Data Collection and Disclosure Amid COVID-19 Public Health Emergency

On monitoring of persons entering offices/buildings:

• Building or office administrators may collect personal data (name, contact details, and travel history) of all persons who will be entering such building or office but only as may be necessary with what is required by the Department of Health (DOH).
• While no consent form is needed, it is advisable however to provide a privacy notice informing the visitors of the purpose and basis of the collection of such personal data. Once collected, reasonable and appropriate safeguards must ensure the security of the forms and personal data contained therein.

On collection of personal data of employees:

• Employers may ask employees to submit declaration forms that provide personal data – for instance, whether they have traveled to or been in close contact with persons who have gone to regions affected by COVID-19, whether they are experiencing symptoms, etc.
• Once collected, reasonable and appropriate safeguards should ensure the security of the forms and personal data contained therein.
• Disclosure of employee data in this scenario should be limited to the DOH and other appropriate government agencies and following all existing protocols on the matter.
• Since the basis for the disclosure is not consent, ​but rather the DOH mandate due to the declared public health emergency, then no consent form is needed. Instead, a privacy notice should be put in place informing employees of the purpose of collection.

On contact tracing of Persons Under Monitoring (PUM) or Persons Under Investigation (PUI):

• Contact tracing should be done only upon the authority, guidance, and instruction of the DOH.
• If a PUM/PUI has been proven positive of the COVID-19, the company may make the necessary notices internally without disclosing the identity of the person who is COVID-19 positive. Companies should only disclose such personal information as may be necessary to enable other employees to assess their health and potential exposure. Revealing the identity of the COVID-19 patient offers no benefit to the patient nor any advantage to other members of the company in assessing their exposure. If someone in your company tests positive, protocols and guidelines for PUMs/PUIs would apply and, generally, would cover everyone.
• The disclosure of the identity of the patient shall be limited to the DOH personnel only, following the PUM/PUI protocol.