NPC Issuance Wiki

NPC Advisory Opinion No. 2021-042 — Disclosure of List of Frontline Workers Affected by COVID-19

Issued Advisory Opinion

Official opinion tags

Text

16 December 2021

Re: DISCLOSURE OF LIST OF FRONTLINE WORKERS AFFECTED BY COVID-19

Dear [Redacted],

We write in response to your letter received by the National Privacy Commission (NPC) which sought clarification on whether to grant the request of a third-party organization to be given a list of frontline workers who were affected by COVID-19.

Discussion

We understand that the Department of Health (DOH) received a request from the Filipino International Staff of the Asian Development Bank (ADB Fil-IS) for a list of names of frontline workers who passed away or were severely affected by COVID-19. This request is pursuant to ADB Fil-IS’ initiative to raise funds to help the affected Filipino frontline workers and their beneficiaries for the fund drive, Alay Dangal sa Bayaning Lumalaban sa COVID-19.

You now ask on whether the disclosure of such information is allowed under the Data Privacy Act of 20121 (DPA).

A list of names, by itself, is considered personal information under the DPA. However, a list of names of COVID-19 patients are considered sensitive personal information since it pertains to the health information of the said individuals. Hence, to be able to process such data, there must be lawful basis under Section 13 of the DPA.

In this scenario, the DOH, as the health authority of the country, has information on COVID- 19 cases and related deaths. However, the processing of the said information is limited only for purposes of disease surveillance and response against the COVID-192 and is based on the requirements of various laws, rules, and regulation on notifiable diseases and the pandemic response of the government. On the other hand, the ADB is a private international financial institution that provides assistance to, among others, developing member countries and the private sector.

For further processing of the said health information which includes disclosure to third parties, such as the proposed disclosure by the DOH of the personal data of frontline workers who passed away or were severely affected by COVID-19 to the ADB Fil-IS, pursuant to the latter’s initiative to extend financial assistance, there must be lawful basis under Section 13 which is distinct from the original lawful basis for processing relied upon by the DOH as a public authority.

Section 13 of the DPA provides that the processing of sensitive personal information is generally prohibited unless it falls under any of the criteria for processing. In particular, processing may be allowed when the data subject has given his or her consent, specific to the purpose prior to the processing.3

In the current matter, although the disclosure of data will be used for a good cause and legitimate purposes in extending assistance to frontline workers and/or their families, the requirements of the DPA must still be complied with.

The DOH, as the personal information controller, must obtain the consent of the affected frontline workers or their heirs for those who are deceased, prior to the disclosure of their identities to the ADB Fil-IS.

Public health authorities such as the DOH, their partner agencies and authorized personnel must limit the use and disclosure of health information to the purpose specified at the time of collection.4 Further, the processing of COVID-19-related personal data by public

authorities should be limited to the pandemic response, specifically the following as stated in the DOH and NPC JOINT MEMORANDUM CIRCULAR No. 2020-0002:

V. GENERAL GUIDELINES

xxx

  1. The processing of personal health information of COVID-19 cases and identified close contacts for disease surveillance and response shall be to the extent necessary for the following purposes:

a. To outline a true picture of the country’s COVID-19 health situation in terms of status and extent of local and community transmission. b. To build a repository of real-time COVID-19-related data as basis of evidence-informed health policy and intervention measures. c. To support case investigation and management, contact tracing and monitoring, quarantine and isolation, mandatory reporting to national and local public health authorities, and other disease surveillance-related activities. d. To improve response activities, including the quality and accessibility of health services and other related interventions for COVID-19. e. To allow information sharing and exchange between and among healthcare providers, public health authorities and other government authorities for treatment and care coordination, and/or surveillance and response purposes.5

We note that the proposed disclosure of the requested personal data to ADB Fil-IS does not fall under any of the foregoing purposes and circumstances. Hence, the consent of the affected frontline workers and the heirs of the deceased must be obtained prior to the disclosure of such information.

We also note that the rights of the data subjects must be considered under the current circumstance. For instance, there may be some frontline workers and/or the heirs of the deceased who may not want their personal data, specifically their health information, disclosed to third parties.

Statistical Data; Further Processing

For purposes of the fundraising, the DOH may opt to provide statistical data only rather than providing the personal data of the frontline workers. However, we emphasize that the foregoing condition on further processing must be strictly construed. This means that the data must be purely statistical and free from any factors that will enable others to reasonably identify the individuals involved.

We note that under this option, the identities of the affected frontline workers and their heirs remain confidential. As to how the financial assistance from the funds raised by ADB Fil-IS will eventually be distributed, the DOH and the ADB Fil-IS may device such mechanisms which are less privacy-intrusive, i.e., make announcements as to how affected frontline

workers may apply for assistance, etc., thereby making any further personal data processing consent-based in this instance.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. Department of Health and National Privacy Commission, Privacy Guidelines on the Processing and Disclosure of COVID-19 Related Data for Disease Surveillance and Response, Joint Memorandum Circular No. 2020-0002 [DOH-NPC JMC No. 2020-0002] (April 24, 2020). ↩

  3. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, § 13(a) (2012). ↩

  4. DOH-NPC JMC No. 2020 – 0002, § VI (D). ↩

  5. Id. § V (2). ↩

Backlinks

  • No backlinks found