NPC Releases Advisory Opinion on the Disclosure of List of Frontline Workers Affected by COVID-19
The National Privacy Commission (NPC) released Advisory Opinion No. 2021-042 on the disclosure of frontline workers affected by COVID-19.
In the advisory opinion, the Department of Health (DOG) clarified whether the disclosure of information to the Filipino International Staff of the Asian Development Bank (ADB Fil-IS) for the purpose of raising funds to help the affected workers through the ADB’s Alay Dangal sa Bayaning Lumalaban sa COVID-19 fund drive was allowed under the Data Privacy Act of 2012 (DPA).
The NPC stated that the list of names of COVID-19 patients are considered as sensitive personal information under the DPA as it pertains to the health information of the data subjects. As a result, the processing of this kind of information must comply with Section 13 of the DPA and must have a distinct lawful basis apart from the processing done by the DOH itself as the country’s health authority.
Under Section 13 of the DPA, sensitive personal information may only be processed if it falls under any of the criteria for processing. Hence, a data subject must provide their consent for the specific purpose prior to the processing. Despite the purpose of processing, the NPC noted that the processing of sensitive personal information must still comply with the DPA.
As the personal information controller (PIC), the DOH must obtain the consent of those affected frontline workers or their heirs prior to the disclosure to the ADB Fil-IS. Additionally, the DOH must also limit the use and disclosure of health information to the specified purpose of collection.
With respect to the purpose of fundraising, the Commission also stated that the DOH may instead provide statistical data rather than the personal information of frontline workers. Statistical data implies that the data is free from any factors which will enable others to reasonably identify the data subjects.
The full advisory opinion can be found here.