NPC Issuance Wiki

NPC Advisory Opinion No. 2019-026 — Redacted Information in Requested Public Documents

Issued Advisory Opinion

Official opinion tags

Text

24 April 2019

Re: REDACTED INFORMATION IN REQUESTED PUBLIC DOCUMENTS

Dear [Redacted],

We write in response to your letter which sought clarification regarding the redaction of information in requested public documents from the Bureau of the Treasury (BTr) in relation to the Data Privacy Act of 2012 (DPA).1 Specifically, you are seeking clarification on the following:

a. Whether the BTr can redact information in requested public documents by virtue of them being sensitive personal information under the DPA; b. If in the affirmative, what information may be redacted; and c. Proper procedure to be followed by government agencies when redacting information in a public document.

Discussion

Right to information on matters of public concern; access to public documents; limitations

The people have a fundamental right to information, particularly on matters of public concern.2 Every Filipino citizen is afforded this right, subject to certain limitations provided by law.

Executive Order (EO) No. 024 relates to the operationalization of the people’s right to information under the executive branch. EO No. 2 permits the disclosure of information in the possession or under the custody of the government unless they fall under any of the exceptions enshrined in the Constitution, existing law or jurisprudence.3

In addition, the DPA, having the twin policies of protecting the right to data privacy while at the same time ensuring the free flow of information for innovation and growth,4 sets certain parameters under which personal data may be processed (e.g., disclosed) in a manner that is consistent with the general data privacy principles.

As you discussed in your letter, public documents include the written official acts, or records of the official acts of the sovereign authority, official bodies and tribunals, and public officers, whether of the Philippines, or of a foreign country, documents acknowledged before a notary public except last wills and testaments, and public records, kept in the Philippines, of private documents required by law to be entered therein.5

It has been held that access to public documents may be duly regulated, despite their nature as such. In Legaspi vs. Civil Service Commission,6 the Court held as follows:

“The authority to regulate the manner of examining public records does not carry with it the power to prohibit. A distinction has to be made between the discretion to refuse outright the disclosure of or access to particular information and the authority to regulate the manner in which the access is to be afforded. The first is a limitation upon the availability of access to the information sought, which only the Legislature may impose (Art. III, Sec. 6, 1987 Constitution). The second pertains to the government agency charged with the custody of public records. Its authority to regulate access is to be exercised solely to the end that damage to, or loss of, public records may be avoided, undue interference with the duties of said agencies may be prevented, and more importantly, that the exercise of the same constitutional right by other persons shall be assured.”

EO No. 2 clarifies that “while providing access to information, public records, and official records, responsible officials shall afford full protection to the right to privacy of the individual.”7 For this purpose, it requires that each government office shall ensure that personal information in its custody or control is disclosed or released only if it is material or relevant to the subject-matter of the request and its disclosure is permissible under this EO or existing law, rules or regulations, among others.8

The above is consistent with the provisions of the DPA which recognizes that certain personal information of public concern is outside of the scope of the law. This pertains to information about any individual who is or was an officer of a government institution that relates to the position or functions of the individual under Section 4(a), including:

  • The fact that the individual is or was an officer or employee of the government institution;
  • The title, business address and office telephone number of the individual;
  • The classification, salary range and responsibilities of the position held by the individual; and
  • The name of the individual on a document prepared by the individual in the course of employment with the government.

While the information may be outside of the scope of the law, this is only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned.

Hence, when a request involves the above information, the concerned government agency may disclose such information. However, where a particular document or form contains personal and sensitive personal information (collectively, personal data) of the government officer or employee which is no longer of public concern, government agencies may redact such personal data.

There is a need to balance, in a case to case basis, the right to information of the public and the right to data privacy of government personnel.

Redacted information in government documents and forms

In all instances, adherence with the general data privacy principles of transparency, legitimate purpose and proportionality is required when processing personal data.9

The principle of transparency states that the data subject must be aware of the nature, purpose and extent of processing of his or her personal data. This entails giving notice and information to the data subjects using clear and plain language and giving them the procedure and mechanism on how to exercise their rights as data subjects.10 Second, the processing of personal information shall be compatible with a declared and specified purpose, which is not contrary to law, morals or public policy.11 Lastly, the principle of proportionality states that only adequate, relevant, suitable and necessary information in relation to your legitimate purpose shall be processed.12

The request with the BTr for the certified true copies of the 2010-2018 fidelity bond applications (General Forms 57-A and 58-A) and required supporting documents pertaining to a punong barangay and a municipal mayor should be examined in light of these principles and taking into account relevant laws and regulations on public documents.

We provide our comments as follows:

