Text
11 September 2018
Re: CLARIFICATIONS ON ISSUANCE OF PRESS RELEASES BY THE PHILIPPINE DEPOSIT INSURANCE CORPORATION
Dear [Redacted],
We write in response to your request for an advisory opinion regarding the non-applicability of the Data Privacy Act of 2012 (DPA)1 and its Implementing Rules and Regulations (IRR) on the press releases which the Philippine Deposit Insurance Corporation (PDIC) issues in its capacity as insurer of bank deposits, risk mitigator, together with other financial regulators, and as the statutory liquidator of closed banks based on Section 4(e) of the DPA.
Section 4 of the DPA states that the law is applicable to the processing of all types of personal information and to any natural and juridical person involved in personal information processing. Likewise, it provides for certain personal information excluded from its scope – one of which is personal information necessary in order to carry out the functions of public authority, including the processing of personal data for the performance by the regulatory agencies of their constitutionally and statutorily mandated functions.2
Note that the exclusion above is not absolute. The exclusion of the information specified in Section 4 of the DPA is only to the minimum extent necessary to achieve the specific purpose, function or activity.
Given this, the personal and sensitive personal information enumerated in Section 4 may be lawfully processed by a personal information controller, even without meeting the conditions under Sections 12 and 13 of the DPA, but the processing shall be limited to that necessary to achieve the specific purpose, function, or activity. The PIC is still required, however, to implement measures to secure and protect personal information.
Discussion
We understand that the PDIC is mandated to promote and safeguard the interests of the depositing public and to generate, preserve, maintain faith and confidence in the country’s banking system, and protect it from illegal schemes and machinations.3
To do this, we understand that PDIC issues and posts press releases pertaining to cases filed by the PDIC against former bank officers, shareholders, and employees of closed banks for unfair and unsound banking practices under the PDIC Charter, and for fraud, irregularities, and anomalies discovered as a result of investigations conducted by the PDIC.
The DPA, on the other hand, has the twin task of protecting the fundamental human right of privacy and ensuring the free flow of information to promote innovation and growth. The law will not operate to hinder the PDIC from publishing certain items of personal information it deems crucial that the public be informed of, anchored on its mandate discussed above.
We refer you to Advisory Opinion No. 2017-035 dated 27 July 2017, addressed to [Redacted] of the PDIC where the same issue was briefly discussed, to wit:
If it is within the mandate of the PDIC to publish reports on cases or complaints filed by the PDIC in order to inform the public, the DPA will not operate to hinder the said mandate.
We note however that there may be a need to check other pertinent laws, jurisprudence, rules and regulations which provide for the confidentiality of records of court proceedings or information from proceedings.
Furthermore, said publication should also adhere to the principle of proportionality especially since it would involve public disclosure of personal information. The principle requires that “the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if purpose of the processing could not reasonably be fulfilled by other means.”4
This opinion is being rendered based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMOND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information In Information And Communications Systems In The Government And The Private Sector, Creating For This Purpose A National Privacy Commission, And For Other Purposes [DATA PRIVACY ACT OF 2012] Republic Act No. 10173 (2012). ↩
-
An Act Establishing the Philippine Deposit Insurance Corporation, Defining its Powers and Duties and for other Purposes [PDIC CHARTER] Republic Act No. 3591 (1963), as amended, § 1. ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18(c) (2016). ↩