NPC Issuance Wiki

NPC Advisory Opinion No. 2019-029 — Request for Endorsement/Ruling on the Use of Third-Party Processor

Issued Advisory Opinion

Official opinion tags

Text

17 July 2019

Re: REQUEST FOR ENDORSEMENT / RULING ON THE USE OF THIRD-PARTY PROCESSOR

Dear [Redacted],

We write in response to your letter which sought guidance on the use of the Web-based Census and Accreditation System (Web-CAS) by the Philippine College of Chest Physicians (PCCP) in the processing of personal information. Specifically, you are concerned about the following:

  1. Whether or not the decision of PCCP to subcontract its processing of personal information to a third-party under a data processing agreement is allowed by Data Privacy Act (DPA);1 and
  2. Whether or not sharing of patient’s information, limited to hospital’s name, date of admittance and discharge, location, medical procedures, and initial and final diagnosis, to PCCP and its third-party processor based on explicit consent of the patient is lawful under the DPA.

Discussion

The PCCP, a subspecialty society of the Philippine Medical Association, is tasked to provide accreditation services to various training hospitals and healthcare providers to ensure effective healthcare delivery in the field of pulmonary medicine.

In order to ensure that a member hospital meets the standards set by the PCCP, such hospital is required to submit personal data of their patients to PCCP through an online system called Web-based Census and Accreditation System (Web-CAS). This system will be used for the efficient and effective monitoring and recording of training activities and quality assurance of training hospitals nationwide.

Relevant to this, we have issued an advisory opinion2 stating that the use of patient’s health information for accreditation and training purposes requires consent from the patient, otherwise, only de-identified information may be lawfully processed.

Accordingly, the PCCP resolved to obtain consent as legal basis when collecting the following personal data of patients:

  • Name of hospital
  • Data of admittance and discharge
  • Location
  • Medical procedures
  • Initial and final diagnosis

Outsourcing the processing of personal data

Section 14 of the DPA provides that a personal information controller (PIC),3 PCCP in this case, may subcontract the processing of personal data which includes outsourcing the development and maintenance of the Web-CAS.

The outsourcing arrangement shall be governed by a contract or other legal document that binds the PCCP and the third party as a personal information processor4 (PIP). Section 44 of the Implementing Rules and Regulations (IRR) of the DPA sets forth the requirements to be considered in such outsourcing agreements.

Furthermore, both PIC and PIP shall ensure that reasonable and appropriate security measures intended for the protection of personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing,5 including having mechanisms in place for the exercise of data subjects’ rights, are implemented.

As stated in Advisory Opinion No. 2018-056, personal data of the patient may be lawfully processed by the PCCP and its PIP if the patients or their legally authorized representative has given consent specific to the purpose of accreditation and training.

Correspondingly, the PCCP is required to adhere to the principles of transparency, legitimate purpose and proportionality. The patients must be made aware of the nature, purpose, and extent of the processing of personal data, as well as the risks and safeguards involved, and how they may be able to exercise their rights as data subjects.

Also, PCCP shall process information that is adequate, relevant, necessary, and not excessive in relation to its purpose of ensuring the quality of training provided by member hospitals. It is likewise paramount to ensure the quality of data collected – that it be accurate, and rectified in case of incomplete or inaccurate data, and that personal data is only retained for as long as it is necessary.

Finally, we wish to emphasize that the advisory opinions of the National Privacy Commission (NPC) provide guidance to the requesting party and the general public6 on matters relating to the interpretation of the provisions of the DPA, its IRR, and NPC issuances, compliance requirements, enforcement of data privacy laws and regulations, and other related matters on personal data privacy, security, and protection.7 As such, an advisory opinion will not rule on or provide an endorsement of a particular method of processing that a PIC may have chosen.

This opinion is rendered based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. Note that the attached agreements and consent form were not reviewed for purposes of this advisory opinion.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) IVY D. PATDU *Officer-in-Charge and Deputy Privacy Commissioner for Policies and Planning

*Per letter issued by the Office of the President dated 12 July 2019.

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. National Privacy Commission, NPC Advisory Opinion No. 2018-056 (5 October 2018). ↩

  3. Data Privacy Act of 2012, § 3 Definition of Terms, (h) Personal information controller refers to a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf. ↩

  4. Data Privacy Act of 2012, § 3 Definition of Terms, (i) Personal information processor refers to any natural or juridical person qualified to act as such under this Act to whom a personal information controller may outsource the processing of personal data pertaining to a data subject. ↩

  5. Data Privacy Act of 2012, § 20. ↩

  6. National Privacy Commission, Rules of Procedure on Requests for Advisory Opinions, Circular No. 2018-01 [NPC Circular 18-01] (September 10, 2018), § 2. ↩

  7. Id., § 5(a). ↩

Backlinks

  • No backlinks found