NPC Issuance Wiki

NPC Advisory Opinion No. 2018-077 — Congressional Request for Beneficiary Lists

Issued Advisory Opinion

Official opinion tags

Text

25 October 2018

Re: CONGRESSIONAL REQUEST FOR LISTS OF BENEFICIARIES OF THE PANTAWID PAMILYANG PILIPINO PROGRAM (4Ps) AND THE SOCIAL PENSION FOR INDIGENT SENIOR CITIZENS PROGRAM

Dear [Redacted],

We write in response to your request for an advisory opinion which sought clarification on the possible data privacy concerns regarding the request for information from the Chairperson of the Committee on Appropriations of the House of Representatives. The request states in part as follows:

Discussion

“In the performance of the oversight function of Congress through the House Committee on Appropriations, this representation respectfully requests from your good office the list of beneficiaries of the following DSWD programs:

  1. Pantawid Pamilyang Pilipino Program (4Ps) 2. Social Pension for Indigent Senior Citizens Program.”

We understand that both the 4Ps and the Social Pension for Indigent Senior Citizens Program are government programs under the DSWD aimed at providing assistance to indigents. Both programs, in processing personal information of beneficiaries, are covered by the Data Privacy Act of 20121 (DPA).

  1. Would the names of the beneficiaries be considered as personal information or sensitive personal information?

The names of the beneficiaries are considered as personal information, defined under the DPA as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.2 It is not sensitive personal information. The DPA under Section 3(l) provides an enumeration of what constitutes sensitive personal information, such as a person’s race, marital status, age, health and educations records, social security numbers, among others.

  1. If the DSWD is asked to provide a sorted list, e.g. sorted by congressional district, would that constitute another field of information? If so, would such additional information be considered personal information or sensitive personal information?

The sorted list showing congressional district would constitute another field of information, as the list would now indicate name and address, albeit limited to district, of the data subject. The information is considered personal information and not sensitive personal information.

  1. Assuming the names and other information of beneficiaries are considered merely “personal information” and not “sensitive personal information”, under Section 12(c) of the DPA, the same may be processed when “The processing is necessary for compliance with a legal obligation to which the personal information controller is subject.” In this instance, would the oversight function of Congress qualify as a “legal obligation” of the DSWD?

Congressional oversight embraces “all activities undertaken by Congress to enhance its understanding of and influence over the implementation of legislation it has enacted. Clearly, oversight concerns post-enactment measures undertaken by Congress: (a) to monitor bureaucratic compliance with program objectives, (b) to determine whether agencies are properly administered, (c) to eliminate executive waste and dishonesty, (d) to prevent executive usurpation of legislative authority, and (d) to assess executive conformity with the congressional perception of public interest.”3

We refer to the Rules of the House of Representatives4 which declares that “efficient and effective access to and dissemination of appropriate and accurate information are imperative in lawmaking.”5 Further, the said rules state that “Committees shall have oversight responsibilities to determine whether or not laws and programs addressing subjects within their jurisdictions are being implemented and carried out in accordance with the intent of Congress and whether or not they should be continued, curtailed, or eliminated.”6

In addition, the rules provide that committees shall review and study on a continuing basis, or upon order of the House:

a. the application, administration, execution, and effectiveness of laws and programs addressing subjects within their respective jurisdictions; b. the organization and operation of national agencies and entities having responsibilities for the administration and execution of laws and programs addressing subjects within their respective jurisdictions; and

c. any conditions or circumstances that may indicate the necessity or desirability of enacting new or additional legislation addressing subjects within their respective jurisdictions.7

Note that Section 12 of the DPA provides for the criteria for lawful processing of personal information. Included among these is the criterion relating to the mandate of public authorities, i.e. when “processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate.”8

In view of the foregoing, the request for information and processing to be done by the Committee on Appropriations may be founded on the fulfillment of the mandate of the said Committee exercising its oversight function.

  1. Again assuming the names and other information of beneficiaries are considered merely “personal information” and not “sensitive personal information”, under Section 12(f) of the DPA, the same may be processed when “The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed.” In this instance, would the “oversight function of Congress qualify as a “legitimate interest” of the Congress?

The processing performed by the government should always be anchored on the Constitution, or mandated by a law, rule or regulation. Hence, legitimate interest of government should have statutory or constitutional basis.

