Text
24 October 2019
Re: ACCESS TO PSA CIVIL REGISTRY DOCUMENTS FOR VERIFICATION PURPOSES
Dear [Redacted],
We write in response to your letter which sought our opinion on three (3) matters raised by the Armed Forces and Police Savings and Loan Association, Inc. (AFPSLAI) in relation to the processing of the personal and sensitive personal information (collectively, personal data) of AFPSLAI’s members.
Discussion
The issues may be summarized as follows:
- AFPSLAI offers automatic transmittal of capital contribution, loan, and pension remittances from the respective finance centers of the Armed Forces of the Philippines, Philippine Navy, Philippine Air Force, Philippine National Police, Philippine Veterans Affairs Office, Bureau of Fire Protection, Bureau of Jail Management Protection and other similar military/civilian branch, to facilitate related transactions. Upon knowledge of death of the member, the pertinent finance center notifies AFPSLAI to return the amount of remittances. There are instances, however, that AFPSLAI already knows of the death of a member and is ready to return the overpaid remittances, but the necessary proof of the fact of death, i.e. death certificate, cannot be acquired by AFPSLAI. Efforts have been made to communicate with the concerned heirs but to no avail. Hence, the over remitted funds kept on accumulating as accounts payable by AFPSLAI;
- Members’ loans are insured. Upon death, the insurance companies require the death certificate to release the insurance proceeds to be applied to the members’ accountabilities. As mentioned above, there is difficulty in acquiring the death certificate; and
- The Bangko Sentral ng Pilipinas (BSP) requires the AFPSLAI to ensure that all members are duly qualified. AFPSLAI’s records reveal that there are associate members whose qualifications are in doubt as there are no documents to prove filiation with regular members. AFPSLAI sent letters to a number of these associate members for the submission of their birth and/or marriage certificates. However, many have not complied with the request.
In view of the above, AFPSLAI coordinated with the Philippine Statistics Authority (PSA). There is a draft Memorandum of Agreement (MOA) which contains the terms and conditions of AFPSLI’s access to the PSA’s Batch Request Entry and Query System (BREQS) and Data Matching of Records scheme.
You now ask for opinion on AFPSLAI’s right to process the necessary documents in behalf of the members for the above purposes.
Discussion
Criteria for lawful processing
AFPSLAI may rely on any of the provisions of Sections 12 and 13 of the Data Privacy Act of 20121 (DPA) which provides the criteria for lawful processing of personal and sensitive personal information, respectively.2
For all three issues, the processing may be related to a contract between AFPSLAI and the member, a legal obligation on the part of the AFPSLAI, or a requirement under a specific law, rule or regulation, i.e. Commission on Audit (COA) rules on affecting finance centers of the Armed Forces of the Philippines and/or the Philippine National Police, insurance laws or issuances of the Insurance Commission relating to insured loans, and/or BSP rules governing membership in non-stock savings and loans associations. AFPSLAI may likewise consider whether its processing is based on the establishment, exercise or defense of legal claims.
With the above, AFPSLAI should make a determination of the proper basis for the processing depending on the nature of the personal data being processed.
Data sharing; Memorandum of Agreement with the PSA
As defined in the IRR, data sharing pertains to the disclosure or transfer to a third party of personal data under the custody of a personal information controller (PIC) or a personal information processor (PIP) wherein such transfer was directly instructed by the PIC. The data sharing agreement then refers to the contract which contains the terms and conditions of a dating sharing arrangement between two or more PICs.
We understand that the MOA covers the Data Matching Records Scheme and the use of BREQS scheme (issuance of PSA civil registry documents) for the purpose of verification of status of AFPSLAI pensioners/members and their beneficiaries through the system to be provided by the PSA.
We provide the following general comments on the draft MOA pursuant to the provisions of NPC Circular No. 16-02 governing data sharing involving government agencies:
-
There is a need to clarify Section 7.4 of the MOA, which requires AFPSLAI to submit various forms to PSA, i.e. Application Form, Consent Form, and Waiver and Authorization Form. It further provides that “AFPSLAI shall sign and accomplish all forms in behalf of its members/relatives of members, in connection with the rationale and the legitimate purposes mentioned in the whereas clauses.”
Note we were not provided with a copy of the abovementioned forms, and hence, these were not reviewed for purposes of this opinion.
To clarify, consent of the data subject refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so.
With the above, it is not appropriate for AFPSLAI to accomplish a consent form in behalf of its members/relatives of members, unless it has been specifically authorized by the data subjects for the said purpose.
As we understood it, AFPSLAI is already having difficulty in communicating with the members and/or their relatives with respect to requesting for the pertinent civil registry documents. With this scenario, it may not be feasible to require a consent form. As mentioned above, AFPSLAI’s processing may be based on a number of various criteria for processing. Considering the attendant circumstances, consent may not be the most appropriate basis for the status quo.
Nonetheless, if moving forward and based on privacy impact assessment, AFPSLAI makes a determination that indeed, consent of the data subject is the proper basis for processing, it may then implement changes to its data processing systems whereby consent will be obtained from the data subject at the most opportune time.
-
The MOA should have provisions on the following matters:
- Remedies available to a data subject, in case the processing of personal data violates his or her rights, and how these may be exercised;
- The designated data protection officers of AFPSLAI and PSA;
- The personal information controller responsible for addressing information requests and complaints filed by a data subject and/or is being investigated by the Commission; and
- Process through which a data subject may access a copy of the MOA.
The NPC, the DPA, its IRR, and issuances of the Commission do not limit the agreement of the parties provided that the agreement does not contravene the letter and intent of the law. The Commission fully subscribes to the fundamental legal tenet ascribing a presumption of regularity in the performance of functions by government agencies.
Finally, please note that a data sharing agreement does not prior approval from the NPC.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
See: National Privacy Commission, NPC Advisory Opinion No. 2019-39 (Sept. 3, 2019). ↩