Text
November 6, 2019
RE: CONSENT OF DATA SUBJECTS PRIOR TO SHARING OF PERSONAL DATA
Dear [Redacted],
This refers to your letter-request received by the National Privacy Commission (NPC) for an advisory opinion on whether it is necessary to secure the consent of data subjects prior to sharing of their personal data in relation to the proposed data sharing arrangement.
Based on your letter, the Department of Human Settlements and Urban Development (DHSUD) and its five (5) attached Key Shelter Agencies (KSAs) namely, the Home Development Mutual Fund (HDMF), National Housing Authority (NHA), Social Housing Finance Corporation (SHFC), National Home Mortgage Finance Corporation (NHMFC) and Human Settlements Adjudication Commission (HSAC) will be signing a Data Sharing Agreement (DSA).
The purpose of the data sharing is to facilitate the Housing Beneficiaries Monitoring and Evaluation System (HBMES) which involves the sharing of the personal information of the beneficiaries of the KSAs with the DHSUD as the central repository of all personal data.
The sharing of personal information shall primarily enable the DHSUD and the KSAs to strictly implement the “one-time availment” policy and to ensure that the limited government allocation for housing shall be given to the underprivileged Filipino families.
You now inquire on whether the consent of all beneficiaries or data subjects are required prior to the sharing of their personal data, considering the provisions of the Data Privacy Act of 2012 (DPA), specifically Section 4 (e) thereof.
Discussion
Scope of the DPA; special cases; data sharing; compliance with the DPA
The DPA provides for a list of specified information that are not covered by the law. Section 5 of its Implementing Rules and Regulations (IRR)1 provides for the special cases wherein the law and the rules are not applicable. Specifically, Section 5 (d) may find application in this scenario:
Information necessary in order to carry out the functions of public authority, in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function, including the performance of the functions of the independent, central monetary authority, subject to restrictions provided by law. Nothing in this Act shall be construed as having amended or repealed Republic Act No. 1405, otherwise known as the Secrecy of Bank Deposits Act; Republic Act No. 6426, otherwise known as the Foreign Currency Deposit Act; and Republic Act No. 9510, otherwise known as the Credit Information System Act (CISA);
Being an exception to the rule, it must be established that the information claimed to be outside the scope of the law is:
- Necessary in order to carry out the law enforcement or regulatory functions of the public authority;
- Processing of personal data is for the fulfillment of a constitutional or statutory mandate;
- Applies only to the minimum extent of collection, access, use, disclosure, or other processing necessary for the purpose; and
- Presupposes that there is strict adherence to all substantive and procedural processes.2
Regulatory Functions of the Public Authority; Constitutional or Statutory Mandate
Section 5(d) of the DPA is interpreted to the effect that a government agency having a constitutional or statutory mandate to collect and process personal data may do so even without the consent of the data subject in the exercise of its regulatory function. But this is with the concomitant responsibility of ensuring that organizational, physical and technical security measures are in place to protect the personal data it is processing.3
In relation to the above, Republic Act No. 11201 or the Department of Human Settlements and Urban Development Act provides that the DHSUD shall be the sole and main planning and policy-making, regulatory, program coordination and performance monitoring entity for all housing, human settlement and urban development concerns, primarily focusing on the access to and the affordability of basic human needs.4
Said law has also mandated the DHSUD to develop and adopt a national strategy to immediately
address the provision of adequate and affordable housing to all Filipinos and ensure the alignment of the policies, programs and projects of its KSAs in achieving the said objectives.5 Consequently, this includes ensuring that there is no repeat availment of housing services among the beneficiaries.
We understand also that all the KSAs are attached agencies8 of the DHSUD, having their respective mandates under the Department of Human Settlements and Urban Development Act and their pertinent Charters. The proposed data sharing between should also find constitutional or statutory basis in the charters of the KSAs.
We emphasize that government agencies may share or transfer personal data under its control or custody through a DSA in order to facilitate the performance of a public function or the provision of a public service.6
Necessity and Proportionality; adherence to substantive and procedural process
Furthermore, government agencies as personal information controllers, must be able to show that the processing of personal data is necessary to their regulatory functions, and that the processing shall be limited to achieving the specific purpose, function or activity. In order to be considered necessary, the data collection should not be excessive as to purpose of processing and the manner of collection should not be unduly intrusive.
PICs remain to be subject to the requirements of implementing measures to secure and protect personal data.7 Protecting the rights of data subjects should be a consideration in all stages of the processing.
Lawful criteria for processing; law and regulation
The DHSUD may also rely on the other provisions of the DPA, particularly Sections 12 and 13 which provides for the various criteria for lawful processing of personal and sensitive personal information, respectively, i.e. processing is necessary for compliance with a legal obligation, processing is provided for by existing laws and regulations, etc.
Considering that there is a need for DHSUD, as the regulatory authority mandated by R.A. 11201, to ensure one time availment among the beneficiaries of housing services and assuming all the attached agencies have similar mandate, the data sharing may no longer require consent of the data subjects.
As to the form and contents of the proposed DSA, please refer to the provisions of NPC Circular No. 2016-02 - Data Sharing Agreements Involving Government Agencies available at our website at https://www.privacy.gov.ph/memorandum-circulars/npc-circular-16-02-data-sharing-agreements-involving-government-agencies/, for guidance and additional information.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
Implementing Rules and Regulations of Republic Act No. 10173, known as the “Data Privacy Act of 2012” (24 August 2016). ↩
-
See: National Privacy Commission, NPC Advisory Opinion No. 2018-079 (Oct. 23, 2018). ↩
-
Id. ↩
-
An Act Creating the Department of Human Settlements and Urban Development, Defining Its Mandate, Powers and Functions, and Appropriating Funds Therefor [Department of Human Settlements and Urban Development Act], Republic Act No. 11201, § 4 (2018). ↩
-
Ibid. ↩
-
National Privacy Commission, Data Sharing Agreements Involving Government Agencies, Circular No. 16-02 [NPC Circular 16-02], § 1 (October 10, 2016). ↩
-
See: National Privacy Commission, NPC Advisory Opinion No. 2017-035 (July 27, 2017). ↩