NPC Issuance Wiki

NPC Advisory Opinion No. 2018-039 — Right to Erasure in Relation to Retention of Personal Information

Issued Advisory Opinion

Text

27 July 2018

RE: RIGHT TO ERASURE IN RELATION TO RETENTION OF PERSONAL INFORMATION

Dear [Redacted],

We write in response to your inquiry requesting for a clarification with regard to NPC Advisory Opinion No. 2017-024 on retention of personal data under Republic Act No. 10173,1 also known as the Data Privacy Act of 2012 (DPA). Specifically, you seek to clarify the following:

a. Whether a resigned employee may request that all his personal data kept by the former employer be deleted; b. Whether a resigned employee may demand the turnover of the compilation of his personal data under the employer’s custody; and c. Possible valid reasons for an employer to deny the above requests.

Discussion

Rights of the Data Subject

Section 16 of the DPA clearly sets forth the right of every data subject to suspend, withdraw or order the removal or destruction of personal information from the filing system of a personal information controller (PIC) upon discovery and substantial proof that the personal information is outdated or is no longer necessary for the purposes for which they were collected, among other conditions.

Thus, it is possible for employees as data subjects to request for deletion of their personal data held by former employers. Note however that this right is not absolute and is subject to existing laws and regulations governing the retention period of employment documents or records.

Section 34(e) of the Implementing Rules and Regulations (IRR) of the Data Privacy Act provides that this right may be exercised upon discovery and substantial proof of any of the following:

  1. The personal data is incomplete, outdated, false, or unlawfully obtained;
  2. The personal data is being used for purpose not authorized by the data subject;
  3. The personal data is no longer necessary for the purposes for which they were collected;
  4. The data subject withdraws consent or objects to the processing, and there is no other legal ground or overriding legitimate interest for the processing;
  5. The personal data concerns private information that is prejudicial to data subject, unless justified by freedom of speech, of expression, or of the press or otherwise authorized;
  6. The processing is unlawful; and
  7. The personal information controller or personal information processor violated the rights of the data subject.

Likewise, employees as data subjects have the right to reasonable access to personal data subject to processing by the PIC. This includes reasonable access to the following:

  1. Contents of his or her personal information that were processed;
  2. Sources from which personal information were obtained;
  3. Names and addresses of recipients of the personal information;
  4. Manner by which such data were processed;
  5. Reasons for the disclosure of the personal information to recipients;
  6. Information on automated processes where the data will or likely to be made as the sole basis for any decision significantly affecting or will affect the data subject;
  7. Date when his or her personal information concerning the data subject were last accessed and modified; and
  8. The designation, or name or identity and address of the personal information controller.2

The employee may exercise his or her right to reasonable access by requesting for copies of the information comprising his or her personal data from the employer.

As to turnover of employees’ personal data, the question contemplates two situations where different rights may apply. On one hand, if the employer merely provides copies of the records to the employees, he complies with the right to access by acceding to the data subjects’ requests for their respective personal data. On the other hand, if the employer transfers the records in their custody to the former employee, this fulfills the employee’s right to erasure because the records are effectively deleted or removed from the database of the employer.

Nonetheless, turning over of the employee’s compiled personal data upon cessation of employment may not be possible in instances where the PIC has a legitimate purpose to retain the same.

Retention Period of Records

The DPA allows the employer to retain personal data of employees for as long as necessary for the fulfillment of the purposes for which the data was obtained or for the establishment, exercise or defense of legal claims, or for legitimate business purposes, or as provided by law.3

As stated in NPC Advisory Opinion No. 2017-24, factors that may be considered by a company in determining retention periods of employment records would include, but are not limited to the following:

  1. Legal requirements to which the company may be subject;
  2. Applicable prescription periods in existing law (i.e., money claims);
  3. Department of Labor and Employment rules;
  4. Bureau of Internal Revenue regulations; and
  5. Industry standards and other laws and regulations that apply to the sector.

Thus, the above-mentioned may be used by the employers as ground for denial of requests for deletion of employee records and requests for turnover of the same. Notwithstanding the circumstances, the employees shall not be hindered from exercising their right to access and obtain copies of their personal data.

Lastly, the company should be mindful of the data privacy principles of transparency, legitimate purpose and proportionality. This means that employees must be informed of the basis and purpose for the retention of his or her employment records. Further, the company must ensure that only those personal data which is adequate, relevant, suitable and necessary for the purpose will be retained.4

This opinion is being rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission and for other Purposes [DATA PRIVACY ACT OF 2012], Republic Act No. 10173 (2012). ↩

  2. Id., § 16(c). ↩

  3. Id., §11(e). ↩

  4. Id., §11. ↩

Backlinks

  • No backlinks found