Text
12 December 2019
Re: REQUEST FOR THE LAST KNOWN ADDRESS OF A FORMER EMPLOYEE
Dear [Redacted],
We write in response to your request for advisory opinion received by the National Privacy Commission (NPC) where you seek clarification on whether the Metropolitan Waterworks & Sewerage System (MWSS) may provide the last known address of its former employee at the request of the Commission on Audit (COA), pursuant to Section 7, Rule IV of its 2009 Revised Rules of Procedures.
We understand that you have denied the request of COA for having no clear indication in the said provision that compels your office to submit such information.
The 2009 Revised Rules of Procedures of the COA applies to its pleadings and practice in all matters, actions and proceedings originally acted upon by or appealed to it in the exercise of its quasi-judicial function, including administrative cases.1
Per COA’s letter to your office, the request for the last known address of your former employee was made in accordance with Section 7, Rule IV of the same rules, to wit:
RULE IV PROCEEDINGS BEFORE THE AUDITOR
xxx xxx xxx
Section 7. Service of Copies of ND/NC/NS, Order or Decision. — The ND, NC, NS, order, or decision shall be served to each of the persons liable/responsible by the Auditor, through personal service, or if not practicable through registered mail.
In case there are several payees, as in the case of a disallowed payroll, service to the accountant who shall be responsible for informing all payees concerned, shall constitute constructive service to all payees listed in the payroll.
From our understanding of the abovementioned provision, the purpose of the request is to be able to serve the corresponding copies of Notice of Disallowance/Charge (ND/NC) and/or Notice of Suspension (NS)2 to the person considered liable by the Auditor, either through personal service or his/her registered mail.
The Data Privacy Act of 20123 (DPA) applies to all types of processing of personal data in the country or outside, subject to certain qualifications.4 The last known address of a former employee is considered personal information5 under the DPA.
Pursuant to Section 12 of the DPA, processing of personal information may only be allowed if not otherwise prohibited by law and when justified by at least one of the conditions therein, such as the following:
SECTION 12. Criteria for Lawful Processing of Personal Information. – xxx
(a) The data subject has given his or her consent; (b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract; (c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject; (d) The processing is necessary to protect vitally important interests of the data subject, including life and health; (e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or (f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.6
In this regard, we note COA’s mandate as provided for under Section 2, Article IX-D of the 1987 Philippine Constitution, which states that:
Section 2. (1) The Commission on Audit shall have the power, authority, and duty to examine, audit and settle all accounts pertaining to the revenues and receipts of, and expenditures or uses of funds and property, owned or held in trust by, or pertaining to the Government, or any of its subdivisions, agencies, or instrumentalities, including government-owned and controlled corporations with original charters, and on a post-audit basis: (a) constitutional bodies, commissions and offices that have been granted fiscal autonomy under the Constitution; (b) autonomous state colleges and universities; (c) other government-owned or controlled corporations and their subsidiaries; and (d) such non-governmental entities receiving subsidy or equity directly or indirectly, from or through the government, which are required by law or the granting institution to submit to such audit as a condition of subsidy or equity. However, where the internal control system of the audited agencies is inadequate, the Commission may adopt such measures, including temporary or special pre-audit, as are necessary and appropriate to correct the deficiencies. It shall keep the general accounts of the Government, and for such period as may be provided by law, preserve the vouchers and other supporting papers pertaining thereto.
(2) The Commission shall have exclusive authority subject to the limitations in this Article, to define the scope of its audit and examination, establish the techniques and methods required therefor, and promulgate accounting and auditing rules and regulations including those for the prevention and disallowance of irregular, unnecessary, excessive, extravagant, or unconscionable expenditures, or uses of government funds and properties.
Considering the mandate of the COA, the Auditor may rely on Section 12(c) of the DPA as the appropriate basis for the lawful processing of personal information.
We note however that any processing of personal information shall also adhere to the principles of transparency, legitimate purpose, and proportionality.7 Thus, the disclosure shall be only limited to the last known address of the former COA employee for the purpose as stated by COA.
This opinion is being rendered based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
Footnotes
-
2009 Revised Rules of Procedures of the Commission on Audit, Rule I, § 2. ↩
-
2009 Revised Rules of Procedures of the Commission on Audit, Rule IV, § 4 — Audit Disallowances/Charges/Suspensions. In the course of the audit, whenever there are differences arising from the settlement of accounts by reason of disallowances or charges, the auditor shall issue Notices of Disallowance/Charge (ND/NC) which shall be considered as audit decisions. Such ND/NC shall be adequately established by evidence and the conclusions, recommendations or dispositions shall be supported by applicable laws, regulations, jurisprudence and the generally accepted accounting and auditing principles. The Auditor may issue Notices of Suspension (NS) for transactions of doubtful legality/validity/propriety to obtain further explanation or documentation. ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
Id., § 4. ↩
-
Data Privacy Act of 2012, § 3(g) — Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual. ↩
-
Data Privacy Act of 2012, § 12. Emphasis supplied. ↩
-
Id., § 11. ↩