Data Privacy

Data Collection and Disclosure Amid COVID-19 Public Health Emergency

Updated as of 01 May 2020

“Data protection and privacy should not hinder the government from collecting, using, and sharing personal information during this time of public health emergency.”

In its Public Health Emergency (PHE) Bulletin No. 3 released on 19 March 2020, the National Privacy Commission (NPC) reminded the public to collect what is necessary and disclose only to the proper authority:

On monitoring of persons entering offices/buildings:

  • Building or office administrators may collect personal data (name, contact details, and travel history) of all persons who will be entering such building or office but only as may be necessary with what is required by the Department of Health (DOH).
  • While no consent form is needed, it is advisable however to provide a privacy notice informing the visitors of the purpose and basis of the collection of such personal data. Once collected, reasonable and appropriate safeguards must ensure the security of the forms and personal data contained therein.

On collection of personal data of employees:

  • Employers may ask employees to submit declaration forms that provide personal data – for instance, whether they have traveled to or been in close contact with persons who have gone to regions affected by COVID-19, whether they are experiencing symptoms, etc.
  • Once collected, reasonable and appropriate safeguards should ensure the security of the forms and personal data contained therein.
  • Disclosure of employee data in this scenario should be limited to the DOH and other appropriate government agencies and following all existing protocols on the matter.
  • Since the basis for the disclosure is not consent, ​but rather the DOH mandate due to the declared public health emergency, then no consent form is needed. Instead, a privacy notice should be put in place informing employees of the purpose of collection.

On contact tracing of Persons Under Monitoring (PUM) or Persons Under Investigation (PUI):

  • Contact tracing should be done only upon the authority, guidance, and instruction of the DOH.
  • If a PUM/PUI has been proven positive of the COVID-19, the company may make the necessary notices internally without disclosing the identity of the person who is COVID-19 positive. Companies should only disclose such personal information as may be necessary to enable other employees to assess their health and potential exposure. Revealing the identity of the COVID-19 patient offers no benefit to the patient nor any advantage to other members of the company in assessing their exposure. If someone in your company tests positive, protocols and guidelines for PUMs/PUIs would apply and, generally, would cover everyone.
  • The disclosure of the identity of the patient shall be limited to the DOH personnel only, following the PUM/PUI protocol.

The DOH is the primary competent authority handling the country’s response to the COVID-19. Thus, announcements (such as press releases o​r statements relating to an employee or individual who is a confirmed case for COVID-19) should come only from the DOH or other appropriate government agencies. Anyone with relevant information should immediately relay it to the DOH for proper handling.

Click here to read the entire text of NPC PHE Bulletin No. 3.

This article has been updated by the "Data Privacy Rights Remain in Effect Despite COVID-19 Crisis".

Disclaimer: The information in this website is provided for general informational purposes only. No information contained in this post should be construed as legal advice from Platon Martinez or the individual author, nor is it intended to be a substitute for legal counsel on any subject matter. No reader of this post should act or refrain from acting on the basis of any information included in, or accessible through this post without seeking the appropriate legal or other professional advice on the particular facts and circumstances.