Text
14 January 2019
Re: INSPECTION OF CORPORATE RECORDS CONCERNING AN INDIVIDUAL
Dear [Redacted],
We write in response to your request for an advisory opinion on the interpretation of the provisions of the Data Privacy Act of 20121 (DPA) and its Implementing Rules and Regulations (IRR)2 in relation to Section 74 of the Corporation Code of the Philippines (Corporation Code), specifically the following:
- Whether case files involving a member of a corporation constitute personal information or sensitive personal information under the DPA; and
- Whether the disclosure of the case files to inspecting members of a corporation would constitute lawful processing under the DPA or unlawful disclosure giving rise to liability under the DPA.
Discussion
Scope of the DPA; Personal Information; Sensitive Personal Information
The DPA applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing.
As defined in Section 3(g) of the DPA, personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.
Thus, the files regarding a case before a company’s ethics committee, which includes the committee report/s, minutes of the committee and Board of Directors’ meetings, and any pertinent board resolution/s on the matter, which necessarily identifies the individual or data subject concerned, is considered as personal information.
Moreover, information “about an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings”3 are considered sensitive personal information.
In your letter, you have requested for clarification on whether the emphasized statement above pertains only to judicial proceedings and not to any other type of proceedings.
After a careful reading of the provision above, it is worthy to note that the items are separated by commas and the last phrase is conjoined by the word or which signals disassociation or independence of the words and ideas enumerated.4
The provision clearly states that information pertaining to any: (1) proceeding for any offense committed or alleged to have been committed by the data subject; (2) the disposal of the proceedings; OR (3) the sentence of any court in such proceedings, qualifies such information as sensitive.
It then covers any of the three (3) items involving a data subject, not limited to court proceedings.
The omission of the term judicial to specify the type of proceeding under Section 3(l) of the DPA reflected the view of the legislators not to limit the scope of proceedings to judicial proceedings. Thus, case files of every data subject, in all types of proceedings, shall be provided a higher degree of protection “as the context of their processing could create significant risks to the fundamental rights and freedoms.”5
Case files, whether judicial or non-judicial in nature, may contain evidence in the form of affidavits, photographs, confidential documents, or objects that may endanger an individual, cause undue prejudice or cloud judgement that will violate the rights and interests of the data subject/s involved.
Records of other types of proceedings may comprise of minutes of the meetings, notes, opinions and committee resolutions. These may be akin to those documents related to the deliberative process of reaching a decision.
In In Re: Production of Court Records and Documents and the Attendance of Court officials and employees as witnesses under the subpoenas of February 10, 2012 and the various letters for the Impeachment Prosecution Panel dated January 19 and 25, 2012,6 the Supreme Court ruled that certain information contained in the records of cases before them are considered confidential and are exempt from disclosure due to the dictates of the integrity of the decision-making function of the body which may be affected by the disclosure of particular information.7
Similarly, records of other types of proceedings may be treated with utmost protection, where the disclosure of such documents will hinder free discussion of issues, exchange of opinions, and positions of the individuals involved.
Further, Section 38 of the DPA provides that any doubt in the interpretation of any provision of the Act shall be liberally interpreted in a manner mindful of the rights and interests of the individual about whom personal information is processed.
Hence, the protection of case files, which includes not only the resolution but the deliberations, evidence, notes, opinions or any other documentation relevant to the proceeding, is incumbent upon the personal information controller for these are sensitive personal information, as defined in the DPA.
Lawful Processing of Sensitive Personal Information; Section 74 of the Corporation Code
The DPA generally prohibits the processing of sensitive personal and privileged information, except in the following cases in Section 13:
a. The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing;
b. The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information; Provided, further, that the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;
c. The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing;
d. The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations; Provided, That such processing is only confined and related to the bona fide membership of these organizations or their associations; Provided, further, That the sensitive personal information are not transferred to third parties; Provided, finally, that consent of the data subject was obtained prior to processing;
e. The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured; or
f. That the processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.
You have cited in your letter that the processing of sensitive personal information of the data subject concerned may fall under Section 13(b) of the DPA in relation with Section 74 of the Corporation Code, which provides for the right of any director, trustee, stockholder or member of the corporation to inspect the records of all business transactions of the corporation and the minutes of any meeting.
In the case of Philippine Associated Smelting and Refining Corporation vs. Lim,8 the Supreme Court had the occasion to rule on Section 74 of the Corporation Code, to wit:
“Specifically, stockholders cannot be prevented from gaining access to the (a) records of all business transactions of the corporation; and (b) minutes of any meeting of stockholders or the board of directors, including their various committees and subcommittees.
The grant of legal personality to a corporation is conditioned on its compliance with certain obligations. Among these are its fiduciary responsibilities to its stockholders. Providing stockholders with access to information is a fundamental basis for their intelligent participation in the governance of the corporation as a business organization that they partially own.
xxx xxx xxx
The phraseology of the text of the law provides that access to the information mentioned in Section 74 of the Corporation Code is mandatory. The presumption is that the corporation should provide access. If it has basis to deny, then the corporation shoulders the risks of being sued and of successfully raising the proper defenses. The corporation cannot immediately deploy its resources — part of which is owned by the requesting stockholder — to put the owner on the defensive.
From the foregoing, the disclosure of the case files to inspecting members may fall under the criterion for lawful processing provided for in Section 13(b) of the DPA, in relation to Section 74 of the Corporation Code.
Nevertheless, Section 13(b) of the DPA requires basis under law or regulation for the processing of sensitive personal information. It is the duty of the corporation to determine whether Section 74 of the Corporation Code suffices for the purpose of allowing the disclosure contemplated by the requesting party.
We note that such disclosure intended, although seemingly mandatory, is also limited by the conditions set forth in Section 74, i.e. “it shall be a defense to any action under this section that the person demanding to examine and copy excerpts from the corporation’s records and minutes has improperly used any information secured through any prior examination of the records or minutes of such corporation or of any other corporation, or was not acting in good faith or for a legitimate purpose in making his demand.”9
Likewise, such disclosure shall also be duly limited by any other applicable laws, rules, regulations, policies, contractual obligations on the matter, i.e. those requiring non-disclosure and confidentiality of documents and records, etc. Finally, the disclosure of the case files, if indeed warranted, shall also consider the general privacy principles of transparency, legitimate purpose, and proportionality set forth in the DPA and its IRR.
The data subject concerned has the right to be informed of the request for disclosure. Moreover, the corporation has the obligation to examine or inquire about the particular demand thereby disclosing only those personal information that are necessary, not excessive, relevant and adequate to fulfill the legitimate purpose of the demand, as required by Section 74 of the Corporation Code.
This opinion is based on the limited information you have provided. The NPC was not provided with the details of the nature of the case in question deliberated upon by the ethics committee. Additional information may change the context of the inquiry and the appreciation of facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 (2016). ↩
-
Microsoft Corporation v. Rolando D. Manansala and/or Mel Manansala, G.R No. 166391 (21 October 2015). ↩
-
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) Official Journal of the European Union, Vol. L119, Recital 51 (4 May 2016). ↩
-
Supreme Court En Banc Resolution (14 February 2012). ↩
-
Id. ↩
-
Philippine Associated Smelting and Refining Corporation v. Lim, 804 SCRA 600, G.R. No. 172948 (October 5, 2016). ↩
-
The Corporation Code of the Philippines, Batas Pambansa Blg. 68, § 74 (1980). ↩