NPC Issuance Wiki

NPC Advisory Opinion No. 2017-063 — Personal and Sensitive Information

Issued Advisory Opinion

Text

09 October 2017

Re: PERSONAL AND SENSITIVE INFORMATION

Dear [Redacted],

This pertains to your query received by the National Privacy Commission (NPC) on 25 July 2017, via Facebook. Specifically, your query pertains to the following:

  a. NPC’s stand on blacklisting

  b. Clarification on hand-written signatures being considered as biometrics and sensitive personal information

  c. If the following information in an application system is considered as personal or sensitive personal information:

   1. Username

   2. Password

   3. IP/MAC address

   4. Current location

   5. Cookies

  d. If birthday (consist of month and day only) is considered a personal or sensitive personal information.

Blacklisting

As a generic approach, blacklists are databases that consist of collected specific information relating to a specific group of persons, which may generally imply adverse and prejudicial effects for the individuals included thereon and which may discriminate against a group of people by barring them access to a specific service or harming their reputation.1

That said, blacklisting constitutes processing of personal data and is therefore subject to the general data privacy principles set out in the Data Privacy Act of 2012 (DPA). Thus, the law mandates that a data subject must be properly informed of the nature, purpose and extent of the processing of his or her personal data.2

Further, it is mandatory for an organization to clearly establish procedures that allow data subjects to exercise their right to access, rectification, erasure or blocking.

Personal Information

As can be gleaned from Republic Act (RA) No. 10367,3 biometrics refer to “the quantitative analysis that provides a positive identification of an individual such as voice, photograph, fingerprint, signature, iris and/or such other identifiable features.”4

While under Article 29 Opinion 4/2007 (EU),5 a biometric data may be considered both as content of the information about a particular individual as well as an element to establish a link between one piece of information and the individual. As such, it can work as “identifier” for it produces a unique link to a specific individual.

On that note, it must be emphasized that DPA defines personal information as “any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.”6 Corollarily, hand-written signatures, as may be used to identify an individual, is considered as personal information.

In the same manner, unique information relating7 to an individual or when linked with other information will allow an individual to be distinguished from others, may be treated as personal information.

Accordingly, username, password, IP address, MAC address, location, cookies and birthday (month and day only), as for its common use, when combined with other pieces of information, may allow an individual to be distinguished from others and may therefore be considered as personal information.

Note however that the DPA defines sensitive personal information as personal information, to wit:

  (1)  About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;

  (2)  About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;

  (3)  Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and

  (4)  Specifically established by an executive order or an act of Congress to be kept classified.8

In light of the above provisions, it is imperative to note that the specific data you inquired may all fall under the ambit of personal information but are not considered as sensitive personal information.

For your reference.

Very truly yours,

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. Article 29 of Directive 95/46/EC “Working document on Blacklists”, Adopted on 3 October 2002, available at http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2002/wp65_en.pdf ↩

  2. IRR of RA 10173, §18(a) ↩

  3. AN ACT PROVIDING FOR MANDATORY BIOMETRICS VOTER REGISTRATION, 15 February 2013, §2(b) ↩

  4. R.A. No. 10367, §2(a) ↩

  5. Opinion 4/2007 on the concept of personal data, Adopted on 20th June 2007 ↩

  6. Id., §3(g). ↩

  7. EU Directive 95/46/EC Working Party Document No. WP 105 noted that “Data relates to an individual if it refers to the identity, characteristics or behavior of an individual or if such information is used to determine or influence the way in which that person is treated or evaluated.” ↩

  8. Id., §3(l). ↩

Backlinks