MANILA, Philippines – As the number of coronavirus cases in the Philippines steadily increased from mid-March to late May, the National Privacy Commission (NPC) had been investigating 22 complaints of privacy breaches involving more than 150 COVID-19 patients, as well as suspected and probable cases.

In at least 7 of these cases, the breach was committed by people who had access to the patients’ information; in all others, the culprits were third parties, which included ordinary citizens.

Among those being investigated by the NPC was the leaked manifest of the medical evacuation plane that crashed at the Ninoy Aquino International Airport (NAIA) in late March, revealing the names of the passengers and crew. The screenshot of the flight manifest made the rounds on social media. 

Some of the data breaches were allegedly committed by health workers. In one instance, a hospital staff took a photo of the death certificate of a suspected COVID-19 patient and posted it in their department group chat. One of the members sent that photo to her own family group chat, from which her father forwarded it to another group chat. The photo of the death certificate ended up in several group chats.

These instances, and several more privacy breaches, highlight the difficulty in keeping patients’ personal details confidential when a pandemic happens in the age of rapid and easy transmission of information. (READ: Things to know before sharing others’ personal info amid coronavirus outbreak)

Lawyer Carlo Navarro was among the first, if not the first, Filipino to voluntarily identify himself as a COVID-19 patient. Navarro told Rappler he decided to do so because “na-breach na ang privacy ko (my privacy had been breached anyway).”

When Navarro tested positive for the virus on March 5, the Department of Health (DOH) told him that he couldn’t disclose to anyone, except his family, that he had the coronavirus disease.

Soon after, however, the DOH itself was sharing with the media bits and pieces of details about Patient No. 4. Navarro was not named publicly, but everything was pointing to him. Finally, he decided to identify himself, in part also to correct the false information that had been going around.

Cagayan incident

The situation becomes more complicated when local governments themselves end up disclosing patients’ identities in the name of contact-tracing efforts. 

One case the NPC is looking into, according to Privacy Commissioner Raymund Liboro, was the Cagayan provincial government’s disclosure of the names of the coronavirus positive residents on its official Facebook page.

The Cagayan provincial government in April began revealing on its official Facebook page the names COVID-19 patients. “Para mapabilis ang isasagawang contact-tracing (for faster contact tracing),” the provincial government said in its post.

The post said the decision to disclose the patients’ identities was based on an executive order of Governor Manuel Mamba. It wasn’t clear if the provincial government obtained the patients’ consent before disclosing their names on social media.

Rappler tried to get the side of Mamba and the Cagayan provincial government. They have yet to respond as of posting time.

Among those who were publicly identified was a nurse who had attended to returning overseas Filipino workers (OFWs). In an emotional post on Facebook, the nurse spoke about what could be deduced as being stigmatized after his name was revealed.

By May, Cagayan’s netizens persisted with their online protest. Among them was Michael Masirag, who had openly criticized the provincial government on his personal Facebook account.

“Firstly, it’s unfair for the patients. Secondly, it’s just illegal. And I don’t think that an office in the provincial government, or any government officer for that matter, can just do whatever it wants. Plus, they have readers who think that it’s right – that they can just disregard a constitutionally-protected right for their convenience,” Masirag told Rappler.

The Cagayan provincial government has since gone back to the old posts to edit out the patients’ names. It also labeled each post with a red stamp that read: “Contact-tracing accomplished.”

Asked if the provincial government removed the patients’ names because of the people’s protests, Masirag replied: “Because tapos na sila mag-contact tracing (Because they are done with their contact tracing).”

By June, the Cagayan provincial government was no longer publishing names of patients in its COVID-19 updates on Facebook, and has been releasing only limited information about them.

Policy dilemma

As soon as the Duterte administration declared a public health emergency in March, Liboro had issued guidelines, based on the Data Privacy Act, on the public disclosure of private information.

These included balancing the potential harm to the patient that a disclosure could bring and the potential damage to trust in medical workers and health institutions on the one hand, and the potential harm to the public if information is not disclosed and the potential benefits to individuals and the community if the information is shared on the other hand. 

“I think a good question to ask at this point is, what’s the context of contact tracing in different phases of the COVID pandemic?” Liboro told Rappler.

