Text
19 December 2019
RE: TEENAGE PREGNANCY REGISTRY
Dear [Redacted],
We write in response to your request for advisory opinion regarding the data sharing of teenage pregnancy registry between your institution, Southern Isabela General Hospital (SIGH) and the City Population Office (CPO) of Santiago City.
We understand that the CPO of Santiago City is requesting for the following personal data from your institution for the purpose of creating plans, activities, or any possible interventions in the campaign to decrease the incidence of teenage pregnancy in your city:
- Complete name of female client;
- Age;
- Admission;
- Discharge;
- Final Diagnosis; and
- Barangay.
The abovementioned information being requested by the CPO are health information. Health information, under the Data Privacy Act of 2012 (DPA),1 is considered as sensitive personal information and processing of such information is prohibited, except if the following cases:
a. The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing;
b. The processing of the same is provided for by existing laws and regulations: Provided, that such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;
c. The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing;
d. The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, That such processing is only confined and related to the bona fide members of these organizations or their associations: Provided, further, That the sensitive personal information are not transferred to third parties: Provided, finally, That consent of the data subject was obtained prior to processing;
e. The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured; or
f. The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.2
Note that we cannot confirm the basis of the proposed data sharing agreement from the information provided. It is not clearly indicated whether a law or city ordinance was issued that mandates the CPO to collect sensitive personal information for teenage pregnancy registry and the specific program or project that needs the said personal data for implementation.
The purpose of the collection, “to create plans and activities or any possible interventions in the campaign to decrease the incidence of teenage pregnancy in the city” is general in nature, which may be attainable even without the disclosure of personal information.
On its face, without the specific purpose and statutory basis of the CPO, the planning and execution of activities and campaigns on teenage pregnancy may be administered and implemented with the use of aggregate or statistical data.
Should the data sharing push forward, SIGH must ensure that the proposed data sharing agreement with the CPO has complied with the requirements of the DPA, must conform with the NPC Circular No. 16-02, and has met any of the abovementioned criteria for lawful processing before sharing such information with the CPO of Santiago City. Likewise, the data sharing must adhere to the principles of transparency, legitimate purpose and proportionality.
This opinion is based solely on the information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. The attached data sharing agreement was not reviewed for the purpose of clarifying the basis of the said processing.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner