Text
15 August 2018
Re: Disclosure of Certificate of Live Birth
Dear [Redacted],
We write in response to your inquiry received by the National Privacy Commission (NPC) via email.
We understand that you received a subpoena requiring you to appear in relation to an investigation regarding the alleged falsification and perjury in connection with the Certificate of Live Birth (Certificate) of your daughter. During the hearing, you were presented with a copy of the said Certificate which was requested from the Civil Registrar in your municipality.
In addition, you likewise mentioned that a portion of the said Certificate was posted on social media (Facebook) which showed the name of the child and the father, among others.
You now inquire whether a violation of the Republic Act No. 10173,1 otherwise known as the Data Privacy Act of 2012 (DPA), has been committed in the given scenario.
Discussion
Acquisition of the Certificate of Live Birth for a Court Proceeding
The DPA and its Implementing Rules and Regulations (IRR) applies to the processing2 of all types of personal information and to any natural and juridical person in the government or private sector.3 Personal information is defined by the law as “any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.”4 The law then further categorizes certain personal information as sensitive personal information, which among others, includes an individual’s race, ethnic origin, age, color and religion.5
The Certificate contains the following information of an individual: name, sex, date of birth, place of birth, citizenship, and religion, among others. By its very nature, the certificate issued by the Civil Registrar contains sensitive personal information.
As decreed by the DPA and its IRR, the processing of sensitive personal information is prohibited except for certain cases stated under the law.6 One exception is when sensitive personal information is processed because it is provided to government or public authority pursuant to a constitutional or statutory mandate.
In the case of certificates of live birth, Presidential Decree No. 603, otherwise known as The Child and Youth Welfare Code, applies. Thus:
Article 7. Non-disclosure of Birth Records. — The records of a person’s birth shall be kept strictly confidential and no information relating thereto shall be issued except on the request of any of the following:
(1) The person himself, or any person authorized by him; (2) His spouse, his parent or parents, his direct descendants, or the guardian or institution legally in-charge of him if he is a minor; (3) The court or proper public official whenever absolutely necessary in administrative, judicial or other official proceedings to determine the identity of the child’s parents or other circumstances surrounding his birth; and (4) In case of the person’s death, the nearest of kin.7
In the given situation, the subject of the court proceeding was the alleged falsification and perjury in connection with the Certificate of Live Birth of your daughter. The crimes of falsification and perjury necessarily pertain to alleged falsified information stated in the certificate. Such information may relate to the parents’ identity or other circumstances surrounding the birth of your daughter. Hence, the acquisition of the Certificate of Live Birth and its successive disclosure made to the court is specifically allowed under prevailing law.
Unlawful Disclosure of Sensitive Personal Information
With respect to the posting without consent of the contents of the Certificate of Live Birth on Facebook, the following are the possible violations penalized by imprisonment and fine under the DPA:
Section 58. Malicious Disclosure. Any personal information controller or personal information processor, or any of its officials, employees or agents, who, with malice or in bad faith, discloses unwarranted or false information relative to any personal information or sensitive personal information obtained by him or her, shall be subject to imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).
Section 59. Unauthorized Disclosure. xxx xxx xxx
b. Any personal information controller or personal information processor, or any of its officials, employees or agents, who discloses to a third party sensitive personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from three (3) years to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00).
This opinion is being rendered based solely on the limited information you have disclosed. Additional information may change the context of the inquiry and the appreciation of the facts. It shall be understood that this opinion shall not be binding upon the Commission or the courts in other cases. Should the matter be raised as a complaint, the Commission shall render its decision upon further inquiry and investigation, and due appreciation of established facts and circumstances in accordance with the Rules of Procedure under NPC Circular 16-04.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC – Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Id. § 4 — Processing refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data. ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 4 (2016). ↩
-
Id. § 3 (t) (1). ↩
-
Emphasis supplied. ↩