Text
26 November 2018
Re: SUBMISSION OF PERSONAL DATA OF SEAFARERS TO THE MARITIME INDUSTRY AUTHORITY
Dear [Redacted],
We write in response to your request for advisory opinion on whether your company, the Manila Shipmanagement & Manning, Inc. (Manship) may grant the request of the Maritime Industry Authority (MARINA) for certain personal data of seafarers, and whether the requested information is not covered by the Data Privacy Act of 20121 (DPA) as it falls under Section 4 (e) of the DPA, as “information necessary in order to carry out its statutorily mandated functions,” and in light of Section 4.15, Rule I of the Implementing Rules and Regulations (IRR) of Executive Order No. 75, series of 20122 (E.O. No. 75).
Discussion
We understand that Manship is a manning agency duly licensed by the Philippine Overseas Employment Administration (POEA) to engage in the recruitment and placement of qualified Filipino seafarers for vessels plying international waters and for related maritime activities. On the other hand, pursuant to E.O. No. 75 (2012)3 as well as Republic Act (R.A.) No. 10635,4 the MARINA is the authority responsible for the oversight and supervision of maritime education, training, and certification of seafarers in accordance with the International Convention on Standards of Training, Certification and Watchkeeping for Seafarers (STCW). In particular, Section 4(a) and (b) of RA No. 10635 provides:
Section 4. Powers and Functions of the MARINA.—In addition to the mandate of the MARINA under Presidential Decree No. 474, as amended, and in order to carry out the provisions of this Act, the MARINA shall exercise the following powers and functions:
(a) Act as the single and central maritime administration for all purposes relating to compliance with the STCW Convention.
(b) Administer and ensure the effective implementation of the STCW Convention; including all international conventions or agreements implementing or applying the same, as well as international maritime safety conventions or agreements that it seeks to promote compliance with.
In its letter dated 21 May 2018, the MARINA requested all manning agencies for certain information on seafarers who were awarded disability compensation, specifically:
a. Names; b. Ranks; c. Illnesses or injuries from which the disability claims arose; d. Dates the cases for disability claims were filed; and e. Dates the National Labor Relations Commission (NLRC), National Conciliation and Mediation Board (NCMB), or appellate court decisions awarding disability claims were promulgated.
As clarified by the MARINA, the request for information is the agency’s response to the increase of cases being filed by injured and ill seafarers who allege that they are permanently disabled in order to claim large amounts of money intended as disability compensation. Such information shall help the MARINA prevent the issuance of STCW-related certificates to dishonest seafarers.
At the outset, we clarify that the provisions of the DPA applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing.5 However, the law provides under Section 4 the particular types of information that are considered as special cases excluded from its scope and application.6
We affirm that the requested information by MARINA falls under Section 4 of the DPA, as expounded in Section 5 of its IRR, in particular, paragraph (d) which states:
Section 5. Special Cases. The Act and these Rules shall not apply to the following specified information, only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned:
xxx xxx xxx
d. Information necessary in order to carry out the functions of public authority, in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function, including the performance of the functions of the independent, central monetary authority, subject to restrictions provided by law. Nothing in this Act shall be construed as having amended or repealed Republic Act No. 1405, otherwise known as the Secrecy of Bank Deposits Act, Republic Act No. 6426, otherwise known as the Foreign Currency Deposit Act; and Republic Act No. 9510, otherwise known as the Credit Information System Act (CISA);
xxx xxx xxx
Provided, that the non-applicability of the Act or these Rules do not extend to personal information controllers or personal information processors, who remain subject to the requirements of implementing security measures for personal data protection: Provided further, that the processing of the information provided in the preceding paragraphs shall be exempted from the requirements of the Act only to the minimum extent necessary to achieve the specific purpose, function, or activity.7 (Emphasis supplied)
As may be gleaned from the above provisions, however, the exemption is not absolute. The exclusion of such information from the scope of the law is limited to the minimum extent of collection, access, use, disclosure or other processing necessary to achieve the specific purpose, function or activity. This means that while consent of the data subject is not required in the processing of such personal information, the non-applicability does not extend to the duties and responsibilities of an entity or organization as a personal information controller or personal information processor under the DPA.
We also note that Section 4.15, Rule I of the IRR of E.O. No. 75 provides that the MARINA has the power to “develop and enforce appropriate measures to prevent fraudulent acts and other unlawful practices involving the issuance of any certificates and endorsement in accordance with the requirements of the STCW Convention.”
