 Maintaining a registry for research purpose falls within the special cases recognized by the DPA.

Second, the processing will be exempted only to the extent necessary. Personal information controllers7 (PICs) and personal information processors8 (PIPs) engaged in research which involves sensitive personal information are expected to comply with their obligations under the DPA on the implementation of organizational, technical, and physical security measures to ensure the protection of personal data against accidental or unlawful destruction, alteration, disclosure, or unlawful processing.9 PICs are also responsible for personal information under its control or custody, including those transferred or shared with third parties.10

Third, the flexibility for research purposes will only apply in so far as it is consistent with ethical and legal standards. This means that there are instances when the consent requirements for research may be waived if such waiver is consistent with legal and ethical principles. Likewise, the rights of data subjects may also be limited where such limitation is necessary to maintain research integrity.

One way of demonstrating adherence to ethical standards is by seeking the approval of a duly recognized Research Ethics Committee (REC)/Internal Review Board (IRB)/Ethics Board (EB)11 for the research protocol, including the waiver of the consent requirement for research purpose.

We understand that the Registries - Rizal Cancer Registry and Manila Cancer Registry – are maintained by the government and a private institution, respectively. We assume that sensitive personal information in these Registries have been collected and processed pursuant to a statutory mandate in the case of the DOH, and consent of data subjects, in the case of the PCS. Without consent from data subjects, the burden is on PCS to demonstrate that the processing of sensitive personal information without consent is consistent with legal and ethical standards.

While maintaining a registry for research purposes may be permitted under the DPA, linkages with the PSA database may be subject to other laws allowing disclosure of information to the public. The PSA is mandated to ensure confidentiality of all primary data that they retain.12 Consequently, the agency may only release the aggregated information in a summary form.13 Further, Republic Act 10625,14 otherwise known as the Philippine Statistical Act of 2013, and its implementing rules and regulations, prohibit the agency from disclosing information that may lead to any person’s identity, unless otherwise mandated by another law. Under the DPA, the criteria for lawful processing of sensitive personal information are:

a. The data subject has given his or her consent; b. The processing of the same is provided for by existing laws and regulations; c. The processing is necessary to protect the life and health of the data subject or another person; d. The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, That such processing is only confined and related to the bona fide members of these organizations or their associations: Provided, further, that the sensitive personal information are not transferred to third parties: Provided, finally, that consent of the data subject was obtained prior to processing; e. The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured; or f. The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.

Where one of the criteria provided in the DPA is met, sensitive personal information may be processed and shared. Note also that data sharing between government agencies for the purpose of a public function or provision of a public service should be covered by a data sharing agreement. Please refer to NPC Circular No. 16-02 - Data Sharing Agreements Involving Government Agencies

  • for additional details.

In view of the foregoing, it is best to consult with the PSA Legal Service and clarify if it is possible for the DOH and the PCS to provide PSA with a list of specific individuals from their respective databases and for the latter to match this with its mortality database, i.e. provide a “Yes” or “No” answer as to the status of those individuals, taking into consideration the provisions of NPC Circulars No. 2016-01 (Security of Personal Data in Government Agencies) and 2016-02 (Data Sharing Agreements Involving Government Agencies)

This opinion is provided based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For you reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating For this Purpose a National Privacy Commission, and For Other Purposes [DATA PRIVACY ACT OF 2012], Republic Act No. 10173 (2012). ↩

  2. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173. ↩

  3. Data Privacy Act of 2012, §4. ↩

  4. Id, §5. ↩

  5. Id., §5(c). ↩

  6. Supra note 13. ↩

  7. Id. § 3 (h). ↩

  8. Id. § 3 (i). ↩

  9. Id, §20. ↩

  10. Id, §21. ↩

  11. Philippine Health Research Ethics Board Ad Hoc Committee for Updating the National Ethical Guidelines, National Ethical Guidelines for Health and Health Related Research 15 (2017). ↩

  12. An Act to Create a Bureau of the Census and Statistics to Consolidate Statistical Activities of the Government therein [BUREAU OF CENSUS AND STATISTICS], Commonwealth Act 591 (1940) §4. ↩

  13. Id. ↩

  14. An Act Reorganizing The Philippine Statistical System, Repealing For The Purpose Executive Order Numbered One Hundred Twenty-One, Entitled “Reorganizing And Strengthening The Philippine Statistical System And For Other Purposes” [PHILIPPINE STATISTICAL ACT OF 2013], Republic Act No. 10625 (2013). ↩

Backlinks