NPC Issuance Wiki

NPC Advisory Opinion No. 2021-023 — Processing of Personal Data for Research Without Ethics Clearance

Issued Advisory Opinion

Official opinion tags

Text

5 July 2021

Re: PROCESSING OF PERSONAL DATA FOR RESEARCH WITHOUT ETHICS CLEARANCE

Dear [Redacted],

We write in response to your letter received by the National Privacy Commission (NPC) which sought an assessment if there is a potential case of data sampling with unlawful collection or processing for an unauthorized purpose not specified in the consent form, in relation to a research conducted without the proper clearance and approval from the appropriate authorities and institutions.

In your letter, we understand that a study entitled “Genomic Characterization of the Filipino People” was conducted by a certain Filipino researcher currently working at the Department of Organismal Biology, Human Evolution of the Uppsala University in Sweden. You further disclosed that the said researcher applied for ethics clearance from the National Ethics Committee (NEC) in 2015 to collect, transport, and analyze saliva samples sourced from indigenous peoples/indigenous cultural communities (IPs/ICCs) of the Philippines. However, no ethics clearance was issued since the conditions imposed by NEC were not satisfied and the researcher did not pursue his application for ethics clearance further.

We further understand from your letter and its annexes that the researcher allegedly committed the following improprieties in the conduct of his study:

  1. According to the published study, the researcher reportedly collected more than one thousand ninety-four (1,094) individual biological samples from one hundred twelve (112) Filipino ethnolinguistic groups without the required research ethics clearance, as required by Joint Memorandum Order (JMO) No. 2012-001 on the Requirement for Ethical Review of Health Research Involving Human Participants;1

  2. Saliva samples were collected from IPs/ICCs without observing the guidelines required by the National Commission on Indigenous Peoples (NCIP), the primary government agency mandated to protect the rights and well-being of IPs/ICCs, as required by NCIP Administrative Order (AO) No. 2012-12 and NCIP AO No. 2012-3.3 In particular, the researcher and his team conducted the research without being accompanied by an NCIP team designated to monitor compliance with the Indigenous Knowledge and Systems Practices (IKSP) of the communities; and

  3. The biological samples were transferred from the Philippines to Sweden without the required Material Transfer Agreement (MTA), as approved by an accredited research ethics committee. The MTAs submitted by the researcher have been disapproved, the disapproval of which was communicated to him, since the parties to the MTA must be a local Philippine institution/indigenous community and the Uppsala University. However, the researcher chose to withdraw his application for ethics clearance instead, alleging that the NEC does not have regulatory mandate on the nature of his study.

You disclosed in your letter that the researcher still proceeded with the study despite the lack of ethics clearance. Further, you discovered that the study has been published in a reputable science journal and that the researcher was among those awarded of a two-year grant by the European Commission for a project titled “Probing the Genetic Diversity and Demographic History of Ancient Seafarers in ISEA and Oceania, from Archaic Hominins to the Dispersal of the Malayo Polynesia Language Family” where the samples collected by the researcher from the Philippines will be used.

We note also that the NCIP issued a statement dated 15 April 2021 condemning the conduct of genetic/genomic research with indigenous peoples by the researcher without Free and Prior Informed Consent (FPIC) and the required ethical clearance; that the blatant disregard of policies governing scientific research in the Philippines will have far-reaching adverse impact to the governance of scientific research in the country; and that the lack of consent offends the rights of the IPs/ICCs to self-determination, self-governance, human rights, and social justice.

You now express concern over the possible unlawful processing of personal data involved in the study since this may have serious implications in scientific integrity. You now ask on the possible actions that may be taken, considering the provisions of the Data Privacy Act of 20124 (DPA).

Discussion

Scope of the DPA; research; special case

Research is an activity that aims to develop or contribute to knowledge that can be generalized (including theories, principles, relationships), or any accumulation of information using scientific methods, observation, inference, and analysis.5

Section 4 of the DPA enumerates the categories of personal information and sensitive personal information (collectively, personal data) which fall outside the scope of the law. This includes the processing of personal data for research purposes.6 The DPA recognizes that research is critical to nation-building and serves a public interest.7 It is therefore the intent of the DPA to grant a certain degree of flexibility in the processing of personal data for purposes of research.8 Stated differently, a personal information controller, such as a researcher, may lawfully process personal data even without meeting the criteria provided by Section 12 and Section 13 of the DPA.9

However, this exemption is not absolute. The following must be strictly complied with:

  1. the processing must be only to the minimum extent necessary to achieve the specific purpose, function or activity;10
  2. the research must be:
    • a. intended for a public benefit;
    • b. subject to the requirements of applicable laws, regulations or ethical standards.11

The exemption afforded to the processing of personal data for research purposes shall only apply if the requirements of applicable laws, regulations or ethical standards are complied with. Research on human subjects, especially persons belonging to a vulnerable group such as ICCs, are bound by various ethical and legal obligations.

First, the guidelines under JMO No. 2012-001 on the Requirement for Ethical Review of Health Research Involving Human Participants must be observed in the conduct of the study. Second, the provisions of NCIP AO No. 2012-1 and NCIP AO No. 2012-3 on research and documentation guidelines and free and prior informed consent, respectively, must also be complied with since the data subjects are IPs/ICCs.

The researcher apparently failed to complete the foregoing ethical and legal standards during the conduct of his study, as determined by the NEC and the NCIP, the appropriate authorities on this matter. As a result, the processing of personal data pursuant to such study cannot be considered as a special case under the DPA since the conditions provided by the law were not fulfilled.

