NPC Issuance Wiki

NPC Advisory Opinion No. 2019-037 — Request For A Certified Copy Of The Personal Data Sheet Of A Former Job Order Personnel

Issued Advisory Opinion

Official opinion tags

Text

8 August 2019

Re: REQUEST FOR A CERTIFIED COPY OF THE PERSONAL DATA SHEET OF A FORMER JOB ORDER PERSONNEL

Dear [Redacted],

We write in response to your inquiry received by the National Privacy Commission (NPC) which sought to clarify whether or not the purpose indicated in the letter request of a certain law firm for a certified copy of the Personal Data Sheet (PDS) of a former Job Order (JO) personnel is sufficient to warrant the granting of the request.

We understand that the law firm will use the document in a case filed against the former JO, specifically for Falsification of Public Document which is pending before the Office of the City Prosecutor of Quezon City (QC).

Scope of the Data Privacy Act of 2012; special cases; JO personnel; information of public concern

Section 4 of the Data Privacy Act of 20121 (DPA) provides that the law applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing.

It further provides for certain specified information or special cases which are outside of its scope, one of which is information about an individual who is or was performing service under contract for a government institution that relates to the services performed, including the terms of the contract, and the name of the individual given in the course of the performance of those services under Section 4 (b) thereof.

This section may be applicable to the present inquiry involving the information about a JO personnel.

We note that the Joint Circular No. 1, s. 2017 of the Civil Service Commission (CSC), Commission on Audit (COA), and the Department of Budget and Management (DBM) provides that job order refers to piece work or intermittent or emergency jobs, which are of short duration and for a specific piece of work.2 Further, contracting the services of job order workers are subject to the pertinent budgeting, accounting and auditing rules and regulations.3

While the above non-applicability may apply in this case with respect to the information about a JO personnel who performed certain services under contract for the Land Registration Authority (LRA), it is only insofar as the information relates to the services performed and generally, where access to such information will uphold the right to information on matters of public concern.

Further, the non-applicability of the law is only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned, and does not extend to personal information controllers (PICs) or personal information processors (PIPs), who remain subject to the requirements of implementing security measures for personal data protection.4

Personal Data Sheet; Lawful criteria for processing sensitive personal information; Executive Order No. 2; NPC Advisory No. 2017-02; right to privacy; right to information

A PDS is a repository of information pertaining to that employee or official, including his or her personal background, qualifications, and eligibility.5 It contains sensitive personal information such as civil status, blood type and other health information, GSIS, Pag-Ibig and Philhealth No., information about the employee’s family which may include information about minor children, among others.6

Hence, its processing, which includes disclosure, may find basis under Section 13 of the DPA, particularly Section 13(b), which recognizes the processing that is provided for by existing laws and regulations. This provision should be read in relation to Executive Order (EO) No. 2,7 which relates to the operationalization of the people’s right to information under the executive branch, and permits the disclosure of information in the possession or under the custody of the government unless they fall under any of the exceptions enshrined in the Constitution, existing law or jurisprudence.

The EO clarifies that while providing access to information, public records, and official records, responsible officials shall afford full protection to the right to privacy of the individual.8 For this purpose, it requires that each government office shall ensure that personal information in its custody or control is disclosed or released only if it is material or relevant to the subject-matter of the request and its disclosure is permissible under the EO or existing law, rules or regulations, among others.9

Guidance is now being sought on how to apply the relevant provisions of law, to afford full protection to the right of privacy of individuals. In this regard, the NPC issued Advisory No. 2017-02 — Access to Personal Data Sheets of Government Personnel to assist agencies in determining when the PDS of government personnel can be released, considering the purpose, necessity, and proportionality of disclosure and the rights and freedoms of data subjects.

Pursuant to this Advisory, it has been recommended that government agencies must consider the following when resolving a request for access to a PDS:

  1. the information requested falls under matters of public concern;
  2. the individual requesting for personal data has declared and specified the purpose of his or her request;
  3. the declared and specified purpose is not contrary to law, morals, and public policy; and
  4. the personal data requested is necessary to the declared, specified, and legitimate purpose.

We take this opportunity to remind government agencies that the appreciation of the facts and the evaluation of conditions for the release of documents under their control and custody fall primarily with the agency, because they are in the best position to apply their mandate.

Based on the limited information provided, we consider that access to the PDS of a JO personnel may be considered a matter of public concern, in so far as it involves the individual’s qualification to perform services for the government, or possible commission of a crime. Public concern has been understood to cover “a broad spectrum of subjects which the public may want to know, either because these directly affect their lives, or simply because such matters naturally arouse the interest of an ordinary citizen.”10 This finds support in Section 4(b) of the DPA, as discussed in the preceding section, which puts outside the scope of the DPA information about an individual who is or was performing service under contract for a government institution.

In this case, the law firm has also declared and specified the purpose of the request, which is to use the certified copy of the PDS for the pending case before the QC Office of the City Prosecutor for Falsification of Public Document. Requesting the PDS for purpose of establishing a legal claim is not contrary to law, morals, and public policy. In general, the agency should always evaluate whether disclosure of documents is allowed under its mandate, and to assure itself that the request is not intended to harass a data subject or could otherwise be considered unduly intrusive.

The requested PDS is necessary to the declared purpose. While disclosure may be justified, the agency is urged to apply the principle of proportionality and determine whether redaction of certain personal information in the PDS is proper, particularly sensitive personal information that may no longer be necessary for the purpose of the request. It should also ensure that the use of the PDS is limited to the purpose of the request.

Considering the foregoing, the release or disclosure of the certified copy of the PDS may be justified in this instance pursuant to the provisions of Section 4(b) and Section 13(b) of the DPA, in relation to EO No. 2 and NPC Advisory No. 2017-02.

This opinion is based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. Note that this opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC – Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. Civil Service Commission, Commission on Audit, and the Department of Budget and Management, Joint Circular No. 1, s. 2017, § 5.4 (June 15, 2017). ↩

  3. Id., § 6.3.2. ↩

  4. National Privacy Commission, NPC Advisory Opinion No. 2017-056 (Sept. 20, 2017) citing Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, §5 (2016). ↩

  5. Advincula v. Dicen, G.R. No. 162403 (2005). ↩

  6. See: National Privacy Commission, NPC Advisory Opinion No. 2018-088 (Dec. 5, 2018). ↩

  7. Office of the President, Operationalizing In The Executive Branch The People’s Constitutional Right To Information And The State Policies To Full Public Disclosure And Transparency In The Public Service And Providing Guidelines Therefor, Executive Order No. 2 [EO No. 2] (July 23, 2016). ↩

  8. EO No. 2, § 7. ↩

  9. Id., § 7 (a). ↩

  10. Palad v. Solis, G.R. No. 206691 (2016) citing Legaspi v. Civil Service Commission, 234 Phil. 521 (1987). ↩

Backlinks