NPC Issuance Wiki

NPC Advisory Opinion No. 2020-022 — Public Disclosure of Identities of Covid Patients for Contact Tracing

Issued Advisory Opinion

Official opinion tags

Text

Re: PUBLIC DISCLOSURE OF IDENTITIES OF COVID PATIENTS FOR CONTACT TRACING

Dear [Redacted],

We write in response to your request for an advisory opinion received by the National Privacy Commission (NPC) which sought to clarify issues on contact tracing and the public disclosure of identities of COVID-19 patients vis-à-vis the provisions of the Data Privacy Act of 20121 (DPA) and other relevant issuances of the NPC and the Department of Health (DOH).

Specifically, you ask what would be the measures to address patient tracking without publicly announcing or reporting the name, sex, and residence or barangay as well as the places where the probable patients travelled to for the past two (2) weeks, and those with whom he or she had been in contact with.

You further ask if it is appropriate for the concerned local government unit (LGU), through their health personnel, to allow the public to assess their own risks by sharing the above information.

Finally, you ask the limit in terms of what information to collect and disclose, whom to disclose, method or process of information gathering, and data storage and retention so it will not be used in the future for malicious reasons.

Discussion

Processing of health information; contact tracing; COVID-19 data; lawful basis for processing; public authority; mandate

Contact tracing as defined under recent regulations of the DOH refers to the identification, listing, and follow-up of persons who may have come into close contact with a confirmed COVID-19 case.2 It has three (3) goals:

  1. To interrupt ongoing transmission and reduce spread of infection; 2. To alert close contacts to the possibility of infection and offer preventive counselling or care; and 3. To understand the epidemiology of a disease in a particular population.3

Accordingly, contact tracing would inevitably involve the processing of personal and sensitive personal information (collectively, personal data) of COVID-19 suspected, probable, and confirmed cases by the DOH and other government agencies engaged in the COVID-19 response. Such processing for contact tracing is expected to be in accordance with existing laws and regulations on the matter, i.e. Republic Act No. 11332 or the Mandatory Reporting of Notifiable Diseases and Health Events of Public Health Concern Act, the DPA, as well as applicable issuances of the DOH and the NPC.

The DOH Updated Guidelines on Contact Tracing provides for the specific guidelines for the identification of contacts of suspect cases, case investigation and contact tracing for probable and confirmed cases, contact tracing in areas with community transmission, among others. These guidelines also provide for the use of standard forms, i.e. Case Investigation Form, Travel History Form, Close Contact Line List Form, Profile of the COVID-19 Close Contacts, etc.

All these measures ensure that only the necessary personal data are collected in a standard and appropriate manner and disclosed only to the proper authorities.

We wish to emphasize that the DPA has never been a hindrance to contact tracing activities of the government as the law does not prevent government institutions from processing personal data when necessary to fulfill their mandates.

We reiterate our 2018 Advisory Opinion issued to the DOH on the processing of health information pursuant to its mandate of conducting disease surveillance, epidemic investigation, contact tracing, survey research and disease registry, among others, at the national and regional level:

“… In this case, the DPA does not prohibit the DOH from collecting and processing personal data for purposes necessary to its mandate, with the concomitant responsibility of complying with the requirements of the DPA, its Implementing Rules and Regulations (IRR), and other issuances of the National Privacy Commission (NPC).

xxx xxx xxx

The processing of personal data by DOH finds support in the DPA. The DOH is a public authority performing regulatory functions, and is permitted to process personal data to the extent necessary for the fulfillment of these functions.”4

The DPA recognizes that the government can perform its functions in this pandemic while still guaranteeing the data privacy rights of our citizens. The law requires that all government agencies involved in the COVID-19 response, i.e. the DOH, agencies authorized by the DOH, and other agencies or entities authorized by law, specifically on contact tracing, shall adhere to the general data privacy principles, implement safeguards to protect personal data they process, and uphold data subjects’ rights at all times.

