MANILA, Philippines — The National Privacy Commission (NPC) has called on agencies to only collect necessary information as the country fights to combat the coronavirus disease (COVID-19).
NPC made the remark as calls for patients to “waive” their privacy rights and to publicly disclose their health status emerge during the pandemic.
“In this war that is testing our humanity and values, it should be emphasized that protecting privacy rights is tantamount to protecting lives,” the NPC said in a statement.
The commission likewise clarified that its earlier statements were “never meant to support any request for the voluntary waiver by COVID-19 patients, PUIs and PUMs of the confidentiality of their medical condition.”
The Integrated Bar of the Philippines, Philippine Medical Association and Philippine College of Surgeons “quoted a recent bulletin of the National Privacy Commission” in their call for COVID-19 patients to waive the confidentiality of medical condition.
“We remain firm in our stand that authorities and institutions should collect only what is necessary and share information only to the proper authority,” NPC said.
In terms of sharing information with other authorized public authorities, the NPC said that the Department of Health (DOH) may do so subject to the limitations that the sharing is “pursuant to a public function or a public service, based on the constitutional or statutory mandate of the DOH and/or the other public authorities, strictly following set protocols and processes, ensuring the security of such shared information, and upholding data subjects’ rights.”
Sharing to the general public
NPC said that it is the personal choice of a patient, PUI, or PUM if they would like to disclose their information to the general public like what some public figures have done.
“We affirm our stand that doing so may not be as helpful to contact tracing interventions as this can only induce fear among these individuals given the multiple reports now on physical assaults, harassments, and discrimination endured by patients, PUIs, PUMs, and even health workers,” NPC said.
“These threats to their safety and security may discourage them to report their symptoms to public authorities, take confirmatory tests, and submit to treatments,” the commission added.
The Data Privacy Act of 2012, the NPC said: “requires consent to be freely given, specific, and an informed indication of will that they indeed agree to the public disclosure.”
“Informed consent requires that these patients, PUIs, or PUMs have been made aware of the risks that may arise from the disclosure, including the risk of being subjected to violent physical attacks as some COVID positive patients and their family members have experienced according to news reports,” NPC said.
Under the law
The commission argued that the Data Privacy Act of 2012’s provisions are enough for contact tracing, treating patients, and addressing threats while guaranteeing the privacy of COVID-19 positive patients, persons under investigation (PUIs), and persons under monitoring (PUMs).
“The Data Privacy Act of 2012 is not a hindrance to the COVID-19 response,” NPC said.
Likewise, NPC said that Republic Act No. 11332 or An Act Providing Policies and Prescribing Procedures on Surveillance and Response to Notifiable Diseases, Epidemics, and Health Events of Public Health Concern already mandates PUIs and PUMs to be “fully transparent and truthful to the Department of Health (DOH), our hospitals, and other pertinent public authority on the personal data requested from them.”
“Where they may falter in cooperation, as when they refuse to provide details or conceal required information, patients can be penalized with imprisonment and hefty fines under RA 11332,” NPC said.
“In addition, the DOH has set management protocols requiring every health institution to triage patients in emergency rooms according to their conditions. These protocols are in place and designed to keep our health workers safe,” the commission added.