THE National Privacy Commission said companies must obtain the consent of vaccinated persons before gathering personal data specified in their vaccination cards for raffles, promotions, or discounts.
Privacy Commissioner Raymund E. Liboro said in a statement Tuesday that the vaccinated persons should “explicitly agree” to the collection and processing of their vaccine cards.
Mr. Liboro said consent will be valid if freely given, specific, informed, and an indication of will.
The commission recently issued a bulletin following reports on the collection of copies of COVID-19 vaccination cards by certain companies as a reward to vaccinated individuals. The cards contain information such as the person’s age, birthdate, and health information.
“While we laud these gestures as part of the ongoing initiative to encourage all eligible individuals to be vaccinated against COVID-19, we must also remind all personal information controllers (PICs) of the need to establish a lawful basis in the conduct of their respective personal data processing activities,” Mr. Liboro said.
“Consent must also be evidenced by written, electronic, or recorded means,” he added.
Mr. Liboro said a privacy notice must be provided to inform the vaccinated persons of the processing of their personal data and their rights as data subjects.
He also reminded PICs that the use of the vaccine card should only be for its intended purpose, which is to facilitate the distribution of rewards.
“It shall not be used for further processing, such as profiling, automated decision making, or for other purposes incompatible with the declared and specified purpose,” Mr. Liboro said.
The commission added that the health information of individuals should be secured, while PICs should implement measures to protect the copies of vaccine cards and should be held responsible for their custody if they are processed.
It added that the PICs must never post the vaccine cards on public platforms.
“Copies of the vaccine cards must be retained only for as long as necessary for the fulfillment of the purpose. These must be disposed of in a secure manner — hard copies must be shredded properly while soft copies must be deleted or overwritten in a manner that ensures that the stored copy of the vaccine cards are permanently and irreversibly destroyed and beyond recovery,” the commission said. — Revin Mikhael D. Ochave