Health data as sensitive personal information; genetic data

Information about an individual’s race, ethnic origin, health, and genetics are classified as sensitive personal information under the DPA.12 The processing of sensitive personal information is allowed, if not otherwise provided by law, when at least one of the criteria required by Section 13 of the DPA is complied with.

Note that the DPA does not provide a definition for the term “genetic data”. However, the EU General Data Protection Regulation13 (GDPR) may provide further insight on this matter. It defines genetic data as “personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question.”14

Hence, genetic data can only be considered personal data if it can directly identify a specific individual. A genetic sample by itself is not personal data unless it is analyzed to produce data which can identify a specific individual.15 Similarly, anonymized or aggregated genetic data without any identifiers or which can no longer be related to any specific genetic identity or profile shall not be considered personal data.16

Given the foregoing, the saliva samples collected from the IPs/ICCs may not be considered personal data as defined under the DPA if the same can no longer be related to the identity of the person from whom it was collected.

However, we note that the DPA still applies to the other personal data that were collected from the data subjects through the consent form.

Lawful basis for processing sensitive personal information; consent

As the research herein described failed to meet the standards provided by the DPA to be considered a special case, there must be lawful basis in the processing of sensitive personal information under Section 13 of the DPA.

In particular, Section 13 (a) provides that the processing of sensitive personal information is allowed when the data subject has given his or her consent, specific to the purpose prior to the processing.

Consent under the DPA refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal data about and/or relating to him or her.17 Consent shall be evidenced by written, electronic or recorded means and may also be given on behalf of the data subject by an agent specifically authorized by the data subject for the said purpose.18

We note that the act of the IPs/ICCs in providing personal data to the researcher, while seemingly freely given, will still not suffice. We wish to emphasize that the DPA is meant to be read and interpreted with other applicable laws on consent.

In the current matter, specific guidelines are applicable on how the FPIC of the IPs/ICCs as data subjects/participants in a study must be obtained. Hence, the procedural and documentary requirements on consent under JMO No. 2012-001 and NCIP AO No. 2012-3 must be strictly construed.

In addition, under the DPA, the data subject must be aware of the nature, purpose, and extent of the processing of his or her personal data, including among others, the risks and safeguards involved.19 The test to determine whether the general data privacy principle of transparency has been complied with is to assess whether the target audience could have understood the information provided to them.20

In the current matter, the data subjects involved were IPs/ICCs. The researcher, as personal information controller, should have considered the use of plain and simple language in the consent form to inform them of how exactly their data will be used and the consequences of providing such data to the researcher.

Considering that there are concerns raised on the alleged lack of FPIC in relation to the absence of the required ethical clearance, the affected data subjects or their appropriate representatives may consider filing a complaint before the NPC pursuant to the provisions of NPC Circular No. 2021-01 or the 2021 Rules of Procedure of the National Privacy Commission.21

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC – Director IV, Privacy Policy Office

Footnotes

  1. Department of Science and Technology, Department of Health, Commission on Higher Education and University of the Philippines Manila, Requirement for Ethical Review of Health Research Involving Human Participants, Joint Memorandum Order No. 001, Series of 2012 [Joint Memorandum Order No. 2012-001] (December 28, 2012). ↩

  2. National Commission on Indigenous Peoples, The Indigenous Knowledge Systems and Practices (IKSPs) and Customary Laws (CLs) Research and Documentation Guidelines of 2012, NCIP Administrative Order No. 1, Series of 2012 [NCIP AO No. 2012-1] (March 15, 2012). ↩

  3. National Commission on Indigenous Peoples, The Revised Guidelines of Free and Informed Prior Consent (FPIC) and Related Processes of 2012, NCIP Administrative Order No. 3, Series of 2012 [NCIP AO No. 2012-3] (April 13, 2012). ↩

  4. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  5. Philippine Health Research Ethics Board Ad Hoc Committee for Updating the National Ethical Guidelines, National Ethical Guidelines for Health and Health Related Research, Introduction, p. 5 (2017). ↩

  6. Data Privacy Act of 2012, § 4 (d). ↩

  7. See NPC Advisory Opinion No. 2019-017 (March 5, 2019). ↩

  8. Ibid. ↩

  9. See NPC Advisory Opinion No. 2020-029 (July 30, 2020). ↩

  10. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 5 (2016). ↩

  11. Id. § 5 (c). ↩

  12. Data Privacy Act of 2012, § 3 (l). ↩

  13. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) Official Journal of the European Union, Vol. L119 (4 May 2016). ↩

  14. EU General Data Protection Regulation, Art. 4 (13). ↩

  15. See: Information Commissioner’s Office, UK, What is special category data?, available at https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/special-category-data/what-is-special-category-data/#scd3 (last accessed 5 July 2021). ↩

  16. Ibid. ↩

  17. Data Privacy Act of 2012, § 3 (b). ↩

  18. Ibid. ↩

  19. Rules and Regulations Implementing the Data Privacy Act of 2012, § 18 (a). ↩

  20. See: National Privacy Commission, JVA v. U-PESO.PH Lending Corporation (UPESO), NPC Case No. 19-498 (9 June 2020). ↩

  21. National Privacy Commission, 2021 Rules of Procedure of the National Privacy Commission [NPC Circular No. 2021-01], available at https://www.privacy.gov.ph/wp-content/uploads/2021/01/2021RULESOFPROCEDURE_VER8-Final-Sgd-1-1-1.pdf. ↩

Backlinks

  • No backlinks found