Text
7 November 2017
Re: INQUIRY ON INFO IN COMPANY ID
Dear [Redacted],
This pertains to your inquiry received by the National Privacy Commission (NPC) on 20 April 2017, via email.
You sought clarification as to any violation regarding the collection of certain data in a company ID. You stated that the ID contains the following information, among others: SSS number, PhilHealth number, TIN, Pag-Ibig number, date of birth, civil status, gender, blood type, and emergency contact info.
Discussion
A perfunctory reading of Republic Act (RA) No. 10173 or the Data Privacy Act of 2012 (“DPA”) and its Implementing Rules and Regulations (“IRR”) will reveal that the processing of personal information should adhere to the principles of transparency, legitimate purpose and proportionality.
Transparency means that the data subject must be aware of the nature, purpose, and extent of the processing of his or her personal data.1 Legitimate purpose means that the processing of personal information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy.2 Proportionality means that the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.3
For the purpose of a company ID, it is advisable to have a policy as to what personal data is to be reflected therein and the corresponding purpose/s thereof, taking into consideration any applicable labor laws. Employees must be made aware of such policy at the earliest practicable opportunity.
Finally, the data enclosed on the ID must be proportionate to the purpose. Bear in mind that the government-issued ID numbers, civil status, gender and blood type are sensitive personal information (SPI). Under the DPA, these information are afforded more protection and its processing is generally prohibited unless allowed under the various lawful criteria for processing under Section 13 of the law. Note that a personal data breach involving SPI would warrant a more severe penalty under the law.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman