NPC Issuance Wiki

NPC Advisory Opinion No. 2019-040 — Anti-Money Laundering Council Request

Issued Advisory Opinion

Official opinion tags

Text

17 October 2019

Re: ANTI-MONEY LAUNDERING COUNCIL REQUEST

Dear [Redacted],

We write in response to your letter which sought clarification regarding the request from the Anti-Money Laundering Council (AMLC) for documents pertaining to a certain business entity in Antipolo City. The AMLC is requesting for certified true copies of the following:

Discussion

  1. Business Permits;
  2. Duly accomplished application form;
  3. Payment History;
  4. Account Subsidiary Ledger with Gross Receipts and Capital; and
  5. Other relevant documentary requirements submitted by the business entity in relation to the application for/renewal of business permits: a. Income statement; b. Contract of Lease; c. Land Title/Tax Declaration; and d. Community Tax Certificate.

You seek clarification if your office may provide such documents of the business entity to the AMLC pursuant to its investigative functions under Republic Act No. 9160 or the Anti-Money Laundering Act of 2001.

Discussion

Scope of the Data Privacy Act of 2012; processing of personal information

The Data Privacy Act of 20121 (DPA) applies to the processing of all types of personal information by any natural and/or juridical person involved in personal information processing.2 The law defines personal information as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.3

Business establishments are juridical persons. Thus, generally speaking, the certified true copies of the above listed documents are the juridical person’s information, and not an individual’s personal information.

Article 44 of the Civil Code of the Philippines defines juridical persons, to wit:

Article 44. The following are juridical persons:

(1) The State and its political subdivisions; (2) Other corporations, institutions and entities for public interest or purpose, created by law; their personality begins as soon as they have been constituted according to law; (3) Corporations, partnerships and associations for private interest or purpose to which the law grants a juridical personality, separate and distinct from that of each shareholder, partner or member.

Nonetheless, as there may be personal and/or sensitive personal information (collectively, personal data) in such requested documents, the DPA recognizes various criteria for processing the same under Section 12, i.e. processing is necessary for compliance with a legal obligation4 or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate;5 or Section 13, i.e. processing of the same is provided for by existing laws and regulations6 or processing concerns is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.7

Hence, the BPLO may rely on the above lawful bases for processing, considering that the AMLC is vested with investigative functions under RA No. 9160.

We wish to emphasize that the DPA should not be an obstacle to the collection and processing of personal data by the various government agencies as long as the same is necessary for the fulfillment of their respective mandates. The law promotes fair, secure, and lawful processing of such information.8 This is with the concomitant responsibility of complying with the requirements of the DPA, its Implementing Rules and Regulations, and other issuances of the National Privacy Commission.9

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. Id. § 4. ↩

  3. Id. § 3 (g). ↩

  4. Data Privacy Act of 2012, § 12 (c). ↩

  5. Id. § 12 (e). ↩

  6. Id. § 13 (b). ↩

  7. Id. § 13 (f). ↩

  8. See: National Privacy Commission, NPC Advisory Opinion No. 2018-083 (Nov. 26, 2018). ↩

  9. Id. ↩

Backlinks