Text
11 March 2019
Re: DATA COLLECTION SURVEYS BY GOVERNMENT AGENCIES
Dear [Redacted],
We write in response to your letter which sought guidance from the National Privacy Commission (NPC) with regard to the application of the Data Privacy Act of 20121 (DPA) in data collection surveys conducted by the Philippine Statistics Authority (PSA).
We understand that the PSA is a government agency primarily responsible for all national censuses and surveys, sectoral statistics, consolidation of selected administrative recording systems and compilation of the national accounts.2
Section 6 of RA No. 10625 or the Philippine Statistical Act of 2013 provides for the following powers of the PSA, among others, to wit:
- Serve as the central statistical authority of the Philippine government on primary data collection;
- Develop and maintain appropriate frameworks and standards for the collection, processing, analysis and dissemination of data;
- Conduct continuing methodological, analytical and development activities, in coordination with the Philippine Statistical Research and Training Institute (PSRTI) to improve the conduct of censuses, surveys and other data collection activities;
- Implement policies on statistical matters and coordination, as directed by the PSA Board.
From the provisions above, PSA issued Resolution No. 5, Series of 2015, establishing the Regional Statistics Committees (RSCs) to provide direction and guidance to regional/local statistical development activities, serve as the policymaking body on statistical matters and shall serve as the venue for discussion and resolution of statistical issues at the local level.3
In your letter, you have stated that one of the provisional agendas during the RSC–NCR second quarter meeting was the presentation of “Problems on Data Sharing among Government Agencies and Local Government Units” by the Department of Information and Communications Technology. During the said meeting, concerns on the DPA were raised, especially the issue on response rate to surveys conducted by the PSA.
Hence, it was agreed during the meeting that the committee will seek qualification assistance from the NPC.
Discussion
Scope of the DPA; response rate to surveys; criteria for lawful processing of personal information
The DPA applies to the processing of all types of personal information4 and to any natural and juridical person involved in personal information processing.5 In this case, PSA is considered as a personal information controller (PIC) within the purview of the DPA as it controls the collection, holding, processing or use of personal and sensitive personal information (collectively, personal data) during the conduct of surveys.
The DPA recognizes several criteria for processing personal and sensitive personal information under Sections 12 and 13 thereof, respectively. In the case of PSA, the processing of personal data of respondents may be based on consent, or to fulfill its functions as a public authority, or when processing is provided for under existing laws and regulations.
We understand that under the Philippine Statistical Act of 2013, there are instances where the National Statistician shall determine whether a survey to be conducted is with or without an obligation to provide information, to wit:
SEC. 25. Obligation to Provide Information. – The National Statistician shall determine whether a statistical inquiry or survey to be conducted is with or without an obligation to provide information. If such obligation is stipulated, all respondents whether natural or legal persons shall be liable to reply to the statistical inquiry or survey. This section applies to all statistical inquiries or surveys conducted by other statistical offices in the PSS.
The respondents under this Act are required to give truthful and complete answers to statistical inquiries or surveys of the PSA and other statistical offices of the PSS. The respondent is considered to have complied with the obligation only upon receipt of the duly completed statistical inquiry or survey forms. The government shall provide franking privileges, charges and postings to the survey offices, unless otherwise disallowed by law.
The PSA is authorized to gather data from other government agencies for statistical purposes.” (Emphasis supplied.)
Thus, where a statistical inquiry or survey is determined to be with an obligation to provide information, the same is mandatory and the PSA need not obtain consent of the data subjects for the collection of their personal data.
We wish to emphasize that the DPA, its Implementing Rules and Regulations (IRR), and related issuances of the NPC should be read together with existing laws. The DPA has the twin task of protecting the right to privacy while ensuring the free flow of information, and should not be used as an excuse for non-compliance with other existing laws, rules, and regulations.6
General Data Privacy Principles
While the authority of the PSA to process personal data based on its mandate or based on consent is expressly allowed by the DPA, such processing is regulated and should always adhere to the general data privacy principles of transparency, legitimate purpose and proportionality.7
The principle of transparency refers to the awareness of the data subjects or the respondents regarding the nature, purpose, and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of the PIC and other recipients of his or her personal data.8 The PSA is bound to inform the data subjects, either through a privacy notice or some other mechanism, using clear and plain language for easy understanding.
Second, the processing of personal data should be compatible with a declared and specified purpose which is not contrary to law, morals, or public policy.9 Before even conducting a survey, the PSA should determine its exact purpose and such purpose is relayed to the respondents of the survey.
Lastly, information collected, used and stored shall be adequate, relevant, suitable, necessary, and not excessive in relation to the declared and specified purpose. Gathering personal data over and beyond those required to fulfill the objective of the survey violates this principle. Thus, the principle of proportionality should be duly considered in the development of survey questionnaires.
Obligations of a PIC; data sharing; data sharing agreement; sharing of aggregated data
Every PIC should implement reasonable and appropriate organizational, physical and technical security measures for protection of personal data. The appropriate level of security must take into account the nature of the personal data that requires protection, the risks posed by the processing, the size of the organization and complexity of its operations, current data privacy best practices, and the cost of security implementation, among others.10
As to the sharing of personal data between or among government agencies, it must always be for the purpose of a public function or provision of a public service and should be covered by a data sharing agreement.11 Relative thereto, the NPC issued Circular No. 16-0212 which sets out the guidelines for data sharing agreements involving government agencies.
These provisions emphasize that the data sharing may be done to facilitate performance of a public function and to provide public services.13 Data sharing between government agencies for the above purposes is not prohibited provided that the function or service is consistent with and necessarily required under the general mandate of the agencies concerned.14
We wish to emphasize that the data sharing contemplated in the IRR and Circular pertains to sharing of personal data. Hence, the sharing or disclosure of aggregated information in the form of summaries or statistical tables in which a person will no longer be identified need not be covered by a data sharing agreement. Such sharing or disclosure is no longer within the scope of the DPA, but may be subject to the provisions of other applicable laws and regulations, i.e. Philippine Statistical Act of 2013.
This opinion is based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
An Act Reorganizing the Philippine Statistical System, Repealing for the Purpose Executive Order Numbered One Hundred Twenty-One, Entitled “Reorganizing and Strengthening the Philippine Statistical System and for Other Purposes [Philippine Statistical Act of 2013], RA 10625, § 5 (2013). ↩
-
Philippine Statistics Authority, Resolution No. 5, Series of 2015, Article I (March 20, 2015). ↩
-
Data Privacy Act of 2012, § 3 (g). Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual. ↩
-
See: National Privacy Commission, Advisory Opinion No. 2018-035 (20 July 2018). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (2016). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 29 (2016). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, § 20 (d). ↩
-
National Privacy Commission, [[issuances/2020/data-sharing-agreements-involving-government-agencies-this-circular-has-been-repealed-by-npc-circular-no-2020-03-data-sharing-agreements|Data Sharing Agreements Involving Government Agencies, Circular No. 16-02]] [NPC Circular 16-02] (October 10, 2016). ↩
-
See: National Privacy Commission, NPC Advisory Opinion No. 2017-54 (11 September 2017). ↩
-
See: National Privacy Commission, NPC Advisory Opinion No. 2017-52 (11 September 2017). ↩