Text
3 January 2019
Re: PRIVATE DETECTIVE SERVICES
Dear [Redacted],
We write in response to your request for an advisory opinion received by the National Privacy Commission (NPC). You disclosed that Eyespy Detectives and Investigators Co. (Eyespy) is a duly registered partnership with the Securities and Exchange Commission, and a duly registered and licensed to operate detective agency with the Supervisory Office of Security and Investigation Agencies of the Philippine National Police, pursuant to Republic Act No. 5487, as amended,1 or the Private Security Agency Law.
Discussion
Eyespy offers several services including background checks or investigation, records verification, property checks or verification, surveillance operation, service of summons (from foreign courts), assistance in locating missing persons, insurance claim investigation or verification, polygraph examination and lifestyle check upon the request of clients.
As stated in your letter, Eyespy has adopted measures to ensure that client requests for services are supported by legal and justifiable purposes, such as gathering of evidence for a pending case of or a suit to be instituted by the client. You further stated that there are, however, instances where services, such as surveillance operations and background checks, are requested for the sole purpose of enabling the client to make better personal decisions.
The conduct of a discreet surveillance operation, background check or investigation, or record verification are often requested: a) by a party in a dating relationship, on their partner; b) by a foreigner, on his Filipino fiancée to determine if she is indeed single, has the capacity to marry and without derogatory record; and c) by parents, on the girlfriend, boyfriend, fiancé or fiancée of their child.
You now wish to clarify whether the abovementioned activities of Eyespy are permissible by the provisions of Republic Act No. 10173,2 or the Data Privacy Act of 2012 (DPA), particularly on the processing of sensitive personal information of individuals in cases when the request is not pursuant to a pending case or in preparation for the filing of one.
Activities in Private Investigation Subject to the DPA
Processing refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.3
Moreover, the law defines personal information as information which the identity of individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information, would directly and certainly identify and individual.4 On the other hand, what is considered as sensitive personal information is clearly enumerated as:
(1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; (2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or cm-rent health records, licenses or its denials, suspension or revocation, and tax returns; and (4) Specifically established by an executive order or an act of Congress to be kept classified.5
While private investigation is a duly recognized field, there being the Private Security Agency Law, the activities and services involved therein, such as records verification on birth, marital status and education, would necessarily involve the processing of personal information and sensitive personal information, thus subject to the provisions of the DPA. For processing of personal information, the Section 12 of the law provides the following conditions for lawful processing:
(a) The data subject has given his or her consent; (b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract; (c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject; (d) The processing is necessary to protect vitally important interests of the data subject, including life and health;
(e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or (f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights an freedoms of the data subject which require protection under the Philippine Constitution.
Meanwhile, under the Section 13 of the law, the processing of sensitive personal information is prohibited unless specific conditions under the law are met:
(a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing; (b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information; (c) The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing; (d) The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, That such processing is only confined and related to the bona fide members of these organizations or their associations: Provided, further, That the sensitive personal information are not transferred to third parties: Provided, finally, That consent of the data subject was obtained prior to processing; (e) The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured; or (f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.
Furthermore, the general data privacy principles of transparency, legitimate purpose, and proportionality must always be adhered to in the processing of personal data.
Expectation of Privacy
On another perspective, while the 1987 Philippine Constitution guards the right to be let alone of individuals against unreasonable State intrusion, the Civil Code of the Philippines holds liable individuals for violating another person’s right to privacy. The Code states:
Every person shall respect the dignity, personality, privacy and peace of mind of his neighbors and other persons and that the act of prying into the privacy of another’s residence and meddling with or disturbing the private life or family relations of another, though it may not constitute a criminal offense, shall produce a cause of action for damages, prevention and other relief:
(1) Prying into the privacy of another’s residence: (2) Meddling with or disturbing the private life or family relations of another;
(3) Intriguing to cause another to be alienated from his friends; (4) Vexing or humiliating another on account of his religious beliefs, lowly station in life, place of birth, physical defect, or other personal condition.6
Our Supreme Court had the chance to delve on the right to privacy in relation to the abovementioned provision and held:
The right to privacy is enshrined in our Constitution and in our laws. It is defined as “the right to be free from unwarranted exploitation of one’s person or from intrusion into one’s private activities in such a way as to cause humiliation to a person’s ordinary sensibilities.” It is the right of an individual “to be free from unwarranted publicity, or to live without unwarranted interference by the public in matters in which the public is not necessarily concerned.” Simply put, the right to privacy is “the right to be let alone.”
