NPC Issuance Wiki

NPC Advisory Opinion No. 2018-027 — Pasig City Ordinance No. 11 and Personal Data Registration

Issued Advisory Opinion

Text

4 May 2018

Re: PASIG CITY ORDINANCE NO. 11 “AN ORDINANCE REQUIRING THE REGISTRATION OF MIGRANTS, TENANTS, BOARDERS AND TRANSIENTS TO THE BARANGAY, AND FOR OTHER PURPOSES”

Dear [Redacted],

This pertains to your request for advisory opinion from the National Privacy Commission (NPC) which sought to clarify whether Pasig City Ordinance No. 111 (Ordinance) is compliant with Republic Act No. 10173,2 also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR) and relevant issuances of the NPC, and particularly respond to the following questions:

  1. Whether or not the local government of Pasig City is compliant with the DPA vis-à-vis its ability to protect the information they are requesting;
  2. Whether or not a processor, Barangay Kapitolyo is compliant with the DPA; and
  3. Whether or not Barangay Kapitolyo has exceeded their authority in requesting for additional information not contemplated by the Ordinance such as birth date, profession and last address, and requesting these from tenants and lessees themselves.

Preliminary to responding to the issues you have presented, it is important to discuss the essence of the Ordinance. It is considered as a local law and is permanent in nature, enacted by the local government unit pursuant to its delegated legislative power.3 In this case, Ordinance No. 11 was enacted as a preventive measure to minimize the increasing criminal activities within the city and promote peace and order.

The Urban Development and Housing Act of 1992 likewise mandates the local government units to set up effective mechanisms to monitor trends in the movement of population, i.e. from rural to urban, urban to rural and urban to rural areas, and identify measures by which such movements can be influenced to achieve balance between urban capabilities and population, to direct appropriate segments of the population into areas where they can have access to opportunities to improve their lives and to contribute to national growth and recommend proposed legislation to Congress, if necessary.4

In Europe, population registers are conducted on a municipal level, which are then consolidated and centralized in a national register, not only for official public purpose but for research and development as well.5 For other jurisdictions such as Estonia, submission and compilation of population registers are part of international obligations for comparison of migration records and facilitation in processing permits.6

The highlights of Ordinance No. 11 are as follows:

Section 3. REGISTRATION. — Owners of dormitories, boarding houses, apartments, bed spaces and rooms are required to submit to their respective barangay offices lists of tenants/lessees, transients and copies of their respective lease agreements within 24 hours upon signing.

Owners who do not execute written contracts should likewise submit the names of their tenants, renters, bedspacers to the barangay office within 24 hours upon start of rental.

Section 4. ALIEN/FOREIGN LESSEES. — Owners of dormitories, boarding houses, bedspaces and rooms including warehouses, hotels, inns, apartelles, motels, pension houses whose lessees or actual occupants are aliens of foreign nationals shall submit copies of the contracts and/or lease agreements including copies of passports of aliens or foreign nationals occupying aforesaid properties to the barangay offices having jurisdiction over the property.

Section 5. DUTY OF PERMANENT RESIDENTS WITH VISITORS. — It shall be the duty of every permanent resident who has accepted transients/visitors whose stay shall be for a period of one week or more to report the names of their visitors to their respective barangay offices.

A careful reading of the provisions of the Ordinance will reveal that the duty of submitting the list of tenants or lessees and transients falls on the owners. Hence, there is no basis in collecting the names of the tenants directly from the tenants or lessees themselves. In the event that the owners fail to submit the required information, it is the responsibility of the barangay to go after the owners and penalize them for non-compliance with the directives of the Ordinance.

In your letter-request, you mentioned that persons claiming to be personnel or agents deputized by the barangay went to your house, on at least two separate occasions, to distribute forms which have to be filled up by the homeowners.

The form asks for the following information:

  • name of owner;
  • address;
  • number of units;
  • contact details (landline, mobile number and email); and
  • type of unit.

Further, the tenants were asked for the following:

  • name;
  • birthday;
  • profession;
  • last address;
  • address; and
  • date of arrival.

First, the Ordinance merely required for the disclosure of the name of the tenant/lessee or transient and for a copy of the lease agreement. Nowhere in the ordinance will it require the disclosure of the contact details, birthday, profession, and last address of the tenants.

Second, the deputized members or agents of the barangay must have presented their authority to collect information, as well as the actual copy of the Ordinance and further issuances to support the collection of information. As mentioned above, the tenants are not the one responsible to furnish such information to the barangay, but the owners themselves.

