NPC Issuance Wiki

NPC Advisory Opinion No. 2017-029 — Reverse Search Module

Issued Advisory Opinion

Text

23 June 2017

Re: REVERSE SEARCH MODULE

Dear [Redacted],

This refers to the letters of the Securities and Exchange Commission (SEC) dated 3 August 2016 and 4 February 2017 to the National Privacy Commission (NPC), seeking guidance regarding the implications of Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR) on the operations of the SEC, including the public’s access to the SEC Reverse Search Module (RSM).

BACKGROUND

SEC and its Computerization Program

The SEC, a regulatory government agency that oversees the Philippine corporate sector, was created in 1936 pursuant to Commonwealth Act No. 83. Its initial mandate was to regulate the sale and registration of securities,1 brokers, dealers and salesmen,2 and exchanges.3 Its powers and functions have since been broadened through the enactment of subsequent laws.4

In 2008, the SEC envisioned a future populated by self-regulating organizations that function effectively, despite minimum intervention from the Commission.5 To achieve this, it sought to strengthen the country’s corporate and capital market infrastructure and maintain a regulatory system aligned with international best standards and practices.6

In its annual report that year, the SEC stated as one of its major final outputs (MFO) the promotion of the laws it is charged with administering. A key activity under this MFO is the development, implementation, and maintenance of information systems and databases, as well as the SEC website, under the auspices of the Commission’s Economic Research and Information Department (ERID). For that year, the ERID reported that it implemented several modules under the computerization program, including the Reverse Search Module (RSM).7

Reverse Search Module

The RSM is a system that provides access to company information such as incorporators, company affiliations, and case relationships, and forms part of the more comprehensive SEC i-Report Module.8 As per SEC Office Order No. 344 (2009),9 which sets out its implementing guidelines, the following information may be retrieved through the system:

  1. Affiliations of an individual to a company in whatever capacity: incorporator, stockholders, officers, partners, director/trustee – Current retrievable data are sourced from the database of the SEC i-Register and SEC company registration database; hence, limited to data on incorporators and partners. Updated directors’ and officers’ information from the GIS and information from 2006 onwards become available after encoding.

  2. Relationship of a company to another – Only data found in the Articles of Incorporation and Partnership of companies registered from 2002 onwards are available; and

  3. Relationship of an individual to an SEC case.

This RSM also allows SEC personnel to retrieve the necessary information for the processing of registration and secondary license applications, and to respond to queries.10 Meanwhile, the public may access the facility via designated SEC kiosks made available by the Commission’s Public Reference Unit.11

With the enactment of the DPA, the SEC modified its policy and suspended public access to the facility until it ascertains the impact of the law on the Commission and its data processing operations, such as that undertaken through the RSM. However, co-regulators, legislators, and law enforcement agencies are still allowed to access the system upon their submission of a letter-request.

On 29 March 2017, representatives of the NPC’s Privacy Policy Office met with officials of the SEC to discuss the RSM and other SEC concerns relating to data privacy. The NPC was given a copy of an illustration of the step-by-step process being followed for the use the RSM (attached herewith as Annex “A”).

According to the SEC, the main users of the RSM are journalists, banks, credit institutions, foreign investors, legislators, and law enforcement agencies. Thus, it came as no surprise that among those vocal with their disappointment at the suspension of the public’s access to the system were members of the media. For Malaya columnist, Ellen Tordesillas, for instance, removal of the platform is a big blow to the transparency efforts of the government.12 The RSM, she said, assists journalists in the conduct of investigative research, particularly when trying to ascertain relevant links between government officials and other individuals. It also promotes accountability in government. The Philippine Center for Investigative Journalism (PCIJ) also expressed a similar sentiment through a letter they sent to the SEC on 1 February 2017 (attached herewith as Annex “B”). They even requested for a meeting to discuss the exemption extended by the DPA to journalists.

ISSUES

  1. Whether the exemptions to the scope of the DPA, particularly personal information processed for journalistic, artistic, literary or research purposes, may be invoked by journalists in their requests for information from the SEC through the use of the RSM;

  2. Clarification on the processing of the Tax Identification Number (TIN) as sensitive personal information vis-à-vis the requirement under Executive Order No. 98 dated 28 April 1999; and

  3. Balancing the thrust of the SEC towards transparency and disclosure for the promotion of foreign and local investments and prevailing concerns relating to data privacy.

DISCUSSION

The exemption afforded to personal information processed for journalistic purposes may not be invoked by journalists to compel the SEC to disclose data by reintroducing the RSM to the public.

The exemption from DPA requirements afforded to personal data being processed by journalists may not be invoked by the latter when insisting that the RSM facility be made accessible to the public anew.

