NPC Issuance Wiki

NPC Advisory Opinion No. 2018-001 — Request for Opinion on the Applicability of the Data Privacy Act of 2012 on Contracts

Issued Advisory Opinion

Text

5 January 2018

Re: REQUEST FOR OPINION ON THE APPLICABILITY OF THE DATA PRIVACY ACT OF 2012 ON CONTRACTS

Dear [Redacted],

This pertains to your request for advisory opinion received by the National Privacy Commission (NPC) on 20 November 2017, which sought guidance regarding Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), particularly its applicability to contracts you execute in the normal course of operations.

Discussion

Scope

The DPA applies to the processing of all types of personal information and to any natural and juridical person involved in the personal information processing.1 Under Section 3(g) of the DPA, and Section 3(j) of its Implementing Rules and Regulation (IRR), personal information is defined as follows:

Personal Information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.

In addition, Section 3(l) of the DPA defines sensitive personal information as personal information, to wit:

(1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; (2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and (4) Specifically established by an executive order or an act of Congress to be kept classified.

In your letter request, you have stated that you are collecting the following information:

  1. Name;
  2. Civil status;
  3. Nationality;
  4. Principal address; and
  5. Information contained in government-issued identification cards.

Based on the definition above, it is clear that the data that you are collecting are considered as personal information and its processing is covered by the DPA, its IRR and issuances of the NPC.

Some information, particularly, the civil status, nationality and the government-issued identification numbers as may be reflected in the ID cards are considered as sensitive personal information. Note that the lawful processing of personal and sensitive personal information should be based on the criteria provided for under Sections 12 and 13 of the DPA, respectively.

[Redacted] as Personal Information Controller

In light of the above provisions, it is imperative to note given the nature of data you collect and process from the contracts being entered into, [Redacted], as the personal information controller,2 is expected to comply with its duties and responsibilities under the law, i.e. adherence to the principles of transparency, legitimate purpose and proportionality,3 implementation of reasonable and appropriate organizational, physical and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration and disclosure,4 as well as uphold data subjects’ rights.5

For further information and additional resources, you may visit our website at https://privacy.gov.ph/.

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. RA No. 10173, §4. ↩

  2. RA No. 10173, §3(h). Personal information controller refers to a person or organization who controls the collection, holding, processing or use of personal information, including a person or an organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf. The term excludes: (1) A person or organization who performs such functions as instructed by another person or organization; and (2) An individual who collects, holds, processes, or uses personal information in connection with an individual’s personal, family or household affairs. ↩

  3. Id., §11. ↩

  4. Id., §20(a). ↩

  5. Implementing Rules and Regulations (IRR) of RA No. 10173, §6(a). ↩

Backlinks

  • No backlinks found