More importantly, paragraph 12 of Regulation I/2 of the Manila Amendments to the Annex to the 1978 International Convention on Standards of Training, Certification and Watchkeeping for Seafarers (the STCW Convention)8 (the Manila Amendments) decrees that, “Each Party shall ensure that certificates are issued only to candidates who comply with the requirements of this regulation.” Furthermore, paragraphs 1 and 2 of Regulation I/5 therein states:
Each Party shall establish processes and procedures for the impartial investigation of any reported incompetency, act, omission or compromise to security that may pose a direct threat to safety of life or property at sea or to the marine environment by the holders of certificates or endorsements issued by that Party in connection with their performance of duties related to their certificates and for the withdrawal, suspension and cancellation of such certificates for such cause and for the prevention of fraud.
Each Party shall take and enforce appropriate measures to prevent fraud and other unlawful practices involving certificates and endorsements issued. (Emphasis supplied)
Accordingly, the MARINA has a mandated regulatory function, specifically on compliance with the duties under the STCW Convention and the Manila Amendments. MARINA must ensure that STCW-related certificates are issued only to qualified candidates. It is also evident that the MARINA has the obligation to prevent any fraudulent or unlawful practices involving the certificates that were issued.
Thus, the disclosure to the MARINA by Manship of the requested personal data of seafarers who were awarded disability compensation, may be considered as lawful processing under a special case in accordance with the DPA. Note, however, that the disclosure must be limited to the extent necessary to achieve the specific purpose.
In determining if the processing is necessary for the purpose, the UK Information Commissioner’s Office (ICO) produced a guide on the provisions of the Regulation (EU) 2016/679—which repeals the 1995 EU Directive from which the DPA is based on.
According to the guide, “necessary” means that the processing must be a targeted and proportionate way of achieving the purpose. An organization does not have a lawful basis for processing if there is another reasonable and less intrusive way to achieve the same result.9
In the same manner, the principle of proportionality under the DPA requires a determination of what information are actually required for the fulfillment of a declared, specified, and legitimate purpose.10
According to MARINA, the purpose for requesting information is to prevent the issuance of STCW-related certificates to dishonest seafarers. As mentioned earlier, the dates for which the disability claims were filed by the seafarers are included in the requested information. These consist of all types of claims such as whether the disability claim is permanent or temporary, and whether the case filed is pending or promulgated.
To clarify, the MARINA, may process only those information which are necessary to carry out its mandates or functions, and shall be used for the specified purpose only. In this case, however, the disclosure of the fact of a pending case filed by a seafarer may not be necessary and proportionate to the purpose of helping the MARINA prevent the issuance of certificates to supposedly disabled seafarers.
Note further that such disclosure may result to a seafarer being profiled and/or blacklisted for simply filing a case, which might prevent seafarers with legitimate claims, from filing valid cases for disability claims. In the same manner, where the case takes a long time to be resolved, and where seafarer may have become already fit for work, the fact of a pending case may prevent him or her from seeking new employment or contract.
In which case, the information on cases which have not been decided with finality should not be considered as basis for non-issuance of STCW-related certificates, and even more, for determination of fraudulent acts. Indeed, there is a separate body that decides these claims. To label immediately those applying for a new contract where claims for disability (without distinction) are still pending, as possibly “fraudulent” may be overreaching.
One of the purposes of informational privacy is to prevent a person from being discriminated against based on unauthorized or unlawful processing of their personal data. In this regard, the information requested by the MARINA should relate to the requirements of certification and any other legally mandated functions.
In relation to this, one of the conditions for certification is medical fitness of a seafarer. Section 4(c)(5) of R.A. No. 10635 states that:
(5) The MARINA shall coordinate with the DOH to ensure that the medical standards established to ascertain the medical fitness of seafarers are in accordance with the international conventions/treaties and existing laws. For this purpose, the MARINA shall:
(i) Ensure that the medical examinations and issuance of medical certificates by the DOH accredited hospitals, medical clinics, and laboratories, including medical practitioners are in accordance with the standards prescribed by the STCW Convention; and
(ii) Ensure that medical certificates are issued by a duly-qualified medical practitioner recognized by and accredited with the DOH, and for this purpose, a register of recognized medical practitioners shall be maintained and made available to seafarers, shipping companies and State parties to the STCW Convention.11
Furthermore, the International Labour Organization and International Maritime Organization developed a guideline aimed at providing maritime administrations with an internationally recognized set of criteria for use by competent authorities either directly or as the basis for framing national medical examination standards that will be compatible with international requirements.12 According to part IV of the guidelines:
The medical certificate is neither a certificate of general health nor a certification of the absence of illness. It is a confirmation that the seafarer is expected to be able to meet the minimum requirements for performing the routine and emergency duties specific to their post at sea safely and effectively during the period of validity of the medical certificate. Hence, the routine and emergency duties must be known to the examining medical practitioner, who will have to establish, using clinical skills, whether the seafarer meets the standards for all anticipated routine and emergency duties specific to their individual post and whether any routine or emergency duties need to be modified to enable them to be performed safely and effectively.13 (Emphasis Supplied)
In view of the aforementioned, it is clear that the MARINA has a responsibility to guarantee that all medical certificates issued are in accordance with the standards established by the STCW Convention. Moreover, compliance with the STCW Convention requires the reliable expertise of a medical practitioner who shall ultimately determine the medical fitness of a seafarer.
