NPC Issuance Wiki

NPC Advisory Opinion No. 2019-039 — Request For Tax Declaration

Issued Advisory Opinion

Official opinion tags

Text

03 September 2019

Re: REQUEST FOR TAX DECLARATION

Dear [Redacted],

We write in response to your letter which sought clarification regarding your request to secure copies of tax declarations, certificates of title, and tax clearances of real properties from the Assessor’s Office and the Treasurer’s Office of the City of Antipolo vis-à-vis the provisions of the Data Privacy Act of 20121 (DPA).

We understand that you are the counsel for Manila Water Company, Inc. (MWCI). Pursuant to the Concession Agreement of Manila Water with the Metropolitan Waterworks and Sewerage System (MWSS), the former acts as an agent of the latter. In line with the relevant provisions of Concession Agreement, MWCI embarked on a pipeline laying project which necessitates the conduct of due diligence on the identity, ownership, possession and valuation of properties that may be duly affected by the project, hence this request for the copies of the abovementioned documents.

We understand that the Assessor’s Office and the Treasurer’s Office of the City of Antipolo claim that the names and addresses of the property owners are personal information that are protected under the DPA.

Scope of the Data Privacy Act of 2012; regulatory function; public authority

The DPA applies to all types of processing of personal information subject to certain qualifications.2 The disclosure of documents containing personal or sensitive personal information (collectively, personal data) is considered processing. Under the DPA, processing of personal data shall be allowed, subject to compliance with the law and adherence to the

principles of transparency, legitimate purpose, and proportionality. By way of exception, the DPA recognizes that certain specified information is outside its scope.

One of these special categories is “information necessary in order to carry out the functions of public authority which includes the processing of personal data for the performance by the … regulatory agencies of their constitutionally and statutorily mandated functions.”3 In order to apply, it must be established that the information claimed to be outside the scope of the law is:

  1. The information is necessary to carry out the regulatory or law enforcement functions of a public authority;
  2. These functions are provided for by the Constitution or by law;
  3. The processing is only to the minimum extent of collection, access, use, disclosure, or other processing necessary for the purpose; and
  4. There is strict adherence to all substantive and procedural processes.4

The above is interpreted to the effect that a government agency having a constitutional or statutory mandate to collect and process personal data may do so even without the consent of the data subject in the exercise of its regulatory function.5 The information requested may be released to MWCI if the same documents may properly be released to MWSS, under its legal mandate. This comes with the concomitant responsibility of ensuring that organizational, physical and technical security measures are in place for data protection.6

In this case, the personal data needed by MWCI, acting as an agent of MWSS, which is a regulatory agency pursuant to RA No. 6234,7 may be outside of the scope of the DPA, but subject to the above requisites as well as the provisions of their Concession Agreement.

Lawful criteria for processing of personal and sensitive personal information; general data privacy principles

MWCI may rely on the other provisions of the DPA, specifically Sections 12 and 13 which provides the criteria for lawful processing of personal and sensitive personal information, respectively. These sections clarify that consent of the data subject is just one of the possible bases for processing. Personal information controllers (PICs), such as the City of Antipolo and MWCI, should make their own determination of the proper basis for the disclosure, depending on the nature of the personal data being processed.

Property laws vis-à-vis the DPA

The provisions of Presidential Decree No. 1529,8 Act No. 496,9 and other applicable laws and regulations on the matter should be read together and harmonized with the DPA. For instance, in order to quiet title to real property or remove clouds therefrom, processing is recognized under the DPA for purpose of the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims.10

In Advisory Opinion No. 2018-083,11 it was emphasized that “the DPA is not meant to prevent government institutions from processing personal data when necessary to fulfill their mandates. Rather, it aims to protect the right to information privacy while ensuring free flow of information. What the DPA does is to promote fair, secure, and lawful processing of such information.”

Public documents; publicly available information

The belief that tax declarations and tax clearances are not protected by the DPA is misguided. A public document, or even publicly available information, by such fact alone, does not lose the protection afforded by the DPA in so far as the processing involves the personal data contained in such documents.

Further, Advisory Opinion No. 2017-03012 discussed the processing of personal data which is available in the public domain, to wit:

… the provisions of the DPA are still applicable even for those personal data which are available in the public domain. Note that the law has specified the information which is outside of its scope but only to the minimum extent necessary to achieve the specific purpose, function, or activity in Section 4 thereof.

There is no express mention that personal data which is available publicly is outside of its scope. Thus, “it is a misconception that publicly accessible personal data can be further used or disclosed for any purpose whatsoever without regulation.”

… the PIC which collects and processes personal data from the public domain must still observe the requirements under the law, specifically on the criteria for lawful processing of personal, sensitive personal and privileged information found under Sections 12 and 13 thereof.

Likewise, reference to the case of Francisco v. Magbitang,13 is misplaced. The ruling of the Court does not create an obligation on the part of government agencies to allow unrestricted access to tax declarations. Documents under control and custody of government agencies remain to be subject to the protection of the DPA. Even Executive Order (EO) No. 0214 operationalizing Freedom of Information in the Executive Branch admits of certain limitations such as those that pertain to the privacy of individuals and those that may affect security.

The EO clarifies that “while providing access to information, public records, and official records, responsible officials shall afford full protection to the right to privacy of the individual.”15 For this purpose, it requires that each government office shall ensure that personal information in its custody or control is disclosed or released only if it is material or relevant to the subject-matter of the request and its disclosure is permissible under this EO or existing law, rules or regulations, among others.16

We note also the provision of Act No. 496 which you discussed, wherein all records and papers relating to registered land in the office of the Register of Deeds shall be open to the public, but the same is subject to reasonable regulations as may be prescribed by the Land Registration Authority. This reinforces the rationale that the public documents are still duly protected and access to the same may still be regulated.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. Id. § 4. ↩

  2. Data Privacy Act of 2012, § 4(e). ↩

  3. See generally, National Privacy Commission, NPC Advisory Opinion No. 2018-079 (Oct. 23, 2018). ↩

  4. See: National Privacy Commission, NPC Advisory Opinion No. 2017-035 (July 27, 2017). ↩

  5. Id. ↩

  6. An Act Creating The Metropolitan Waterworks And Sewerage System And Dissolving The National Waterworks And Sewerage Authority; And For Other Purposes, Republic Act No. 6234 (1971). ↩

  7. Amending and Codifying the Laws Relative to Registration of Property and for other Purposes [Property Registration Decree], Presidential Decree No. 1529 (1978). ↩

  8. An Act to Provide for the Adjudication and Registration of Titles to Lands in the Philippine Islands [The Land Registration Act], Act No. 496 (1902). ↩

  9. Data Privacy Act of 2012, § 13(f). ↩

  10. National Privacy Commission, NPC Advisory Opinion No. 2018-083 (Oct. 29, 2018). ↩

  11. National Privacy Commission, NPC Advisory Opinion No. 2017-030 (June 28, 2017), citing Office of the Privacy Commissioner for Personal Data, Hong Kong, Guidance Note - Guidance on Use of Personal Data Obtained from the Public Domain, August 2013, available at https://www.pcpd.org.hk/english/publications/files/GN_public_domain_e.pdf ↩

  12. G.R. No. 48132 (1989). ↩

  13. Office of the President, Operationalizing In The Executive Branch The People’s Constitutional Right To Information And The State Policies To Full Public Disclosure And Transparency In The Public Service And Providing Guidelines Therefor, Executive Order No. 2 [EO No. 2] (July 23, 2016). ↩

  14. EO No. 2, § 7. ↩

  15. Id. ↩

  16. Id. ↩

Backlinks