There are people who are lobbying for the public disclosure of the name/identity of the covid19 patient/person under investigation (PUI)/person under monitoring (PUM) for the reason of public health/safety concern. In evaluating the validity of this proposition, the questions, answers, and illustrations below will help us better understand the relevance/irrelevance of the said disclosure to prevent the spread of virus.
- If the name/identity of covid19 patient/PUI/PUM is disclosed to the public, what will be its use to you if you don’t know personally or if you can’t recall the person identified in the disclosure?
For the sake of illustration, let us say the information of covid19 patient/PUI/PUM below is publicly disclosed online, will you find it relevant? Do all of us need it?
| Name/Photo | Itinerary |
| Juan Zamora | Passenger of Flight no. 123 from Manila to Davao (with date and time) |
| Efren Boon | Passenger of a Cruise Ship (with date and time) |
| Conan Attinenza | Lined up during the checkpoint at the borders of Bulacan and Caloocan, then took an MRT from North Avenue to Cubao (with date and time) |
| Janice Co | Resident of Davao who attended a City concert (with date and time) |
| Maira Lu | Bank employee in Cebu who took a bus and jeep going to work (with date and time) |
If you have the same itinerary with the persons identified above, but you don’t personally know them or you can’t even recall their faces, will their identity be useful to you?
If you don’t have direct contact with those persons, what is the value of disclosing said information to you? Will you conduct your own case investigation, patient interview, or contact tracing?
If you were not a passenger of the above flight, ship, public transportation or if you have not been in Davao or Cebu, do you need to know the names of the persons identified above? Are you a person of interest?
What data therefore is more important? The identity of the covid19 patient/PUI/PUM or the itinerary?
The disclosure of the name or photo of covid19 patient/PUI/PUM to the public is therefore less important, irrelevant and not proportional. The disclosure of itinerary of the covid19 patient/PUI/PUM which is now being done by the government should be sufficient for us to do self-quarantine and other preventive measures.
2. What is the government doing to trace covid19 patient/PUI/PUM?
The Mandatory Reporting of Notifiable Diseases and Health Events of Public Health Concern Act (RA 11332) provides that all public and private physicians, allied medical personnel, professional societies, hospitals, clinics, health facilities, laboratories, institutions, workplaces, schools, prisons, ports, airports, establishments, communities, other government agencies, and NGOs are required to accurately and immediately report notifiable diseases and health events of public health concern as issued by the DOH.
The government conducts epidemic/outbreak and epidemiologic investigations, case investigations, patient interviews, review of medical records, contact tracing, collection, storage, transport and testing of samples and specimen, risk assessments, laboratory investigation, population surveys, and environmental investigation.
The government regularly issues relevant data to persons of interest who can undertake effective prevention and control activities.
3. Why is our government officials too protective of the privacy of the covid19 patient/PUI/PUM?
It’s because unauthorized disclosure is prohibited and punishable under these laws:
- Data Privacy Act (RA 10173),
- Mandatory Reporting of Notifiable Diseases and Health Events of Public Health Concern Act (RA 11332)
| RA 10173 | RA 11332 |
| Section 32. Unauthorized Disclosure. –(a) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party personal information not covered by the immediately preceding section without the consent of the data subject, shall he subject to imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00). (b) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party sensitive personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from three (3) years to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00). | Section 9. Prohibited Acts. -The following shall be prohibited under this Act:(a) Unauthorized disclosure of private and confidential information pertaining to a patient’s medical condition or treatment; Section 10. Penalties. -Any person or entity found to have violated Section 9 of this Act shall be penalized with a fine of not less than Twenty thousand pesos (₱20,000.00) but not more than Fifty thousand pesos (₱50,000.00) or imprisonment of not less than one (1) month but not more than six (6) months, or both such fine and imprisonment, at the discretion of the proper court. The Professional Regulation Commission shall have the authority to suspend or revoke the license to practice of any medical professional for any violation of this Act. The Civil Service Commission shall have the authority to suspend or revoke the civil service eligibility of a public servant who is in violation of this Act. If the offense is committed by a public or private health facility, institution, agency, corporation, school, or other juridical entity duly organized in accordance with law, the chief executive officer, president, general manager, or such other officer in charge shall be held liable. In addition, the business permit and license to operate of the concerned facility, institution, agency, corporation, school, or legal entity shall be cancelled. |
- 4. Can there be authorized disclosures?
Yes, for cases mentioned below:
| RA 10173 | RA 11332 |
| a. Data sharing shall be allowed when it is expressly authorized by law: Provided, that there are adequate safeguards for data privacy and security, and processing adheres to principle of transparency, legitimate purpose and proportionality. b. Data Sharing shall be allowed in the private sector if the data subject consents to data sharing. In this case, it is important that the data subject shall be provided with the following information prior to collection or before data is shared: (a) Identity of the personal information controllers or personal information processors that will be given access to the personal data; (b) Purpose of data sharing; (c) Categories of personal data concerned; (d) Intended recipients or categories of recipients of the personal data; (e) Existence of the rights of data subjects, including the right to access and correction, and the right to object; (f) Other information that would sufficiently notify the data subject of the nature and extent of data sharing and the manner of processing. c. Data collected from parties other than the data subject for purpose of research shall be allowed when the personal data is publicly available, or has the consent of the data subject for purpose of research. d. Data sharing between government agencies for the purpose of a public function or provision of a public service shall be covered a data sharing agreement. | Disclosure of confidential information will not be considered violation of this Act if the disclosure was made to comply with a legal order issued by a court of law with competent jurisdiction. |
- 5. What can we do now to avoid being infected?
Follow the health directives. Stay at home and practice social distancing. Wash your hands, use alcohol, and avoid touching your mouth, eyes, and nose. Exercise and take nutritious food.
Whether or not you know the identity of the covid19 patient/PUI/PUM, if you are following above directives, you can prevent the spread of the virus.
As such, in view of the foregoing, except for cases allowed by law, the disclosure of the name/identity of the covid19 patient/PUI/PUM does not equate to prevention of the spread of virus.
ADM PRIVACY WEBSITE 