xxx xxx xxx
Thus, an individual’s right to privacy under Article 26(1) of the Civil Code should not be confined to his house or residence as it may extend to places where he has the right to exclude the public or deny them access. The phrase “prying into the privacy of another’s residence,” therefore, covers places, locations, or even situations which an individual considers as private. And as long as his right is recognized by society, other individuals may not infringe on his right to privacy.7
Furthermore, in our Advisory Opinion No. 2018-090 – Data Privacy and Office-Issued Mobile Devices, we discussed on the expectation of privacy and how the passage of the DPA affects it, to wit:
The ruling in Ople v. Torres also expounded on the “reasonable expectation of privacy” test in ascertaining whether there is a violation of the right to privacy. This test determines whether a person has a reasonable or objective expectation of privacy and whether the expectation has been violated. The reasonableness of a person’s expectation of privacy depends on a two-part test:
(1) whether by his conduct, the individual has exhibited an expectation of privacy; and (2) whether this expectation is one that society recognizes as reasonable.
The factual circumstances of the case determine the reasonableness of the expectation. Similarly, customs, community norms, and practices may, therefore, limit or extend an individual’s reasonable expectation of privacy. The reasonableness of a person’s expectation of privacy must then be determined on a case-to-case basis.
xxx xxx xxx
It is noteworthy to mention that the reasonable expectation test was used at a time when there were no laws on data protection and informational privacy.
xxx xxx xxx
Yet, with the DPA now in place, the reasonable expectation test should be revisited and interpreted in the context of the law.
By virtue of a legislation on data protection and privacy, the assumption is that individuals now have an expectation of privacy. As to the second element, data privacy is now more than a reasonable expectation – it is now enshrined in the DPA. The reasonable expectation of privacy test then should take into consideration the standards provided under the DPA.8
General Guidelines to Consider
In your letter, it is unclear what means and methods are used by Eyespy in the conduct of its services. Thus, the NPC is unable to make a categorical determination on the legality of its activities as circumstances may also differ.
However, in the conduct of the contemplated services, Eyespy may examine its activities through the framework below:
- The type of personal data is involved, i.e. personal information and/or sensitive or privileged personal information; 2) The lawful basis to process such personal data given the situation, if any (Eyespy may look into Sections 12 (b) and (f) and/or 13(f) of the DPA); and 3) The means and methods used, taking into consideration proportionality and expectation of privacy.
Given the foregoing discussion, it is also for Eyespy to determine whether its acts, such as records verification and background investigation, would: (a) constitute a violation of an individual’s expectation of privacy, and (b) violate existing laws, including the DPA.
It is worth noting that the DPA dictates its provisions shall be liberally interpreted in a manner mindful of the rights and interests of the data subject.9 Thus, it is the burden of Eyespy to ensure that any processing of personal data is in accordance with the law.
This advisory opinion is based on the information provided and may vary based on additional information or when the facts are changed or elaborated.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act to Regulate the Organization and Operation of Private Detective, Watchmen or Security Guards Agencies [Private Security Agency Law], Republic Act No. 5487, as amended (1969). ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, (2012). ↩
-
An Act to Ordain and Institute the Civil Code of the Philippines [CIVIL CODE OF THE PHILIPPINES], Republic Act No. 386, art. 29 (1949). ↩
-
Spouses Bill and Victoria Hing v. Alexander Choachuy Sr. and Allan Choachuy, G.R. No. 179736, June 26, 2013. Citations omitted. ↩
-
National Privacy Commission, NPC Advisory Opinion No. 2018 – 090 (Nov. 28, 2018). Citations omitted. ↩