NPC Issuance Wiki

NPC Advisory Opinion No. 2020-030 — Reporting to the Department of the Interior and Local Government of COVID-19 Related Hospital Deaths

Issued Advisory Opinion

Official opinion tags

Text

Re: REPORTING TO THE DEPARTMENT OF THE INTERIOR AND LOCAL GOVERNMENT OF COVID-19 RELATED HOSPITAL DEATHS

Dear [Redacted],

We write in response to your request for an advisory opinion seeking guidance on the requirement of the Department of Interior and Local Government – VII (DILG-VII) in a Memorandum dated 3 July 2020 and the corresponding Memorandum from the Provincial Director of the DILG Cebu Province, requiring hospitals to submit a daily report of COVID- 19 related deaths.

We understand from your email that the report requested will contain the following:

Discussion

a. Registry number; b. Patient’s complete name; c. Sex; d. Date of death; e. Cause of death; f. Classification (Suspect/Probable/Confirmed COVID-19 case); g. Address; h. Local government unit (LGU) involved; and i. Whether the cadaver has been released or not.

The above will be submitted daily in an Excel template and sent to an email address of the DILG Cebu Province. Both DILG memoranda made reference to another DILG issuance: DILG Memorandum Circular (MC) No. 2020-063 dated 27 March 2020 on the Interim Guidelines on the Management of Human Remains for Patient Under Investigation (PUI) and Confirmed Coronavirus Disease 2019 (COVID-19) Cases.

Processing of Sensitive Personal Information; Public Authority; Mandate; Proportionality

Under the Data Privacy Act of 20121 (DPA), personal information about an individual’s health is considered as sensitive personal information (SPI), the processing of which is generally prohibited, unless it falls under any of the criteria for processing pursuant to Section 13. Specifically applicable in this scenario is when such processing is provided for by existing laws and regulations, provided that such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information,2 and when information is to be provided to government pursuant to a constitutional or statutory mandate.3

We understand that Section 9.2 of Joint Memorandum Circular No. 01 (JMC)4, issued by the DILG and the Department of Health, in relation to the DILG MC No. 2020-063, provides that “the hospital, through a designated point person, shall immediately inform the nearest kin of the deceased and/or the Local MDM Cluster Focal Person of the city/municipality of residence once a suspect, probable (PUI), or confirmed COVID-19 patient dies…”

In view of the foregoing and all the related DILG issuances, compliance with the reportorial requirement may be warranted under the law.

Nonetheless, it is worthy to note that the processing of SPI, even if allowed under specific circumstances under the DPA, must always adhere to the general data privacy principles, specifically in this case the principles of legitimate purpose and proportionality. The principle of legitimate purpose requires that the processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy. As mentioned above, the legitimate purpose for the intended processing is provided for under the DILG issuances which were made in response to the current public health emergency.5 On the other hand, the principle of proportionality requires that the processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.6

We note that the purpose of DILG requirement is to ensure that COVID-19 related hospital deaths within the region are reported in a timely manner. We advise that the reports should contain only the information requested and that reasonable and appropriate safeguards should be implemented to protect all personal data collected against any unauthorized access, disclosure, or processing, given that Section 4.4 of DILG MC No. 2020-063 is clear in stating that the identity and other personal details of the deceased shall be respected at all times and remain confidential, unless otherwise provided by law.

We likewise emphasize Section 22 of the DPA which requires that all sensitive personal information maintained by the government, its agencies and instrumentalities shall be secured, as far as practicable, with the use of the most appropriate standard recognized by the information and communications technology industry, and as recommended by the Commission.

This opinion is rendered based solely on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. Id. § 13 (b). ↩

  3. Id. § 13 (f) and Rules and Regulations Implementing the Data Privacy Act of 2012, § 22 (f). ↩

  4. Suppletory Guidelines on the Management of Human Remains for Patient Under Investigation (PUI) and Confirmed COVID-19 Cases (DILG Memorandum Circular No. 2020-063). ↩

  5. Rules and Regulations Implementing the Data Privacy Act of 2012, § 17 (b). ↩

  6. Rules and Regulations Implementing the Data Privacy Act of 2012, § 18 (c). ↩

Backlinks

  • No backlinks found