Text
01 Aug 2019
Re: REQUEST FOR LIST OF BUSINESS INDUSTRIES AND THE NAMES OF REGISTERED BUSINESSES IN EACH INDUSTRY IN SORSOGON CITY FOR RESEARCH PURPOSES
Dear [Redacted],
We write in response to your letter request seeking clarification on the applicability of the Data Privacy Act of 2012 (DPA)1 to a request for information made by a graduate student from the Bicol University.
Said student requested for the following data from your office: (1) list of business industries in Sorsogon City and (2) names of businesses in each industry registered with the BPLO from year 2008-2018. The requested data shall be used for the student’s thesis on “Assessment on Survival Phase from Introduction to Growth stage of SMEs in Sorsogon City.”
You asked for clarification on the following matters in relation to the above and the article which you have read regarding the DPA and the exception for research:
- What does the phrase “provided that no activities are carried out and no decisions are taken regarding the data subject” mean?
- The data being requested are so many, should I issue the same even though the research title is tentative?
- Does the thesis warrant that the requested data be issued to the client? Or just the number of establishment per industry?
Discussion
Scope of the DPA; information on classification of business industries and business names
We wish to reiterate that the DPA applies only to the processing of all types of personal information by any natural and/or juridical person involved in personal information processing.2 The law defines personal information as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.3
Business establishments are juridical persons. Thus, generally speaking, the name of a business establishment and the classification of the nature of its business are a juridical person’s information, and not personal information.
Article 44 of the Civil Code of the Philippines define juridical persons, to wit:
“Article 44. The following are juridical persons:
(1) The State and its political subdivisions; (2) Other corporations, institutions and entities for public interest or purpose, created by law; their personality begins as soon as they have been constituted according to law; (3) Corporations, partnerships and associations for private interest or purpose to which the law grants a juridical personality, separate and distinct from that of each shareholder, partner or member.”
In this instance, the information requested from your office are not personal information as defined under the DPA. On its face, the lists of business industries and business names do not directly identify an individual, save in certain circumstances where the business involves a sole proprietorship.
Nonetheless, the DPA recognizes various criteria for processing personal information under Section 12 thereof, specifically, where processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed.4 This may be a lawful basis for disclosing business names of sole proprietors for research purposes. But there is a need to consider whether trade names will be sufficient without necessarily disclosing the names of the individual sole proprietors.
For guidance, to determine if there is “legitimate interest” in processing personal information, personal information controllers (PICs) must consider the following:5
-
Purpose test - The existence of a legitimate interest must be clearly established, including a determination of what the particular processing operation seeks to achieve.
-
Necessity test - The processing of personal information must be necessary for the purposes of the legitimate interest pursued by the PIC or third party to whom personal information is disclosed, where such purpose could not be reasonably fulfilled by other means; and
-
Balancing test - The fundamental rights and freedoms of data subjects must not be overridden by the legitimate interests of the PICs or third party, considering the likely impact of the processing on the data subjects.
Likewise, even if we consider such personal information as being outside of the scope of the DPA as the same will be processed for research, we reiterate NPC Advisory Opinion No. 2019-017,6 which discussed the implications of the DPA to the conduct of academic research vis-à-vis access to documents and records in the custody of government, to wit:
“It is the intent of the DPA to grant processing of personal information for research purposes with much flexibility. It recognizes that research is critical to nation-building and serves the interest of the public.
… However, the law provides special cases where the processing of personal information is excluded from its scope. One is the processing of personal information “for research purpose, intended for a public benefit, subject to the requirements of applicable laws, regulations, or ethical standards.”
Note, however, that the law does not provide for blanket exemption for research. Such exemption is limited to the minimum extent of collection, access, use, disclosure or other processing necessary to achieve the specific purpose, function or activity.
Hence, researchers have the concomitant obligations to implement the necessary security measures to protect the personal data they process, uphold the rights of data subjects, and adhere to data privacy principles and the other provisions of the DPA.”
Data subject’s rights; limitation on rights; non-applicability
Section 19 of the DPA provides for the non-applicability of the rights of data subjects where the processing of personal information is only for the needs of scientific and statistical research and, on the basis of such, no activities are carried out and no decisions are taken regarding the data subject. The last portion of the provision means that the personal information processed for research shall not be used as a basis for taking measures or making any decisions regarding any particular individual.7
Nevertheless, we wish to emphasize that any limitations on the rights of the data subject shall only be to the minimum extent necessary to achieve the purpose of said research.8
General data privacy principles; proportionality
PICs, such as government agencies, are required to adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality when processing personal information. Specifically on proportionality, said principle requires that the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.9 Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.10
With this, PICs are not precluded from seeking further clarification from researchers as to the purpose of their studies and from there, make a determination of whether the requested information is absolutely necessary for the said purpose, in keeping with the practice of data minimization.
This opinion is rendered based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Id. § 4. ↩
-
Id. § 3 (g). ↩
-
Id. § 12 (f). ↩
-
See generally, Data Privacy Act of 2012, § 12 (f); United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ (last accessed on August 1, 2019). ↩
-
See: Directive 95/46/EC of the European Parliament and of the Council, Article 13 (2) (1995). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 37 (2016). ↩
-
Data Privacy Act of 2012, § 11 and Rules and Regulations Implementing the Data Privacy Act of 2012, § 18 (c) (2016). ↩
-
Id. ↩