NPC Issuance Wiki

NPC Advisory Opinion No. 2018-037 — Applicability of the Data Privacy Act of 2012 to Physical or Online Archives and Libraries

Issued Advisory Opinion

Text

8 August 2018

RE: APPLICABILITY OF THE DATA PRIVACY ACT OF 2012 TO PHYSICAL OR ONLINE ARCHIVES AND LIBRARIES

Dear [Redacted],

We write in response to your inquiry received by the National Privacy Commission (NPC) regarding the applicability of Republic Act No. 10173,1 also known as the Data Privacy Act of 2012 (DPA), to physical or online archives and libraries. Particularly, you are inquiring whether the DPA applies to access to archival records which contain information of deceased individuals as well as church records used for historical research.

Discussion

Scope of the DPA

At the outset, there is no conflict between the DPA and Republic Act No. 94702 or the National Archives of the Philippines Act of 2007 (NAP). It should be noted that the DPA has the twin task of protecting the fundamental human right of privacy and ensuring the free flow of information to promote innovation and growth.3 Thus, the law will not operate to curtail the applicability of laws and regulations relative to archives and libraries.

As such, the pertinent provisions of the NAP will primarily apply as to the management and administration of all public records with archival value, held by either government offices or private collections, for the protection of public documents and records for the preservation of the country’s cultural heritage and history.

Nevertheless, when libraries and archives process personal information, the DPA will apply. As stated in Section 4 of the DPA, it applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing. Processing has a very broad definition and includes essentially anything which one can do with personal information, including, but not limited to its collection, storage, use, retrieval, disclosure, and disposal.4

In this regard, the DPA, its IRR, and other related issuances of the NPC shall apply to archives and libraries when they use, store and provide access to archival records which contain personal information.

Libraries and archives are then obliged to comply with the provisions of the DPA, its IRR and other NPC issuances that are relevant to their operations and to the nature of information that they are processing. They must adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality.5 Libraries and archives are also mandated to uphold the rights of the data subjects6 and implement security measures for the protection of personal data.7

Processing for Historical Research Purposes

As to historical research, it is important to note that personal information processed for research purposes is outside of the scope of the DPA.8 The same is reiterated in the IRR, which further states that the Act shall not apply to personal information processed for research purpose, intended for a public benefit, subject to the requirements of applicable laws, regulations or ethical standards.9

This encompasses access to archival records and church records that may contain personal information for historical research.

This exemption, however, applies only to the minimum extent necessary to achieve the specific purpose, function, or activity. Also, this entails the concomitant responsibility of ensuring that appropriate organizational, physical and technical security measures are in place to protect the personal data being processed for historical research purposes.

Although the consent of the data subjects may not be required in certain instances, the person or organization conducting the research must recognize the rights of the data subjects, including the right to be informed, among others.10 The data subjects must be aware of the nature of the processing activities, the purpose of processing, the retention period of personal data and the enforcement of their rights.11

Likewise, Section 11(f) of the DPA provides that personal information must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected and processed, provided that personal information collected for other purposes may be processed for historical, statistical or scientific purposes, and in cases laid down in law, may be stored for longer periods.

We note also that pursuant to the EU General Data Protection Regulation, the processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected.12 Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes is considered to be processing that is lawful and compatible to the original purpose for which such information were collected or processed.13

Further, the law does not prescribe a specific retention period, but rather, applies the laws, rules, or regulations pertinent to a specific industry or sector. In the absence of such, retention of personal data shall only be for as long as necessary for the fulfillment of the declared, specified, and legitimate purpose.14

These provisions should complement the NAP specifically on provisions applicable to records stored with permanent and enduring archival value. Thus, libraries and archives should strive to strike a balance in order to determine on a case-to-case basis whether access to archival records containing personal information for historical research meets both the requirements of the NAP and those of the DPA.

Deceased Individuals

While the DPA does not explicitly provide for its applicability on personal information of deceased individuals, Section 17 thereof specifically grants the lawful heirs and assigns of the data subject the right to invoke the rights of the data subject at any time after death or when the data subject is incapacitated or incapable of exercising his or her rights. Hence, when personal data of deceased individuals are processed, they are still considered as data subjects and the lawful heirs and assigns may exercise the rights of the deceased as a data subject.

Consequently, processing of personal information of deceased individuals requires the concomitant responsibility to observe general data privacy principles of transparency, legitimate purpose, and proportionality, as well as the implementation of appropriate security measures as required by the DPA. Note, however, considering the foregoing discussion on processing for historical research, personal information of deceased individuals processed for research purposes may be exempt from the coverage of the DPA.

This opinion is being rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission and for other Purposes [DATA PRIVACY ACT OF 2012], Republic Act No. 10173 (2012). ↩

  2. An Act to Strengthen the System of Management and Administration of Archival Records, Establishing for the Purpose the National Archives of the Philippines, and for other Purposes [NATIONAL ARCHIVES OF THE PHILIPPINES ACT OF 2007], Republic Act No. 9470 (2007). ↩

  3. Republic Act No. 10173, §2. ↩

  4. See: Republic Act No. 10173, §3(j). ↩

  5. Republic Act No. 10173, §11. ↩

  6. Id., §16. ↩

  7. Id., §20. ↩

  8. Id., §4(d). ↩

  9. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, §5(c) (2016). ↩

  10. Maldoff, Gabe. How GDPR changes the rules for research, available at https://iapp.org/news/a/how-gdpr-changes-the-rules-for-research/ (last accessed 16 July 2018). ↩

  11. Id. ↩

  12. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC [EU GENERAL DATA PROTECTION REGULATION], Recital 50 (2016). ↩

  13. Id. ↩

  14. See: Republic Act No. 10173, §11(e). ↩

Backlinks

  • No backlinks found