NPC reminds establishments to secure personal data of customers to be used for contact tracing

The National Privacy Commission (NPC) on Sunday reminded business establishments to secure the details provided by customers to them as part of their contact tracing measures amid the ongoing threat of COVID-19.

NPC Privacy Commissioner and Chairman Raymund Liboro said customers are responsible for giving the right personal information which may be used by authorities for contact tracing purposes, and so are business establishments in making sure that they are kept safe.

"Sa mga business establishment, dapat ang babalikan lang din natin ay 'yung mga prinsipyo natin on protecting privacy," he said in an interview on Dobol B sa News TV.

"Collect what is necessary but disclose only to the proper authorities. So 'yun ang kailangan nating disiplina sa panahong ito," he added.

Many businesses like restaurants, salons, and even banks have been asking their customers to give their names, addresses, and contact numbers before going inside their establishments for contact tracing purposes.

Liboro said these establishments should be transparent to their customers regarding the use of such information.

"Mahalaga din doon ay isinasaad kung paano nila sine-secure ang mga data na ito, at kung magkakaroon sila ng tanong ay hanapin 'yung data protection officer," he said.

"So itong mga collection ng data, siguraduhin na 'yung policy natin sa tindahan ay tama. So halimbawa, 'yung retention, gaano katagal nga dapat ito ilagak," he added.

Liboro said these personal data should never be repurposed, such as including them in the establishment's marketing list and allowing other personnel to handle them.

"Dapat nagtatalaga lamang ng isang officer sa establishment kung ano ang magiging disposition ng mga listahang ito. Hindi puwedeng i-access ninuman," he said.

Liboro said the Inter-Agency Task Force for the Management of Emerging Infectious Diseases is already reviewing the personal information that customers are required to disclose following reports of allegedly unauthorized use of these data.

Establishments that will be found repurposing these personal information may be slapped with a penalty of P500,000 to P2 million and even jail sentence for the management under the law, he added.

Liboro said customers who may have complaints about the unauthorized use of their personal information may seek help from the data privacy officer of the business establishment or from the NPC itself by sending an email to complaints@privacy.gov.ph.

"Again, ang panawagan ko sa mga establishment, may mga panahon ngayon na ang mga tao natin ay mga pag-aalinlangan. Kailangan mapawi yan lalo na't kapag nagkokolekta sila ng impormasyon. Siguraduhin natin sa mga tao na makakaasa sila na hindi mapapasama ang kanilang mga personal data," he added. —Erwin Colcol/KG, GMA News