Text
4 May 2018
Re: REQUEST FOR INFORMATION FROM LAW ENFORCEMENT AGENCIES
Dear [Redacted],
This pertains to your request for advisory opinion received by the Privacy Policy Office of the National Privacy Commission (NPC) on 10 April 2018, which sought to clarify whether the disclosure of Cebu Pacific passengers’ personal information and travel records to law enforcement agencies is in accordance with Republic Act No. 10173,1 also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR),2 and relevant issuances of the NPC.
You mentioned in your letter that the Philippine Drug Enforcement Agency (PDEA) filed an administrative case against its employee, [Redacted]. In relation to the said case, PDEA would like to confirm [Redacted] whereabouts on 16 August 2015. Said personnel presented, as part of his defense the following:
- System generated Cebu Air, Inc. Official Receipt No. [Redacted] dated [Redacted] for Php1,734.68; and
- Printout of the online booking with Booking Reference Number [Redacted] for [Redacted] Cebu to Butuan [Redacted].
PDEA requested Cebu Pacific to verify if indeed [Redacted] booked a flight and purchased tickets, and if he actually boarded any flights on [Redacted] and the time and destination of said travel.
Discussion
Scope of the DPA
The DPA applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing.3 Personal information pertains to any information from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.4
Consequently, the name of the passenger is considered as personal information, combined with the flight details, such information taken together will directly and certainly identify the individual.
However, the DPA exempts from its scope information about any individual who is or was an officer or employee of a government institution that relates to the position or functions of the individual, including:
- The fact that the individual is or was an officer of employee of the government institution;
- The title, business address and office telephone number of the individual;
- The classification, salary range and responsibilities of the position held by the individual; and
- The name of the individual on a document prepared by the individual in the course of employment with the government.5
Thus, if the personal information being requested relates to an official trip of [Redacted] for him to perform his responsibilities as [Redacted], supported by an official document from the agency authorizing his trip, his flight details and confirmation on whether he boarded the aircraft are outside the coverage of the DPA.
In fact, this validation is also necessary for accounting and auditing purposes of the government agency, as well as for public information considering the use of public funds.
In the event, however, that the trip of [Redacted] is personal in nature, and in no way related to the discharge of his functions in PDEA, the personal information requested is not exempt from the coverage of the law, and Cebu Pacific has the responsibility, as a personal information controller, to protect it against unauthorized processing6 or unauthorized disclosure.7
Lawful Processing of Personal Information
Section 12 of the DPA provides that personal information can only be processed if the data subject has given his or her consent, or when processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by third parties to whom the data is disclosed, among other conditions provided by law.
We understand that this certification from Cebu Pacific is a crucial evidence that can incriminate or absolve [Redacted] from the ongoing administrative case. It is then considered as a legitimate interest of PDEA, the third party to whom data will be disclosed.
Nevertheless, the PDEA may opt to simply require [Redacted] to personally obtain the certification from Cebu Pacific, seeing that this will greatly strengthen his defense and support his case, otherwise, for [Redacted] to authorize PDEA to acquire the certification in his behalf.
This advisory opinion is based on the limited information provided in the request, and may vary based on additional information or when the facts are changed or elaborated.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
AN ACT PROTECTING INDIVIDUAL PERSONAL INFORMATION IN INFORMATION AND COMMUNICATIONS SYSTEMS IN THE GOVERNMENT AND THE PRIVATE SECTOR, CREATING FOR THIS PURPOSE A NATIONAL PRIVACY COMMISSION, AND FOR OTHER PURPOSES, “Data Privacy Act of 2012” (15 August 2012). ↩
-
Implementing Rules and Regulations of the Data Privacy Act (24 August 2016). ↩
-
Supra note 1, §4. ↩
-
Id., §3(g). ↩
-
Supra note 3. ↩