Text
01 Aug 2019
Re: PUBLICATION OF LIST OF CASES FILED AGAINST EMPLOYERS FOR NON-PAYMENT OF SOCIAL SECURITY CONTRIBUTIONS
Dear [Redacted],
We write in response to your request which sought clarification on whether the publication in the newspaper or posting in the Social Security System (SSS) website of a list of cases filed against the employers for non-payment of social security contributions and pending before the Social Security Commission (SSC) will be in violation of the Data Privacy Act of 2012 (DPA).1
Discussion
Condonation Program; publication or posting of docket numbers and names of employers with pending and decided cases involving non-payment of SSS contributions
Pursuant to the Social Security Act of 2018 (SSA), specifically Section 4(a) thereof, the SSC has the power to condone, enter into a compromise or release, in whole or in part, such penalties imposed upon delinquent social security contributions regardless of the amount involved under such valid terms and conditions it may prescribe through rules and regulations when the financial position of the employer demonstrates a clear inability to pay the assessed delinquency arising from economic crisis, serious business losses or financial reverses, or resulting from natural calamity or man-made disaster without fault on the part of the employer.
In connection therewith, Circular No. 2019-004 on the Condonation and Non-Imposition of Penalties on Delinquent Social Security Contributions dated 15 March 2019, provides for the mechanics on how delinquent contributors may remit, in full or through an installment proposal.
To carry out the objectives of the Condonation Program, you intend to publish or post the following:
- Cases pending before the SSC which involves collection of contributions; and
- Cases with final judgment but pending compliance by employers.
The list to be published will include case docket numbers and names of employers. The purpose of publication is to inform concerned employers so they can avail of the program and for them to verify the status of their cases before the Office of the Executive Clerk of the SSC.
Scope of the DPA; criteria for lawful processing of personal data; general data privacy principles; proportionality
We wish to reiterate that the DPA applies only to processing of personal information pertaining to a natural person. Article 44 of the Civil Code of the Philippines2 provides:
“Article 44. The following are juridical persons:
(1) The State and its political subdivisions; (2) Other corporations, institutions and entities for public interest or purpose, created by law; their personality begins as soon as they have been constituted according to law; (3) Corporations, partnerships and associations for private interest or purpose to which the law grants a juridical personality, separate and distinct from that of each shareholder, partner or member.”
Based on the foregoing, corporations are considered as juridical persons. Hence, the processing of a juridical person’s information is outside the scope of the DPA. The publication in the newspaper or posting in the SSS website of cases of corporations may be allowed for purposes of availing the condonation program as provided under the SSA.
As to the processing of personal and sensitive personal information (collectively, personal data) of employers who are individuals or natural persons, i.e. sole proprietorships, the processing of the same may find support in the DPA, specifically Section 12(e) – when processing is necessary in order to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate and/or Section 13(b) – when processing is provided for by existing laws and regulations.
Nevertheless, we wish to emphasize that while the processing of personal data in this case is for the fulfillment of a statutory mandate, the SSC, as a personal information controller, is required to observe and adhere to the data privacy principles of transparency, proportionality and legitimate purpose, and uphold the rights of data subjects.
Specifically for proportionality, the principle requires that the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.3 Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.4
There is a need to determine if publication in a newspaper or posting online the names of individual employers with cases, pending or otherwise, is proportional to the purpose of informing them about the condonation program so that they can avail of the same. In lieu of publication or posting, it may be advisable to send communications directly to such employers to encourage them to avail of the program and to actively disseminate information about the program in all appropriate media.
This opinion is based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
An Act To Ordain And Institute The Civil Code Of The Philippines [Civil Code of the Philippines], Republic Act No. 386 (1949) ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (c) (2016). ↩
-
Id. ↩