THE National Privacy Commission (NPC) has warned companies against disclosing the identities of employees under investigation or confirmed positive for the new coronavirus disease 2019 (COVID-19).
In an information sheet released to the press on Thursday, the commission said companies can collect employee data, but added that companies may only collect what is necessary.
“Once collected, reasonable and appropriate safeguards should ensure the security of the forms and personal data contained therein,” it said.
Employers may collect data elements such as name, contact details, and travel history, only as needed by the Department of Health (DoH) for contact tracing. NPC encourages companies to coordinate with the DoH, and to give employees’ privacy notices informing them of the purpose of the data collection. It said contact tracing should be done only upon the authority, guidance, and instruction of the DoH.
Companies should only disclose personal data to the DoH and other relevant agencies, NPC said, adding that announcements to the public should come from the DoH instead of company press releases. The commission added that companies may make internal notices that an employee has been tested positive for COVID-19, but should not disclose the identity of the patient except to DoH personnel.
“Revealing the identity of the COVID-19 patient offers no benefit to the patient nor any advantage to other members of the company in assessing their exposure,” NPC said.
NPC said that the DoH should weigh potential harm to the patient and to trust in medical institutions if information is disclosed against potential harm to the public if information is not released. — Jenina P. Ibañez
