NPC Issuance Wiki

NPC Advisory Opinion No. 2018-004 — Employee Non-Disclosure Undertaking

Issued Advisory Opinion

Text

22 January 2018

Re: EMPLOYEE NON-DISCLOSURE UNDERTAKING

Dear [Redacted],

This pertains to your letter request for the review of the Philippine Institute for Development Studies’ (PIDS) proposed Non-Disclosure Undertaking for its officials and employees in relation to its compliance with Republic Act No. 10173,1 also known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR).2 A copy of the draft Non-Disclosure Undertaking provided is attached herewith as Annex “A.”

At the outset, the DPA aims to protect individual personal information being processed by both the public and private sectors. Processing of personal information covers several activities, including but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.3 PIDS, as a nonstock, nonprofit government corporation,4 is necessarily subject to the provisions of the DPA when it processes personal information in the course of its research,5 dissemination and research utilization,6 and outreach programs.7

Discussion

Upon a review of the draft Non-Disclosure Undertaking, the NPC offers the following comments and recommendations for alignment with the Data Privacy Act:

Scope of Information Definition

That I am fully aware and clearly understand that my access to the data, information and records (all hereinafter referred to as information) in the course of my functions as employee of the Philippine Institute for Development Studies is limited to my need for the information in the performance of my duties and responsibilities.

Recommendation: We understand that the information referred to herein is not actually limited to personal information8 or sensitive personal information9 as defined under the DPA. As such, there may be a need to clarify this by defining the term “information”. Likewise, instead of referring solely to “access” you may opt to encompass other processing activities, i.e. “collection, access, use, disclosure or other processing necessary” for the performance of official functions and/or the provision of a public services.

Authorized Access and Use

That I will use my authorized access to the data only in the performance of my responsibilities of my position.

Recommendation: For consistency to the first undertaking above, consider using the term “information” instead of “data”. Also, on authorized access, consider adding a provision or reference to the issuance of a security clearance10 as this is required for purposes of providing access to personal data.

Compliance with Policies

That I shall comply with all control established by the Philippine Institute for Development Studies regarding the use of information/data/material gathered/generated/collected.

Recommendation: To be more specific, you may use “access control policy” and/or “acceptable use policy” and any other applicable policy/ies instead of using “control”.

Guidance on Privacy and Data Protection Laws

That I shall be guided by the applicable PIDS policy and the National Privacy Commission rules, regulations and advisory and the provisions of RA 10173 and its Implementing Rules and Regulations. That I understand and agree that my obligation not to disclose information will continue even after I leave the employment with PIDS.

Recommendation: Consider adding a catch-all statement for guidance: “…its Implementing Rules and Regulations, and any other applicable laws governing confidentiality of information.”

Care and Protection of Data

I will exercise care to protect the data against accidental or unauthorized access, modifications, disclosures, or destruction.

Recommendation: To emphasize the significance of the officers and employees’ role in data protection, further revision of this stipulation is recommended in such a manner that the officer or employee shall exercise “due diligence”11 as defined under the law and prevailing jurisprudence.

Sanctions for Violations

I understand that any violation of this undertaking or other PIDS policies related to the appropriate release or disclosure of information may result in one or more sanctions including immediate termination of my access to data, disciplinary actions up to and including dismissal from employment, criminal penalties, or civil liability.

Recommendation: Sanctions should include revocation of the security clearance to access information.

Acknowledgment of Policy Briefing

I affirm that I have been given the opportunity to review and understand the PIDS Guidelines on Data Protection and other PIDS policies referenced therein, and I further affirm that my questions about those policies have been answered to my satisfaction.

Recommendation: Note that in the conduct of NPC’s compliance checks, it is possible for the Commission to interview officials and employees and ask them regarding the company’s policies and data processes. Thus, it is incumbent upon the company to make sure that officials and employees have indeed been briefed on said policies and processes and have a working understanding of the same.

Finally, we wish to emphasize that a mandatory, agency-wide annual training on privacy and data protection policies is required to be conducted, and a similar training should be provided during all agency personnel orientations.12

For your information.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes, “Data Privacy Act of 2012” (15 August 2012). ↩

  2. Implementing Rules and Regulations of the Data Privacy Act (24 August 2016). ↩

  3. Data Privacy Act of 2012, §3(j). ↩

  4. About Us, Philippine Institute for Development studies, https://www.pids.gov.ph/about-us (last accessed 16 January 2018). ↩

  5. Research Projects, https://www.pids.gov.ph/research-projects (last accessed 22 January 2018). ↩

  6. Publications, https://www.pids.gov.ph/publications (last accessed 22 January 2018). ↩

  7. Legislative Inputs (Comments on Proposed Bills), https://www.pids.gov.ph/legislative-inputs (last accessed 22 January 2018). ↩

  8. RA No. 10173, §3(g) – Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual. ↩

  9. Id., §3(l) - Sensitive personal information refers to personal information: (1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; (2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and (4) Specifically established by an executive order or an act of Congress to be kept classified. ↩

  10. See: IRR of RA No. 10173, §31(a) and NPC Circular No. 2016-01, §15. ↩

  11. See R.A. No. 386, otherwise known as the “Civil Code of the Philippines,” Article 1163: Every person obliged to give something is also obliged to take care of it with the proper diligence of a good father of a family, unless the law or the stipulation of the parties requires another standard of care. ↩

  12. NPC Circular No. 2016-01, §4(D). ↩

Backlinks

  • No backlinks found