The National Privacy Commission (NPC) has discouraged the collection of signatures and other unnecessary personal information for contact tracing forms.
The NPC made the statement after reports said that private establishments and government agencies collect signatures and other personal data that are immaterial in moving contact tracing efforts forward.
“In every aspect of the data processing cycle, activities must observe the basic principles of transparency, legitimate purpose and proportionality,” lawyer Stephen John Duma of the NPC Compliance and Monitoring Division said.
The NPC reminded data protection officers (DPOs) to update their privacy notice and manual and re-do the privacy impact assessment against the backdrop of the health crisis.
Duma said the DPO's responsibility is providing a clear and accessible privacy notice that gives data subjects sufficient information on data collection, processing, storage, and disposal activities to weigh out risks in giving their personal data.
“Detailed information on the relevant personal data flows must be provided. You should have a clear way of employing these activities and show in your privacy notices that they have adequate organizational, physical, and technical capacity to protect data from collection to disposal,” Duma said.
He noted the importance of including the DPO’s name and contact information in the privacy notices in order to enlighten data subjects of the establishment’s data protection measures.
The NPC reiterated its call to business establishments to work towards complying with data privacy standards.
“The commission is more than willing to provide businesses and agencies the required guidance in formulating policies and implementing measures that capture the privacy and protection needs of their data subjects,” Duma added.