NPC Issuance Wiki

NPC Advisory Opinion No. 2017-054 — Data Sharing Agreement Between Government Agencies

Issued Advisory Opinion

Text

11 September 2017

Re: DATA SHARING AGREEMENT BETWEEN GOVERNMENT AGENCIES

Dear [Redacted],

This is in response to your queries received by the National Privacy Commission (NPC) on 25 August 2017 with regard to interpretation of “law enforcement” and “regulatory function” in relation to Section 5(d) of the Implementing Rules and Regulation (IRR) as well as data sharing between government agencies.

Law Enforcement and Regulatory Function

Section 5(d) of the IRR provides:

d. Information necessary in order to carry out the functions of public authority, in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function, including the performance of the functions of the independent, central monetary authority, subject to restrictions provided by law. Nothing in this Act shall be construed as having amended or repealed Republic Act No. 1405, otherwise known as the Secrecy of Bank Deposits Act; Republic Act No. 6426, otherwise known as the Foreign Currency Deposit Act; and Republic Act No. 9510, otherwise known as the Credit Information System Act (CISA);1

“Law enforcement” and “regulatory function” should be understood in relation to the definition of a public authority.

The IRR defines a public authority as any government entity created by the Constitution or law, and vested with law enforcement or regulatory authority and functions.2 Please note that the Act and its IRR does not specify to which public authorities this exemption is applicable. As such, if a public authority falls under the definition provided in the IRR, personal information necessary to its law enforcement and regulatory function shall be exempted from the coverage of the Act.

Nevertheless, the exception does not extend to the public authority as an entity. It still remains subject to the requirements of implementing security measures for personal data protection. Further, the processing of information shall be exempted from the requirements of the Act and the IRR only to the minimum extent necessary to achieve the specific purpose, function, or activity.3

Data Sharing Agreement

Section 20 of the IRR of the Data Privacy Act of 2012 provides for the general requirements when data sharing is allowed, i.e. when it is expressly authorized by law and provided that there are adequate safeguards for data privacy and security, and that processing adheres to principle of transparency, legitimate purpose, and proportionality.4

Particularly for data sharing between government agencies, Section 20(d) of the IRR applies. It states as follows:

d. Data sharing between government agencies for the purpose of a public function or provision of a public service shall be covered by a data sharing agreement.

  1. Any or all government agencies party to the agreement shall comply with the Act, these Rules, and all other issuances of the Commission, including putting in place adequate safeguards for data privacy and security.
  2. The data sharing agreement shall be subject to review of the Commission, on its own initiative or upon complaint of data subject.5

The Commission has also issued NPC Circular No. 16-02 which sets out guidelines for data sharing agreements involving government agencies. Section 1 of the Circular provides:

SECTION 1. General Principle. To facilitate the performance of a public function or the provision of a public service, a government agency may share or transfer personal data under its control or custody to a third party through a data sharing agreement: Provided, that nothing in this Circular shall be construed as prohibiting or limiting the sharing or transfer of any personal data that is already authorized or required by law.6

These provisions emphasize that the data sharing may be done to facilitate performance of a public function and to provide public services. The transfer or sharing of the list of pensioners under SSS to DSWD for the Social Pension Program falls squarely under this. As such, a data sharing agreement is required.

Consent

NPC Circular No. 16-02 further provides that the consent of the data subjects to the data sharing is required, but may be dispensed with when such consent is not required for lawful processing of personal data, as provided in the Act.7

In other words, consent of SSS pensioners may no longer be required, provided that the data sharing through the Social Pension Program falls under any of the instances of lawful processing provided in the Act which does not require the consent of data subjects. It would be important to document the statutory mandate or legal basis for DSWD to implement the Social Pension Program through the LGUs. The participation of the LGUs, and the extent by which LGUs would have access to the data, will also need to be examined. If the processing is not provided for by the Constitution, law or regulations, then consent of the data subject would be needed prior to data sharing.

This opinion is being rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. IRR of RA No. 10173, §3(r) ↩

  2. IRR of RA No. 10173, §5 ↩

  3. IRR of RA No. 10173, §20(a) ↩

  4. See: RA No. 10173, §12 and 13 ↩

  5. See: NPC Circular No. 16-02, §4 ↩

  6. See: NPC Circular No. 16-02, §1. ↩

  7. See: NPC Circular No. 16-02, §4. ↩

Backlinks

  • No backlinks found