Redacted Information in General Form 57A of a Punong Barangay and Municipal MayorComment/Remarks
Date when incoming officer assumes accountability (Section 3)These information forms part of matters of public concern and may be disclosed without redaction, subject to their relevance and necessity to the purpose of the request.
Amounts of maximum accountability or custody (Section 5)These information forms part of matters of public concern and may be disclosed without redaction, subject to their relevance and necessity to the purpose of the request.
Salary attached to the position (Section 6)These information forms part of matters of public concern and may be disclosed without redaction, subject to their relevance and necessity to the purpose of the request.
Bond fixed by law or by the Chairman of the Commission on Audit (Section 8)These information forms part of matters of public concern and may be disclosed without redaction, subject to their relevance and necessity to the purpose of the request.
Previous experience (Section 9A)This may be considered as personal information, the disclosure of which should be based upon any criteria under Section 12 of the DPA, and subject to its relevance and necessity to the purpose of the request.
Criminal or Administrative Record (Section 9B)This is sensitive personal information under the DPA, the disclosure of which should be based upon any criteria under Section 13 of the law, and subject to its relevance and necessity to the purpose of the request. We note that in your letter, you have not stated the purpose of your request for these forms. Considering the principles of legitimate purpose and proportionality, you may not be given access to information on criminal and administrative records, especially if such is still pending with the Ombudsman as you have stated in your letter.
Redacted Information in General Form 58A of a Municipal MayorComment/Remarks
Place and date of birthThese are considered as personal (place of birth) and sensitive personal information (date of birth from which the age may be computed), the disclosure of which should be based upon any criteria under Section 13 of the law, and subject to their relevance and necessity to the purpose of the request.
Civil status; How many persons are dependent for supportCivil status is sensitive personal information, the disclosure of which should be based upon any criteria under Section 13 of the law, and subject to its relevance and necessity to the purpose of the request. The number of dependents is not personal information, hence, outside of the scope of the DPA.
Income other than salary as barangay official, amount and source; If engaged in other business, and names of partners or associationsThese information forms part of matters of public concern and may be disclosed without redaction, subject to their relevance and necessity to the purpose of the request.
Tax Identification NumberThis is sensitive personal information under the DPA, the disclosure of which should be based upon any criteria under Section 13 of the law, and subject to its relevance and necessity to the purpose of the request.
Three Character ReferencesThese are personal information, the disclosure of which should be based upon any criteria under Section 12 of the DPA, and subject to its relevance and necessity to the purpose of the request.
Have you ever been discharged from any position and particularsThese may be considered as personal information, the disclosure of which should be based upon any criteria under Section 12 of the DPA, and subject to its relevance and necessity to the purpose of the request.
Life insurance, amount, insurance company, and beneficiaryThese may be considered as personal information, the disclosure of which should be based upon any criteria under Section 12 of the DPA, and subject to its relevance and necessity to the purpose of the request.
Criminal or Administrative Record and nature thereofSee comment above for General Form 57A.
Estimated total amount of all monthly living expenses of your familyThese may be considered as personal information, the disclosure of which should be based upon any criteria under Section 12 of the DPA, and subject to its relevance and necessity to the purpose of the request.
Date when form was accomplishedThis information forms part of matters of public concern and may be disclosed without redaction, subject to their relevance and necessity to the purpose of the request.
Name and Signature of WitnessThe names of the witnesses form part of matters of public concern and may be disclosed without redaction, subject to their relevance and necessity to the purpose of the request. As to their signatures, the same may be redacted.
Name and Signature of the Fidelity Bond ApplicantSee immediately preceding comment.

Evaluating requests for information; procedure for redacting information in a public document

Government agencies should abide by their Freedom of Information (FOI) Manual when dealing with requests for public document pursuant to EO No. 2. Likewise, it is incumbent upon the government agency to promulgate rules or criteria against which the request for disclosure shall be assessed.

The National Privacy Commission (NPC) issued NPC Advisory No. 2017-02 (Advisory) dated 03 April 2017 to shed light on the nature of processing that is permissible under the DPA while upholding the freedom to access information, public records and official records pursuant to EO No. 02.

Though the Advisory particularly pertains to requests for access to or disclosure of the Personal Data Sheet (PDS) of government personnel, the issuance included considerations that may be taken into account in a request for access to public documents which may also be applicable to the present inquiry. These are:

  1. The information requested falls under matters of public concern;
  2. The individual requesting for personal data has declared and specified the purpose of his or her request;
  3. The declared and specified purpose is not contrary to law, morals, and public policy; and
  4. The personal data requested is necessary to the declared, specified, and legitimate purpose.

As to the process of redaction, which is defined as the permanent removal of information within a document,13 the Commission has yet to issue guidelines on the standard manner of redacting public documents.

One may refer to ISO/IEC 27038:2014 - Information technology — Security techniques — Specification for digital redaction for reference on the characteristics of techniques for performing digital redaction on digital documents, and the requirements for software redaction tools and methods of testing that digital redaction has been securely completed.14

Redaction tools may likewise be found in software applications, i.e., Adobe Acrobat Pro DC, Microsoft Word Add-In, etc.

For the redaction of documents in hardcopy,15 methods may include blacking/whiting out which is done by photocopying the original document and using a black marker pen or correction fluid to block out the information. The redacted version should then be photocopied again to produce an access version. Another way is the scalpel, whereby the information is physically removed from the photocopied document using an artist’s scalpel or similar tool, leaving a ‘doily’, which is then photocopied again to provide the redacted document.

This opinion is based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. PHIL. CONST. art. 3 § 7. ↩

  3. Office of the President, Operationalizing In The Executive Branch The People’s Constitutional Right To Information And The State Policies To Full Public Disclosure And Transparency In The Public Service And Providing Guidelines Therefor, Executive Order No. 2 [EO No. 2] (July 23, 2016). ↩

  4. Data Privacy Act of 2012, § 2. ↩

  5. Supreme Court, Rules of Court, Rule 132, § 19. ↩

  6. Legaspi vs. Civil Service Commission, G.R. No. L-72119 (1987). ↩

  7. EO No. 2, § 7. ↩

  8. Id. ↩

  9. Data Privacy Act of 2012, § 11. ↩

  10. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (a) (2016). ↩

  11. Id. § 18 (b). ↩

  12. Id. § 18 (c). ↩

  13. International Organization for Standardization, ISO/IEC 27038:2014(en) Information technology — Security techniques — Specification for digital redaction, preview available at https://www.iso.org/obp/ui/#iso:std:iso-iec:27038:ed-1:v1:en (last accessed 24 April 2019). ↩

  14. Id. ↩

  15. See: The UK National Archives, Redaction toolkit, 14-15, available at http://www.nationalarchives.gov.uk/documents/information-management/redaction_toolkit.pdf (last accessed 24 April 2019) ↩

Backlinks