Text
8 September 2020
Re: DATA SHARING PURSUANT TO THE UNIVERSAL HEALTH CARE ACT
Dear [Redacted],
We write in response to your letter requesting for an advisory opinion from the National Privacy Commission (NPC) on whether the Philippine Health Insurance Corporation (PhilHealth) is exempted from executing any data sharing agreement (DSA) by virtue of Republic Act No. 11223 or the Universal Health Care Act (UHC), in relation to the provisions of the Implementing Rules and Regulations (IRR) of the Data Privacy Act of 2012 (DPA) and NPC Circular No. 16-02 (Data Sharing Agreements involving Government Agencies).
We understand that the Department of Health (DOH) is asking PhilHealth for the execution of a DSA in relation to PhilHealth’s furnishing the DOH with the former’s COVID-19 related data, which necessarily includes personal and sensitive personal information.
Discussion
Data Sharing; Data Sharing Agreement; NPC Circular 16-02
The IRR of the DPA defines data sharing as the disclosure or transfer to a third party of personal data under the control or custody of a personal information controller (PIC). A DSA refers to a contract, joint issuance, or any similar document that contains the terms and conditions of a data sharing arrangement between two or more PICs.
Section 20 of the IRR provides for the general requirements when data sharing is allowed, i.e. when it is expressly authorized by law and provided that there are adequate safeguards for data privacy and security, and that processing adheres to the principles of transparency, legitimate purpose, and proportionality.
DSAs involving government agencies are further governed by NPC Circular No. 2016-02. Section 1 thereof provides that government agencies may share or transfer personal data under its control or custody to a third party through a DSA for the performance of a public function or the provision of a public service. Nevertheless, such Circular shall not be construed as prohibiting or limiting the sharing or transfer of any personal data that is already authorized or required by law.
Universal Health Care Act; Other Applicable Laws and Regulations; Submission of Data Required by Law; Exemption from DSA Requirement
With this, we refer to the UHC Act provision quoted in your letter, to wit:
Section 31. Evidence-Informed Sectoral Policy and Planning for UHC. -
(a) All public and private, national and local health-related entities shall be required to submit health and health-related data to PhilHealth including, among others, administrative, public health, medical, pharmaceutical and health financing data: Provided, That PhilHealth shall furnish the DOH a copy of the health data: Provided, further, That these shall be used for the purpose of generating information to guide research and policy-making: Provided, finally, That the DOH shall strengthen its research capability by supporting health systems development and reform initiatives through policy and systems research, and shall support the growth of research consortia in line with the vision of the Philippine National Health Research System.
Based on the foregoing discussion and the above provision of the UHC Act, a separate DSA between the DOH and PhilHealth is not indispensable for purposes of PhilHealth furnishing the DOH with COVID-19 related data, such as but not limited to administrative, public health, medical, pharmaceutical and health financing data, for the purpose of generating information to guide research and policy-making.
We emphasize that it is the UHC Act, its IRR, and other related issuances on the matter requiring the submission of these information to DOH which govern the data submission/sharing/transfer/furnishing arrangement. Hence, the DOH and PhilHealth need not execute a DSA in this scenario.
This notwithstanding, the parties are not precluded from executing a DSA should they wish to do so, perhaps to further lay down the details of the data submission between them, to outline the security measures to be implemented in order to protect the data in their custody, among others. But we emphasize that a separate DSA for this particular scenario is not mandatory.
Finally, we wish to clarify the statement from PhilHealth that it is exempt from the execution of any DSA with other national government agencies pursuant to the above UHC Act. Such statement is inaccurate.
The above UHC Act provision is limited to sharing, disclosure, or any other processing of personal data which may be necessary for research, developing sectoral policies that are evidenced-based and/or for purposes of planning vis-à-vis the PhilHealth’s and the DOH’s mandate and functions under such law. Outside of the foregoing purposes, the UHC Act provision allowing the transfer/sharing of personal data will not apply, as such a separate DSA may be required. Hence, the UHC Act did not grant PhilHealth a blanket exemption from executing DSAs with other national government agencies.
Any other submission, sharing, transfer, or disclosure involving personal data by PhilHealth should be reviewed and evaluated on a case-to-case basis, considering whether there is a law or regulation requiring sharing of personal data, whether sharing is for the performance of a public function or the provision of a public service, among others.
This opinion is based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner