Text
14 August 2017
Re: PROFILING OF INDIVIDUALS AND COLLECTION OF
PERSONAL INFORMATION BASED ON PUBLICLY
AVAILABLE DATA
Dear [Redacted],
This pertains to your query received by the National Privacy Commission (NPC) on via email. You sought clarification on two points. First, whether or not publicly available personal data specifically those posted on social media sites and published in news articles, magazines and other reading materials available to the public, are covered by the Data Privacy Act of 2012 (“DPA”). Second, whether or not companies are allowed to profile individuals and keep a record of personal information based on publicly available data about them.
Social media and privacy in the Philippines
Philippine jurisprudence concerning social media is relatively new. In 2014, the Supreme Court ruled on the case of Vivares v. St. Theresa’s College1. The case elucidated that “[to] address concerns about privacy,…Facebook was armed with different privacy tools designed to regulate the accessibility of a user’s profile as well as information uploaded by the user.”2 Thus, it basically sets the protection of the individual’s privacy in the hands of the Facebook user himself.
In the recent case of Belo v. Guevarra3, the Supreme Court reiterated that “before one can have an expectation of privacy in his or her online social networking activity - in this case, Facebook - it is first necessary that said user manifests the intention to keep certain posts private, through the employment of measures to prevent access thereto or to limit its visibility. This intention can materialize in cyberspace through the utilization of Facebook’s privacy tools.”4
Again, data privacy and security rest on the choices made by the individual in Facebook. The passage of the DPA, however, establishes new standards wherein personal data may be secured.
Information available in the public domain
We believe that the provisions of the DPA are still applicable even for those personal data which are available in the public domain. Note that the law has specified the information which is outside of its scope but only to the minimum extent necessary to achieve the specific purpose, function, or activity in Section 4 thereof.
There is no express mention that personal data which is available publicly is outside of its scope. Thus, “it is a misconception that publicly accessible personal data can be further used or disclosed for any purpose whatsoever without regulation.”5
With this, we believe that the personal information controller (PIC) which collects and processes personal data from the public domain must still observe the requirements under the law, specifically on the criteria for lawful processing of personal, sensitive personal and privileged information found under Sections 12 and 13 thereof.
Thus, even if the data subject has provided his or her personal data in a publicly accessible platform, this does not mean he or she has given blanket consent for the use of his/her personal data for whatever purposes.6
We believe that consent may still be required from the data subject where his or her data will be processed for marketing purposes even if such personal data was procured from the public domain.
We reiterate the definition of consent as “any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so.”7
Profiling based on publicly available information
Profiling is defined under Section 3(p) of the Implementing Rules and Regulations (IRR) of the DPA as “any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.”
There is no express prohibition for a company to profile individuals based on publicly available data. As defined, a PIC is a “person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.”8
Note however that a data subject has a right to be informed on whether personal data pertaining to him or her shall be, are being, or have been processed, including the existence of automated decision-making and profiling.9 Likewise, the data subject has the right to object and to withhold consent in relation to processing for direct marketing, automated processing or profiling.10
In addition, the PIC engaged in automated decision-making – where automated processing becomes the sole basis for making decisions about a data subject – is required under Section 48 of the IRR to notify the Commission of such processing.
Lastly, PICs are required to uphold the rights of data subjects, and adhere to general data privacy principles and the requirements of lawful processing.11
For your reference.
Very truly yours,
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
G.R. No. 202666, 24 September 2014. ↩
-
Ibid. ↩
-
A.C. No. 11394, 01 December 2016. ↩
-
Ibid. ↩
-
Office of the Privacy Commissioner for Personal Data, Hong Kong, Guidance Note - Guidance on Use of Personal Data Obtained from the Public Domain, August 2013, available at https://www.pcpd.org.hk/english/publications/files/GN_public_domain_e.pdf ↩
-
Id. ↩
-
Id., §34(b) ↩
-
Id., §6(a) ↩