NPC Issuance Wiki

NPC Advisory Opinion No. 2020-028 — Collection and Encoding of Information on COVID-19 Related Deaths

Issued Advisory Opinion

Official opinion tags

Text

Re: COLLECTION AND ENCODING OF INFORMATION ON COVID-19 RELATED DEATHS

Dear [Redacted],

We write in response to your request for an advisory opinion seeking guidance on the propriety of complying with the series of memoranda and other communications issued by the Department of Interior and Local Government (DILG) requesting your office to do the following:

  1. Encode the details of confirmed COVID-19 related deaths on https://tinyurl.com/R4A-Death-Report; 2. Upload the respective death certificates on https://tinyurl.com/R4A-COVID19- DCert; and 3. Provide the CALABARZON Disaster Risk Reduction Management (DRRM) Focal Persons – Management of Human Remains, through their Viber group, a daily update on the number of COVID-19 related deaths starting 27 June 2020.

Specifically, you ask whether accommodating the requests would result in possible violation/s of the provisions of the Data Privacy Act of 20121 (DPA) and its Implementing Rules and Regulations2 (IRR).

Discussion

Death Certificate; sensitive personal information

A Death Certificate is an official document setting forth particulars relating to a deceased person.3 It contains details such as (a) date and place of death, (b) full name, (c) age, (d) sex, (e) occupation or profession, (f) residence, (g) status as regards marriage, (h) nationality of the deceased, and (i) probable cause of death.4

Section 3 of the DPA specifically enumerates sensitive personal information, which includes information about an individual’s marital status, age and health, among others. Thus, certain personal data found in the Death Certificate are sensitive personal information which must be processed in accordance with the DPA.5

Providing the DILG with electronic copies of death certificates; encoding details and uploading of the certificates; mandate

Under Section 13 of the DPA, processing of sensitive personal information is generally prohibited, unless it falls under any of the criteria for processing, specifically, when such processing is provided for by existing laws and regulations.6

In connection with this, we understand that there are several issuances of the DILG and the Department of Health (DOH) which deals with the handling of human remains and standard coding and reporting of deaths in relation to COVID-19:

  1. DILG and DOH Joint Memorandum Circular No. 01 Series of 2020 (JMC)7 - Suppletory Guidelines on the Management of Human Remains for Patient Under Investigation (PUI) and Confirmed COVID-19 Cases;
  2. DILG Memorandum Circular No. 2020-0638 - Interim Guidelines on the Management of Human Remains for Patient Under Investigation (PUI) and Confirmed COVID-19 Cases); and
  3. DOH Department Circular No. 2020-0067-A9 - ICD-10 code for COVID-19.

In relation to these issuances, the DILG further issued an Advisory and Memoranda from the DILG REGION IV-A and Rizal Province, to cascade the guidelines to the regional and provincial levels and provide specifics of what is required.

With the foregoing considered, the requests made by the DILG for encoding the details surrounding the COVID-19 related deaths and uploading the corresponding death certificates on a secure site may fall under the criteria for lawful processing under Section 13 of the DPA; more specifically, processing that is provided for by existing laws and regulations10 and when sensitive personal information is provided to the government or a public authority.11 These issuances should be duly complied with. Compliance to the same is recognized under the DPA, its IRR, and issuances of the NPC. We reiterate that the DPA should be read together with other laws and regulations and should not be used as an excuse for non-compliance with the same.12

We trust also that the DILG, as a personal information controller (PIC), is well aware of its obligations, specifically NPC Circular No. 16-0113 on the Security of Personal Data in Government Agencies, which requires all government agencies engaged in the processing of personal data to observe various duties and responsibilities for the protection of personal data, which includes the implementation of adequate and reasonable security measures to protect personal data against unauthorized access and disclosure.

In addition, we also note that the DILG, as a PIC, must adhere to the general data privacy principles, specifically in this case the principles of legitimate purpose and proportionality. The principle of legitimate purpose requires that the processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy.14 On the other hand, the principle of proportionality requires that the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose, and that personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.15

As to the requirement for providing daily updates on the number of COVID-19 related deaths, these only involve the disclosure of aggregate data which are statistical in nature, and hence, the provisions and principles under the DPA may not necessarily apply.

Statistical information which does not include information from which the identity of an individual is apparent or can be reasonably and directly ascertained, is not personal information, and thus, not covered by the provisions of the DPA and its IRR.

This opinion is rendered based solely on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 (2016). ↩

  3. See: Philippine Statistics Authority, Death Certificate, available at https://psa.gov.ph/civilregistration/requesting-civil-registry-document/death-certificate (last accessed July 16, 2020). ↩

  4. See: National Privacy Commission, NPC Advisory Opinion No. 2019-045 (Nov. 6, 2019) citing Law on Registry of Civil Status, Act No. 3753, § 6 (1930). ↩

  5. Id. ↩

  6. Data Privacy Act of 2012, § 13 (b). ↩

  7. Department of the Interior and Local Government and Department of Health, Suppletory Guidelines on the Management of Human Remains for Patient Under Investigation (PUI) and Confirmed COVID-19 Cases [Joint Memorandum Circular No. 01 Series of 2020] (April 16, 2020). ↩

  8. Department of the Interior and Local Government, Interim Guidelines on the Management of Human Remains for Patient Under Investigation (PUI) and Confirmed COVID-19 Cases [Memorandum Circular No. 2020-063] (March 27, 2020). ↩

  9. Department of Health, Amendment to Department Circular No. 2020-067 re ICD-10 code for COVID-19 (previously known as 2019-nCoV Acute Respiratory Disease). ↩

  10. Data Privacy Act of 2012, § 13 (b). ↩

  11. Id. § 13 (f). ↩

  12. See: National Privacy Commission, NPC Advisory Opinion No. 2018-035 (July 20, 2018). ↩

  13. NPC Circular No. 16-01 dated 10 October 2016, § 4. ↩

  14. Rules and Regulations Implementing the Data Privacy Act of 2012, § 18 (b). ↩

  15. Data Privacy Act of 2012, § 13 (c). ↩

Backlinks