NPC Issuance Wiki

NPC Advisory Opinion No. 2022-015 — Use of Camera During Surveillance Visits

Issued Advisory Opinion

Official opinion tags

Text

23 June 2022

Re: USE OF CAMERA DURING SURVEILLANCE VISITS

Dear [Redacted],

We respond to your request for an Advisory Opinion on the taking of photos or videos by the Regulations Licensing and Enforcement Division (RLED) of the Department of Health – Metro Manila Center for Health Development (DOH-MMHCD) during its monitoring and surveillance visits.

You inform that DOH Administrative Order No. 2012-0012 dated 18 July 2012 authorizes the RLED to conduct on-site visits and inspection of health facilities such as hospitals, lying-in clinics, dental clinics and clinical laboratories. To aid the exercise of the RLED’s visitorial function, it proposes to document its on-site visits through photos and videos to facilitate the resolution of complaints and the imposition of the appropriate penalties.

You thus seek clarification on the following:

  1. Whether the RLED can take photos and videos during on-site visits for monitoring and surveillance purpose, without requesting for the consent of the authorized representatives of the health facilities or the persons whose photo or video will be taken.

  2. Whether RLED can use photos and videos for purpose of presenting the same in courts and administrative bodies.

  3. What data privacy laws, rules and regulations are applicable to RLED in the taking and use of photos and videos from on-site visits.

Discussion

Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.1 Accordingly, the image of an identifiable individual captured in a photograph or video is personal information about the individual and, thus, covered by the Data Privacy Act of 2012 (DPA).

The collection and use of audio-visual recordings may be justified under Section 12 of the DPA, specifically where the processing is necessary for compliance with a legal obligation,2 or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate.3

Under Section 12 of the DPA, the processing of personal information shall be permitted only if not otherwise prohibited by law and when at least one of the following conditions exists:

  • (a) The data subject has given his or her consent;
  • (b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract;
  • (c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;
  • (d) The processing is necessary to protect vitally important interests of the data subject, including life and health;
  • (e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or
  • (f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution. (emphasis ours)

Thus, in NPC Advisory Opinion No. 2018-053,4 we stated that the processing of personal information, which in that case involves photographs of hospital staff and doctors, can only be lawfully taken and processed when at least one of the conditions set forth in Section 12 of the DPA exists.

In addition, Section 13 of the DPA may likewise apply where a footage or image involves sensitive personal information, such as clinical photographs which necessarily contain the health information of patients.5 Sensitive personal information refers to personal information:

  • (1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;
  • (2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;
  • (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and
  • (4) Specifically established by an executive order or an act of Congress to be kept classified.

In which case, the processing thereof is prohibited except in the following cases:6

  • (a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing;
  • (b) The processing of the same is provided for by existing laws and regulations: Provided, that such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;
  • (c) The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing;
  • (d) The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, That such processing is only confined and related to the bona fide members of these organizations or their associations: Provided, further, That the sensitive personal information are not transferred to third parties: Provided, finally, That consent of the data subject was obtained prior to processing;
  • (e) The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured; or
  • (f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.

As mentioned above, Section 13 (b) recognizes processing that is imposed by existing laws and regulations. As applied in this instance, the processing of such images is anchored on such rules and regulations mandating the RLED to conduct monitoring and surveillance of health facilities regulated by the DOH. Hence, it is permitted under the DPA to process personal data through the taking of photos or videos during on-site visits and the consent of the data subject/s is not required should their images be captured in the process.

We wish to reiterate that the consent of the data subject/s is not the only lawful criteria for processing information and that the PIC should choose the lawful basis that most closely reflect the true nature of the relationship with the data subject and the purpose of the processing.

As for photos or videos of hospital premises, the DPA will not apply if no individual or data subject is captured. This does not mean, however, that other laws, regulations and generally accepted hospital standards will not apply.7

Audio-visual recordings may be used as evidence by the RLED in courts and administrative bodies.

