NPC Issuance Wiki

NPC Advisory Opinion No. 2018-067 — OWWA E-Card Project

Issued Advisory Opinion

Text

24 September 2018

RE: OWWA E-CARD PROJECT

Dear [Redacted],

We write in response to your request for an advisory opinion which sought to confirm whether the OWWA E-Card Project is a special case within the purview of Section 4(e) of the Data Privacy Act of 2012 (DPA).1

As mentioned in your letter, Section 11 of the Overseas Workers Welfare Administration Act (OWWA Act)2 mandates the OWWA board to issue an OWWA E-Card, identification card or any other proof of membership upon payment of the member’s contribution. It likewise directed the OWWA to maintain a comprehensive and updated database of member-Overseas Filipino Workers (OFWs).

Discussion

Special case under the law

Section 4 of the DPA states that the law does not apply to:

e) Information necessary in order to carry out the functions of public authority which includes the processing of personal data for the performance by the independent central monetary authority and law enforcement and regulatory agencies of their constitutionally and statutorily mandated functions. Nothing in this Act shall be construed as to have amended or repealed Republic Act No. 1405, otherwise known as the Secrecy of Bank Deposits Act; Republic Act NO. 6427, otherwise known as the Foreign Currency Deposit Act; and Republic Act No. 9510, otherwise known as the Credit Information System Act (CISA);

Based on the provision above, the exemption on information necessary in order to carry out the functions of a public authority shall apply only to the independent central monetary authority, law enforcement, and regulatory agencies. It is then important to evaluate whether OWWA is law enforcement or regulatory agency.

The OWWA is a chartered institution, attached to the Department of Labor and Employment (DOLE) with the function of developing and implementing welfare programs and services for its member-OFWs and their families, and administer the OWWA Fund.3 It functions as an administrative agency, not as a regulatory or law enforcement agency.

Hence, the processing4 of personal information for the OWWA e-card project is not exempt from the scope of the DPA.

Lawful processing of personal data

The letter that you have provided us failed to indicate the personal data that will be processed pursuant to the OWWA E-Card Project. However, considering that the stakeholders and data subjects involved are OFWs, it can be derived that sensitive personal information5 are involved, such as passport details and other government issued identification numbers and details.

Section 13(b) of the DPA states that processing of sensitive personal information is permitted when the processing of the same is provided for by existing law and regulations. The OWWA Act clearly instructed the OWWA to issue any proof of membership upon payment of the required contribution to facilitate in availment of services, participation in welfare programs and receive assistance from the agency.

With this, there is evidently legal and lawful basis for the processing activities by OWWA.

Nevertheless, OWWA as a personal information controller (PIC)6 shall ensure that processing of personal data of OFWs is in accordance with the general privacy principles of transparency, legitimate purpose and proportionality.7

The principle of transparency entails the awareness of the data subjects of the nature, purpose, and extent of the processing of his or her personal information.8 OWWA must inform the data subjects, the OWWA members in this case, regarding the risks and safeguards involved in the processing, as well as their rights a data subjects, and how they can exercise those rights.

Also, it is important to state that the purpose of processing their personal information is for the E-Card Project, the database and other related programs of the agency.9 Lastly, OWWA shall ensure that the information collected, used, and stored are all necessary, relevant and not excessive in relation to the declared purpose of processing.10

Furthermore, OWWA, as a PIC is duty-bound to comply with the DPA, its IRR and other relevant issuances, including the appointment or designation of a Data Protection Officer, registration of data processing system/s, implementation of organizational, physical and technical security measures, and formulation of data breach protocols, among others.

The diagram of the process flow on the collection, use, processing and issuance of the OFW E-Card illustrates the intervention of a third party for the card printing. Each PIC shall be responsible for personal information transferred to a third-party for processing and shall ensure that agreements and contracts with such third parties have sufficient and appropriate safeguards in place.11

This opinion is based solely on the questions propounded and the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. Note that the attached OWWA Privacy Policy was not reviewed for purposes of this advisory opinion.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose, a National Privacy Commission, and for other purposes, “Data Privacy Act of 2012” (15 August 2012). ↩

  2. An Act Governing the Operations and Administration of the Overseas Workers Welfare Administration, “Overseas Workers Welfare Administration Act” (10 May 2016). ↩

  3. Id., §4. ↩

  4. Data Privacy Act of 2012, §3(j). ↩

  5. Id., §3(l). ↩

  6. Id., §3(h). ↩

  7. Implementing Rules and Regulations of the DPA, §11. ↩

  8. Id., §18(a). ↩

  9. Id., §18(b). ↩

  10. Id., §18(c). ↩

  11. Id., §43. ↩

Backlinks

  • No backlinks found