Data Privacy Act remains despite COVID-19
National Privacy Commission says “No” to requests to waive privacy rights, disclosure of health status
MANILA – The provisions of the country’s Data Privacy Act of 2012 (DPA) will never be a hindrance to the government’s COVID-19 response.
In a statement released today, the NPC said despite the public health crisis after receiving calls to set aside existing laws on data privacy, the protection of privacy rights is identical with protecting lives.
The government agency said there are enough provisions in the law to allow contact tracing, treating patients, and addressing threats at the same time guaranteeing the privacy of COVID-19 positive patients, persons under investigation (PUIs) and persons under monitoring (PUMs).
Republic Act No. 11332, also known as An Act Providing Policies and Prescribing Procedures on Surveillance and Response to Notifiable Diseases, Epidemics, and health Events of Public Health Concern) dictates patients, PUIs, and PUMs to be fully transparent and truthful to the Department of Health (DOH), hospitals and other pertinent public authority on the personal data which include travel and medical history, among others, that are requested of them.
Such information will be material for health and local institutions to treat them and properly contain the spread of the infectious disease in a timely manner.
When they refuse to provide details or conceal required information, patients can be penalized with imprisonment and fines under Republic Act 11332.
The Department of Health (DOH) has formulated management protocols requiring every health institution to triage patients in emergency rooms according to their conditions. Accordingly, these protocols are in place and designed to keep health workers safe.
The National Privacy Commission said the DOH may share information with other authorized public authorities subject to limitations that the sharing is according to a public function or a public service, based on te constitutional or statutory mandate of the DOH and the other public authorities, strictly following set protocols and practices, ensuring the security of such shared information and upholding data subjects rights.
In the same statement, the NPC, regarding the sharing of medical information of individuals to private health institutions, said the DOH would be in the best position to determine if it is consistent with the provisions of R. A. 11332 and other applicable protocols in a pandemic.
Referring to the requests from the Integrated Bar of the Philippines, Philippine Medical Association, and Philippine College of Surgeons, the NPC said the statement was made in connection with the latter’s appeal for the release of “trusted and verified information during an “unfamiliar global pandemic.” The NPC explained it was never meant to support any request for thee voluntary waiver by COVID-19 patients, PUIs and PUMs on the confidentiality of their medical conditions.
“We remain firm in our stand that authorities and institutions should collect only what is necessary and share information only to the proper authority,” the statement said.
Regarding the call for patients, PUIs, and PUMs to share or consent to the sharing of personal data to the general public for contact tracing, the NPC said they affirm their stand that doing so “may not be as helpful” to contact tracing interventions as this can only induce fear among these individuals due to the multiple reports about physical assaults, harassments, and discrimination endured by patients, PUIs, PUMs, and even health workers.
If a patient, PUI, or PUM himself or herself would want to disclose such information as what some public figures have cone, that is their personal choice.
The Data Privacy Act requires consent to be freely given, specific and an informed indication of will that they indeed agree to the public disclosure. Informed consent requires that these patients, PUIs or PUMs have been made aware of the risks that may arise from the disclosure, including the risk of being subjected to violent physical attacks as some COVID positive patients and their family members have experienced according to media accounts.
The NPC emphasized that even in times of calamity or a state of a public health emergency, rules on patient privacy, the confidentiality or health records, medical ethics, and data subjects’ rights remain in effect and upholding them equate to protecting lives. (Melo M. Acuña)
National Privacy Commissioner Raymond Liboro (NPC File Photo)