Text
07 May 2019
Re: DISCLOSURE OF THE NAMES OF THE UNIT OWNERS/MEMBERS OF A CONDOMINIUM ASSOCIATION
Dear [Redacted],
We write in response to your request for advisory opinion, which sought clarification on the application of the Data Privacy Act of 20121 (DPA) to the request received by your client, a condominium association (the Association), from several of its members for a list of the names of members in good standing and delinquent unit owners for purposes of identifying the persons who need to be present to reach a quorum in the Annual General Assembly.
Discussion
Names of members of the Association as personal information; criteria for lawful processing; legal obligation to which the personal information controller is subject
The names of the members of the Association and their respective membership standing are considered as personal information. Personal information under Section 3(g) of the DPA is defined as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.
Section 12 of the DPA provides the for the various criteria for lawful processing of personal information. Specifically, Section 12(c) appears to be relevant to the issue at hand, which states as follows:
“Section 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists: xxx
(c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject; xxx”
In relation to the above provision, Section 73 of the Revised Corporation Code2 provides:
“Section 73. Books to be kept; Stocks Transfer Agent. – Every corporation shall keep and carefully preserve at its principal office all information relating to the corporation including, but not limited to: xxx
(b) The current ownership structure and voting rights of the corporation, including lists of stockholders or members, group structures, intra-group relations, ownership data, and beneficial ownership; xxx
Corporate records, regardless of the form in which they are stored, shall be open to inspection by any director, trustee, stockholder or member of the corporation in person or by a representative at reasonable hours on business days, and a demand in writing may be made by such director, trustee or stockholder at their expense, for copies of such records or excerpts from said records. The inspecting or reproducing party, shall remain bound by confidentiality rules under prevailing laws, such as xxx Republic Act No. 10173, otherwise known as the “Data Privacy Act of 2012”, xxx.”
In your case, the Association has a legal obligation to its members, rooted in Section 73 of the Revised Corporation Code, to provide access to and inspect corporate records and documents.3 The DPA does not operate to curtail existing rights of members of a condominium corporation, specifically on inspection of corporate books and records, subject to existing laws and regulations on such matters.4
The members of the Association were able to establish the basis for the request for the list of members, i.e. they specified a purpose for requesting for the list, which is to identify those who need to be present to reach a quorum in the Annual General Assembly. Such purpose is not contrary to law, morals or public policy.
It is also worthy to note that under Section 11(e) of the DPA, personal information must be retained only for as long as necessary for the fulfillment of the purposes for which the data was obtained.
It is thus recommended that you advise the members of the Association they must only retain and use such list to determine the quorum necessary for the Annual General Meeting. Subsequently, once the purpose has been fulfilled, the personal data should be disposed or discarded in a secure manner that would prevent further processing, unauthorized access, or disclosure to any other party or the public, or prejudice the interests of the data subjects.5
This opinion is rendered based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
An Act Providing for the Revised Corporation Code of the Philippines [Revised Corporation Code of the Philippines], Republic Act No. 11232 (2019). ↩
-
See: National Privacy Commission, NPC Advisory Opinion No. 2018-011 (Mar. 22, 2018). ↩
-
Id. ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, § 19 (d) (3) (2016). ↩