On the question of whether RLED can use photos and videos as evidence in courts and administrative bodies, Section 13 (f) states that processing of sensitive personal information is permitted if the processing is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority. Although Section 13(f) applies to sensitive personal information, the protection of lawful rights and interests under Section 13 (f) is considered as legitimate interest pursuant to Section 12(f) of the DPA.8 This section provides that it is lawful to process personal information if it is necessary for the purpose of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.9

Thus, the RLED may present in evidence photos or videos it captured during inspections as the processing of such information is pursuant to the existence of the latter’s legitimate interest which is to resolve complaints filed against health facilities, and consequently, the imposition of penalties thereto.

We wish to reiterate that the law does not prohibit government agencies from processing personal data pursuant to their respective mandates, taking into consideration the applicable provisions of law, rules and regulations, and the general data privacy principles enunciated in the DPA. The DPA promotes fair, lawful, and secure processing of such information.

Adherence to the general data privacy principles when taking audio-visual recordings during on-site visit; data subjects’ rights; security measures.

While there may be lawful basis for processing under the DPA, the RLED must always adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality.

The principle of proportionality requires that processing of personal information shall be adequate, relevant, suitable, necessary, and not excessive in relation to the declared and specified purpose.10 We note from your letter that the RLED intends to document its on-site visits through photos and videos to facilitate the resolution of complaints and the imposition of the appropriate penalties. The RLED must ensure that such photos and videos will only be processed in relation to such purpose.

On the other hand, the principle of transparency requires that the data subject must be aware of the nature, purpose, and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of the personal information controller, his or her rights as a data subject and how these can be exercised. During the RLED’s inspection, it must provide the appropriate privacy notices to apprise data subjects that it will take photos or audio-visual recordings.

A privacy notice is statement made to a data subject that describes how an organization collects, uses, retains and discloses personal information. A privacy notice may be referred to as a privacy statement, a fair processing statement or, sometimes, a privacy policy.11 In the present case, we suggest that RLED create a privacy notice that taking of photographs or audio-visual recordings may be done during on-site visits or inspections and must include the lawful criteria on which the processing is based on. This privacy notice may be presented to the health facilities before conducting the inspection or when questions are raised on the propriety of taking photographs or videos by the RLED. By doing so, the data privacy principle of transparency is complied with.

Lastly, the RLED is required by the DPA to uphold the rights of data subjects and implement reasonable and appropriate security measures for the protection of the personal data collected against unauthorized processing. As such, the RLED must integrate privacy and data protection in all processing activities involved in the conduct of its on-site visit/s, considering the nature of the personal data that requires protection, the risks to the rights and freedoms of the patients as data subjects, current data privacy best practices, among others.12 We also reiterate that the audio-visual recordings, should only be used for the intended purpose thereof. You may refer to NPC Circular No. 2016-01 - Security of Personal Data in Government Agencies for further details as to which appropriate security measures are applicable to your agency.

Please be advised that this Advisory Opinion was rendered based solely on your provided information. Any extraneous fact that may be subsequently furnished to us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

Please be guided accordingly.

Very truly yours,

(Sgd.) FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office

Footnotes

  1. Data Privacy Act of 2012, § 20 (c) ↩

  2. Id. § 12 (c) ↩

  3. Id. § 12 (e) ↩

  4. NPC Advisory Opinion No. 2018-053 (November 26, 2018). ↩

  5. Data Privacy Act of 2012, § 3 (l) (2) ↩

  6. Id. § 13 (b) ↩

  7. NPC Advisory Opinion No. 2018-053 (November 26, 2018). ↩

  8. CID Case No.17-K-003 dated 19 November 2019 ↩

  9. R.A. 10173, Section 12(f); Ibid. ↩

  10. Data Privacy Act of 2012, § 11 (c) ↩

  11. IAPP, Glossary of Privacy Terms, available at https://iapp.org/resources/glossary/#paperwork-reduction-act-2 ↩

  12. Data Privacy Act of 2012, § 20 ↩

Backlinks