On 26 April 2019, Republic Act 11332 or the “Mandatory

Reporting of Notifiable Diseases and Health Events of Public

Health Concern Act” was promulgated. The new law aims to
protect people from public health threats through the efficient
and effective disease surveillance of diseases of public health
concern. Through this timely and accurate information
dissemination of preventive measures and epidemic responses
in the country will be ensured. While the new law aims to
protect the public through surveillance and mandatory
reporting of notifiable diseases and health events of public
concern, it does not, in any way, violate any of our existing
laws which prohibits processing of sensitive personal
information.

Sensitive personal information as defined by Republic Act

10173 commonly known as the “Data Privacy Act of 2012”
refers to any personal information about an individual’s race,
ethnic origin, marital status, age, color, and religious,
philosophical or political affiliations. It may also refer to
personal information on individual’s health, education, genetic
or sexual life of a person, or to any proceeding for any offense
committed or alleged to have been committed by such person,
the disposal of such proceedings, or the sentence of any court
in such proceedings. It also include information issued by
government agencies peculiar to an individual, such as social
security number or information marked as classified by the
executive or the Congress. The aforementioned law generally
prohibits processing of these information but also provided
certain circumstances where such information may be
processed.

Andrew B. Lastrollo
 The processing of sensitive personal information can only
be done if any of the following conditions exists: if the subject
individual gives his or her consent; if there is an existing law
that requires processing of such information protection and
the consent of the subject individual is not required, provided
the enactment guarantees the protection of such information;
if it is necessary to protect the life and health of the subject
individual or other person but consent cannot be legally or
physically given by the subject individual; if it is necessary for
purposes of medical treatment and the processing is carried
out by a medical practitioner or a medical treatment
institution, and an adequate level of protection of personal
information is ensured; lastly, if the processing concerns such
personal information as is necessary for the protection of
lawful rights and interests of natural or legal persons in court
proceedings, or the establishment, exercise or defense of legal
claims, or when provided to government or public authority it.

Under Republic Act 11332, the Department of Health and

its local counterparts are mandated to implement a
surveillance system and mandatory reporting procedures for
notifiable disease and health events. Needless to say, such
surveillance and mandatory reporting procedures processes
sensitive personal information about an individual’s health. It
may also process other information about the individual such
race, ethnic origin, marital status, age, color, education,
genetic or sexual life because such data are always included in
someone’s health portfolio. The processing of these
information is not prohibited under “Data Privacy Act of 2012”

Andrew B. Lastrollo
because this is one of the circumstances where sensitive
personal information can be processed.

Republic Act 11332 is an existing law requiring such

information and guarantees the protection of the sensitive
personal information by providing guidelines and regulations
that should be followed in processing such information. It also
provided penalties against any person or entities who
committed prohibited acts expressly enumerated under
Republic Act 11332 such as: unauthorized disclosure of
private and confidential information pertaining to a patient’s
medical condition or treatment; and tampering of records or
intentionally providing misinformation.

Furthermore, it is expressly provided for in the Republic

Act 11332 that data collection, analysis, and the
dissemination of information from official disease surveillance
and response systems can only be done by authorized
personnel from the Department of Health and its local
counterparts and may only be used for public health concern
purposes only; thus, should be exempted in the provision of
Data Privacy Act on accessibility of data.

The primary objective of Republic Act is to ensure that

public health authorities have the statutory and regulatory
authority in dealing with epidemics and outbreaks. While it is
always a priority to respect to the fullest extent possible, the
rights of people to liberty, bodily integrity, and privacy, a
balance must be achieve while maintaining and preserving
public health and security.

Andrew B. Lastrollo