Text
09 May 2018
Re: INTERPRETATION OF THE DATA PRIVACY ACT OF 2012 VIS-À-VIS THE CONCESSION AGREEMENT BETWEEN TRANSCO, PSALM AND NGCP
Dear [Redacted],
This pertains to your query received by the National Privacy Commission (NPC) on 27 November 2017, via letter dated 08 November 2017, regarding the applicability of Republic Act No. 10173,1 also known as the Data Privacy Act of 2012 (DPA), to the records of the National Grid Corporation of the Philippines (NGCP) required for inspection by the National Transmission Corporation (TransCo) and the Power Sector Assets and Liabilities Management Corporation (PSALM) pursuant to the provisions of the Concession Agreement dated 28 February 2008 (Concession Agreement) executed among TransCo, PSALM and NGCP.
Per your letter, TransCo, PSALM and NGCP entered into the Concession Agreement for the operation of TransCo’s transmission business in line with the privatization mandate of Republic Act No. 9136, otherwise known as the “Electric Power Industry Reform Act of 2001” (EPIRA). Under the Concession Agreement, NGCP has the obligation to periodically report to TransCo and PSALM and allow the access to, and inspection of, its technical, regulatory, financial, and legal records.
In its last inspection, NGCP refused access to the following records:
- Case folders pertaining to labor cases which include the date of filing, amount involved, handling lawyer, and the status thereof; and
- Summary of Collections Per Charge Type Per Customer Per Month/Year.
The refusal is anchored on the belief that the grant of access shall be a violation of the DPA.
Exemptions to the scope of the DPA
The DPA provides for a list of specified information that are not covered by the law. This includes information necessary in order to carry out the functions of public authority which includes the processing of personal data for the performance by the regulatory agencies of their constitutionally and statutorily mandated functions.2
We understand that TransCo was created through the EPIRA. It is classified under relevant law as a government-owned and controlled corporation.3 The EPIRA mandates TransCo to assume the electrical transmission function of the National Power Corporation, and the latter’s authority and responsibility for the planning, construction and centralized operation and maintenance of its high voltage transmission facilities, including grid interconnections and ancillary services.4
Information required by TransCo, as a public authority under the law,5 to fulfill its regulatory mandate under the EPIRA and its responsibilities under the Concession Agreement, is excluded in the scope of the DPA.
We wish to emphasize that the exemption is not an exemption on the entity or agency but on the type of information processed. Also, this exemption is not a blanket exemption but only to the minimum extent necessary to achieve the specific purpose, function or activity.
The exemption particularly pertains to information necessary in carrying out the functions of TransCo, in accordance to its regulatory mandate under the law creating it. This does not mean that all information collected by TransCo is outside the scope of the DPA. Being an exception to the rule, it must be established that the information claimed to be outside the scope of the DPA is:
- Necessary in order to carry out the functions of public authority; and
- Its processing is for the performance of a constitutional or statutory mandate.
Thus, only the information required to be processed pursuant to the said function shall not be covered by the law, while TransCo, as an entity, is still covered by the DPA.
This means that TransCo, as a personal information controller, is mandated under the DPA to adhere to the data privacy principles of transparency, legitimate purpose and proportionality. It remains to be subject to the requirements of implementing reasonable and appropriate organizational, technical, and physical security measures for personal data protection, and in upholding the rights of data subjects.
In determining whether the personal data being collected by TransCo is necessary to carry out its functions, the personal data, such as the labor case records, would have to be processed to the extent necessary for its inspection of books and records under the terms and conditions of the Concession Agreement.
An option to consider is to accept anonymized summaries or digests or statistical data for labor cases, if this would suffice for purposes of the inspection.
With respect to the Summary of Collections Per Charge Type Per Customer Per Month/Year, it is worth noting that the customers of NGCP are not individuals but corporations and cooperatives. Thus, such information does not fall within the ambit of the DPA as the law only applies to the protection of personal data of individuals, not juridical entities such as corporations and cooperatives.
For your reference.
Very truly yours,
IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
AN ACT PROTECTING INDIVIDUAL PERSONAL INFORMATION IN INFORMATION AND COMMUNICATIONS SYSTEMS IN THE GOVERNMENT AND THE PRIVATE SECTOR, CREATING FOR THIS PURPOSE A NATIONAL PRIVACY COMMISSION, AND FOR OTHER PURPOSES, “Data Privacy Act of 2012” (15 August 2012). ↩
-
RA No. 9136, §8; see RA No. 10149, otherwise known as the “GOCC Governance Act of 2011.” ↩
-
Ibid. ↩
-
IRR of RA No. 10173, §3(r) — “Public authority” refers to any government entity created by the Constitution or law, and vested with law enforcement or regulatory authority and functions. ↩