NPC Issuance Wiki

NPC Advisory Opinion No. 2019-024 — Disclosure of Criminal History

Issued Advisory Opinion

Official opinion tags

Text

07 May 2019

Re: DISCLOSURE OF CRIMINAL HISTORY

Dear [Redacted],

We write in response to your request for advisory opinion received by the National Privacy Commission (NPC) which sought clarify the extent of processing and disclosure of criminal history vis-à-vis the provisions of the Data Privacy Act of 20121 (DPA).

Discussion

Processing of sensitive personal information under the DPA; criminal history; publication in newspapers, media, DOJ website

The DPA applies to the processing of all types of personal information and to any natural and juridical person involved in the processing of personal information.2 Sensitive personal information includes information about any proceeding for any offense committed or alleged to have been committed by an individual, the disposal of such proceedings, or the sentence of any court in such proceedings.3

The processing of sensitive personal information is prohibited except in the following cases:4

  • The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing;
  • The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;
  • The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing;
  • The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, That such processing is only confined and related to the bona fide members of these organizations or their associations: Provided, further, That the sensitive personal information are not transferred to third parties: Provided, finally, That consent of the data subject was obtained prior to processing;
  • The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, That such processing is only confined and related to the bona fide members of these organizations or their associations: Provided, further, That the sensitive personal information are not transferred to third parties: Provided, finally, That consent of the data subject was obtained prior to processing;
  • The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured; or
  • The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.

The DPA recognizes that journalists process personal and sensitive personal information when reporting on criminal cases on television and newspapers. As a special case, personal information processed for journalistic, artistic or literary purpose, in order to uphold freedom of speech, of expression, or of the press, subject to requirements of other applicable law or regulations, is outside of the scope of the DPA – but only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned.5

In addition, these publishers, editors, or duly accredited reporters, who are considered as personal information controllers (PICs) or personal information processors (PIPs) within the meaning of the DPA, are still bound to follow the law and related issuances with regard to the processing of personal data, upholding rights of their data subjects and maintaining compliance with other provisions that are not incompatible with the protection provided by Republic Act No. 53.6

As to the posting of cases in the Department of Justice (DOJ) website, such processing is allowed under Section 13(b) and (f) above as part of their mandate pursuant to the Administrative Code of 19877 and other applicable laws and regulations on the matter.

Please note, however, that the said processing is limited only to the minimum extent necessary to achieve the specific purpose, function, or activity of the DOJ, and the agency is not precluded from adhering to the general data privacy principles as well as the requirements of implementing measures to secure and protect personal data.

Particularly on the principle of proportionality, the DOJ is bound to observe and align its practices in order to ensure that only relevant, necessary, and not excessive information is disclosed to the public.

Right to information and freedom of the press vis-à-vis right to privacy; prejudicial publicity; fair and true reporting

The constitutional right to information on matters of public concern is enshrined in Article III, Sec. 7 of the 1987 Constitution. The incorporation of this right is a recognition of the fundamental role of free exchange of information in a democracy.8

Together with the constitutionally guaranteed right of freedom of the press, the Commission recognizes the vital role of the media in protecting the interest of the public. In fact, newspapers should be given such leeway and tolerance as to enable them to courageously and effectively perform their important role in our democracy.9 However, we wish to highlight the case of Tulfo v. People of the Philippines,10 where the Supreme Court ruled that:

“The freedom of the press is one of the cherished hallmarks of our democracy; but even as we strive to protect and respect the fourth estate, the freedom it enjoys must be balanced with responsibility. xxx” (underscoring supplied)

With this, publishers, editors, or duly accredited reporters reporting on criminal cases should process personal and sensitive personal information fairly and lawfully, in a manner that would respect the privacy rights of an individual. The same should avoid prejudicial publicity that may deprive the accused of due process rights to a fair trial.

