Data Privacy Protection in Research Involving Human Participants: A Primer

With the Data Privacy Act of 2012, the Philippines has enacted its first comprehensive law on privacy protection. Patterned after the European Union’s Data Protection Directive (now superseded by the General Data Protection Regulation), the law penalizes the unauthorized processing of personal information.
The law’s impact on human-subjects research, however, remains ambiguous. While Section 3(j) of the law appears to give some leeway for “personal information processed for journalistic, artistic, literary or research purposes,” a closer reading of the law and other public articulations by the National Privacy Commission suggests that this is not a blanket exemption for research. Section 5(c) of the law’s Implementing Rules and Regulations, in particular, allows for such processing “subject to the requirements of applicable laws, regulations, or ethical standards.”
This Primer on Data Privacy Protection and Research Involving Human Participants seeks to serve as a baseline discussion on data privacy in research covering the main thematic areas of inquiry, namely: (1) Privacy Rights; (2) Principles of Data Privacy; (3) Contextual Issues; (4) Privacy and Welfare Protection in Research; and (5) Confidentiality and De-identification. It is primarily intended to address the needs of research ethics committees, Philippine research and higher education institutions, researchers, patient organizations, other stakeholders, and the general public. The Primer aims at aiding individuals and organizations in adhering to the ethical guidelines and standards of the National Privacy Commission (NPC) and the Philippine Health Research Ethics Board (PHREB). Likewise, this material may also serve as supplementary reading for those who wish to know the concepts and application of the Data Privacy Act in the context of research, especially health-related studies, in the Philippines.