NPC Issuance Wiki

NPC Advisory Opinion No. 2018-066 — Submission of Required Personal Data of Patients Who Undergo Drug Testing to the Department of Health

Issued Advisory Opinion

Text

8 November 2018

Re: SUBMISSION OF REQUIRED PERSONAL DATA OF PATIENTS WHO UNDERGO DRUG TESTING TO THE DEPARTMENT OF HEALTH

Dear [Redacted]:

We write in response to your inquiry regarding the submission drug test results and other personal data of patients by Grepa Medical and Diagnostic Center (GMDC) to the Department of Health (DOH) through the Integrated Drug Testing Management Information System (IDTOMIS).

Particularly, your main concern is whether the submission of the required personal data of patients who undergo drug testing is consistent with the general data privacy principles enshrined in the Data Privacy Act of 2012 (DPA)1 given the following situations:

  1. In terms of transparency and legitimate purpose, the DOH may share the personal data of patients who undergo drug testing with other government agencies; and
  2. In terms of proportionality, the DOH collects personal data of other persons, i.e. name of the spouse of the person being tested.

We understand that as an accredited drug testing laboratory, GMDC is required to use IDTOMIS to submit to the DOH all required personal data of patients who undergo drug testing.

Also, that the IDTOMIS is a system implemented by the DOH to facilitate collection of data for accrediting drug testing laboratories and rehabilitation centers, drug testing operations as compliance to the mandate given to the DOH by Republic Act No. 9165, otherwise known as the Comprehensive Dangerous Drugs Act of 2002.2

Discussion

Legitimate Purpose

Under the DPA and its Implementing Rules and Regulations (IRR), the principle of legitimate purpose pertains to the processing of personal information based on the declared and specified purpose, which is not contrary to law, morals or public policy.3 Lawful processing, on the other hand, is discussed under Sections 12 and 13 of the DPA for processing of personal information and sensitive personal information, respectively.

In consideration of the foregoing, we confirm that the submission of personal data of patients who undergo drug testing by GMDC to the DOH, through the IDTOMIS, as well as sharing of the such information by the DOH to authorized government agencies, is permitted4 pursuant to the provisions of the Comprehensive Dangerous Drugs Act of 2002, to wit:

Section 76. The Duties and Responsibilities of the Department of health (DOH) Under this Act. – The DOH shall:

(1) Oversee the monitor the integration, coordination and supervision of all drug rehabilitation, intervention, after-care and follow-up programs, projects and activities as well as the establishment, operations, maintenance and management of privately-owned drug treatment rehabilitation centers and drug testing networks and laboratories throughout the country in coordination with the DSWD and other agencies;5

The lawfulness of the processing of personal data through the IDTOMIS is further supported by the DOH Administrative Order No. 2008-00256 and the Dangerous Drug Board Regulation No. 8, S. 2007 which states that:

Section 3. Section 6, Sub-Paragraph 5.2 (Information Technology Requirements) of DDB Regulation No. 2, Series of 2003, is hereby amended, such that the provision shall now read as follows:

xxx

“5.2 The laboratory shall have access to and utilize the Integrated Drug Testing Operations Management Information System (IDTOMIS), which is the Application Service Provider (ASP) approved and maintained by the DOH.”7

Notwithstanding lawful processing of personal data, GDMC as personal information controller (PIC) is required to comply with the DPA, its IRR and other relevant issuances, including the implementation of organization, physical and technical security measures, and formulation of data breach protocols. It must be able to safely and securely transfer information to the DOH through the IDTOMIS.

Transparency

The principle of transparency, as discussed by the law and the IRR, pertains to the data subject’s awareness of the nature, purpose, the extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of the PIC, his or her rights as a data subject, and how these can be exercised.8

GDMC, as a PIC, is then required to inform the patients who undergo drug testing regarding the recipients of his or her personal data or the entities to whom personal data are or may be disclosed, including DOH and other authorized government agencies.

The GDMC may exercise the principle of transparency through a privacy notice. A privacy notice is a statement made to a data subject that describes how the organization collects, uses, retains and discloses personal information.9 A privacy notice is sometimes referred to as a privacy statement, a fair processing statement or sometimes a privacy policy.10

Proportionality

In compliance with the principle of proportionality, the DOH and other government agencies, as PICs, should be able to determine and justify the adequacy, relevance, appropriateness of the personal data being collected through IDTOMIS.11

With this, we recommend that the GDMC to seek clarification and justification from the DOH regarding the collection of other personal data, specifically the name of spouse of patients who undergo drug testing.

This opinion is rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMOND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information In Information And Communications Systems In The Government And The Private Sector, Creating For This Purpose A National Privacy Commission, And For Other Purposes [DATA PRIVACY ACT OF 2012] Republic Act No. 10173 (2012). ↩

  2. An Act Instituting the Comprehensive Dangerous Drugs Act of 2002, Repealing Republic Act No. 6425, otherwise known as the Dangerous Drugs Act of 1972, As Amended, Providing Funds Therefor, and for other purposes [THE COMPREHENSIVE DANGEROUS DRUGS ACT OF 2002] Republic Act No. 9165 (2002). ↩

  3. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (b) (2016). ↩

  4. Id., § 13. ↩

  5. Supra note 2, § 76. ↩

  6. Department of Health, Administrative Order 2008-0025, Guidelines on the Implementation of the Integrated Drug Test Operations and Management Information System (IDTOMIS) for Screening and Confirmatory Drug Test Laboratory Operation (29 July 2008). ↩

  7. Dangerous Drugs Board, Board Regulation No. 8 Series of 2007, AMENDING BOARD REGULATION NO. 2, SERIES OF 2003, ENTITLED “IMPLEMENTING RULES AND REGULATIONS GOVERNING ACCREDITATION OF DRUG TESTING LABORATORIES IN THE PHILIPPINES” (11 December 2007). ↩

  8. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (a) (2016). ↩

  9. IAPP, Glossary of Privacy Terms, “Privacy Notice” available at https://iapp.org/resources/glossary/#paperwork-reduction-act-2 (last accessed on 10 September 2018). ↩

  10. Implementing Rules ↩

  11. Id., § 18(c) (2016). ↩

Backlinks

  • No backlinks found