Further, on the concept of true and fair reporting, the Supreme Court in People of the Philippines v. Castelo held that where the publication is a fair and true report of an official investigation it comes within the principle of a privileged communication so that even if the same is defamatory or contemptuous the publisher need not be prosecuted upon the theory that he has done it to serve public interest or promote public good,11 to wit:

“Thus, under our law, it is postulated that “a fair and true report, made in good faith, without any comments or remarks, of any judicial, legislative, or other official proceedings which are not of confidential nature, or of any statement, report, or speech delivered in such proceedings, or of any other act performed by public officers in the exercise of their functions”, is deemed privileged and not punishable (Article 354, paragraph 2, Revised Penal Code).

The reason behind this privilege is obvious. As it was aptly said, “Public policy, the welfare of society, and the orderly administration of government have demanded protection for public opinion. The inevitable and incontestable result has been the development and adoption of the doctrine of privilege” (U. S. vs. Bustos, 37 Phil., 731, 742).”12

To reiterate, the DPA has the twin task of protecting the fundamental human right of privacy while ensuring the free flow of information to promote innovation and growth. The balancing of the right to privacy of an individual vis-à-vis freedom of the press is worth noting.

Public notice for termination of employee; disclosure of grounds for termination; disclosure of case to current employer

It has been the common practice for companies to publish notices in newspapers and other media that a certain person appearing in the photograph used to be their employee, but is now no longer connected with the company, and a warning that transactions with the said person on behalf of the company will no longer be honored.

The above is still allowed under the DPA. The basis for processing may be Section 12(f) which provides for the processing that is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.

Legitimate interest refers to matters that are desired by or important to a PIC, which must not be contrary to law, morals or public policy. This includes business, financial or other reasonable purpose. In order to use legitimate interest as basis for lawful processing, PICs must consider the following:13

  1. Purpose test - The existence of a legitimate interest must be clearly established, including a determination of what the particular processing operation seeks to achieve;
  2. Necessity test - The processing of personal information must be necessary for the purposes of the legitimate interest pursued by the PIC or third party to whom personal information is disclosed, where such purpose could not be reasonably fulfilled by other means; and
  3. Balancing test - The fundamental rights and freedoms of data subjects should not be overridden by the legitimate interests of the PICs, considering the likely impact of the processing on the data subjects.14

From the foregoing, while such public notices may be allowed under the DPA, we wish to emphasize the data privacy principle of proportionality, which requires that the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.

Hence, it is suggested that only the following details of the former employee be published: full name, facial image, previous designation or position in the company, and effectivity date of the employee’s separation from the company. To indicate the grounds for the employee’s separation or termination from the company, i.e. cases filed against him or her, and other additional personal information, i.e. home address, email address, mobile number, etc., may no longer be proportional to the primary purpose of the public notice.

As to the disclosure of cases to the current employer of the person, the same may be possible in instances where the current employer asks the former employer as a character reference, when verifying or validating details of employment and other pertinent records submitted by the person, or in general, when the person has given his consent to the current employer to ask former employers about him or her, probably as part of pre-employment requirements or as a continuing requirement during the course of employment.

Companies should have policies in place on how they handle their applicants’ and employees’ data, and these should be cascaded at the very outset of the relationship with the person, i.e. as a job applicant, and later on, when said person is hired. There is a need to provide clear information about the processing of his or her personal data within the duration of the employment and after separation for whatever cause. All these should adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality.

This opinion is based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. Data Privacy Act of 2012, § 4. ↩

  3. Id. § 3 (l). ↩

  4. Id. §13. ↩

  5. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 5 (b) (2016). ↩

  6. Id. 7 (b). ↩

  7. Instituting the Administrative Code of 1987 [Administrative Code of 1987], Executive Order No. 292, BOOK IV, Title III, Chapter 1-General Provisions (1987). ↩

  8. Baldoza v. Dimaano, Adm. Matter No. 1120-MJ, May 5, 1976, 17 SCRA 14. ↩

  9. Lopez v. Court of Appeals, G.R. No. L-26549 (1970) ↩

  10. G.R. Nos. 161032 & 161176 (2008) ↩

  11. People v. Castelo, G.R. No. L-11816 (1962). ↩

  12. Id. ↩

  13. See generally, Data Privacy Act of 2012, § 12 (f); United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ [last accessed on September 5, 2018]. ↩

  14. See: National Privacy Commission, NPC Advisory Opinion No. 2018-061 (Sept. 6, 2018). ↩

Backlinks