QR code for contact-tracing and the law

By Atty. Eduardo T. Reyes III

 

The adoption and implementation of the Quick Response (QR) code as a system of data-gathering to contact-trace persons infected (or at least reasonably suspected to be infected) with Covid-19 is gaining traction among local government units (LGUs) across the country.

For starters, the QR code is a bar-code that may be scanned by establishments to elicit as well as record data about the person entering the same.  LGUs are banking on this electronic data as a means of retracing the steps of the subject person so that he/ she may be reported to the proper government agencies for possible infection and to avoid spreading the virus.

Regardless of the feasibility or viability of the QR code system in containing Covid-19, it is an interesting question to ask: what is the legal basis for LGUs to gather data using the QR code system and their authority to deny entry into private establishments for lack of a QR code?

It has been reported that the LGUs are anchoring their implementation of the QR code system on REPUBLIC ACT No. 11332 which is entitled “An Act Providing Policies and Prescribing Procedures on Surveillance and Response to Notifiable Diseases, Epidemics, and Health Events of Public Health Concern, and Appropriating Funds Therefor, Repealing for the Purpose Act No. 3573, Otherwise Known as the “Law on Reporting of Communicable Diseases”.

Indeed, this law provides for the mechanisms on data-gathering during times of epidemics or pandemics and measures on how to contain the virus that caused the outbreak. However, a closer look at the salient provisions of REPUBLIC ACT No. 11332, will reveal that this mandate devolves on the Department of Health (DOH) and its local counterparts, thus:

“Section 6. Mandatory Reporting of Notifiable Diseases and Health Events of Public Concern. –The DOH, through the Epidemiology Bureau, shall issue the official list of institutionalized public health information system, disease surveillance and response systems for mandatory reporting of notifiable diseases and health events of public concern provided in Section 5 of this Act.. This official list shall include the Field Health Service Information System (FHSIS), the Philippine Integrated Disease Surveillance Response (PIDSR) System with its Case-based Surveillance and Event-based Surveillance, and other duly institutionalized public health disease surveillance and response systems of the DOH.

Under this Act:

(a) The DOH and its local counterparts are mandated to implement the mandatory reporting of notifiable diseases and health events of public health concern;

(b) The DOH and its local counterparts shall establish and maintain functional disease surveillance and response systems, which include coordination mechanisms, implementation protocols for reporting and response, measures for data security and confidentiality, and procedures and provision to ensure safety of personnel conducting disease surveillance and response activities;

X x x

(d) Data collection, analysis, and the dissemination of information from official disease surveillance and response systems can only be done by authorized personnel from the DOH and its local counterparts and may only be used for public health concern purposes only; thus, should be exempted in the provision of Data Privacy Act on accessibility of data;

(e) To perform their disease surveillance and response functions, authorized health personnel from the DOH and its local counterparts have the statutory and regulatory authority to enforce the following:

(1) Establishment of public health information system disease surveillance and response systems in private and public facilities deemed necessary to protect the health of the population in coordination with the DOH-Epidemiology Bureau;

(2) Mandatory reporting of notifiable diseases and health events of public health concern;

(3) Conduct of epidemic/outbreak and epidemiologic investigations, case investigations, patient interviews, review of medical records, contact tracing, collection, storage, transport and testing of samples and specimen, risk assessments, laboratory investigation, population surveys, and environmental investigation;

(4) Rapid containment, quarantine and isolation, disease prevention and control measures, and product recall;

(5) Response activities for events of public health concern;

(f) The DOH and its local counterparts shall ensure that all surveillance and response officers have adequate capacity for mandatory reporting of notifiable diseases, risk assessment, epidemiology, disease surveillance, and response to epidemics and health events of public health concern. It shall also ensure that the safety and protection of all personnel directly involved in surveillance and response activities are upheld; x x x”

The authority to gather data under REPUBLIC ACT No. 11332 is entrusted to the DOH which is an administrative agency presumed to possess the specialized skill, knowledge and training to perform such mandate, which qualifications LGUs may not possess thus raising serious legal concerns on their implementation of the same.

Neither can the authority of the LGUs be predicated on RA 11469 or the “Bayanihan to Heal as One Act” because most of the powers were granted to the President and not to LGUs. At best, the law merely dictates that “all local government units (LGUs) are acting according to the regulations and directives issued by the national government while implementing the standards of the community quarantine to their respective locales. The LGUs are still allowed to exercise their autonomy in situations not defined by the national government”, thereby relegating LGUs to merely take their cue from the national government.

In Administrative Law, the legal mantra is that “what has been delegated, cannot be further delegated”. Thus, in one case, the Supreme Court explained the reason behind such principle:

“The principle of separation of powers ordains that each of the three great branches of government has exclusive cognizance of and is supreme in matters falling within its own constitutionally allocated sphere. Necessarily imbedded in this doctrine is the principle of non-delegation of powers, as expressed in the Latin maxim potestas delegata non delegari potest, which means “what has been delegated, cannot be delegated.” This doctrine is based on the ethical principle that such delegated power constitutes not only a right but a duty to be performed by the delegate through the instrumentality of his own judgment and not through the intervening mind of another. However, this principle of non-delegation of powers admits of numerous exceptions, one of which is the delegation of legislative power to various specialized administrative agencies like the Board in this case”.(BUREAU OF CUSTOMS EMPLOYEES ASSOCIATION (BOCEA), represented by its National President (BOCEA National Executive Council) Mr. Romulo A. Pagulayan,
v. HON. MARGARITO B. TEVES, in his capacity as Secretary of the Department of Finance,  et al, G.R. No. 181704 December 6, 2011

Here, it is the humble opinion of the author that the authority to gather data for contact-tracing had been delegated by REPUBLIC ACT No. 11332 to the DOH and thus cannot be further delegated to the LGUs. And unless the LGUs enact an ordinance, they are not only ill-equipped to gather and handle data but they also seem to lack the legal authority to do so.

Even then, the same law itself did not fail to acknowledge that the people’s constitutional rights to liberty and privacy could be trammeled during a pandemic and thus made a caveat that:  “(g) All personnel of the DOH and its local counterparts, and all other individuals or entities involved in conducting disease surveillance and response activities shall respect, to the fullest extent possible, the rights of people to liberty, bodily integrity, and privacy while maintaining and preserving public health and security”.

Truly, this may not be normal times. But the rights to constitutional liberty and privacy are ageless, timeless and amorphous. No virus could be as infectious as to change that.

 

(The author is the senior partner of ET Reyes III & Associates- a law firm based in Iloilo City. He is a litigation attorney, a law professor and a law book author. His website is etriiilaw.com).