Text
8 November 2018
Re: BARANGAY TANYAG ORDINANCE NO. 03 — PAUPAHAN FORM
Dear [Redacted],
We write in response to your letter seeking clarification regarding the Paupahan Form (Form) required by Barangay Bagong Tanyag, Taguig City in accordance with Barangay Ordinance No. 031 on the registration of tenants of leased residential spaces as a pre-requisite for the issuance of Barangay Clearance for Business Permit and the renewal thereof.
Discussion
As we understand, you are inquiring whether the Form complies with the provisions of the Data Privacy Act of 2012 (DPA).1 Particularly, you raised the following questions:
- Whether the Form is valid when it does not have a clear provision stating the specific purpose of collecting the information; 2. Whether the Form collects an excessive amount of personal information; 3. Whether the Form is valid when it does not contain any statement on the protection of personal information collected; 4. Whether a point person who will take charge in the safekeeping of the data and the liability in case of a data breach must be designated;
- Whether the barangay can compel its constituents to sign the Form and whether it can sanction them for not following the ordinance; and 6. Whether residents may refuse to fill up the Form due to the barangay’s lack of security measures to protect their personal information.
An ordinance enjoys the presumption of validity and can only be nullified in a direct action assailing its validity or constitutionality.2 Under this presumption, Barangay Bagong Tanyag can mandate its constituents to comply with the provisions of Ordinance No. 03 and provide penalties for non-compliance.
In collecting personal data from its constituents, the barangay now assumes the role of a personal information controller (PIC),3 and thus becomes subject to the DPA and the general data privacy principles of transparency, legitimate purpose, and proportionality. Likewise, they should implement security measures to maintain the confidentiality, integrity and availability of personal data, and ensure that the rights of data subjects are protected in the implementation of this ordinance.
Transparency
The principle of transparency states that data subjects must be aware of the nature, purpose, and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of the personal information controller, and the rights of the data subjects and how these can be exercised.4 The purpose of the data collection need not be included in the form itself, provided that the purpose is shared with the data subjects through other means that are equally effective.
In this case, the ordinance states that the purpose for the submission of the list of tenants is for the maintenance of peace and order in the barangay and the effective management of its constituents. Likewise, it provides an exhaustive list of personal information required to be submitted. The constituents were, however, not informed as to the extent of processing, the risks and safeguards involved, and their rights as data subjects and how they may be exercised. Both the ordinance and the form does not provide for such information. For instance, it must be clear to the data subjects how and to what extent does the barangay intend to use their personal data for maintenance of peace and order, including whether such personal data will be shared with any other government or private entities.
Legitimate purpose
The principle of legitimate purpose5 states the processing of personal information shall be compatible with a declared and specified purpose, which is not contrary to law, morals or public policy. With Barangay Tanyag, the basis for processing is the mandate of cities and barangays to enact measures on how to protect its territorial jurisdiction and maintain peace and order.6 Thus, as long as the barangay is able to provide its legal basis, and has ensured that its purpose is consistent with its statutory or constitutional mandate, then it may be considered as within its rights to issue an ordinance like Ordinance No. 03.
Proportionality
Even with a legitimate purpose, the authority of the barangay to process personal data is limited and not absolute. The principle of proportionality states that the processing of information shall be adequate, relevant, suitable, necessary and not excessive in relation to a declared and specified purpose.7 Under this principle, there is a need to examine whether every item of personal data required to be submitted is necessary and relevant to the stated purpose. It must be emphasized that personal data must only be processed if the purpose of processing could not be reasonably fulfilled by other means. For instance, the barangay may consider collecting “number of occupants - adults and children” instead of collecting the names of all the occupants, to fulfill the purpose of determining the total number of constituents covered by the jurisdiction of the barangay.
This means that the barangay should be able to readily explain why a particular item of personal data is collected and the why its processing is necessary to achieve the objectives of the ordinance. The barangay should strongly consider whether collecting statistical or aggregate data is already sufficient to fulfill these objectives.
In addition, the data collected must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected and processed, unless the personal information collected for other purposes may lie processed for historical, statistical or scientific purposes, and in cases laid down in law may be stored for longer periods. In either case, the DPA requires that adequate safeguards are guaranteed by said laws authorizing their processing.8 No such safeguards exist in the ordinance, such as provisions on retention periods and records disposal.
Data Subject Rights
As the barangay is now a PIC, it must implement reasonable and appropriate organizational, physical, and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration, and disclosure, as well as against any other unlawful processing.
The barangay should have a person in charge of ensuring that the barangay complies with such obligation. The barangay should have a designated Data Protection Officer (DPO). They may instead appoint a Compliance Officer for Privacy (COP), provided that the latter shall be under the supervision of the Data Protection Officer (DPO) of the corresponding province, city, or municipality that the barangay is a part of. For further guidance, it would be helpful to look into NPC Circular No. 2016-01 which provides guidelines on security of personal information in government agencies, and NPC Advisory 2017-01 on the designation of a Data Protection Officer.
On the part of data subjects, those with concerns about how their personal data is handled under this ordinance may refer the matter to the Data Protection Officer of the barangay, or if there is no such officer in the barangay, to the Data Protection Officer of the City of Taguig. The barangay should have procedures in place to ensure that data subjects can exercise their rights.
The risk involved in the collection of personal information is a valid concern, particularly with the amount of data collected by the barangay and the lack of information on existing safeguards for personal data protection in the provisions of the ordinance.
Upon complaint of a data subject, or the discovery of a data breach occurring due to negligence, a personal information controller or its responsible officials may be subject to penalties specified in Chapter VII (Sections 25-37) of the DPA should they be found to have failed to comply with provisions of the law and to take adequate precautions to protect personal information they collect and hold.
This advisory opinion is based solely on the information provided in the request and may vary based on additional information or when the facts are changed or elaborated on.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Social Justice Society v. Atienza, Jr., G.R No. 156052 (13 February 2008). ↩
-
See: Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (a) (2016). ↩
-
See: An Act Providing For A Local Government Code Of 1991 [Local Government Code of 1991], Republic Act No. 7160 § 16 (1991). ↩