NPC Issuance Wiki

NPC Advisory Opinion No. 2018-019 — Appointment of Data Protection Officer and Registration of Data Processing System of a Homeowners’ Association

Issued

Text

18 April 2018

RE: APPOINTMENT OF DATA PROTECTION OFFICER AND REGISTRATION OF DATA PROCESSING SYSTEM OF A HOMEOWNERS’ ASSOCIATION (HOA)

Dear [Redacted]:

This pertains to your request for advisory opinion received by the Privacy Policy Office of the National Privacy Commission (NPC) on 15 March 2018, which sought to clarify whether HOAs are covered by Republic Act No. 10173,1 also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR)2 and relevant issuances of the NPC. Particularly, whether they are required to appoint its own Data Protection Officer (DPO) and register its data processing system with the NPC.

Discussion

Scope

It is important to recall that the DPA applies to all the processing of all types of personal information and to any natural and judicial person involved in personal information processing.3

Processing of personal data pertains to any operation or any set of operations performed upon such data including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction.4

Consequently, a HOA, being a juridical entity5 engaged activities geared towards the provision of basic community services and facilities for its members-homeowners, may inevitably perform processing of personal information of its individual members-homeowners. It is considered as a personal information controller6 (PIC) and is covered by the DPA.

It is of no matter that a HOA will not be dealing with the processing of sensitive personal information of persons other than its members. The DPA is applicable nonetheless, whether the personal data processed is from internal or external sources.

Appointment of a DPO

NPC Advisory No. 2017-01 dated 14 March 2017 on the Designation of Data Protection Officers (DPO) states that pursuant to Section 21(b) of the DPA and Section 50(b) of the IRR, PICs shall designate an individual or individuals who are accountable for the organization’s compliance with the law.

The Advisory and the guidelines apply to all PICs and personal information processors7 (PIPs) both in the government or private sector. The designation of a DPO is mandatory for PICs and PIPs, regardless of the number of employees, number of sensitive personal information processed, nature of processing or duration or regularity of processing activities.

Thus, the HOA is mandated to appoint a DPO to ensure the HOA’s compliance with the DPA, its IRR and related issuances.

Registration of Data Processing Systems

NPC Circular No. 2017-018 dated 31 July 2017 regarding the registration of data processing systems provides that in line with Sections 46 and 47 of the IRR, a PIC or PIP that employs fewer than two hundred fifty (250) persons shall not be required to register unless the processing it carries out is likely to pose a risk to the rights and freedoms of data subjects, is not occasional, or includes sensitive personal information of at least one thousand (1,000) individuals.

In your letter-request, you mentioned that HOAs are not likely to employ at least two hundred fifty (250) employees and will deal only with the processing of sensitive personal information of its members.

Note, however, that HOAs will be required to register its data processing system/s in the event of processing of sensitive personal data of at least one thousand (1,000) individuals or homeowners.

Thus, we recommend the conduct of a privacy impact assessment (PIA)8 so that HOAs can make a determination and an inventory of the categories of data and exact number of data subjects whose personal data is being processed.

Finally, we wish to emphasize that registration is just one of the means to comply with the DPA and related issuances of the NPC. This means that while a company or organization may not be required to register their data processing systems, they are still covered by the other provisions of the DPA, must appoint a DPO, and are mandated to implement reasonable and appropriate security measures to protect personal data they are processing.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes, “Data Privacy Act of 2012” (15 August 2012). ↩

  2. Implementing Rules and Regulations of the Data Privacy Act (24 August 2016). ↩

  3. Supra note 1, §4. ↩

  4. Id., §3(j). ↩

  5. An Act Providing for a Magna Carta for Homeowners and Homeowners’ Associations, and for Other Purposes, “Magna Carta for Homeowners and Homeowners’ Associations”, Republic Act No. 9904 (07 January 2010), §4. ↩

  6. RA No. 10173, §3(h). ↩

  7. Id., §3(i). ↩

  8. See: NPC Advisory No. 2017-03 - GUIDELINES ON PRIVACY IMPACT ASSESSMENTS dated 31 July 2017. ↩

Backlinks