Text
3 February 2020
Re: INFORMATION ON VEHICLE INGRESS AND EGRESS
Dear [Redacted],
We write in response to your inquiry received by the National Privacy Commission (NPC) seeking to clarify the nature of vehicle ingress and egress information in light of the Data Privacy Act of 20121 (DPA).
We understand from your letter that your company, Serendra Condominium Corporation (SCC), received a letter from one of your residents (“A”) through a certain law office requesting SCC to release the record of ingress and egress of the resident’s vehicle on 23 July 2018 (“Subject Information”). However, as confirmed from your records, A is married to B, the latter also a registered SCC resident. Thus, you opined that the vehicle may be conjugal property and SCC cannot determine who used and was in possession of the car on the said date.
In its reply to the law firm, SCC requested a sworn-affidavit from A stating that she was in actual use and possession of the vehicle. The purpose of the affidavit is to ensure that A is the owner and driver of the subject vehicle at that time. However, the law firm responded that the Subject Information is neither privileged nor confidential and does not contain sensitive personal information and thus is not covered by the DPA.
You now seek clarification on the following questions:
(a) Whether the vehicle ingress and egress of the resident is considered as personal information under the DPA; and (b) Assuming that it is personal information, is the Subject Information owned by the registered owner of the vehicle or the actual possessor/driver of the vehicle during the requested period?
Discussion
Vehicle ingress and egress as personal information; access; disclosure; legitimate interest
As defined under the DPA, personal information is any information from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.2
Taking from the definition, the exact location of an individual at a certain date and time when put together with other information may directly and certainly identify an individual. Thus, the ingress and egress of a vehicle driven by an individual, which point to the individual’s location at a certain time and date is considered personal information.
As to the second inquiry, the vehicle ingress and egress may pertain to both the personal information of the registered owner of the vehicle and/or the driver or the possessor of the vehicle at that specific moment. The details of an individual’s movement or whereabouts are considered personal information. At the same time, because the vehicle is registered to a natural person, information on the vehicle’s movement may also be considered as an identifier which relates to the registered owner.
Given the foregoing, details on a vehicles ingress and egress are considered as personal information under our law. SCC, as the personal information controller (PIC), has the responsibility to process, which includes disclosure, said personal information in accordance with the provisions of the DPA and its implementing rules and regulations, including the implementation of reasonable and appropriate security measures for the protection of personal information, adherence to the general data privacy principles, and upholding data subjects’ rights.
We wish to clarify that while this particular request may be treated as an exercise of a data subject’s right to access, where the registered owner of the car is the one requesting for information, the same is not the only manner by which disclosures of personal information can be made.
In the case at hand, SCC may also consider Section 12(f) of the DPA on legitimate interest which allows processing (i.e. disclosure) that is necessary for the purposes of the legitimate interests pursued by the PIC or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.
In order to use legitimate interest as basis for lawful processing, PICs must consider the following:3
- Purpose test – The existence of a legitimate interest must be clearly established, including a determination of what the particular processing operation seeks to achieve;
- Necessity test – The processing of personal information must be necessary for the purposes of the legitimate interest pursued by the PIC or third party to whom personal information is disclosed, where such purpose could not be reasonably fulfilled by other means; and
- Balancing test – The fundamental rights and freedoms of data subjects should not be overridden by the legitimate interests of the PICs, considering the likely impact of the processing on the data subjects.4
This opinion is rendered based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Data Privacy Act of 2012, § 3 (g). ↩
-
See generally, Data Privacy Act of 2012, § 12 (f); United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ [last accessed on Feb. 12, 2020]. ↩
-
See: National Privacy Commission, NPC Advisory Opinion No. 2018-061 (Sept. 6, 2018). ↩