NPC Issuance Wiki

NPC Advisory Opinion No. 2018-028 — Ownership of 201 Files and Data Subject Access Rights

Issued Advisory Opinion

Text

16 May 2018

Re: OWNERSHIP OF 201 FILES

Dear [Redacted],

This pertains to your query received by the National Privacy Commission (NPC) via email. As stated in your email, your wife (“Employee A”) requested for her 201 file from her company but was only able to obtain the 201 file from another officemate. Employee A was later reprimanded by the company for serious misconduct by reason of her alleged covert acquisition of the 201 file. You therefore sought clarification on the ownership of an employee’s 201 file in a private company.

An employee 201 file, usually containing records pertaining to the employee’s personal information, employment contract, duties, salary, performance and employment history, among others, is established and maintained by an employer for specific purposes relating to the employee’s employment, i.e. payroll, training and development, performance evaluation, promotion, etc. As this file is compiled and in part, created by and held under the custody of the company, such files may be considered company property and acquiring a copy thereof may still be governed by certain company rules and regulations.

On the other hand, Republic Act No. 10173,1 also known as the Data Privacy Act of 2012 (DPA), applies to the processing2 of all types of personal information and to any natural and juridical person involved in the processing thereof.3 Thus, companies that process personal information of an individual must comply with the provisions of the DPA.

Discussion

They are bound to uphold the rights of data subjects,4 adhere to general data privacy principles of transparency, legitimate purpose and proportionality, and the requirements of lawful processing. They must ensure that data subjects are aware of the nature, purpose, and extent of the processing of their personal data, including the risks and safeguards involved, the identity of personal information controller, their rights as a data subject, and how these may be exercised. Furthermore, they must also provide easy access to information and communication relating to the processing of personal data.5

Section 16(c) of the DPA sets forth the data subject’s right to reasonable access, upon demand, to the following:

  1. Contents of his or her personal data that were processed;
  2. Sources from which personal data were obtained;
  3. Names and addresses of recipients of the personal data;
  4. Manner by which such data were processed;
  5. Reasons for the disclosure of the personal data to recipients, if any;
  6. Information on automated processes where the data will, or is likely to, be made as the sole basis for any decision that significantly affects or will affect the data subject;
  7. Date when his or her personal data concerning the data subject were last accessed and modified; and
  8. The designation, name or identity, and address of the personal information controller.

Accordingly, Employee A, being a data subject, is entitled to have reasonable access to the personal information in her 201 file. She may exercise her right to access in the manner provided under the DPA but she must still abide by company protocols in accessing her 201 file.

Under the law, the company is obligated to respond and grant reasonable access to subject request. Should the request be ignored or denied, a complaint with the NPC may be initiated following the procedure laid down in NPC Circular No. 2016-04, as one of NPC’s functions is to enforce and effectively implement the provisions of the DPA, including those pertaining to the rights of data subjects.

For your information.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. AN ACT PROTECTING INDIVIDUAL PERSONAL INFORMATION IN INFORMATION AND COMMUNICATIONS SYSTEMS IN THE GOVERNMENT AND THE PRIVATE SECTOR, CREATING FOR THIS PURPOSE A NATIONAL PRIVACY COMMISSION, AND FOR OTHER PURPOSES, “Data Privacy Act of 2012” (15 August 2012). ↩

  2. Id., §4 — Processing refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data. ↩

  3. Id., §4. ↩

  4. Id., §3(c) — Data subject refers to an individual whose personal information is processed. ↩

  5. IRR of RA No. 10173, §18(a). ↩

Backlinks