Text
5 November 2020
Re: DISCLOSURE OF SPECIFIC HEALTH CONDITION TO THE EMPLOYER FOR SICK LEAVE UTILIZATION
Dear [Redacted],
We write in response to your request for an Advisory Opinion on whether an employer can require its employees to call an employer-run hotline to report that he or she will go on sick leave and to disclose to the hotline operator the specific health condition which caused the employee to utilize sick leave benefit.
We note that the hotline operator, using a software application system, will only disclose certain details of the report to the concerned employee’s project lead: 1) that the employee will go on a sick leave; 2) the number of days of sick leave; and 3) the total number of sick leave days for the last twelve (12) months.
We understand that the purpose of informing the project lead is to ensure that he or she is aware of the absence and can make the necessary adjustments to minimize work disruption. We also note that the specific health condition of the employee will not be disclosed to the project lead.
However, the same may be communicated to the employer’s Health and Wellness Team and endorsed to the onsite clinic personnel if the health condition relates to specific infectious diseases, i.e. conjunctivitis, chicken pox, measles, PTB, shingles, German measles, mumps/parotitis, herpes simplex, hand foot and mouth disease, scabies, impetigo and viral exanthem. We further understand that if an infectious disease is identified, it will trigger intervention actions, i.e. disinfecting the employee’s work area and observing/assisting other employees who may have been exposed.
Another instance where the specific health condition of the employee will be reported to the Health and Wellness Team is when the same pertains to specific pregnancy-related illnesses. In this case, the employee will be advised to secure a fit-to-work certification from her health professional before she will be allowed to report back to work.
Discussion
Processing of health information; sensitive personal information; lawful criteria; law or regulations; labor laws; occupational safety and health; mandatory notification of infectious diseases
The employer hotline for sick leave utilization involves the processing of health information. Under Section 13 the Data Privacy Act of 20121 (DPA), an individual’s health information is classified as sensitive personal information and can only be processed if one of the conditions provided in Section 13 of the DPA is met.
In this scenario, the possible basis for processing is provided for under Section 13(b) which recognizes processing of health information that is necessary based on existing laws and regulations.
The employer may check the existing labor laws and Department of Labor and Employment (DOLE) policies applicable on handling and processing employee leave benefits such as sick leaves,2 as well as the pertinent laws and regulations on occupational safety and health standards, i.e. Republic Act (RA) No. 11058 or An Act Strengthening Compliance with Occupational Safety and Health Standards and Providing Penalties for Violations Thereof.
As to the pregnancy-related illnesses, the employer may also refer to RA No. 9710 or The Magna Carta of Women and see if the provisions relating to the grant of Special Leave or the Gynecological Leave for Women may also be applicable.
In addition, we note the consideration given to infectious diseases. Pursuant RA No. 11332 or the Mandatory Reporting of Notifiable Diseases and Health Events of Public Health Concern Act, all workplaces are required to accurately and immediately report notifiable diseases and health events of public health concern as issued by the DOH.3
Notifiable diseases include some of the infectious diseases such as those you have enumerated. Hence, employers are required by law to make a notification to the proper government authority.
General data privacy principles; transparency; privacy notice; proportionality
Nevertheless, while there may be lawful basis to process health information, the employer is still required to observe the general data privacy principles under the DPA. Specifically for transparency, employees must be adequately informed of the details of this personal data processing system for sick leave utilization, including the risks and safeguards involved. This may be done through a privacy notice which should be easy to access and understand and, at least, contain the following information:
- a) the personal data to be processed;
- b) the purpose of such processing:
- ensure that the employee does not have a contagious disease, or if so, for the employer to facilitate intervention measures to prevent the spread of the disease; or
- specific pregnancy-related illness to enable the employer to take measures to address the employee’s condition upon return to work.
- c) how personal data is processed;
- d) recipients of the personal data, if any;
- e) how personal data is protected;
- f) retention period;
- g) rights of the data subject; and
- h) contact details of the data protection officer.
Further, we remind employers of the proportionality principle which requires that the processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.4 Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.5
Hence, the employer should assess the proportionality of the personal data collected, considering that this involves health information, the methodology of processing, and if the purpose sought to be achieved cannot be fulfilled by any other less privacy intrusive means.6
Security measures; privacy impact assessment
In addition, the employer should implement reasonable and appropriate organizational, physical, and technical security measures on the software application to be used for this processing activity.
Likewise, the employer should consider conducting a privacy impact assessment (PIA) in order to assess privacy risks related to the personal data processing and the application to be used, and to take appropriate safeguards to mitigate the identified risks. Guidelines on conducting a PIA may be found at the NPC website: https://www.privacy.gov.ph/wp-content/files/attachments/nwsltr/NPC_Advisory No.2017-03.pdf.
Lastly, it is suggested that the operator of the hotline and the members of the Health and Wellness Team sign a non-disclosure agreement to ensure that any health information they receive in the course of their official duties are not disclosed to unauthorized third-parties or other personnel. Employers shall be responsible for reminding the pertinent staff that the use of such collected health information for any other unauthorized purpose is a violation of the provisions of the DPA which may result to the filing of complaints and conduct of investigations.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
Department of Labor and Employment, Employee Guidebook, available at https://www.dole.gov.ph/wp-content/uploads/2019/04/Employee-Guidebook-as-of-2013-10-07.pdf (last accessed 6 Nov 2020). ↩
-
An Act Providing Policies and Prescribing Procedures on Surveillance and Response to Notifiable Diseases, Epidemics, and Health Events of Public Health Concern, and Appropriating Funds Therefor, Repealing for the Purpose Act No. 3573, Otherwise Known as the “Law on Reporting of Communicable Diseases [Mandatory Reporting of Notifiable Diseases and Health Events of Public Health Concern Act], Republic Act No. 11332, § 6(c) (2019). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18(c) (2016). ↩
-
Id. ↩
-
See: National Privacy Commission, NPC Advisory Opinion No. 2018-084 (Nov. 28, 2018). ↩