Section 4(d) of the DPA provides for the non-applicability of the law on personal data processed for journalistic, artistic, literary or research purposes. The law’s Implementing Rules and Regulations (IRR) explain that this exemption is made “in order to uphold freedom of speech, of expression, or of the press, subject to requirements of other applicable law or regulations.”13 They also clarify that the exemption is not absolute. It applies only to the data and not the entities involved in their processing (i.e., personal information controllers or personal information processors). Those entities remain to be subject to the requirements of the law, particularly those relating to the implementation of security measures.14 Note, too, that the exemption from DPA requirements is “only to the minimum extent necessary to achieve the specific purpose, function, or activity concerned.”15

Stated otherwise, the exemption is neither a golden ticket nor a carte blanche authorization that journalists can conveniently present to compel potential sources of information to turn over or disclose data under their custody. After all, public disclosure of data remains subject to a range of policies, including internal ones maintained by organizations, and other laws, as enacted or issued by the appropriate legislating authority.

In any case, as correctly pointed out by the SEC, journalists may still secure the information they require through corporate documents that continue to be available to the public via the SEC iView and SEC Express Systems.

It is also worth noting that this case presents an opportunity for the SEC to take stock of the principle of proportionality espoused by the DPA relative to its processing operations as a regulator, specifically public disclosures of personal data. The principle requires that “the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.”16

The SEC must re-examine its current data processing systems, practices, programs, and projects and ensure that it implements them in a manner that unnecessarily sacrifices the privacy protections given by the DPA to personal data. More specifically, if the SEC can avoid or lessen public disclosures of personal data in the course of performing its statutory mandate, it should exert utmost efforts and work towards that direction. If unavoidable, public disclosures should only involve the minimum amount necessary to meet its declared purpose or objective.

Tax Identification Number (TIN)

Section 3 of the DPA states that sensitive personal information includes personal information issued by government agencies peculiar to an individual. This makes an individual’s TIN17 sensitive personal information the processing of which is prohibited, except in the instances provided in Section 13 of the same law. One such instance is when processing is allowed or required by existing laws and regulations18 and/or when the information is to be provided to a public authority or the government.19

Executive Order (EO) No. 98 (1999) directs all government agencies to require the TIN in all applications involving government permits, licenses, clearances, official papers, and/or documents. Whenever possible and where applicable, those documents cannot be issued without such information.20 In addition, the National Internal Revenue Code (NIRC), as amended, also requires that the TIN be indicated in certain documents, including those to be registered with the SEC.21

Accordingly, the SEC has enforced the TIN requirement for a number of purposes, inter alia:

  1. Registration of corporations – The TIN of each incorporator must be indicated in the signature pages of the Articles of Incorporation (AOI) and By-Laws (BL);
  2. Applications for amendments of the AOI and BL, increase/decrease of capital stock, mergers, dissolutions and other applications – The TIN of each member of the board of directors or trustees, as well as that of the treasurer and corporate secretary, are required in various documents; and
  3. Submission of reportorial requirements, specifically the General Information Sheet (GIS) – The TIN of each member of the board of directors, each officer, and each stockholder must be indicated in the documents.

Approved registrations and applications are uploaded to the SEC iView. The public may access (view and print) them through this platform or through the SEC Express System.

Last year, the SEC issued Memorandum Circular (MC) No. 16 (2016), which concerns the revision of the GIS and the Notification Update Form (NUF). In a revised GIS, the TINs and residential addresses of the members of the board, officers and stockholders of domestic corporations, as well as those of the resident agent and officers of foreign corporations are to be indicated in a separate sheet, which will not be uploaded to the SEC iView.22 The revision presumably takes into account the DPA’s definition of sensitive personal information and the criteria it provides for the lawful processing of this type of personal data.

The foregoing circumstances make it clear that there are existing policies that treat the TIN as a pre-requisite for certain transactions with the Philippine government, including those with the SEC. Such a scenario is among those wherein processing of sensitive personal information is allowed by the DPA.

This notwithstanding, the sharing or disclosure of TINs and/or the documents that feature them—online or otherwise—is another matter.

Recall that the DPA has the twin task of protecting the right to privacy while ensuring the free flow of information. It outlines data privacy principles that persons engaged in personal data processing are obliged to observe to ensure adherence to the precepts of the law. One principle states that personal data must be processed fairly and lawfully.23 It must be carried out in a manner compatible with the declared, specified, and legitimate purpose and ensures appropriate privacy and security safeguards.24

In the case of the TIN, policies that require its collection are anchored on the need to improve the government’s monitoring mechanism for tax law compliance.25 Thus, it makes sense to share or provide such information to tax authorities and other similar government regulators, whenever necessary and through the appropriate disclosure or data sharing processes. On the other hand, there is little reason, if any, to make such item available to everyone else, via the SEC’s online and offline platforms, sans the consent of the person it pertains to.

With this, the SEC’s decision to have a separate TIN page for the GIS which will not be uploaded in the SEC iView system is worth noting. For consistency, however, this policy should also be applied to the agency’s offline mechanisms.

