NPC Issuance Wiki

NPC Advisory Opinion No. 2018-010 — Precinct Finder and COMELEC Minute Resolution No. 17-0715

Issued Advisory Opinion

Text

4 May 2018

Re: PRECINCT FINDER AND COMELEC MINUTE RESOLUTION NO. 17-0715

Dear [Redacted],

This pertains to your letter received by the Privacy Policy Office of the National Privacy Commission (NPC) on 27 February 2018, requesting for an opinion on whether the alternative precinct finder of the COMELEC is compliant with Republic Act No. 10173,1 also known as the Data Privacy Act of 2012 (DPA).

We understand that the Precinct Finder search facility in the COMELEC website was made temporarily unavailable to the public after the 2016 National and Local Elections (NLE). Thereafter, the following undertakings were completed:

  1. The source code of the Precinct Finder used for the 2016 NLE was audited and cleared for public access by the Department of Information and Communications Technology (DICT); and
  2. The COMELEC’s Information Technology Department (ITD) made an enhancement of the Precinct Finder by deleting the following voter information:
    • a. Date of birth
    • b. Residential address; and
    • c. Voter’s ID availability status.

We understand further that should the COMELEC decide to use the enhanced Precinct Finder, the source code would have to undergo DICT audit which may take more than one year.

Hence, the following recommendations were put forward, taking into consideration the May 2018 Barangay and Sangguniang Kabataan Elections (BSKE):

  1. Use the enhanced Precinct Finder if the source code review and audit are completed before May 2018;
  2. If the audit is not completed on time:
    • a. The Precinct Finder intended for the 2016 NLE shall be used as it has already passed DICT assessment with the same number of data fields; or
    • b. The Precinct Finder will not be implemented and COMELEC will announce the unavailability of the facility in the website.

Discussion

Another proposed alternative pursuant to COMELEC Minute Resolution No. 17-0715 is the posting of the name of the registered voter with the precinct number in the COMELEC website for the 2018 BSKE. You inquire on whether this last alternative is compliant with the DPA.

Bearing in mind the personal data breach in 2016 which involved the COMELEC website database and affected millions of voter registration records, the last alternative of simply posting of the name of the registered voter with the corresponding precinct number in the website for the 2018 BSKE is the most suitable alternative.

As the primary purpose of the Precinct Finder facility is to enable the registered voters to know their specific precinct numbers, any additional fields of personal data, i.e. date of birth, gender, address, civil status, voter identification number, etc., is unnecessary for that specific purpose.

Personal information controllers, such as the COMELEC, should be mindful that the processing of personal data should always adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality. Specifically, the principle of proportionality declares that the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.2

Recalling the NPC’s decision in NPC Case No. 16-001:3

“… COMELEC is no ordinary data controller; it is effectively one of the Philippines’ largest data controllers. The COMELEC creates, maintains, and processes data to establish a clean, complete, permanent, and updated list of voters, through the adoption of biometric technology, for use in national and local elections.

xxx xxx xxx

The numbers are staggering: there were a total of 76,678,750 voter registration records affected. Although the sensitive fields of these records were not shown to the public, the website database contained sensitive personal information not necessary for the purpose for which the data is being processed.”

Personal data in the Precinct Finder facility should be limited to those which are absolutely necessary for the specified purpose of said search facility. Pursuant to the practice of data minimization, COMELEC should identify the minimum amount of personal data needed to properly fulfill the Precinct Finder’s purpose.4

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. AN ACT PROTECTING INDIVIDUAL PERSONAL INFORMATION IN INFORMATION AND COMMUNICATIONS SYSTEMS IN THE GOVERNMENT AND THE PRIVATE SECTOR, CREATING FOR THIS PURPOSE A NATIONAL PRIVACY COMMISSION, AND FOR OTHER PURPOSES, “Data Privacy Act of 2012” (15 August 2012). ↩

  2. Implementing Rules and Regulations (IRR) of RA No. 10173, §18(c). ↩

  3. In re: Investigation of the security incident involving COMELEC website and/or data processing system, NPC Case No. 16-001, 28 December 2016. ↩

  4. See: Information Commissioner’s Office, The amount of personal data you may hold (Principle 3), https://ico.org.uk/for-organisations/guide-to-data-protection/principle-3-adequacy/ (last visited 28 February 2018). ↩

Backlinks

  • No backlinks found