Text
12 July 2021
Re: MANDATORY PSYCHIATRIC EVALUATION OF ALL NATIONAL COUNCIL ON DISABILITY AFFAIRS PERSONNEL
Dear [Redacted],
We write in response to the request for guidance sent by the Civil Service Commission (CSC) in relation to the proposed mandatory psychiatric examination of all National Council on Disability Affairs (NCDA) personnel.
We note from the CSC letter that one NCDA personnel posted on the group chat of the NCDA two documents: 1) receiving letter for the Department of Health Secretary requesting for a psychiatric testing for all NCDA personnel, and 2) draft Memorandum of Agreement (MOA) with the National Center for Mental Health (NCMH).
We understand that the MOA includes a provision that an average of ten (10) personnel will be subject to psychiatric assessment and evaluation per week until all NCDA personnel has undergone it and that the psychiatric evaluation results will be given to the Executive Director.
In your memo to the Board Secretary and Officer-in-Charge, Finance and Administrative Division of the NCDA, copy furnished the CSC, you are invoking your right to doctor-patient confidentiality and constitutional rights if you will be forced to undergo psychiatric evaluation in the future.
We note also from the letter of the NCDA Executive Director to the Secretary of Health that the purpose of the psychiatric evaluation is to diagnose the mental, emotional, and behavioral
of sensitive personal information; consent.
attitude of the staff, analyze data and results of the assessment, and whenever necessary, develop a treatment plan and measure the progress of the plan.
We further note that the results of the psychiatric evaluation will be forwarded to the NCDA Executive Director rather than to the concerned NCDA personnel.
Discussion
Sensitive Personal Information; Health Information; Psychiatric Evaluation of Employees; Lawful Criteria for Processing Sensitive Personal Information by Employers; Consent
The Data Privacy Act of 20121 (DPA) considers an individual’s health information as sensitive personal information.2 As such, the processing of the same, as a general rule, is prohibited unless the processing falls within the criteria for lawful processing enumerated under Section 13 of the DPA, to wit:
SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:
(a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing;
(b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;
(c) The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing;
(d) The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, That such processing is only confined and related to the bona fide members of these organizations or their associations: Provided, further, That the sensitive personal information are not transferred to third parties: Provided, finally, That consent of the data subject was obtained prior to processing;
(e) The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured; or
(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority. (Emphasis supplied)
In the above-quoted provisions as applied in this instance, consent may be the most appropriate lawful basis for the processing of the health information of the NCDA personnel. We wish to reiterate the definition of consent in Section 3 (b) of the DPA as follows:
“Consent of the data subject refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so.”
We also wish to clarify that the existence of the MOA with the NCMH does not vest the NCDA with a lawful basis for compelling its employees to undergo mandatory psychiatric examination and transmittal of the results thereof to the NCDA Executive Director, in relation to Section 13 (b) on processing that is provided for by law or Section 13 (e) on the processing for purposes of medical treatment carried out by a medical practitioner or treatment institution. These criteria may not be applicable in this scenario.
General Data Privacy Principles; Transparency; Proportionality
We note from your letter that there was no prior consultation with the NCDA personnel regarding this personal data processing activity.
This may run contrary to the general data privacy principle of transparency which provides that a data subject must be aware of the nature, purpose, and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of personal information controller (PIC), his or her rights as a data subject, and how these can be exercised.3
In addition, the principle of proportionality requires that the processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose and personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.4
If the NCDA is indeed concerned about the welfare of its personnel, particularly during this time of pandemic, it may still proceed with the proposed program of having them undergo psychiatric evaluation, but on a voluntary basis.
Moreover, instead of transmitting the results of the evaluation to the NCDA Executive Director, NCDA should consider asking for a certification from the NCMH that the said personnel have undergone psychiatric evaluation and are fit to work. With this, the NCDA can still achieve its purpose of ensuring employee wellness and work performance while upholding their privacy rights.
Finally, the NCMH, with whom the NCDA has a draft MOA, is also considered as a PIC under the DPA. Hence, the NCMH is likewise obliged to comply with the provisions of the DPA, which includes adherence to the general data privacy principles.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Copy furnished: ''''''''''''' ''''''''''''''''''' ''''''''''''''''''''' ''''' '''''''''''''''''
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Id. § 3 (d) (2). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (a) (2016). ↩
-
Id. § 18 (c). ↩