Text
03 October 2017
Re: NATURE OF PROFESSIONAL INFORMATION
Dear [Redacted],
This pertains to your query received by the National Privacy Commission (NPC) on 09 August 2017. You inquired if professional information such as name, position, bank or company, office telephone number, mobile number and company address available in a company’s website are considered as personal information pursuant to the Data Privacy Act of 2012 (DPA).
You likewise mentioned that for those in the government sector, function-related information such as the above are special cases of personal information openly known by the public.
Personal Information
Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.1
We believe that the abovementioned data, taken together, would all be considered as personal information within the purview of the DPA. The fact that these personal information are available in a website of a company or belongs to a government employee or official does not change the nature of the personal information.
As the DPA applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing,2 accordingly, such processing should adhere to the general data privacy principles of transparency, legitimate purpose and proportionality. Further, personal information controllers (PICs) and personal information processors (PIPs) are mandated to uphold the rights of data subjects and implement reasonable and appropriate organizational, technical and physical security measures to protect personal data.
Information Available in the Public Domain
We believe that the provisions of the DPA are still applicable even for those personal information which are available in the public domain. Note that the law has specified the information which is outside of its scope but only to the minimum extent necessary to achieve the specific purpose, function, or activity in Section 4 thereof.
There is no express mention that personal data which is available publicly is outside of its scope. Thus, “it is a misconception that publicly accessible personal data can be further used or disclosed for any purpose whatsoever without regulation.”3
With this, we believe that PICs which collect and process personal data from the public domain must still observe the requirements under the law, specifically on the criteria for lawful processing of personal, sensitive personal and privileged information found under Sections 12 and 13 thereof.
Thus, even if the data subject has provided his or her personal data in a publicly accessible platform, this does not mean he or she has given blanket consent for the use of his/her personal data for whatever purposes.4
Special Cases
As to the special case involving information of public concern, i.e. information about any individual who is or was an officer or employee of government that relates to his or her position or functions,5 such is outside of the scope of the DPA but only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned.6
Such exemption is limited to the specified information and the non-applicability of the DPA does not extend to PICs or PIPs, who remain subject to the requirements of implementing security measures for personal data protection.7
For your information.
Very truly yours,
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
RA No. 10173, §3(g) ↩
-
Office of the Privacy Commissioner for Personal Data, Hong Kong, Guidance Note - Guidance on Use of Personal Data Obtained from the Public Domain, August 2013, available at https://www.pcpd.org.hk/english/publications/files/GN_public_domain_e.pdf ↩
-
Id. ↩
-
Implementing Rules and Regulations (IRR) of RA No. 10173, §5 ↩
-
Id. ↩