NPC Issuance Wiki

NPC Advisory Opinion No. 2023-020 — Use of Breath Analyzer on Employees and Service Providers

Issued Advisory Opinion

Official opinion tags

Text

05 October 2023

Re: USE OF BREATH ANALYZER ON EMPLOYEES AND SERVICE PROVIDERS.

Dear [Redacted], We respond to your request for an Advisory Opinion regarding the proposed implementation by Entrego Express Corporation (Entrego) of the use of breath analyzers as part of its business operations process.

Discussion

You state that Entrego is a duly-licensed fulfillment and solutions corporation organized under the laws of the Republic of the Philippines. As part of its efforts to comply with Republic Act No. 10586, otherwise known as the Anti-Drunk and Drugged Act of 2013 (ADDA),1 Entrego intends to use breath analyzers in the course of the daily deployment of both employee and outsourced drivers (collectively, “data subjects”). The purpose is to prevent vehicular accidents by ensuring that the data subjects are in a good physical and mental state without the influence of alcohol.

Thus, you ask whether the use of breath analyzer falls within the scope of the Data Privacy Act of 2012 (DPA).2

In particular, you seek guidance on the following:

  1. Whether or not the collection and processing of personal data through the intended implementation of breath analyzers is allowed under the confines of the DPA, its Implementing Rules and Regulations (IRR), and other issuances of the NPC;
  2. Whether or not collecting and processing of personal data through the intended use of breath analyzers involves sensitive personal information;
  3. Whether or not the collection and processing through the intended use of breath analyzers fall within any of the criteria for lawful processing; and
  4. Whether or not additional consent from the respective drivers would be necessary to implement the use of breath analyzers.

Scope of the DPA; sensitive personal information; health data

The DPA applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing.3 The DPA treats certain types of personal information as sensitive personal information, as the unlawful processing thereof may lead to the discrimination of the data subject involved. Health data is among those classified as sensitive personal information.4

While the DPA does not define health data, reference could be made to the NPC and Department of Health (DOH) Joint Memorandum Circular (JMC) No. 2020-0002.5 Provision IV, paragraph 11 of JMC 2020-0002 provides that personal health information refers to the individual’s past, present or future physical or mental health or condition, including demographic data, diagnosis and management, medication history, health financing record, cost of services and any other information related to the individual’s total well-being.6

As you explained in your letter, a breath analyzer is an equipment which can determine the blood alcohol concentration level of a person through testing of his breath; while blood alcohol concentration is the measure of the amount of alcohol in a person’s blood, as defined in Section 3 (b) and (c) of the ADDA, respectively.

From the definition, a breath analyzer determines an individual’s present physical condition, i.e., level of alcohol intoxication. Thus, we confirm that use of the breath analyzer entails the processing of the sensitive personal data information of the data subject. Strict compliance with the relevant provisions of the DPA, its IRR, and other issuances of the NPC should therefore be observed.

Generally, the processing of sensitive personal information is prohibited unless allowed under the circumstances enumerated in Section 13 of the DPA.

It is worth noting that given the nature of the relationship between Entrego and the data subjects, consent is not the most appropriate lawful basis for processing. In an employer-employee relationship, “consent is highly unlikely to be a legal basis for data processing at work, unless employees can refuse without adverse consequence” and that “employees are seldom in a position to freely give, refuse or revoke consent, given the dependency that results from the employer/employee relationship.”7

Consent is defined as any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information. In an employment relationship, there would be concerns as to whether consent was indeed freely given by the employee. Hence, in the scenario presented, a request by Entrego upon the data subjects for additional consent for the use of breathalyzers would not be an appropriate criteria in lawfully processing their sensitive personal information.

Entrego cannot likewise rely on legitimate interest, considering that sensitive personal information is involved. Legitimate interest of Entrego as the Personal Information Controller (PIC) is not one of the allowable instances cited under Sec. 13 of the DPA where sensitive personal information of data subjects may be lawfully processed.

Nevertheless, Section 13 (f) of the DPA allows the processing of sensitive personal information when such processing is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise, or defense of legal claims.

In the current matter, Entrego intends to implement the use of breath analyzers to test the blood alcohol content of the data subjects to ensure that no driver is under the influence of alcohol. This intervention is in line with its obligation under Section 13 of the ADDA, viz:

Section 13. Direct Liability of Operator and/or Owner of the Offending Vehicle. – The owner and/or operator of the vehicle driven by the offender shall be directly and principally held liable together with the offender for the fine and the award against the offender for civil damages unless he or she is able to convincingly prove that he or she has exercised extraordinary diligence in the selection and supervision of his or her drivers in general and the offending driver in particular.

This section shall principally apply to the owners and/or operators of public utility vehicles and commercial vehicles such as delivery vans, cargo trucks, container trucks, school and company buses, hotel transports, cars or vans for rent, taxi cabs, and the like. (Emphasis supplied).

Entrego’s legitimate purpose of having its drivers undergo a breath analyzer falls within the meaning of processing sensitive personal information to establish, exercise, or defend legal claims. We note that, although there is no actual or expected legal claim at the time the breath analyzers are administered, the purpose is to establish that Entrego is exercising extraordinary diligence in the supervision of its drivers as required by the ADDA, and to defend against any potential claims in the event any of its drivers become involved in a vehicular accident.

Privacy notice

We highly suggest that Entrego provide a Privacy Notice to the drivers that enumerates the nature, purpose, and extent of the processing of their personal data including, among others, the risks and safeguards involved. It should also contain provisions relating to the retention period and secure disposal of the personal data collected.

In drafting the Privacy Notice, Entrego should also consider the use of plain and simple language to inform their drivers of how exactly their data will be used and the consequences of undergoing and refusing to undergo breath analysis.

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished to us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

For your reference.

Very truly yours,

(Sgd.) FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office

Footnotes

  1. An Act Penalizing Persons Driving Under the Influence of Alcohol, Dangerous Drugs, and Similar Substances, and for Other Purposes [Anti-Drunk and Drugged Driving Act of 2013], Republic Act No. 10586 (2013). ↩

  2. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  3. Id. § 4. ↩

  4. Id. § 3 (l). ↩

  5. National Privacy Commission and Department of Health, Privacy Guidelines on the Processing and Disclosure of COVID-19 Related Data for Disease Surveillance and Response, Joint Memorandum Circular No. 2020-0002 [NPC-DOH Joint Memorandum Circular 2020-002] (April 24, 2020). ↩

  6. Id. § IV (11). ↩

  7. ARTICLE 29 DATA PROTECTION WORKING PARTY, Opinion 2/2017 on data processing at work, available at https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=610169 ↩

Backlinks

  • No backlinks found