Transparency and Disclosure for the Protection of Investors vis-à-vis Data Privacy

A constant but effective balancing of rights is necessary in the implementation of any State policy. This is true for the NPC, as with any other government regulatory agency charged with implementing any particular set of laws or policies.

With the Securities Regulation Code (SRC), the law was enacted “to establish a socially conscious, free market that regulates itself, encourage the widest participation of ownership in enterprises, enhance the democratization of wealth, promote the development of the capital market, protect investors, ensure full and fair disclosure about securities, minimize if not totally eliminate insider trading and other fraudulent or manipulative devices and practices which create distortions in the free market.”26 Together with its IRR, the statute provides for the disclosure and submission of certain reports, documents, and information from public and reporting companies, as well as registered persons (i.e., broker dealers, associated persons or salesmen of associated persons), which may contain personal data.

The enforcement of the SRC and its IRR is the concern primarily of the SEC. However, the Philippine Stock Exchange (PSE) also plays a role in the implementation. The PSE is the only stock exchange in the country. In 1998, it was granted by the SEC a Self-Regulatory Organization (SRO) status, allowing the organization to establish and implement its own rules, including penalties that may be imposed on erring trading participants and listed companies.27 For corporations listed in the PSE, their submissions are made available online through the latter’s internet platform called the “PSE EDGE”.28 This website is a fully automated system that facilitates the efficient processing, validation, submission, distribution, and analysis of time-sensitive disclosure reports submitted to the PSE.29

In going about their respective functions, both the SEC and the PSE are obliged to take into account other laws—old and new alike—that have significant impact on their operations. This includes the DPA, which became effective in 2012. Certainly, as stated above, one exemption to the scope of the DPA are information necessary public authorities to carry out their constitutionally- or statutorily-mandated functions.30 Nonetheless, the specific limitations to such exemption (also discussed earlier) must be considered properly, lest it be invoked inappropriately and applied to situations which should be well within the coverage of the law. This requires going through the “balancing of rights” exercise on a case-to-case basis in order to determine whether a particular processing system, program, activity or project of the SEC or PSE meets both the requirements of their respective functions, and those of the data privacy law.

For your reference.

Sincerely,

IVY D. PATDU Officer in Charge and Deputy Privacy Commissioner for Policies and Planning

Footnotes

  1. Commonwealth Act (CA) No. 83, §4. ↩

  2. id., §14. ↩

  3. id., §17. ↩

  4. see: Presidential Decree No. 902-A (1976), Batas Pambansa Bilang 68 (1980), RA 8799, etc. ↩

  5. see: Securities and Exchange Commission. Annual Report 2008: Integrity, Accountability, Professionalism, Independence, and Initiative. http://www.sec.gov.ph/wp-content/uploads/2015/10/2008-Integrity-Accountability-Professionalism-Independence-and-Initiative.pdf (last visited 22 February 2017). ↩

  6. id. ↩

  7. id. ↩

  8. id. ↩

  9. Dated 7 December 2009. ↩

  10. SEC Office Order No. 344, s. 2006. ↩

  11. id. ↩

  12. Ellen T. Toredesillas. SEC policy disallowing reverse search a blow to transparency. ABS-CBN News. (November 21, 2016). http://news.abs-cbn.com/opinions/11/20/16/sec-policy-disallowing-reverse-search-a-blow-to-transparency (last visited 21 February 2017). ↩

  13. IRR, §5(b). ↩

  14. id., §5. ↩

  15. id. ↩

  16. IRR, §18(c). ↩

  17. National Internal Revenue Code (NIRC), §236(J), “Only one Taxpayer Identification Number (TIN) shall be assigned to a taxpayer.”; Revenue Regulations (RR) No. 7-2012, §3(3), “Taxpayer Identification Number (TIN)” - shall pertain to the system-generated reference index number issued and assigned by the BIR to each and every person registered in its database. In all of the business and/or personal transactions of the registered person whether these are with government offices or otherwise, this reference index number is required to be indicated. ↩

  18. RA 10173, §13(b) ↩

  19. id., §13(f) ↩

  20. EO No. 98, §2 ↩

  21. NIRC, §236(J)(5). ↩

  22. There is a prominent sign at the top of the sheet which states “NOT FOR UPLOADING”. ↩

  23. RA 10173, §11(b). ↩

  24. IRR, §19(b). ↩

  25. EO 98, Whereas clauses. ↩

  26. RA 8799, §2. ↩

  27. PSE, http://www.pse.com.ph/corporate/home.html?tab=0, (last visited 21 April 2017). ↩

  28. see: http://edge.pse.com.ph/. ↩

  29. PSE EDGE, http://edge.pse.com.ph/page/aboutPseEdge.do, (last visited 21 April 2017). ↩

  30. RA 10173, §4(e). ↩

Backlinks

  • No backlinks found