NPC Issuance Wiki

NPC Advisory Opinion No. 2018-078 — Disclosure of Personal Data for the Department of Labor and Employment’s Audit of Employers

Issued Advisory Opinion

Text

16 October 2018

Re: DISCLOSURE OF PERSONAL DATA FOR THE DEPARTMENT OF LABOR AND EMPLOYMENT’S AUDIT OF EMPLOYERS

Dear [Redacted],

We write in response to your letter request for advisory opinion wherein you sought clarification on whether the Convergys Group, namely, Convergys Philippines, Inc., Convergys Singapore Holdings Inc. – ROHQ, Convergys Malaysia (Philippines) Sdn. Bhd. – Philippine Branch, and Encore Receivable Management, Inc. – Philippine Branch:

a) can provide government agencies which have audit powers, the personal information and sensitive personal information of its employees; and b) if the aforesaid sharing and disclosure of the same will not require the consent of and/or prior notice to its employees.

From your letter, we understand that DOLE requests for documents which contain personal and sensitive personal information of your employees, including:

a) roster of employees, status of employment, date of hire, and wage rate; b) pay slips of employees, which contain their name, wage received, and other financial information such as loan details; c) records of leave benefits, which may contain leave benefits pertaining to maternity leaves and violence against women leaves; d) list of foreign officials currently employed by the company, their nationality, nature of employment, status of stay in the Philippines, copies of their Alien Employment Permit, which contain their name, nationality and Tax Identification Number (TIN), among others, and copies of their Alien Card Registrations, which contains their name, nationality, civil status, sex, and date of birth; and e) contracts with various vendors, which contain names, contact information and other personal information such as TIN of the signatories.

You mentioned as well that while you recognize the Department of Labor and Employment’s (DOLE) authority to audit employers, you also need to ensure that you comply with both their requests and the requirements of Data Privacy Act of 20121(DPA). Furthermore, you are concerned with similar situations that may arise from your transactions with other government agencies such as the Social Security System and Bureau of Internal Revenue. Hence, you wanted an opinion on the extent of information that you may provide to these government agencies.

Discussion

Lawful criteria for processing of personal data; general data privacy principles

The DPA applies to the processing of all types of personal information2, sensitive personal information3, and privileged information4 (collectively referred to as personal data) and to any natural and juridical person involved in the processing thereof, including government agencies. The collection, disclosure or any type of processing of the requested personal data by DOLE fall within the ambit of the law, which dictates the requirements that must be complied with.

Sections 12 and 13 of the DPA lay down the specific criteria which must be met for the lawful processing of personal information and sensitive personal information, respectively. In order to authorize any processing of personal data, a personal information controller (PIC) must adhere to all the requirements established by the DPA. Sections 12(e) and 13(b) provide:

“SECTION 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

xxx

(e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate;

xxx

SECTION. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

(b) The processing of the same is provided for by existing laws and regulations; Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;”

As set out in the Administrative Code of 1987,2 the DOLE is mandated to be the primary policy-making, programming, coordinating and administrative entity of the Executive Branch of the government in the field of labor and employment.3 It shall assume primary responsibility for:

  • The promotion of gainful employment opportunities and the optimization of the development and utilization of the country’s manpower resources;
  • The advancement of workers’ welfare by providing for just and humane working conditions and terms of employment;
  • The maintenance of industrial peace by promoting harmonious, equitable, and stable employment relations that assure equal protection for the rights of all concerned parties.4

Furthermore, the DOLE has the following powers and functions set out by the same law, viz:

“SECTION 3. Powers and Functions.—The Department of Labor and Employment shall:

(1) Enforce social and labor legislation to protect the working class and regulate the relations between the worker and his employer;

(2) Formulate and recommend policies, plans and programs for manpower development, training, allocation, and utilization;

(3) Recommend legislation to enhance the material, social and intellectual improvement of the nation’s labor force;

(4) Protect and promote the interest of every citizen desiring to work locally or overseas by securing for him the most equitable terms and conditions of employment, and by providing social and welfare services;

(5) Regulate the employment of aliens, including the enforcement of a registration or work permit system for such aliens, as provided for by law;

(6) Formulate general guidelines concerning wage and income policy;

(7) Recommend necessary adjustments in wage structures with a view to developing a wage system that is consistent with national economic and social development plans;

(8) Provide for safe, decent, humane and improved working conditions and environment for all workers, particularly women and young workers;

(9) Maintain a harmonious, equitable and stable labor relations system that is supportive of the national economic policies and programs;

(10) Uphold the right of workers and employers to organize and promote free collective bargaining as the foundation of the labor relations system;

(11) Provide and ensure the fair and expeditious settlement and disposition of labor and industrial disputes through collective bargaining, grievance machinery, conciliation, mediation, voluntary arbitration, compulsory arbitration as may be provided by law, and other modes that may be voluntarily agreed upon by the parties concerned; and

(12) Perform such other functions as may be provided by law.”

In line with its mandate, powers and functions, the DOLE promulgated Department Order No. 183, Series of 2017, known as the Revised Rules on the Administration and Enforcement of Labor Laws Pursuant to Article 128 of the Labor Code, as Renumbered5 (D.O. 183) which aims to further strengthen the implementation of the visitorial and enforcement powers of the Secretary of Labor under the Labor Code.6 Verily, Article 128 of the Labor Code provides in part:

“The Secretary of Labor and Employment or his duly authorized representatives, including labor regulation officers, shall have access to employer’s records and premises at any time of the day or night whenever work is being undertaken therein, and the right to copy therefrom, to question any employee and investigate any fact, condition or matter which may be necessary to determine violations or which may aid in the enforcement of this Code and of any labor law, wage order or rules and regulations issued pursuant thereto.”7

Given the foregoing, the DOLE is indeed duly authorized to audit employers, and collect, obtain and process the requested information as necessary for the implementation of its mandated powers and functions. Thus, the requested personal data of your employees in your custody may be disclosed to DOLE without the consent of your employees.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. Office of the President, Instituting the “Administrative Code of 1987,” Executive Order No. 292 [Administrative Code of 1987] (July 25, 1987). ↩

  3. Id. Book IV, Title VII, Chapter 1, § 2. ↩

  4. Ibid. ↩

  5. Department of Labor and Employment, Revised Rules on the Administration and Enforcement of Labor Laws Pursuant to Article 128 of the Labor Code, as Renumbered [D.O. 183, s. 2017], (October 18, 2017). ↩

  6. A Decree Instituting a Labor Code Thereby Revising and Consolidating Labor and Social Laws to Afford Protection to Labor, Promote Employment and Human Resources Development and Insure Industrial Peace Based on Social Justice, Presidential Decree No. 442, as amended [LABOR CODE], (May 1, 1974). ↩

  7. Id. § 128. Underscoring supplied. ↩

Backlinks

  • No backlinks found