Disclosure of personal data; limitations; risks of publicly disclosing personal data

As to disclosure of COVID-19 personal data by the DOH, this may be made in a limited manner pursuant to the Annex A of the DOH Updated Guidelines on Contact Tracing:

“6. Disclosure of Patient Identifiers or Patient Data shall be limited to authorized entities, officers, personnel and concerned individuals only. The said disclosure is allowed if the same will serve a public purpose or function during the COVID-19 pandemic.

Disclosure to the public, the media, or any other public-facing platforms without the written consent of the patient or his/her authorized representative or next of kin, shall be strictly prohibited.”5

The above policy is further reinforced in the DOH-NPC Joint Memorandum Circular on the Privacy Guidelines on the Processing and Disclosure of COVID-19 Related Data for Disease Surveillance and Response,6 which contains a similar provision under Section VI (D) (2) thereof on the Specific Guidelines on Use and Disclosure of Health Information.

Further, the JMC provides that aggregate health information, or pseudonymized or anonymized detailed health information may be disclosed for a legitimate purpose, i.e. public information or purpose.7 This is also consistent with the DOH Updated Guidelines on Contact Tracing provisions on Protecting Data Privacy of COVID-19 Cases and Close Contacts,8 where it was declared that “the DOH reserves the right to release information on COVID-19 cases that are relevant for public health interventions without full disclosure of the case’s identity.”

Hence, the general public will not be kept in the dark as to the government’s contact tracing efforts since aggregate, pseudonymized, or anonymized data may still be made available.

This may include details on a patient’s sex, age, barangay, travel history, etc., taking caution that a COVID-19 suspected, probable, or confirmed case should not be capable of being identified from the data that is released following the DOH guidelines. These pseudonymized data may thus allow the public to assess their own risks without necessarily compromising the COVID-19 patients’ privacy rights.

We stand firm against any form of unbridled disclosure of patients’ personal data to the public that has been proven to cause a real risk of severe harm to patients, i.e. physical assaults, harassments, discrimination, among others.9

Storage and retention; further processing

As to the limit in terms of personal data storage and retention, the general rule is that personal data may be retained as necessary to fulfill the purpose for which these were collected, pursuant to the laws, rules and regulations and other protocols on the matter. After achieving the intended purpose/s, personal data shall be disposed in a secure manner that would prevent any unauthorized processing and disclosure.

The above shall likewise apply to all personal data processed in relation to all contact tracing efforts, be it manual or through the use of online applications or any other emerging technologies.

As to any further processing activities, the JMC provides that only aggregate health information or pseudonymized health information shall be shared by public health authorities to stakeholders for the purpose of business intelligence and policy and biomedical researches.10 Further, all policy and biomedical researches related to COVID-19 surveillance and response shall secure an Ethics Board approval prior to implementation.11

This opinion is provided based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. Department of Health, Updated Guidelines on Contact Tracing of Close Contacts of Confirmed Coronavirus Disease (COVID-19) Cases [Department Memorandum No. 2020-0189], § II (A) (April 17, 2020). ↩

  3. Id. § III (B). ↩

  4. National Privacy Commission, NPC Advisory Opinion No. 2018-083 (Nov. 26, 2018). ↩

  5. DOH Department Memorandum No. 2020-0189, Annex A - Guidelines for Processing and Disclosure of the Personal Information of Patient/Data Subject. ↩

  6. Department of Health and National Privacy Commission, Privacy Guidelines on the Processing and Disclosure of COVID-19 Related Data for Disease Surveillance and Response [Joint Memorandum Circular No. 2020-0002] (April 24, 2020). ↩

  7. Id. § VI (D) (3). ↩

  8. DOH Department Memorandum No. 2020-0189, § IV (I) (3). ↩

  9. See: NPC PHE Bulletin No. 11: Joint Statement of the Department of Health (DOH) and National Privacy Commission (NPC) on Processing and Disclosure of COVID-19 Related Data, April 30, 2020 (available at https://www.privacy.gov.ph/2020/04/npc-phe-bulletin-no-11-joint-statement-of-the-department-of-health-doh-and-national-privacy-commission-npc-on-processing-and-disclosure-of-covid-19-related-data/). ↩

  10. DOH and NPC Joint Memorandum Circular No. 2020-0002, § VI (F) (1). ↩

  11. Id. § VI (F) (2). ↩

Backlinks