NPC Issuance Wiki

NPC Advisory Opinion No. 2022-003 — Request for a Copy of Complaints Filed and Records in Relation Thereto

Issued Advisory Opinion

Official opinion tags

Text

14 February 2022

RE: REQUEST FOR A COPY OF COMPLAINTS FILED AND RECORDS IN RELATION THERETO

Dear [Redacted],

We write in response to your request for an Advisory Opinion received by the National Privacy Commission (NPC) on whether to grant the request for a copy of the complaints previously filed against a certain doctor in 2018 by five (5) medical bodies including the documents provided by the said doctor in relation to such complaints.

We understand that the documents requested will be used by the requestor in connection with a case filed by the doctor against the said requestor.

Discussion

Republic Act No. 10713, otherwise known as the Data Privacy Act of 20121 (DPA), provides a specific enumeration of personal data classified as sensitive personal information under the law, one of which involves a data subject’s information pertaining to offenses and the incidence in relation thereto, to wit:

“(1) Sensitive personal information refers to personal information: x x x

(2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings.”2 (emphasis supplied)

In fine, any (1) proceeding for any offense committed or alleged to have been committed by a data subject; (2) the disposal of the proceedings; or (3) the sentence of any court in such proceedings, are considered as sensitive personal information under the DPA.

Although there is a prohibition under the law to process sensitive personal information, the DPA also provide for exceptions to this rule. Section 13 (f) recognizes the processing which concerns the establishment, exercise, or defense of legal claims. The provision reads:

“SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases: x x x

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interest of natural or legal persons in court proceedings or the establishment, exercise, or defense of legal claims, or when provided to government or public authority.”3

It must be noted that in the determination on whether a request based on the aforementioned provision should be granted, “the legitimacy of the purpose and the proportionality of the request shall be taken into consideration”.4

We understand that the request received by the Department of Health (DOH) was in the form of an email communication without any detail as to what the pending case is. To satisfy the DOH on the legitimacy of the purpose of the request, it may opt to require the requestor to provide additional information on the case. But this requirement shall still adhere to the principle of proportionality, and whatever additional information received shall be used solely for the purpose of aiding the DOH in deciding whether to release the requested documents.

It is likewise suggested that the DOH establish a system to handle such requests, to streamline the process and make it more efficient in case there will be similar requests in the future.

The DOH may also clarify with the requestor if instead of the release of the actual copies of the complaints and related documentation, an official certification from the DOH stating the details or a summary of the complaints filed, i.e., names of the medical bodies, nature of the complaints, date filed, status, etc., should suffice.

Should the request be granted, the DOH should require the requestor to sign an undertaking to the effect that the requestor recognizes that the use of the documents will be for the sole purpose of protecting his rights and interests in the case filed against him and that the use thereof beyond its declared purpose may equate to unauthorized processing penalized under the pertinent provision of the DPA. It is also important to include a clause in the undertaking whereby the requestor acknowledges that his receipt of the requested documents carries with it the obligations of a personal information controller under the DPA.5

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC – Director IV, Privacy Policy Office

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for other purposes Data Privacy Act of 2012 Republic Act No. 10173, § 3 (l) (2) (2012). ↩

  2. Id., § 3 (l) (2). ↩

  3. Data Privacy Act of 2012, § 13 (f). ↩

  4. See: National Privacy Commission, NPC Advisory Opinion No. 2021-044 (Dec. 29, 2021). ↩

  5. Id. ↩

Backlinks