Text
07 May 2019
Re: DISCLOSURE OF MARRIAGE CERTIFICATE FOR INVESTIGATION PURPOSES
Dear [Redacted],
We write in response to your request for an advisory opinion which sought to clarify the following matters regarding the Data Privacy Act of 20121 (DPA) in relation to the mandate of the Department of Finance - Revenue Integrity Protection Service (DOF-RIPS). Specifically, you request for clarification on the following:
- Whether the DOF-RIPS, as a public authority which investigates and gathers information necessary to carry out its law enforcement functions, is exempt from the coverage of the DPA;
- Whether Section 4(e) of the DPA applies to information on marital and filial relations sought to be secured by DOF-RIPS in order to carry out its law enforcement functions; and
- Whether the DPA applies to information on marriage or filial records of a public officer or employee when there is doubt on the truthfulness of declarations made by the same in his/her Statement of Assets, Liabilities, and Net Worth (SALN) or Personal Data Sheet (PDS), or when it is necessary to carry out DOF-RIPS’s law enforcement function.
Discussion
Investigatory functions of DOF-RIPS
We understand that the DOF-RIPS was created by virtue of Executive Order (EO) No. 259 in December 2003. It is the anti-corruption arm tasked to detect, investigate and prevent corruption in the DOF and its attached agencies. It has the following powers and functions, among others:2
-
To investigate, upon complaint or motu propio, allegations of corrupt practices of officials and employees of the DOF, the Bureau of Internal Revenue and the Bureau of Customs, and all other agencies under the jurisdiction of the Secretary of Finance.
-
To gather evidence and file the appropriate criminal, civil or administrative complaints against government officials and employees within its jurisdiction before the appropriate court of law, administrative body, or agency of competent jurisdiction, and to assist the prosecuting agency or officer towards the successful prosecution of such cases.
-
To investigate, upon complaint or motu propio, unusual or unjustified accumulation of wealth disproportionate to the earning capacity of government officials and employees under its jurisdiction and to initiate, and assist in, the prosecution of such cases for recovery or forfeiture of ill-gotten wealth.3
Hence, the DOF-RIPS is a public authority, specifically, an investigative body, with the power to gather evidence, file the appropriate complaints against government officials and employees, and assist in the prosecution of cases.
Scope of the DPA; special cases
The DPA provides for a list of specified information that are not covered by the law. Section 5 of the Implementing Rules and Regulations (IRR) of the DPA provides for the special cases wherein the law and the rules are not applicable:
SECTION 5. Special Cases. The Act and these Rules shall not apply to the following specified information, only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned: xxx
d. Information necessary in order to carry out the functions of public authority, in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function, including the performance of the functions of the independent, central monetary authority, subject to restrictions provided by law. Nothing in this Act shall be construed as having amended or repealed Republic Act No. 1405, otherwise known as the Secrecy of Bank Deposits Act; Republic Act No. 6426, otherwise known as the Foreign Currency Deposit Act; and Republic Act No. 9510, otherwise known as the Credit Information System Act (CISA); xxx
Provided, that the non-applicability of the Act or these Rules do not extend to personal information controllers or personal information processors, who remain subject to the requirements of implementing security measures for personal data protection: Provided further, that the processing of the information provided in the preceding paragraphs shall be exempted from the requirements of the Act only to the minimum extent necessary to achieve the specific purpose, function, or activity. (Underscore supplied)
Based on the above, information necessary to carry out law enforcement functions of a public authority, in accordance with a constitutional or statutory mandate, are outside the scope of the DPA. This exemption, however, is to be strictly construed.
First, it applies only to the minimum extent of collection, access, use, disclosure, or other processing necessary to the purpose, function, or activity concerned. Information processed by an agency which does not perform law enforcement or regulatory functions remain subject to the DPA. The processing for law enforcement purpose must also be in accordance with their constitutional or statutory mandate, and strictly adhere to all required substantive and procedural processes. A law enforcement agency must establish its mandate to enforce a particular law, and more importantly, that they are not unreasonably infringing on the rights of individuals guaranteed by the Constitution.
Second, the law is clear that only the specified information is outside the scope of the DPA. This means that the public authority with law enforcement functions remains subject to its obligations as a personal information controller under the DPA, i.e. implementing security measures to protect personal data, upholding the rights of data subjects, and adhering to data privacy principles.
In this case, however, the DOF-RIPS is primarily an investigative agency rather than a law enforcement or a regulatory agency. Hence, its processing does not fall squarely under the special case provided for in the DPA and its IRR.
Criteria for lawful processing of personal and sensitive personal information; certificate of marriage; lifestyle check
A Certificate of Marriage issued by the Office of the Civil Registrar General and/or the Philippine Statistics Authority (PSA) contains both personal and sensitive personal information (collectively, personal data) of the contracting parties.
The processing of personal data by the DOF-RIPS may find support in the DPA, specifically Sections 12 and 13 thereof providing the criteria for lawful processing of personal and sensitive personal information, respectively, to wit:
SECTION 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:
xxx xxx xxx
(e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate;
xxx xxx xxx
SECTION 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:
xxx xxx xxx
(b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;
Based on the foregoing, the DOF-RIPS may utilize the marriage certificate information insofar as the same is necessary and relevant to the conduct of its investigation into the veracity of the SALN or PDS declarations made by government officials and employees. The utilization must be strictly necessary to determine whether the official or employee has undisclosed assets, dependents, or other information material to the investigation.
This opinion is based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Office of the President, Creating the Department of Finance Revenue Integrity Protection Service, and for other purposes, Executive Order No. 259 [E.O. No. 259] (Dec. 17, 2003). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 (2016). ↩