The National Privacy Commission has asked the Department of Health to be circumspect in sharing sensitive personal information of individuals, saying it should only do so if it deems that such sharing or disclosure is authorized under law, adheres to data privacy principles, and there are reasonable and appropriate security measures in place to protect the data.
The commission issued an advisory opinion dated Feb. 26, 2018 in response to the formal request made by the DoH.
Privacy Commissioner Raymund Enriquez Liboro said the disclosure to another government agency or private entity of a copy of the DoH master list of individuals vaccinated with Dengvaxia must be “provided for by existing laws and regulations or a data subject has given his or her consent.”
“We emphasize that the government is one of the biggest repositories of the personal data of citizens. The government or its agencies, however, do not have the blanket authority to access or use the information about private individuals under the custody of another agency,” Liboro said.
The DoH Dengvaxia master list has recently been subject of access requests coming from the Public Attorney’s Office, some private organizations, and members of the media. The information contained in the list is considered as sensitive personal information, and relates to minors, which the NPC identifies as a vulnerable group of data subjects.
In the advisory opinion, Liboro said personal data provided to government or public authorities may be processed without consent when it is done pursuant to the particular agency’s constitutional or statutory mandate, and subject to the requirements of the Data Privacy Act of 2012.
In the case of the request by the PAO to obtain the DoH master list, this general rule does not apply. The agency, however, may be allowed access to the data of the specific victims it represents as their duly authorized legal counsel.
“Should the PAO be authorized as the legal representative of the minor data subjects, they may then be provided information on the particular data subject they are representing, subject to the presentation of proof of such authorization,” Liboro said.
As to the request of media and other private organizations, Liboro said the disclosure of statistical or aggregated data, without any personal or sensitive personal information, should suffice. Otherwise, the release of a copy of the master list in its raw version would be tantamount to an unwarranted invasion of personal privacy.
