NPC Issuance Wiki

NPC Advisory Opinion No. 2019-046 — Inter-Agency Council Against Trafficking (IACAT) Request for Information with the Philippine Statistics Authority (PSA)

Issued Advisory Opinion

Official opinion tags

Text

17 December 2019

Re: INTER-AGENCY COUNCIL AGAINST TRAFFICKING (IACAT) REQUEST FOR INFORMATION WITH THE PHILIPPINE STATISTICS AUTHORITY (PSA)

Dear [Redacted],

We write in response to your request for an advisory opinion received by the National Privacy Commission (NPC) which sought to clarify whether or not the Data Privacy Act of 20121 allows for the disclosure of the personal information, specifically the age, of an alleged trafficking victim, by the Philippine Statistics Authority (PSA) to the Inter-Agency Council Against Trafficking (IACAT) for purposes of filing a criminal case for violation of Republic Act No. 9208.2

Discussion

We understand that during the inquest proceedings of the foreign national arrested by the IACAT Region 7, the IACAT experienced difficulty in proving the age of the victim. We note that minority qualifies the offense under Section 6 of Republic Act No. 9208.

With the consent of the victim, IACAT requested the Philippine Statistics Authority (PSA) for the personal details of the victim, including the age. However, PSA refused to divulge any information, stating that it can only provide the requested information through a court-issued subpoena. As explained by the Regional Prosecutor, a request for the issuance of a subpoena from the court is not possible as the case is currently being investigated by the investigating prosecutor.

Discussion

Sensitive personal information; criteria for lawful processing; Section 13

Section 3 of the DPA provides the definition of sensitive personal information, which includes an individual’s age. As a general rule, the processing of such information is prohibited unless any of the conditions provided for in Section 13 of the DPA is attendant. Specific to this scenario, the following lawful bases should be considered:

  • The data subject has given his or her consent to the processing;3
  • The processing is provided for by existing laws and regulations;4 or
  • The processing concerns such personal information as is necessary (1) for the establishment, exercise or defense of legal claims or (2) when provided to government or public authority.5

While Section 13 (a) of the DPA allows for the processing of sensitive information when there is consent of the data subject, the same must be freely given, specific and an informed indication of the will.6 Only upon the concurrence of the three (3) elements can consent be considered valid.

In this case, however, the consent given by the trafficking victim may not be considered a valid consent because if indeed the trafficking victim is a minor, he or she cannot validly provide the consent needed under the DPA.7

With this, the more appropriate possible basis for the disclosure would be any existing law and regulation. As discussed above, RA No. 9208 qualifies the offense when the victim is a child. To prove the minority of the victim, it follows that the only credible source of information is the records of the PSA, specifically the victim’s Certificate of Live Birth. Implicit in the law as well is the allowance for disclosure of the victim’s personal circumstance, subject to the confidentiality clause provided for by Section 7 of RA No. 9208.

Disclosure may also be made pursuant to Article 7(3) of Presidential Decree No. 6038 which allows the disclosure of a person’s birth information to a court or proper public official whenever absolutely necessary in administrative, judicial or other official proceedings to determine the circumstances surrounding a person’s birth. In this case, the disclosure of the birth information of the victim is necessary in the inquest proceeding to determine whether or not the foreign national is guilty of violating Republic Act No. 9208 as well as for the establishment, exercise or defense of legal claims of the victim.

Likewise, processing is also allowed when sensitive personal information is provided to government or public authority. The disclosure of the trafficking victim’s age to IACAT may be allowed because such disclosure is pursuant to IACAT’s mandate provided for in Section 21 of RA No. 9208. Specifically, IACAT is tasked to assist in the filing of cases against violators of the law as well as secure from any department, bureau, office, agency, or instrumentality of the government such assistance as may be needed to effectively implement the law.

We reiterate that the DPA is not meant to prevent government institutions from processing personal data when necessary to fulfill their mandates. Rather, it aims to protect the right to information privacy while ensuring free flow of information. What the DPA does is to promote fair, secure, and lawful processing of such information.9

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. An Act to Institute Policies to Eliminate Trafficking in Persons Especially Women and Children, Establishing the Necessary Institutional Mechanisms for the Protection and Support of Trafficked Persons, Providing Penalties for its Violations, and for Other Purposes [Anti-Trafficking in Persons Act of 2003], Republic Act No. 9208 (2003). ↩

  3. Data Privacy Act of 2012, § 13 (a). ↩

  4. Id. § 13 (b). ↩

  5. Id. § 13 (f). ↩

  6. Id. § 3 (b). ↩

  7. See: National Privacy Commission, NPC Advisory Opinion No. 2017-49 (August 29, 2017). ↩

  8. The Child and Youth Welfare Code [Child and Youth Welfare Code], P. D. No. 603 (2003). ↩

  9. See: National Privacy Commission, NPC Advisory Opinion No. 2018-083 (Nov. 26, 2018). ↩

Backlinks