However, as discussed above, the disclosure of information by the DSWD to the Committee may be based on the fulfillment of the functions of a public authority under Section 12 (e) of the DPA.

  1. Assuming the names and other information of beneficiaries are considered merely “sensitive personal information” (and not merely “personal information”), under Section 13(f) of the DPA, the same may be processed when “The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.” In this instance, would the Committee on Appropriations of the House of Representatives qualify as a “government or public authority”?

As discussed, the names and addresses of beneficiaries are personal information and not sensitive personal information. However, should such list contain additional information of the beneficiaries, i.e. marital status, age, social security numbers, tax identification numbers, etc., these are then considered as sensitive personal information, and the applicable criteria for lawful processing may be Section 13(b) where processing is provided for by existing laws and regulations and/or Section 13(f) processing concerns such personal information provided to government or public authority.

  1. In sum, and considering all of the foregoing, would it be lawful for the DSWD to grant the request mentioned above, and provide the Committee on Appropriations of the House of Representatives with the lists of beneficiaries of the 4Ps and of the Social pension for Indigent Senior Citizens Program?

DSWD may grant the request of the Committee on Appropriations of the House of Representatives pursuant to the oversight function cited and the criteria for lawful processing of personal information as discussed above.

However, DSWD should also consider the principle of proportionality, whereby the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.

We note that the 2018 General Appropriations Act (GAA) Special Provisions for the 4Ps and Social Pension for Indigent Senior Citizens Program merely require DSWD to “submit its quarterly reports on the financial and physical accomplishments with electronic signature to the DBM, through the unified reporting system, and to the Speaker of the House of Representatives, the President of the Senate of the Philippines, the House Committee on Appropriations and the Senate Committee on Finance…”

Therefore, there is a need to determine if statistics or aggregated data will suffice for the oversight function of the Committee on Appropriations of the House of Representatives instead of requiring individual level data.

We underscore that the interpretation of any provision of the DPA must be in a manner mindful of the rights and interests of the data subject.9 Processing operations performed about vulnerable data subjects like minors, the mentally ill, asylum seekers, the elderly, patients, those involving criminal offenses, or in any other case where an imbalance exists in the relationship between a data subject and a personal information controller or personal information processor,10 require special protection.11

Further, the risk to the rights and freedoms of persons that may result from personal data processing which could lead to physical, material or non-material damage, i.e. where personal aspects are evaluated, in particular analyzing or predicting aspects concerning performance at work, economic situation, health, personal preferences or interests, reliability or behavior, location or movements, in order to create or use personal profiles,12 should be considered as well.

Should aggregated data be insufficient for the purpose, the House of Representatives should provide information why the specific personal information requested is necessary in relation to its declared purpose. Where the House of Representatives collects and processes this information from the DSWD, the House will be bound by its obligations under the DPA, its IRR, and issuances of the NPC, specifically NPC Circular No. 16-01 on the Security of Personal

Data in Government Agencies and NPC Circular No. 16-02 - Data Sharing Agreements Involving Government Agencies.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) LEANDRO ANGELO Y. AGUIRRE Officer-in-Charge and Deputy Privacy Commissioner for Data Processing Systems

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, (2012). ↩

  2. Id. 3 (g). ↩

  3. Abakada Guro Party List v. Purisima, G.R. No. 166715 (2008), citing Macalintal v. COMELEC, 453 Phil. 586 (2003). ↩

  4. House of Representatives, Rules of the House of Representatives 16th Congress, as adopted by the 17th Congress, available at http://www.congress.gov.ph/download/docs/hrep.house.rules.pdf (last accessed 2 October 2018). ↩

  5. Id. Declaration of Principles and Policies ↩

  6. Id. Rule IX, § 26. ↩

  7. Id. ↩

  8. Data Privacy Act of 2012, § 12 (e). ↩

  9. Data Privacy Act of 2012, § 38. ↩

  10. National Privacy Commission, Registration of Data Processing Systems and Notifications Regarding Automated Decision-Making, Circular No. 17-01 [NPC Circular 17-01], § 5 (c) (3) (July 31, 2017). ↩

  11. Article 29 Data Protection Working Party, Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679, Item III (B)(a)(7), 4 April 2017, available at http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=611236, (last accessed 12 Oct 2018). ↩

  12. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) Official Journal of the European Union, Vol. L119 (4 May 2016), Recital 75. ↩

Backlinks