Text
25 November 2019
Re: REQUEST FOR DOCUMENTS FROM PHILHEALTH IN RELATION TO A PENDING COMPLAINT AGAINST A PRIVATE CORPORATION
Dear [Redacted],
We write in response to your request for an advisory opinion received by the National Privacy Commission (NPC) in relation to the request for copies of documents received by the Philippine Health Insurance Corporation (Philhealth) from a private lawyer pertaining to a complaint filed by his clients against the owners of WellMed Dialysis and Laboratory Center (WellMed) for allegedly filing benefit claims of deceased patients. The private lawyer is representing the former employees of WellMed who acted as whistleblowers against the said company.
You further disclosed in your letter that the requested documents consist of disbursement vouchers and benefit claim forms of several patients which contain sensitive personal information such as Philhealth Identification Numbers, birthday, and health information such as diagnoses and confinement period of patients, among others.
You now seek clarification on whether Philhealth may grant the lawyer’s request to provide copies of the documents containing sensitive personal information.
Processing of sensitive personal information; exercise or defense of legal claims
The Data Privacy Act of 2012 (DPA) considers information about an individual’s health as sensitive personal information.1 The processing thereof is prohibited, except if the processing is in accordance with any of the criteria provided under Section 13 of the law. In particular, the processing of sensitive personal information is allowed if it is necessary for the protection of lawful rights and interest of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.2
To provide further insight on the processing of personal data pursuant to a lawful criteria, the EU General Data Protection Regulation (GDPR) provides that the processing of information about a person’s health, is allowed if it is necessary for the establishment, exercise or defense of legal claims or whenever courts are acting in their judicial capacity.3 Such exception is also allowed in legal claims whether in court proceedings or in an administrative or out-of-court procedure.4
In the current matter, the filing of the complaint against WellMed by its former employees for the alleged fraudulent claims may be considered as an exercise of legal claims. The documents requested such as disbursement vouchers and benefit claim forms of several patients may be necessary in the establishment of the said legal claims.
In view of the foregoing and considering that a complaint was already filed against WellMed, Philhealth may grant the private lawyer’s request for the documents containing sensitive personal information. We note, however, that the disclosure of the requested information by Philhealth to the private lawyer must still adhere to the general data privacy principles of transparency, legitimate purpose and proportionality.
Adherence to the data privacy principles; rights of the data subjects
It is worth noting that, although there is lawful basis for the processing of sensitive personal information, the processing is not exempted from the other data protection requirements of the DPA. Sensitive personal information must be processed for a specified and legitimate purpose. In addition, the processing should be limited only to what is necessary in achieving the said purpose. To be considered as necessary, the personal data processed should not be excessive as to the purpose thereof.
Hence, Philhealth may grant the private lawyer’s request only to the extent necessary to build and further support the case against WellMed. For instance, only those documents or personal data which are necessary and material to the complaint filed may be provided by Philhealth.
As a personal information controller, Philhealth must always ensure that the data privacy rights of its members and beneficiaries are protected at all times, even if such persons are already deceased. Philhealth may also opt to redact information in the documents to be provided if such information is immaterial to the case.
We reiterate that persons exercising legal claims are not given blanket authority to collect and process personal data. The processing must still be in accordance with the foregoing requirements of the DPA to ensure protection of personal data.
This opinion is based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission and other Purposes Data Privacy Act of 2012, Republic Act No. 10173, § 3 (l)(2) (2012). ↩
-
Id. § 13 (f). ↩
-
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 in the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) Official Journal of the European Union, Vol. L119 (4 May 2016). ↩
-
EU GDPR, Recital 52 ↩