Text
05 March 2019
Re: RESEARCH AND THE DATA PRIVACY ACT OF 2012
Dear [Redacted],
We write in response to your inquiry regarding academic research in relation to the Data Privacy Act of 2012.1 You are seeking clarification as to the implications of the law to the conduct of academic research vis-à-vis access to documents and records in the custody of national government agencies. Specifically, you are inquiring whether you can be granted access to the geocodes of the Labor Force Survey (LFS) administered by the Philippine Statistics Authority (PSA).
Discussion
DPA and Research
Research is an activity that aims to develop or contribute to knowledge that can be generalized (including theories, principles, relationships), or any accumulation of information using scientific methods, observation, inference, and analysis.2
It is the intent of the DPA to grant processing of personal information for research purposes with much flexibility. It recognizes that research is critical to nation-building and serves the interest of the public.
The DPA applies to the processing of all types of personal information3 and to any natural and juridical person involved in personal information processing.4 However, the law provides special cases where the processing of personal information is excluded from its scope. One is the processing of personal information “for research purpose, intended for a public benefit, subject to the requirements of applicable laws, regulations, or ethical standards.”5
Note, however, that the law does not provide for blanket exemption for research. Such exemption is limited to the minimum extent of collection, access, use, disclosure or other processing necessary to achieve the specific purpose, function or activity.
Hence, researchers have the concomitant obligations to implement the necessary security measures to protect the personal data they process,6 uphold the rights of data subjects,7 and adhere to data privacy principles8 and the other provisions of the DPA.
Likewise, apart from the laws and regulations on privacy, any code of ethics or any rules and regulations on research issued and implemented by institutions involved in research must be complied with by the researchers. After all, personal information used for research remains to be subject to a range of policies, including internal ones maintained by organizations, and other laws, as enacted or issued by the appropriate legislating authority.
Balancing the right to information to obtain data for research vis-à-vis data privacy
It is a declared policy of the law “to protect the fundamental human right of privacy, of communication while ensuring free flow of information to promote innovation and growth.”9 A constant but effective balancing of rights is necessary in the implementation of any State policy, which holds true for the NPC, as with any other government regulatory agency charged with implementing any particular set of laws or policies.10 This balancing of two equally important rights should be done on a case-to-case basis.
Thus, researchers should always keep in mind that though the DPA recognizes that the processing of personal data is critical to quality research, the rights and freedoms of individuals is likewise of utmost importance. This view is consistent with Section 38 of the DPA, which calls for an interpretation of the law that is mindful of the rights and interests of data subjects.
Infrastructure within the National Privacy Commission (NPC) to handle academic research issues; types of data covered by the DPA
The current organizational structure of the NPC does not provide for a specific office or division which specifically handles “non-private sector (academic research) issues on data.”
The law covers the processing of all types of personal information and to any natural and juridical person involved in personal information processing.11 Personal information is broadly defined as “any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.”12
There is no actual listing of all the personal information that the DPA covers. As to sensitive personal information, please refer to Section 3(l) of the law.
Thus, PICs in the public and private sectors should be guided by the provisions of the DPA in determining what particular data in their custody is personal and sensitive personal information which is covered by the law.
Proper process for getting permission for data or requesting for data access
NPC is not mandated to grant permission, nor compel any institution to allow any request of personal data for research purposes. Such requests should be coursed through the agency concerned. National government agencies, as PICs, are the ones who will determine whether data may be disclosed, keeping in mind their specific mandates, their charter or governing law, applicable rules and regulations, and data privacy principles enunciated in the DPA.
As to Institutional Review Boards (IRBs), the approval of the IRB means that the research protocol or proposal has been reviewed and found to have met the standards of the board, including ethical considerations. An IRB approval is one of the ways to demonstrate that ethical standards have been considered in the research.
PSA Labor Force Survey
Survey results which are made available to the public do not show any personal data and merely indicate the summary of results gathered from the respondents. Provincial and municipal or city indicators may be considered as personal information from the point of view of the PSA as a personal information controller as they may still have the original raw data from the surveys conducted and hence, may still identify a particular individual respondent.
However, we understand that when released or presented to the public, these indicators are presented as statistics, i.e. for the LFS, the PSA provides an analysis, for instance, of the Employment Situation in April 2018:13
“More than 60 percent of the population 15 years old and over are in the labor force.
In April 2018, the total population 15 years old and over was estimated at 71.0 million wherein the number of persons who were in the labor force was reported at 43.3 million. This placed the labor force participation rate (LFPR) at 60.9 percent, which means that three in five of the population aged 15 years and over were either employed or unemployed.
Region XIII (Caraga) had the highest reported LFPR with 66.1 percent while the lowest LFPR reported was in Autonomous Region in Muslim Mindanao (ARMM) at 44.3 percent (Table 1 and Figure 1).”
From the above, the public will not be able to identify an individual from such survey results. Arguably, this may hold true even if the PSA presents a report at the provincial or city/municipal level.
As to you, the researcher, these indicators, when presented as aggregate or statistical data, are not considered as personal information under the DPA since such data no longer contains personal information. Hence, the DPA will not apply to your collection and processing of aggregate or statistical data.
Considering the foregoing, your request for access to the provincial and municipal or city indicators of the aforementioned surveys conducted by PSA do not fall under the coverage of the DPA. The PSA is not proscribed under the DPA to release these data. Nonetheless, this is not withstanding any limitations set by other relevant laws and regulations adhered to by the PSA from disclosing such survey results.
This opinion is rendered based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission and for other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Philippine Health Research Ethics Board Ad Hoc Committee for Updating the National Ethical Guidelines, National Ethical Guidelines for Health and Health Related Research, Introduction, p. 5 (2017). ↩
-
Data Privacy Act of 2012, § 3 (g). Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual. ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 5 (c) (2016). ↩
-
See: National Privacy Commission, NPC Advisory Opinion No. 2017-29 (June 23, 2017). ↩
-
Supra note 5. ↩
-
Philippine Statistics Authority, Employment Situation in April 2018, available at https://psa.gov.ph/content/employment-situation-april-2018 (last accessed Nov. 22, 2018). ↩