Text
4 January 2019
Re: REQUEST FOR INFORMATION FROM THE BUREAU OF INTERNAL REVENUE AND THE MANILA ELECTRIC COMPANY
Dear [Redacted],
We write in response to your request for assistance in relation to your various requests for documents and other information from the following:
-
Bureau of Internal Revenue (BIR) — documents relating to a certain corporation under the name Eastern Park View Neighborhood Association, Inc., specifically, the certified true copy of the following:
a. BIR Form No. 1903 — Application for Registration For Corporations/Partnerships (Taxable/Non-Taxable), Including GAIs and LGUs b. BIR Form No. 1906 — Application for Authority to Print Receipt and Invoices c. BIR Certificate of Registration (COR)
-
Manila Electric Company (MERALCO) — information on the following:
a. Person who allowed the MERALCO customers to apply for electric service; b. Names of MERALCO customers; and c. Who are the actual occupants of the subject property.
We understand that the above requests stemmed from your predicament in dealing with alleged informal settlers in your property in [Redacted], Antipolo City.
Discussion
Scope of the DPA
The Data Privacy Act of 2012 (DPA)1 applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing.
Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.
With this, the information in the various BIR forms and BIR COR pertain to corporations or juridical entities. As such, this is corporate information and not personal information.
Nonetheless, the disclosure of such forms is still regulated by other applicable laws and regulations, specifically the 1997 Tax Code, as amended, and Executive Order No. 2, s. 2016, and the Inventory of Exceptions to the same. We understand that the BIR denied your request based on the above.
As to the request for information with MERALCO, this pertains to personal information. We understand that MERALCO likewise denied your request as this will allegedly be contrary to the provisions of the DPA as well as the Distribution Services and Open Access Rules (DSOAR), promulgated by the Energy Regulatory Commission (ERC) pursuant to RA No. 9136 or the Electric Power Industry Reform Act of 2001.
Pursuant to the DPA, the processing of personal information, which includes the disclosure thereof, should be based on any of the following criteria for lawful processing under Section 12, to wit:
SECTION 12. Criteria for Lawful Processing of Personal Information. — xxx
(a) The data subject has given his or her consent; (b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract; (c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject; (d) The processing is necessary to protect vitally important interests of the data subject, including life and health; (e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or (f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.
Based on the above, MERALCO’s disclosure to you can be considered as processing necessary for the legitimate interest of the third party to whom the data is disclosed under Section 12 (f) above.
To determine if there is “legitimate interest” in processing personal information, personal information controllers (PICs) such as MERALCO must consider the following:2
- Purpose test — The existence of a legitimate interest must be clearly established, including a determination of what the particular processing operation seeks to achieve.
- Necessity test — The processing of personal information must be necessary for the purposes of the legitimate interest pursued by the PIC or third party to whom personal information is disclosed, where such purpose could not be reasonably fulfilled by other means; and
- Balancing test — The fundamental rights and freedoms of data subjects must not be overridden by the legitimate interests of the PICs or third party, considering the likely impact of the processing on the data subjects.3
However, similar to the BIR request, it is recognized that other applicable laws and regulations applies to the disclosure of MERALCO’s customer information, such as the DSOAR. Also, MERALCO mentioned that it has no information on the identity of the actual occupants of the property in question.
While we understand the challenges you have encountered, requesting for such information from MERALCO may be moot and academic at this point.
Nevertheless, you may continue with your current efforts with the local government unit and the Philippine National Police, and require assistance from the Housing and Urban Development Coordinating Council (HUDCC) and the Department of Justice (DOJ) as these are the primary government agencies spearheading the drive against professional squatters and squatting syndicates.
This opinion is based solely on the information you have provided. Additional information may change the context of the inquiry and the appreciation of facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
See generally, Data Privacy Act of 2012, § 12(f); United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ (last accessed on June 11, 2018). ↩
-
See: National Privacy Commission, Advisory Opinion No. 2018-080 (Nov. 5, 2018). ↩