Clearly from the foregoing, the effective evaluation of applications for STWC-related certificates submitted by seafarers especially in order to prevent fraud, is not solely dependent on the requested information. This means that the MARINA may still achieve its purpose through other means such as, but not limited to, improving their policies and procedures in the issuance of such certificates.
We take time to emphasize that the right to privacy of seafarers in terms of their medical examinations is also recognized under part VII of the Guidelines developed by the International Labour Organization and International Maritime Organization, which states:
VII. Right to privacy
All persons involved in the conduct of medical examinations, including those who come into contact with medical examination forms, laboratory results and other medical information, should ensure the right to privacy of the examinee. Medical examination reports should be marked as confidential and so treated, and all medical data collected from a seafarer should be protected. Medical records should only be used for determining the fitness of the seafarer for work and for enhancing health care; they should not be disclosed to others without prior written informed consent from the seafarer. Personal medical information should not be included on medical certificates or other documents made available to others following the medical examination. The seafarer should have the right of access to and receipt of a copy of his/her personal medical data.14 (Emphasis Supplied)
Taking into account the discussions, only adjudicated cases where an award for personal disability has been granted with finality may be disclosed, with due notice to seafarer. As to the disclosure of additional information, the MARINA must be able to justify the necessity and proportionality of such disclosure in fulfilling its mandate. The justification must have considered all other less invasive methods in order to obtain the same outcome or purpose.
We trust that the MARINA is aware that it is still subject to the requirements of the DPA, such as upholding the rights of the data subjects and implementing organizational, physical and technical security measures for the protection of personal data.
This opinion is rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) IVY D. PATDU Deputy Privacy Commissioner Officer-In-Charge
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Office of the President, Designating the Department of Transportation and Communications (DOTC), Through the Maritime Industry Authority, as the Single Administration in the Philippines Responsible for Oversight in the Implementation of the 1978 International Convention on Standards of Training, Certification and Watchkeeping for Seafarers, as Amended [E.O. No. 75] (Apr. 30, 2012). ↩
-
E.O. No. 75, § 1 - STCW Administration. The Department of Transportation and Communications (DOTC) through the MARINA shall exercise oversight and supervision over compliance with all qualification requirements and conditions under the STCW Convention, as amended, relating to maritime education, training and certification, subject to existing and applicable laws. ↩
-
An Act Establishing the Maritime Industry Authority (MARINA) as the Single Maritime Administration Responsible for the Implementation and Enforcement of the 1978 International Convention on Standards of Training, Certification and Watchkeeping for Seafarers, as Amended, and International Agreements or Covenants Related thereto, Republic Act No. 10635 (2014). ↩
-
Id. ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 4 (2016). ↩
-
International Maritime Organization, & International Conference on Training and Certification of Seafarers. STCW 1978: International Convention on Standards of Training, Certification, and Watchkeeping for Seafarers, 1978 : with resolutions adopted by the International Conference on Training and Certification of Seafarers, 1978. ↩
-
UK Information Commissioner’s Office, Guide on the General Data Protection Regulation (GDPR): Public task, p. 76, available at https://ico.org.uk/media/for-organisations/guide-to-the-general-data-protection-regulation-gdpr-1-0.pdf (last accessed Oct. 23, 2018). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, § 18(c) (2016) - Proportionality. The processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means. ↩
-
R.A. No. 10635, § 4(c)(5) ↩
-
International Labour Organization and International Maritime Organization. (2013). Guidelines on the medical examinations of seafarers, p.7 (available at: https://www.ilo.org/wcmsp5/groups/public/---ed_dialogue/---sector/documents/normativeinstrument/wcms_174794.pdf ) ↩
-
Id., p.9. ↩
-
International Labour Organization and International Maritime Organization. (2013). Guidelines on the medical examinations of seafarers, p.13 (available at: https://www.ilo.org/wcmsp5/groups/public/---ed_dialogue/---sector/documents/normativeinstrument/wcms_174794.pdf ) ↩