NPC Issuance Wiki

NPC Advisory Opinion No. 2018-070 — Muntinlupa City Ordinance No. 96-80

Issued Advisory Opinion

Text

5 October 2018

Re: MUNTINLUPA CITY ORDINANCE NO. 96-80

Dear [Redacted],

We write in response to your inquiry which sought to clarify whether City Ordinance No. 96-80, requiring the submission of personal information of the rank and file employees to the Public Employment Service Office (PESO), is permissible under the Data Privacy Act of 2012 (DPA).1

Discussion

City Ordinance No. 96-802 directs employers to require submission of the voter’s ID or Income Tax Return for pre-employment screening in order to determine the residency of the potential applicant.3 Furthermore, the PESO is authorized by the city government to require the submission of the following requirements for renewal of business license:

  • a) List of rank and file employees comprising the seventy percent (70%) who are residents of Muntinlupa;
  • b) Nature of business;
  • c) Personal information of rank and file residents:
    1. Age;
    2. Address;
    3. Years of service in the company; and
    4. Current position and job description.4

The provisions above make it clear that the ordinance requires the processing of both personal information and sensitive personal information (age) of employees. Thus, the submission of these personal data constitutes a legal obligation on the part of personal information controller.5

The legal obligation of employers comes from City Ordinance No. 96-80, which is an ordinance be duly enacted by the city government of Muntinlupa. Cities and municipalities, through their respective Sangguniang Panlungsod and Sangguniang Bayan, are granted police power to make statutes and ordinances that promote the health, morals, peace, education, good order or safety and general welfare of its constituents.6 Giving priority to its residents for employment opportunities within the city is part of the functions of the city government based on Section 16 of the Local Government Code, which states that every local government unit (LGU) is mandated to ensure employment and enhance the economic condition of its jurisdiction.

The processing of sensitive personal information is also supported by the DPA, as City Ordinance No. 96-80 satisfies the requirement of an existing law or regulation which requires the processing of sensitive personal information.7

The existence of a lawful basis for processing does not give unrestricted authority to any entity to process personal information. Whenever government collects and further processes personal data, the agency must comply with the obligations under the DPA. The processing of personal information requires adherence to the general data privacy principles of transparency, legitimate purpose, and proportionality.

The principle of transparency states that the data subject must be aware of the nature, purpose and extent of processing of his or her personal data. Therefore, the employers, as well as the city government, must inform the employees in clear and plain language that their personal data is required by the LGU for monitoring and legislative purposes.

Second, the processing of personal information shall be compatible with a declared and specified purpose, which is not contrary to law, morals, or public policy. It is a settled rule that an ordinance duly passed by such Sanggunian is presumed valid unless and until the courts declare the contrary in clear and unequivocal terms.8

Lastly, the principle of proportionality states that only adequate, relevant, suitable and necessary information will be processed. The LGU shall require only as much personal data as is needed to directly fulfill the objectives of the regulation. We therefore recommend that the LGU review the requirement for the sensitive personal information of employees, as well as any personal information beyond name and address, to establish if they are necessary to achieve the objective of the ordinance.

The LGU should be able to demonstrate its accountability for the personal data it is collecting under its ordinance, to the end that the data subjects are protected from harm and other privacy risks. Thus, the LGU is also mandated under the DPA to uphold the rights of data subjects. The collection and further processing of these information collected from employers should be safeguarded against illegal or unauthorized processing. Security measures for data protection should be implemented to ensure that the confidentiality, integrity and availability of the personal data are maintained.

This opinion is based solely on the information you have provided. Additional information may change the context of the inquiry and the appreciation of facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) IVY D. PATDU Officer-in-Charge and Deputy Privacy Commissioner for Policies and Planning

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose, a National Privacy Commission, and for other purposes [Data Privacy Act Of 2012] Republic Act No. 10173 (2012). ↩

  2. Kautusang Panlungsod na Nag-Aatas sa lahat ng Kompanya/Bahay-Kalakal na Nagnenegosyo sa Lungsod ng Muntinlupa, na sa pagtanggap ng karaniwang kawani (rank and file), ang hindi bababa sa pitumpung porsiyento (70%) ng manggagawa ay dapat residente ng lungsod (01 July 1996). ↩

  3. Id. § 4. ↩

  4. Id. § 7. ↩

  5. Id. § 12 (c). ↩

  6. Social Justice Society v. Hon. Jose L. Atienza, G.R No. 156052 (S.C., February 13, 2008) (Phil.), available at http://sc.judiciary.gov.ph/jurisprudence/2008/feb2008/156052.htm ↩

  7. Id. § 13 (b). ↩

  8. Supra note 6. ↩

Backlinks