Text
30 January 2023
Re: REQUEST FOR MEMBERSHIP DETAILS BY A SPOUSE OF A MISSING PHILHEALTH MEMBER
Dear [Redacted],
We respond to your request for an Advisory Opinion on the above matter.
We gather that the wife of a Philippine Health Insurance Corporation (Philhealth) member wrote your office to inform that her husband has been missing since 2015. To aid her in locating her husband, she requested Philhealth for information on the last payment made by her husband including the company name and address of his last employer. Included in the wife’s letter is a Marriage Certificate as proof of the fact of marriage, a police blotter about her missing husband, and the Birth Certificate of the husband.
Thus, you ask whether it is lawful for Philhealth to disclose the personal information of its member to the latter’s spouse.
Lawful processing of personal information; legitimate interests
As far as Philhealth is concerned, the requested information is personal information since it pertains to information that can identify its member. Further, the said information also forms part of the files belonging to the missing husband and thus, is considered personal information. As such, Philhealth, as a personal information controller, is obliged under the DPA to process personal information of its members only when there is lawful basis and the requirements of the DPA are complied with.
Discussion
A personal information controller (PIC) should determine the most appropriate lawful basis for the processing of personal information and sensitive personal information (collectively, personal data), under the given facts and circumstances. For the processing of personal information, any of the conditions under Section 12 of the DPA may be considered. In particular, the following may be appropriate under the present situation:
SECTION 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:
xxx
(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.1
The legitimate interest criteria is to be distinguished from the other lawful criteria for processing since it is not centered around a specific purpose nor is it processing to which the data subject has specifically agreed to.2 In principle, it can apply to any type of processing for any reasonable purpose.3
Legitimate interests are matters that are desired or important to a PIC which may include business, financial or other reasonable purpose and which are not contrary to law, morals or public policy.4 Accordingly, the PIC or third party to whom personal information is disclosed must clearly identify the legitimate interest, reasonable purpose and intended outcome.5
A PIC must be able to establish the existence of a legitimate interest in the processing of personal information or that the third party to whom the PIC has disclosed the information has a legitimate interest over the processing.
In MAF v. Shopee Philippines, Inc., NPC discussed processing based on legitimate interest:
“Processing based on legitimate interest requires the fulfillment of the following conditions: (1) the legitimate interest is established; (2) the processing is necessary to fulfill the legitimate interest that is established; and (3) the interest is legitimate or lawful and it does not override fundamental rights and freedoms of data subjects.”6
In order for the lawful basis of legitimate interest to apply, the conditions under the foregoing enumeration must be satisfied. Hence, the legitimate interest of the wife must be clearly established.
First, it must be established that the processing of personal information shall be done for the sole purpose of pursuing the legitimate interest of the requesting party, which is to help her to locate her husband who has been missing since 2015.
Second, only personal information which is necessary and proportionate to grant the request may be processed pursuant to the identified legitimate interest of the third party to whom the personal information will be disclosed. Hence, the disclosure should only be limited to the personal information specifically requested by the wife. If the husband’s account is active, then the name and address of his current employer may be provided to the wife. However, if the husband’s account has become inactive, then information on the last entry made by his last known employer, and its business address may be provided to the wife in this case.
Third, it is also necessary to establish that the processing of personal information pursuant to the PIC’s or third party’s legitimate interest will not adversely affect the rights and freedoms of data subjects. In the determination of the balancing of rights and interests, it is important to recognize whether the data subject had reasonable expectation at the time and in the context of the collection of personal information that processing of this kind may occur (i.e., the disclosure of personal information to the requesting party/spouse of a member who is reportedly missing).7
As a PIC, Philhealth must assess the purpose and reasonableness of the disclosure to the third party (i.e., to disclose information which may be essential to locating her missing husband). This assessment includes whether or not disclosure of the spouse’s information may provide a means to discovering information leading to his discovery or disappearance. Locating a spouse who has been reportedly missing since 2015 constitutes as a legitimate interest of any spouse, especially if said spouse failed to disclose his last known whereabouts. Further, allowing a third-party access to personal information to pursue his or her own legitimate interest may also be considered a legitimate interest of Philhealth since the same is not unlawful or in violation of any rules or regulations.
It is also worth noting that although this may not be one of the situations contemplated by the data subject during Philhealth’s collection of personal information, it may nonetheless be reasonable in view of the extraordinary circumstances. In addition, reasonableness may also be determined from the designation of a beneficiary of Philhealth benefits in case of the data subject’s death, incapacity or unavailability. In the current matter, the wife was able to present documents to establish her identity and relationship with the data subject and the reason for the request. For a more comprehensive discussion on reasonable expectation, kindly refer to NPC Case No. 17-047.8
General Data Privacy Principles; Proportionality; Reasonable and Appropriate Security Measures
While the disclosure of personal information is supported by a lawful basis, Philhealth (as a PIC) still has the obligation to comply with the other requirements of the DPA. Personal information must be processed lawfully and fairly and with strict adherence to the basic data privacy principles of transparency, proportionality, and legitimate purpose.
Of particular significance in the current scenario, is the principle of proportionality. To reiterate, Philhealth must only disclose such personal information that is adequate and necessary for the third party’s declared purpose.
In addition, PICs must also ensure the protection of the disclosed personal information and uphold the rights of data subjects through the implementation of reasonable and appropriate physical, organizational and technical security measures. For instance, Philhealth may create policies in dealing with requests of this nature and require the submission of documents necessary to prove one’s relationship with a certain member. Philhealth may also require the requesting party to sign an undertaking stating that the personal information requested shall only be used for a specific purpose. Philhealth should also consider how the processing or disclosure will be done (e.g., electronically or through a hard copy personally given to the requesting party).
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
Please be guided accordingly.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office
Footnotes
-
Data Privacy Act of 2012, § 12. ↩
-
National Privacy Commission, NPC Advisory Opinion No. 2022-005 (24 February 2022) citing United Kingdom Information Commissioner’s Office (ICO), “What is the ‘Legitimate Interests’ basis?”, available at https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ [last accessed on 18 January 2022] ↩
-
Ibid. ↩
-
National Privacy Commission, NPC Advisory Opinion No. 2020-039 (30 October 2020) citing United Kingdom Information Commissioner’s Office (ICO), “What is the ‘Legitimate Interests’ basis”, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/. ↩
-
Ibid. ↩
-
National Privacy Commission, MAF v. Shopee Philippines, Inc. NPC 21-167 (Sept. 22, 2022). ↩
-
EU GDPR, Recital 49. ↩
-
NPC 17-047, JV v. JR, https://www.privacy.gov.ph/wp-content/uploads/2020/10/CID-17-047-JV-v.-JR-Decision-PSD-10Aug2020.pdf [last accessed on 4 August 2022]. ↩