NPC Issuance Wiki

NPC Advisory Opinion No. 2018-071 — Disclosure of School Records for Investigation Purposes

Issued Advisory Opinion

Text

5 October 2018

RE: DISCLOSURE OF SCHOOL RECORDS FOR INVESTIGATION PURPOSES

Dear [Redacted],

We write in response to your letter which sought clarification on whether the disclosure of school records for investigation purposes of the National Bureau of Investigation (NBI) is in accordance with Data Privacy Act of 2012 (DPA),1 its Implementing Rules and Regulations (IRR) and relevant issuances of the National Privacy Commission (NPC).

Discussion

School records as sensitive personal information

The Education Act of 1982 (Batas Pambansa Blg. 232)2 promotes and safeguards the welfare and interest of students by defining their rights and obligations. As mentioned in your letter, the law recognizes that schools have the obligation to maintain and preserve the confidentiality of school records.3 Thus, students, in general, have a reasonable expectation of privacy with regard to their school records.

Personal information about an individual’s education and those that are established by law as classified are considered sensitive personal information.4 The DPA prohibits the processing of sensitive personal information, except in the following cases:

  • a. The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing;
  • b. The processing of the same is provided for by existing laws and regulations: Provided, that such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, that the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;
  • c. The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing;
  • d. The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, that such process is confined and related to the bona fide members of these organizations or their associations: Provided, further, that the sensitive personal information are not transferred to third parties: Provided, finally, that consent of the data subject was obtained prior to processing;
  • e. The processing is necessary for purposes of medical treatment is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured; or
  • f. The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.

Disclosure of school records may not be warranted in this case due to the absence of any of the circumstances which will serve as a lawful basis for the processing of sensitive personal information. The letter-request of NBI does not establish the criteria it relies upon to sufficiently justify why the school should not maintain the confidentiality of the school records.

Processing of personal information by law enforcement agencies

Section 5 of the IRR provides that the DPA does not apply to certain categories of personal information, including those that are necessary to carry out the functions of public authority, in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function. This exemption, however, is only to the minimum extent of collection, access, use, disclosure, or other processing necessary to the purpose, function, or activity concerned.

For the exclusion to apply, the personal information processed by public authorities must be necessary to carry out their function as a law enforcement agency or regulatory body, and that such processing is in accordance with their constitutional or statutory mandate.

The NBI is created, reorganized, and modernized to enhance the investigative and detective work that it handles.5 It has express power to request the assistance of law enforcement agencies such as the Philippine National Police (PNP), Armed Forces of the Philippines (AFP) or any other agency of the government in its anti-crime drive.

Thus, it is fundamentally an investigative agency rather than a law enforcement agency. Nevertheless, the NBI is considered a law enforcement agency when statute declares it to be so, such as in the Anti-Child Pornography Act of 20096 and the Comprehensive Dangerous Drugs Act of 2002,7 among others. The letter of the NBI failed to disclose the subject matter of investigation, and it cannot be determined whether it is acting as an investigative agency or as a law enforcement agency and accordingly, exercising its function pursuant to its statutory mandate.

Constitutional guarantee against unreasonable search and seizure

Even if the NBI is acting as a law enforcement agency, the exemptions provided in Section 4 of the DPA (Section 5 of the IRR) apply only to the extent necessary to fulfill its statutory functions, based on the presumed public interest in the processing of these categories of information.

The phrase, “necessary for law enforcement purposes” is not a weapon that can be indiscriminately wielded by any agency that invokes it. The law enforcement agency must establish its mandate to enforce a particular law, and more importantly, that they are not unreasonably infringing on the rights of individuals guaranteed by the Constitution. Failure to establish both grounds renders the processing unnecessary and contrary to law.

Section 2, Article III of the 1987 Philippine Constitution declares the inviolability of the right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures of whatever nature and for any purpose, where a search warrant or warrant of arrest can only be issued upon finding of probable cause and by a court of competent jurisdiction. This provision has at its core the recognition of the right to privacy of individuals, and the guarantee that any limitations on this right is subject to the strictest scrutiny.

The right against unreasonable searches and seizures guards against the exercise of government of unbridled discretion in collecting, obtaining and using information relevant to individuals, for whatever purpose. The request for disclosure of “school records” as in this case, “in connection with the investigation being conducted by this Bureau” is not the same as the issuance of a search warrant. If it were so, then it would be akin to issuing a general search warrant through a mere letter-request, rendering the power of the NBI limitless to gather information, even in those cases where individuals have overriding privacy interests.

The NBI is not prohibited from making this request but neither is the school or institution obligated to disclose such information based only on the letter-request of NBI. The DPA should not be used to legitimize acts or omissions that violate fundamental freedoms. The DPA should always be interpreted in a manner consistent with the full respect for human rights enshrined in the Constitution.

This opinion is rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) IVY D. PATDU Officer-in-Charge and Deputy Privacy Commissioner for Policies and Planning

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission and for other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. An Act Providing for the Establishment and Maintenance of an Integrated System of Education [Education Act of 1982], Batas Pambansa Blg. 232 (11 September 1982). ↩

  3. Id. § 9 (4). ↩

  4. Data Privacy Act of 2012, § 3 (l). ↩

  5. An Act Reorganizing And Modernizing The National Bureau Of Investigation (NBI) And Providing Funds Therefor [NBI Reorganization and Modernization Act], Republic Act No. 10867, § 3 (2016). ↩

  6. An Act Defining the Crime of Child Pornography, Prescribing Penalties Therefor and For Other Purposes [Anti-Child Pornography Act Of 2009] Republic Act No. 9775, § 20 (2009). ↩

  7. An Act Instituting the Comprehensive Dangerous Drugs Act of 2002, Repealing Republic Act No. 6425, Otherwise known as the Dangerous Drugs Act of 1972, as Amended, Providing Funds Therefor, and for Other Purposes [Comprehensive Dangerous Drugs Act Of 2002] Republic Act No. 9165 (2002). ↩

Backlinks