Before government announced on June 18 that it would be hiring around 50,000 contact tracers, Interior Undersecretary for Peace and Order Bernardo Florece Jr told Rappler that the Inter-Agency Task Force on the Management of Emerging Infectious Diseases (IATF-MEID) had put together a data sharing agreement (DSA) to which all contact tracers must adhere.

Florece explained that the DSA allows contact tracers from different agencies to access, with strict confidentiality, the information provided by confirmed and probable cases of COVID-19.

“They cannot divulge [the patient’s] information to the public,” Florece told Rappler by phone.

The agreement covers all members of contact tracing teams from the DOH, the Department of the Interior and Local Government, the Armed Forces of the Philippines, the Bureau of Fire Protection, and the Philippine National Police.

Contact tracing will always be intrusive, whether face-to-face or digital, no matter how important and effective it is as a measure to contain the virus transmission.

“It’s a policy dilemma,” said former Senator Antonio Trillanes IV, who now teaches public policy at the University of the Philippine National College of Public Administration and Governance.

Trillanes said public health and public safety have to be weighed against one’s individual rights. “It’s different when the argument is about national security. You could say that when national security is at stake, it is placed above our individual rights. But under these circumstances, I don’t see the need for the public disclosure of the patients’ identities,” he said.

“Contact tracing can be done confidentially, quietly,” he added.

Trillanes noted that one problem that IATF faced was that local government units were left to interpret on their own the national government’s policies on addressing the pandemic.

Not only that – the IATF, at times, issued confusing statements.

Earlier during the lockdown, the IATF said that all health facilities must first get the consent of patients before revealing their names in public. On April 12, then IATF spokesperson Cabinet Secretary Karlo Nograles said IATF Resolution No. 22 mandates the public disclosure of personal information of COVID-19 patients for faster contact tracing, only to clarify the next day that by “public disclosure,” the government meant patients must disclose to the DOH “accurate and honest information.”

Liboro noted that digital contact-tracing using apps can lead to doxing of individuals, much like what has happened in South Korea, whose approach to contain the outbreak was already considered among the gold standard in the world.

Local IT experts, including former acting information and communications technology secretary official Eliseo Rio Jr, have expressed misgivings over the Duterte administration-endorsed StaySafe. (READ: ‘Borderline spyware’: IT experts raise alarm over Duterte admin contact-tracing app)

Voluntary disclosure

It was also in early April when Baguio City began to reveal the names of its COVID-19 patients to help in contact-tracing. While Mayor Benjamin Magalong convinced and encouraged the patients to come out in the open, it was still voluntary on their part.

While not intended for contact-tracing but to inform and enlighten people about the coronavirus disease, a number of COVID-19 patients – from ordinary citizens to celebrities like Iza Calzado to journalists like Howie Severino – have shared their personal journey of surviving the respiratory disease. Many government officials have announced if they have gone on quarantine or have tested positive for the coronavirus.

For the past months, on its social media platforms, the DOH itself has been sharing stories mostly of health workers who survived the coronavirus disease. Called “Survivors Speak,” the feature has become an effective approach in educating the public about the pandemic, the DOH said.

“To date, the reception of the posts [was] overwhelmingly positive, with the majority of the public expressing their gratitude towards the survivors for inspiring courage and instilling discipline. Some continued to seek further advice. Rest assured that all of the pictures and statements from the survivors were taken with consent,” the DOH said.

The risk, however, remains.

Liboro noted that celebrities could be protected from discrimination precisely because of their status.

“Paano kapag hindi ka kilala? Ano ang relevance ng pangalan? (What if you’re not popular? What is the relevance of a name?)” Liboro said. “Knowing the identity [of the patient] provides a false sense of security.”

Florece added that he believed those who gave their consent to be publicly identified as COVID-19 patients or survivors wanted to help in efforts to control the outbreak.

He, however, still has some apprehensions himself: “Baka ma-violate kasi ang human rights (There might be violations of one’s human rights). The stigma against patients has always been the [concern].”

Fortunately, survivor Navarro said, he had received only messages of support and encouragement since he shared his COVID-19 story with the public, except for a lady who berated him for still going to Japan despite the outbreak already starting. “I just ignored her,” Navarro said.

Three months since he went public with his COVID-19 experience, Navarro still receives interview requests from international media outlets, while private companies have asked him to take part in their webinars about the coronavirus.

For Navarro, it’s important that he’s able to share his story. “Fear emanates from the lack of understanding about the virus and the disease,” he said. – Rappler.com