Text
23 September 2021
RE: DATA SHARING AGREEMENT BETWEEN PHILHEALTH AND CITY CIVIL REGISTRAR ON REPORTING OF REGISTERED DEATHS
Dear [Redacted],
We write in response to your request for an advisory opinion received by the National Privacy Commission (NPC) seeking to clarify certain data privacy issues relating to the Memorandum of Agreement for Data Sharing (MOA) proposed by Philippine Health Insurance Corporation (PHIC).
We understand based on your letter that the proposed MOA states the following:
“1.1 Through its Office of the Local Civil Registrar, it shall transmit to PhilHealth a (monthly) report of registered deaths within its territorial jurisdiction;
1.2 The said report shall contain the full names of the deceased and their circumstances such as date of death, place of death, and last known residence of the deceased;
1.3 Should PhilHealth request for a certified true copy of the certificate of death in line with an investigation, the LGU shall release the same subject to the payment of corresponding fees;
1.4 It expressly understands that any and all information gathered, submitted, or otherwise incorporated in the database of PhilHealth in the course of this engagement shall be exclusively owned by the Corporation; and
1.5 Any and all information regarding PhilHealth members in relation to an investigation/inquiry, from any source and in any form (i.e., written, verbal, or electronic) shall be considered as strictly confidential.”
You raised the following concerns relative to the above:
- Whether the intended data sharing proposed by the PHIC complies with the provision of the NPC Circular No. 16-02 in relation to the Data Privacy Act of 20121 (DPA);
- Whether prior consent from the heirs of or next of kin of the data subject (deceased) is required for purposes of data sharing; and
- Whether the lack of a specific term for the duration of the agreement is contrary to NPC Circular No. 16-02.
Discussion
Criteria for lawful processing
Sections 12 and 13 of the DPA provides for a set of criteria in the processing of personal and sensitive personal information (collectively, personal data), respectively, apart from consent. Particularly, processing that is necessary for compliance with a legal obligation,2 provided for by existing laws and regulations,3 or necessary for the establishment, exercise, or defense of legal claims,4 may be applicable.
We understand that PHIC has been granted quasi-judicial powers which include the conduct of investigations pursuant to Section 17 of RA No. 7875, as amended by RA No. 10606.5 Thus, where the processing of personal data is required pursuant to its mandate, specifically for investigations, the same is recognized under the DPA.
As the basis for lawful processing is by virtue of an existing law or regulation, the consent of the deceased data subject’s heirs or next of kin is not necessary before the City Civil Registrar may share the deceased’s personal data with the PHIC.
General data protection principles; proportionality
Although the DPA sanctions the processing of personal data by virtue of a law, personal information controllers (PICs), such as PHIC and Civil Registrars are still required to adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality.
In this case, the principle of proportionality is of utmost concern. It requires that the processing, which includes disclosure, must be necessary and not excessive in relation to a declared and specified purpose, and that personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.6
Thus, the PHIC monthly reportorial requirement for all registered deaths within the territorial jurisdiction of a particular city, without any qualifications, should be reevaluated if such is still proportional to the purpose. The City Civil Registrar should seek further clarification with the data protection officer of PHIC as to the specific legal basis for requiring such extensive report on all registered deaths and whether a limited report of registered deaths for which PHIC is conducting investigations as part of its statutory mandate should already suffice.
As to PHIC’s request on the release of certified true copies of death certificates in relation to investigations, access to said documents may be allowed. For this purpose, the City Civil Registrar should keep records and appropriate documentation of all PHIC requests.
Data sharing; data sharing agreements; term
We would like to note that NPC Circular No. 2020-038 superseded NPC Circular No. 16-02 as the governing rule regarding data sharing.7
On the term or duration of the data sharing arrangement, the current Circular provides as follows:
“D. Term. It specifies the term or duration of the data sharing arrangement which will be based on the continued existence of the purpose/s of such arrangement. Perpetual data sharing or DSAs that have indeterminate terms are invalid. Parties are free to renew or extend a DSA upon its expiration. The DSA should be subject to the conduct of periodic reviews which should take into consideration the sufficiency of the safeguards implemented for data privacy and security.”8
We recommend that that the parties revisit the proposed MOA and indicate a specific term, in compliance with the above requirement.
This opinion is based solely on the limited information you have provided. We are not privy to the other provisions of the draft MOA and the review of the same is limited to the above quoted provisions for purposes of this opinion. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC – Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
Data Privacy Act of 2012, § 12 (c). ↩
-
An Act Amending Republic Act No. 7875, Otherwise Known as The “National Health Insurance Act of 1995”, As Amended, And For Other Purposes [National Health Insurance Act of 2013], Republic Act No. 10606, § 17 (2013). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (c) (2016). ↩
-
National Privacy Commission, Data Sharing Agreements [NPC Circular 2020-038] (23 December 2020). ↩
-
Id. 9 (D). ↩