Discussion

The DPA mandates natural and juridical persons involved in personal information7 processing8 to abide by the data privacy principles, uphold the rights of the data subject, and implement security measures in order to protect personal information in their custody.

At the outset, the subject Ordinance must be evaluated in terms of its observance with the data privacy principles.

First, the principle of transparency states that the data subject must be aware of the nature, purpose and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of the personal information controller and the rights of the data subjects and how these can be exercised.9 Although the data subject, the constituents, are aware of the nature and purpose of the processing, for public safety and welfare, they were not informed as to the risks and safeguards involved and their rights as data subjects.

Second, the principle of legitimate purpose is clearly provided for in the ordinance, given that the processing of personal information is compatible with the mandate of cities and barangays to enact measures on how to protects its territorial jurisdiction and maintain peace and order.10

Lastly, the principle of proportionality states that the processing of information shall be adequate, relevant, suitable, necessary and not excessive in relation to a declared and specified purpose.11

Pursuant to the Ordinance, the disclosure of the name and lease agreement with tenants complies with the principle of proportionality. However, the additional information being collected by the alleged agents of the barangay have no basis. There is no necessity for collecting the contact numbers, birthday, profession, and last address of the tenants in relation to the main purpose of the ordinance, which is to maintain a registry or list of owners engaged in the business of leasing real property within its jurisdiction. Thus, with regard to information not required by the ordinance, such information violates the principle of proportionality.

An ordinance enjoys the presumption of validity, and can only be nullified in a direct action assailing its validity or constitutionality.12 In determining the legality of an ordinance, both the formal (i.e. whether the ordinance was enacted within the corporate powers of the LGU and whether it was passed in accordance with the procedure prescribed by law), and substantive (i.e. involving inherent merit, like the conformity of the ordinance with the limitation under the Constitution and the statutes, as well as with the requirements of fairness and reason, and its consistency with public policy) tests must be satisfied.13

In view of the foregoing, Ordinance No. 11 is valid and enforceable. Considering that Barangay Kapitolyo is duty bound to turn over and submit, on a monthly basis, to the City Management Information System (MIS) the list of owners engaged in the business of leasing real property, Barangay Kapitolyo is a considered the personal information processor (PIP), directed by the City Management Information System to process personal information of tenants/lessees and transients, including the collection, organization and consolidation of such personal information, within their barangay.

As a PIP, the barangay is then required to comply with the obligations of a PIP stated in the DPA, its IRR and related issuances, i.e. the duty to implement security measures and uphold the rights of the data subjects, among others.

This advisory opinion is based on the limited information provided in the request, and may vary based on additional information or when the facts are changed or elaborated.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. Enacted on 15 September 2016. ↩

  2. AN ACT PROTECTING INDIVIDUAL PERSONAL INFORMATION IN INFORMATION AND COMMUNICATIONS SYSTEMS IN THE GOVERNMENT AND THE PRIVATE SECTOR, CREATING FOR THIS PURPOSE A NATIONAL PRIVACY COMMISSION, AND FOR OTHER PURPOSES, “Data Privacy Act of 2012” (15 August 2012). ↩

  3. Municipality of Parañaque vs. V.M Realty Corporation, G.R No. 127820 (20 July 1998). ↩

  4. Republic Act No. 7279, An Act to Provide a Comprehensive and Continuing Urban Development and Housing Program, Enabling the Mechanism for Its Implementation, and for other purposes, “Urban Development and Housing Act of 1992” (24 March 1992), §37. ↩

  5. Herm, Anne and Poulain, Michel (2013), Central Population Registers as Source of Demographic Statistics in Europe, available at http://www.csda.cam.uk/ukcafsde/h_PDII_1302.0215---centralpopulationregistersasasourcehm ↩

  6. International Migration – Statistical Office of Estonia, available at http://www.stat.ee/docdmend/19482 ↩

  7. Supra note 2, §3(g) Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual. ↩

  8. Id., §3(j) Processing refers to any operation or any set of operations performed upon personal information including, but not limited to the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data. ↩

  9. IRR, §18(a). ↩

  10. Id., §18(b). ↩

  11. Id., §18(c). ↩

  12. Social Justice Society et al. vs. Hon. Jose L. Atienza, Jr., G.R No. 156952 (13 February 2008). ↩

  13. Valentino L. Legaspi vs. City of Cebu, T.C (Tito) Sayson and Ricardo Hapiñan, G.R No. 159110 (10 December 2013) and Bienvenido Jaban, Sr. et. al., vs. Court of Appeals, et. al., G.R o. 159692 (10 December 2013). ↩

Backlinks

  • No backlinks found