Text
21 October 20211
Re: DATA SHARING FOR THE NATIONAL HEALTH WORKFORCE REGISTRY
Dear [Redacted],
We write in response to your request for assistance, comments, or guidance to facilitate the finalization of the Data Sharing Agreement (DSA) between the Department of Health (DOH) and the Professional Regulation Commission (PRC) (collectively, Parties).
We understand that the Parties intend to execute a DSA pursuant to Section 25 (c) of Republic Act No. 11223, otherwise known as the Universal Healthcare Act2 (UHC Act) which mandated the Parties, in coordination with the duly registered medical and allied health professional societies, to create a registry of medical and allied health professionals, indicating, among others, their current number of practitioners and location of practice (Registry). The Parties also issued Joint Administrative Order (JAO) No. 2021-0001 on the Guidelines on the Establishment, Utilization, and Maintenance of the National Health Workforce Registry.3
We understand further that the Registry will use data matching protocols across different human resources for health (HRH) data sources. The matched and assembled datasets of HRH individuals will be stored in the Registry data warehouse and will be refined into anonymized and aggregated reports which could be released to the public as requested.
You now seek guidance on how the Parties can pursue sharing of personal and sensitive personal information (collectively, personal data) required by the UHC Act and the JAO that is aligned with the provisions of the Data Privacy Act of 20124 (DPA), particularly with the general data privacy principle of proportionality.
Discussion
General data privacy principles; proportionality
We understand that the PRC raised the issue of proportionality with regard to the processing of the birthdate and the sex of the health professionals. According to the PRC, the inclusion of such information are excessive and unnecessary to carry out the purpose of the Registry pursuant to the UHC Act which is to have a database of medical and allied health professionals, indicating, among others, their current number of practitioners and location of practice.5
The principle of proportionality provides that the processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose and personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other less intrusive means.6
In keeping with the said principle, we acknowledge the position of the PRC that the inclusion of birthdate and sex in the Registry may not be indispensable to achieve the purpose of the Registry. But we also understand that the DOH plans to use birthdate and sex, being unique identifiers, for the data matching protocols of the Registry.
With this, the DOH should make an assessment on whether these personal data are indeed needed, taking into account the comments of the PRC, and the fact that the Registry will likewise include other information which may serve as the additional variables for the data matching protocols vis-à-vis the achievement of the purpose intended under the UHC Act and the JAO.
Lawful basis for processing personal data; special cases; privacy notice
If the DOH, after its judicious assessment, has determined that the birthdate and sex of the health professionals are indeed indispensable to achieve the purpose of the processing, and such purpose cannot be fulfilled by any other means, the PRC may lawfully share the same.
We wish to clarify the contention of the PRC that consent of the health professionals is needed if their sex and birthdate will be processed pursuant to the UHC Act and the JAO. We note that consent of the data subject is just one of the possible lawful bases for processing. In this scenario, consent may not be the most appropriate lawful basis considering that a government agency is requesting for personal data pursuant to existing laws and regulations.
Instead, the DOH’s processing may be considered as processing under the special cases provided for in Section 4 (e) of the DPA as it is a public authority performing regulatory functions to the extent necessary for the fulfillment of its mandate.
Thus, the Parties need not secure the consent of the health professionals prior to the proposed sharing. Nevertheless, the Parties are still required to provide the health professionals adequate information that describes the nature, extent, and purpose of the processing being done pursuant to the UHC Act and the JAO. This may be done through an appropriate privacy notice.
A privacy notice is “a statement made to a data subject that describes how an organization collects, uses, retains and discloses personal information. A privacy notice may be referred to as a privacy statement, a fair processing statement or, sometimes, a privacy policy.”7
The Parties may post the privacy notice in their respective offices, websites, and/or other official online platforms to ensure that the data subjects will have access to it.
Privacy impact assessment; privacy by design
We recall our comment in November 2020 when we reviewed the draft DSA for the Parties to conduct a privacy impact assessment (PIA) on the Registry.
A PIA is a process undertaken and used to evaluate and manage impacts on privacy of a particular program, project, process, measure, system or technology product of a PIC or PIP. It takes into account the nature of the personal data to be protected, the personal data flow, the risks to privacy and security posed by the processing, current data privacy best practices, the cost of security implementation, and, where applicable, the size of the organization, its resources, and the complexity of its operations.8
The PIA will help identify and provide an assessment of various privacy risks, and propose measures intended to address and mitigate the effect of these identified risks on the data subjects.
In addition to the conduct of the PIA, it is recommended that the Parties incorporate privacy by design principles in the development of the Registry system. Privacy by design is an approach that ensures that privacy and data protection have been taken into account during the design phase of a system, project, program and process and will continue to be taken into account throughout its lifecycle and implementation.9
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Footnotes
-
Tags: criteria for lawful processing; compliance with legal obligation; law or regulation; consent; general data privacy principles; privacy impact assessment; privacy-by-design. ↩
-
An Act Instituting Universal Healthcare for All Filipinos, Prescribing Reforms in the Healthcare System, and Appropriating Funds Therefore [Universal Healthcare Act], Republic Act No. 11223 (2018). ↩
-
Department of Health and Professional Regulation Commission, Guidelines on the Establishment, Utilization, and Maintenance of the National Health Workforce Registry [Joint Administrative Order No. 2021-0001] (20 Jan. 2021). ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
Universal Healthcare Act, § 25 (c). ↩
-
See: Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (c) (2016). ↩
-
IAPP, Glossary of Privacy Terms, available at https://iapp.org/resources/glossary/#paperwork-reduction-act-2. ↩
-
NPC Advisory No. 201-03, Guidelines on Privacy Impact Assessment, 31 July 2017. ↩
-
See generally: Cavoukian, Ann Ph.D., Privacy by Design - The 7 Foundational Principles - Implementation and Mapping of Fair Information Practices, available at https://iapp.org/media/pdf/resource_center/pbd_implement_7found_principles.pdf (last accessed 21 Oct 2021). ↩