NPC Issuance Wiki

NPC Advisory Opinion No. 2021-004 — Request for Personal Data by HMO Brokers

Issued Advisory Opinion

Official opinion tags

Text

10 February 2021

Re: REQUEST FOR PERSONAL DATA BY HMO BROKERS

Dear [Redacted],

We write in response to your inquiry concerning MediCard Philippines (MediCard) and the various issues raised on the request for personal and sensitive personal information (collectively, personal data) by accredited HMO brokers (brokers) with respect to the utilization analysis of Medicard’s corporate clients’ employees and other personal data processing activities.

We understand that the brokers are accredited by MediCard. Accreditation is merely an acknowledgment that a particular broker is recognized by Medicard, but there is no formal agreement establishing mutual contractual obligations between them.

We understand further that the broker and the Medicard corporate client have a service agreement, and as part of the broker’s service offering to the corporate client, the brokers may conduct utilization analysis involving the corporate clients’ employees. To do such activity, the brokers seek to collect utilization information of the corporate clients’ employees from MediCard. Utilization information includes diagnosis, dates of confinement, place of confinement, cost of confinement, procedures done, among others.

In addition, you mentioned that these brokers share information with their branches located in other countries, perform analytics on the data obtained and publish studies on the same, and sell insurances.

With this, MediCard expressed hesitation in providing information to the brokers. In view of the foregoing, you now seek clarification of the following:

  1. Can MediCard charge the accountability of securing the consent of the data subjects to the corporate client since MediCard does not have direct contract with the corporate client’s employees and dependents?
  2. In relation to the corporate account, what is the role of the broker, is it a personal information controller (PIC) or a personal information processor (PIP)?
  3. What can be the broker’s basis for processing/receiving/sharing data since they are not a party to the agreement between MediCard and its corporate clients? Should they secure consent from the employee/data subject?

Discussion

Data Privacy Act of 2012; scope; personal information controller; duties and responsibilities

The Data Privacy Act of 20121 (DPA) applies to the processing of all types of personal information and to any natural and juridical person involved in processing personal information.2 When brokers request for utilization information details and process the same, they are engaged in processing personal data and are thus covered by the provisions of the DPA.

As to whether they are PICs or PIPs, brokers may be considered as PICs based on the information provided. A PIC is defined as a person or organization who controls the collection, holding, processing or use of personal information.3 There is control if the natural or juridical person decides on what information is collected or the purpose or extent of its processing.4

As indicated in the facts provided to us, the brokers may be engaged in the processing of personal data based on their own purposes, distinct and independent from Medicards’ and/or the corporate clients’ purposes. The brokers control the processing of the personal data of the employees of such corporate clients, and determine what personal data to collect and how such information will be used.

Thus, as PICs, the brokers are accountable with respect to the personal data they process and must ensure adherence to the general data privacy principles of transparency, legitimate purpose, and proportionality, the implementation of reasonable and appropriate security measures for the protection of personal data, and that data subject rights are upheld at all times.

Since the brokers intend to collect and process health information, which is considered as sensitive personal information under the DPA, they must anchor their processing on any of the various lawful criteria under Section 13 of the law. A determination must be made on the most appropriate lawful basis, considering all relevant circumstances of the proposed processing, the corporate clients’ employees’ expectation of privacy as well as the impact on their rights and freedoms.

Should there be no other appropriate lawful basis to process such utilization information except for the consent of the employee data subject, it is incumbent upon the brokers to inform them and obtain their consent, either directly or through the corporate clients.

We wish to reiterate the definition of consent. The same must be freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her, and evidenced by written, electronic or recorded means.5

The brokers would have to provide details on the processing for the utilization analysis, analytics, research, sharing and disclosure to third parties, and other proposed personal data processing activities, pursuant to the transparency principle and the data subjects’ right to be informed.

Aggregate data; statistics; proportionality principle

Finally, Medicard is not precluded from asking the brokers if the disclosure of statistical or aggregate information without necessarily including any personal data would already suffice for purposes of the utilization analysis and other proposed analytics or further processing. This is in keeping with the proportionality principle that personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.6

This opinion is based solely on the limited information you have provided. No service agreements or other contracts were reviewed for purposes of this opinion. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. Data Privacy Act of 2012, § 4. ↩

  3. Data Privacy Act of 2012, § 3 (h). ↩

  4. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 3 (m) (2016). ↩

  5. Data Privacy Act of 2012, § 3 (b). ↩

  6. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (c) (2016). ↩

Backlinks

  • No backlinks found