Connect with us
Click me!

Business

Data protection in time of COVID-19

Companies should only disclose such personal information as may be necessary to enable other employees to assess their health and potential exposure.

Avatar

Published

on

On contact tracing — persons under investigation

1. Does an employer need to ask for the consent of an employee who is a person under investigation (PUI) for COVID-19 when disclosing the PUI’s data to the person/s that such PUI have had contact with during the time of suspected infection?

Contact tracing should be done only upon the authority, guidance, and instruction of the Department of Health (DoH).

See the DoH Interim Guidelines on Contact Tracing available at this link: https://www.doh.gov.ph/sites/default/files/health-update/DC2020-0048-Reiteration-of-DM2020-0068-Interim-Guidelines-on-Contact-Tracing-for-Confirmed-2019-nCoV-ARD-Cases.pdf.

2. If a PUI has been proven positive of the COVID-19, can I freely disclose the identity to everyone within the company? The purpose is to inform those who may have had contact with the person so they can be tested and monitored as well.

The company may make the necessary notices internally without disclosing the identity of the person who is COVID-19 positive. The proper authority that does contact tracing is the DoH. It follows that disclosure of the identity of the patient shall be limited to the DoH personnel only, following the PUM/PUI protocol.

Personal information controllers are advised to approach any uncertainty as to the collection and disclosure of personal data of PUI, PUM and confirmed cases of COVID-19 in a reasonable manner.

Companies should only disclose such personal information as may be necessary to enable other employees to assess their health and potential exposure. Here, revealing the identity of the COVID-19 patient offers no benefit to the patient nor any advantage to other members of the company in assessing their exposure. If someone in your company tests positive, protocols and guidelines for PUM/PUI would apply and, generally, would cover everyone.

3. Can our company issue a press release or statement relating to our employee, who is a confirmed case for COVID-19?

Announcements should come from the DoH or other appropriate government agencies. The government should only make the official announcement regarding COVID-19 cases in the country. Anyone with relevant information should immediately relay it to the DoH for proper handling.

4. Can the DoH release names of PUI that are purposely evading or escaping mandatory quarantine, as well as those who deliberately lied about their medical and travel history to protect the public and apprise them of the possible threat of contamination?

The DoH needs to consider the following factors when assessing the disclosure of patient information to the public:

• The potential harm or distress to the patient arising from the disclosure.

• The potential damage to trust in doctors and health institutions in general and weigh it versus:

• The potential harm to the public if the information is not disclosed.

• The potential benefits to individuals and society arising from the release of information.

Apart from the Data Privacy Act of 2012, there is another law relevant to this matter. Republic Act 11332 or the Mandatory Reporting of Notifiable Diseases and Health Events of Public Health Concern Act penalizes non-cooperation of the persons identified as having a notifiable disease or affected by the health event of public concern.

The DoH makes the crucial call on what information is necessary for release to the public, taking into consideration the state of public health emergency and the overall strategy to contain the virus as directed by the Inter-Agency Task Force.

5. Can the DoH publicly disclose more detailed information of the frequented locations of the persons positive for COVID-19 to inform the public better and help prevent the transmission of the virus?

Yes. The DoH can provide information about the frequented locations of the persons positive for COVID-19 without giving details that would identify individuals.

***

Personal information controllers are advised to approach any uncertainty as to the collection and disclosure of personal data of PUI, PUM and confirmed cases of COVID-19 in a reasonable manner.

We trust that all shall be socially responsible. False information about COVID-19 may create more problems. Please refrain from sharing unverified reports and fake news to avoid undue stress and worry due to misinformation.

Finally, we emphasize that the DoH is the primary competent authority handling our country’s response to the COVID-19. We support our Health department, the Inter-Agency Task Force for the Management of Emerging Infectious Disease, health front liners, emergency responders, law enforcement officers and other persons undertaking our country’s response and measures to curtail and eliminate the COVID-19 threat.

For questions or concerns, you may visit our website at https://www.privacy.gov.ph/ and may reach us at info@privacy.gov.ph.

Advertisement
Click to comment
Advertisement
Advertisement
Advertisement