NPC Issuance Wiki

NPC Advisory Opinion No. 2019-048 — Disclosure of Records Under the Custody of the City Civil Registrar

Issued Advisory Opinion

Official opinion tags

Text

20 December 2019

Re: DISCLOSURE OF RECORDS UNDER THE CUSTODY OF THE CITY CIVIL REGISTRAR

Dear [Redacted],

We write in response to your request for an advisory opinion which sought to clarify whether the City Civil Registry Office (CCRO) of Iloilo may release records that contain personal data to agencies like the Social Security System (SSS), Bureau of Internal Revenue (BIR), Philippine Veterans Affairs Office (PVAO) if there is a formal request, and to the regular courts and other agencies upon issuance of a subpoena, without the consent of the document owner.

Discussion

Scope of the DPA; Processing of Personal Data by the CCRO

The Data Privacy Act of 20121 (DPA) and its Implementing Rules and Regulations (IRR) applies to the processing of all types of personal information and to any natural and juridical person in the government or private sector involved in personal information processing.2

We understand that the civil registry was established by law to record the civil status of persons3 and that the City Civil Registrar has the primary function of keeping and preserving the following books and make the proper entries concerning the civil status of persons:

  1. Birth and death register;
  2. Marriage register, in which shall be entered not only the marriages solemnized but also divorces and dissolved marriages.
  3. Legitimation, acknowledgment, adoption, change of name and naturalization register.4

Given the foregoing, civil registry documents contain personal and sensitive personal information. The DPA considers the collection, storage and sharing of records by the CCRO of Iloilo under its custody as processing activities and is thus covered by the DPA.5 As a personal information controller (PIC), the CCRO must adhere to any of the lawful bases for processing provided under Sections 12 and/or Section 13 of the DPA.

Criteria of Lawful Processing of Sensitive Personal Information; Request from Government Agencies and Courts; PSA Memorandum Circular

The DPA provides that the processing of sensitive personal information is prohibited, except for certain instances provided by law.6 In particular, exceptions include processing that is provided for by existing laws and regulations and processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.7 Public authority is defined as any government entity created by the Constitution or law and vested with law enforcement or regulatory authority and functions.8

When processing is based on any of the above criteria, the consent of the document owner is no longer required. Further, the provisions above on the lawful processing of sensitive personal information of the DPA should be read together existing laws, rules, and regulations.

We understand that the Philippine Statistics Authority (PSA) issued Memorandum Circular No. 2019 – 15 on Guidelines on the Issuance of the Civil Registry Documents (CRDs)/Certifications including Authentication addressed to all City/Municipal Civil Registrars, among others.9 The issuance lists down persons who may be allowed to request for the copy issuance of Civil Registry Documents/Certifications other than the document owner. Among those listed are as follows:

  1. The court or proper public official whenever absolutely necessary in administrative, judicial or other official proceedings to determine the identity of the person; provided, that there must be a duly issued subpoena duces tecum and ad testificandum for the production of the civil registry document;10 and
  2. Request from other government agencies pursuant to their mandate; provided, that the requesting government agency executed Data Sharing Agreement with PSA in accordance with NPC Circular 16-02.11

We reiterate that the DPA is not meant to prevent government institutions from processing personal data when necessary to fulfill their mandates. Rather, it aims to protect the right to information privacy while ensuring free flow of information. What the DPA does is to promote fair, secure, and lawful processing of such information.12

We likewise emphasize that NPC Circular 16-02 on Data Sharing Agreements Involving Government Agencies provides that a government agency may share or transfer personal data under its control or custody to a third party through a data sharing agreement to facilitate the performance of a public function or the provision of a public service, and that the Circular shall not be construed as prohibiting or limiting the sharing or transfer of any personal data that is already authorized or required by law.13

Please note however, that although the disclosure of personal data is supported by a constitutional or statutory mandate of government agencies, the adherence to the principles of transparency, legitimate purpose and proportionality must still be complied with.14 For this purpose, the CCRO shall ensure that personal data in its custody or control is disclosed or released only if it is material or relevant to the subject-matter of the request and its disclosure is permissible under the existing law, rules or regulations, among others.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 4 (2016). ↩

  3. Law on Registry of Civil Status [Civil Registry Law], Act No. 3753, § 1 (1930). ↩

  4. Id. § 4. ↩

  5. Data Privacy Act of 2012, § 4. ↩

  6. Id. § 13. ↩

  7. Id. § 13 (b) and (f). ↩

  8. Rules and Regulations Implementing the Data Privacy Act of 2012, § 3(r). ↩

  9. Philippine Statistics Authority, Guidelines on the Issuance of the Civil Registry Documents (CRDs)/Certifications including Authentication, Memorandum Circular No. 2019-15 [PSA MC 2019-015] (June 11, 2019). ↩

  10. Id. § II (6). ↩

  11. Id. § II (7). ↩

  12. National Privacy Commission, NPC Advisory Opinion No. 2018-083 (Nov. 26, 2018). ↩

  13. National Privacy Commission, Data Sharing Agreements Involving Government Agencies, Circular No. 16-02 [NPC Circular 16-02] (October 10, 2016). ↩

  14. Data Privacy Act of 2012, § 11. ↩

Backlinks

  • No backlinks found