NPC Issuance Wiki

NPC Advisory Opinion No. 2018-079 — Authentication of a Marriage Contract for Purpose of Investigation

Issued Advisory Opinion

Official opinion tags

Text

23 October 2018

Re: AUTHENTICATION OF A MARRIAGE CONTRACT FOR PURPOSE OF INVESTIGATION

Dear [Redacted],

We write in response to your request for an advisory opinion on whether the National Bureau of Investigation (NBI) can secure data from any government or private offices in furtherance of investigations being conducted.

In particular, you seek clarification on the exemption provided under Section 4 of the Data Privacy Act of 20121 (DPA), since the Philippine Statistics Authority (PSA) allegedly refused to authenticate a copy of a marriage contract by invoking the DPA, which now impedes your investigation in relation to a case involving a violation of RA No. 9262 or the Anti-Violence Against Women and Their Children Act of 2004 and Article 349 of the Revised Penal Code for Bigamy.

Scope of the DPA

The DPA applies to all types of processing of personal data,2 including disclosure through authentication of a copy of a marriage contract which is considered sensitive personal information.3

Note, however, that Section 4 of the law and Section 5 of its Implementing Rules and Regulations (IRR) exempt specific types of information from its scope and application. Specifically, paragraph (d) of the latter states:

Section 5. Special Cases. The Act and these Rules shall not apply to the following specified information, only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned:

xxx xxx xxx

d. Information necessary in order to carry out the functions of public authority, in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function, including the performance of the functions of the independent, central monetary authority, subject to restrictions provided by law. Nothing in this Act shall be construed as having amended or repealed Republic Act No. 1405, otherwise known as the Secrecy of Bank Deposits Act, Republic Act No. 6426, otherwise known as the Foreign Currency Deposit Act; and Republic Act No. 9510, otherwise known as the Credit Information System Act (CISA);

xxx xxx xxx

Provided, that the non-applicability of the Act or these Rules do not extend to personal information controllers or personal information processors, who remain subject to the requirements of implementing security measures for personal data protection: Provided further, that the processing of the information provided in the preceding paragraphs shall be exempted from the requirements of the Act only to the minimum extent necessary to achieve the specific purpose, function, or activity.4

From the foregoing, the DPA does not apply to certain categories of personal information, including those that are necessary to carry out the functions of public authority, in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function. This exemption, however, is only to the minimum extent of collection, access, use, disclosure, or other processing necessary to the purpose, function, or activity concerned.

Likewise, the exemption is not absolute because the personal information controller (PIC) or personal information processor (PIP) remains to be subject to the requirements of the DPA, including implementing security measures to protect personal data and upholding the rights of the data subjects.

Being an exception to the rule, it must be established that the information claimed to be outside the scope of the DPA is:

  1. Necessary in order to carry out the functions of public authority; and
  2. Processing of personal data is for the performance of a constitutional or statutory mandate.

The above presupposes that there is also strict adherence to all required substantive and procedural processes.

We note that the NBI is created, reorganized, and modernized to enhance the investigative and detective work that it handles.5 It has express power to request the assistance of law enforcement agencies such as the Philippine National Police (PNP), Armed Forces of the Philippines (AFP) or any other agency of the government in its anti-crime drive.

Thus, it is fundamentally an investigative agency rather than a law enforcement agency. Nevertheless, the NBI is considered a law enforcement agency when statute declares it to be so, such as in the Anti-Child Pornography Act of 20096 and the Comprehensive Dangerous Drugs Act of 2002,7 among others.

Lawful processing of sensitive personal information; statutory mandate; PSA Office Memorandum; issuance of certified certificates

Note that under Section 13 of the DPA, consent is not the only basis for processing sensitive personal information. Processing may be based several other criteria, such a processing required by law, those necessary to protect the life and health of the data subject, to achieve the lawful and noncommercial objectives of public organizations, for medical treatment, or for the protection of lawful rights and interests in court proceedings, or establishment, exercise or defense of legal claims.

The NBI’s processing in the given scenario may be based on Section 13(b) of the DPA, which states that processing of sensitive personal information is permitted when the processing of the same is provided for by existing laws and regulations.

In relation to the release of certain civil registry documents, the PSA issued Office Memorandum No. 2017-050 dated 17 April 2017 on the Release of Certificate of Death, Certificate of Marriage, Certificate of No Marriage and Advisory on Marriages. It is stated therein that the above certificates can only be issued to the following:

a) The owner himself or through a duly authorized representative; b) His/her spouse, parent, direct descendants, guardian or institution legally in-charge of him/her, if minor; c) The court or proper public official whenever absolutely necessary in administrative, judicial or other official proceedings to determine the identity of a person; d) In case of the person’s death, the nearest of kin.8

Hence, the NBI, having a statutorily mandated function to investigate crimes and other offenses, and the processing of sensitive personal information is necessary for the performance of such function, may lawfully process such personal data and ask the PSA to authenticate the copy of the subject marriage certificate, provided it strictly follows all existing laws and regulations, and its own procedures, which includes the issuance of the necessary subpoena as provided under Section 4(b) of Republic Act No. 10867.

The disclosure by PSA, i.e. the authentication of the copy of the marriage certificate, no longer needs the consent of the data subject as the basis for processing is not consent but as mentioned, the same is based on existing laws and regulations. Such processing is necessary and consistent with the mandate of the NBI to investigate crimes and other offenses.8

This opinion is rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. Id. § 4. ↩

  3. Id. § 3 (l) — Sensitive personal information refers to personal information: (1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; (2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and (4) Specifically established by an executive order or an act of Congress to be kept classified. ↩

  4. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 5 (2016). ↩

  5. An Act Reorganizing and Modernizing the National Bureau of Investigation (NBI) And Providing Funds Therefor [NBI Reorganization and Modernization Act], Republic Act No. 10867, § 3 (2016). ↩

  6. An Act Defining the Crime of Child Pornography, Prescribing Penalties Therefor and For Other Purposes [Anti-Child Pornography Act Of 2009] Republic Act No. 9775, § 20 (2009). ↩

  7. An Act Instituting the Comprehensive Dangerous Drugs Act of 2002, Repealing Republic Act No. 6425, Otherwise known as the Dangerous Drugs Act of 1972, as Amended, Providing Funds Therefor, and for Other Purposes [Comprehensive Dangerous Drugs Act Of 2002] Republic Act No. 9165 (2002). ↩

  8. Philippine Statistics Authority, Release of Certificate of Death, Certificate of Marriage, Certificate of No Marriage and Advisory on Marriages, Reference No. 17ONS-LS_382, Office Memorandum 2017-050, 17 April 2017. ↩ ↩2

Backlinks