NPC Issuance Wiki

NPC Advisory Opinion No. 2020-005 — Verification of Pre-Employment Documents

Issued Advisory Opinion

Official opinion tags

Text

4 February 2020

Re: VERIFICATION OF PRE-EMPLOYMENT DOCUMENTS

Dear [Redacted],

We write in response to your inquiry received by the National Privacy Commission (NPC) seeking to clarify the lawfulness of document verification in relation to the requirements under Data Privacy Act of 20121 (DPA).

We understand that your company, Dataflow Verification Services Limited (Dataflow), confirms the authenticity of the documents submitted by applicants of government agencies, regulators and organizations as part of their pre-employment or pre-licensing requirements, such as, education and employment certificates, passports, practice licenses. Under your normal operations, you ask the applicants to sign a Letter of Consent/Authorization which you present to the different agencies and entities who issue the documents to be verified.

You now seek clarification on the following issues:

  1. In cases where some applicants do not submit a Letter of Consent or Authorization, can Dataflow still proceed with the processing under Sections 12 (b) and 12 (f) of the DPA?
  2. In cases where the applicants signify their intent to be licensed by government regulators, Dataflow is instructed by the regulator, through a letter of advice, to initiate their Primary Source Verification. Can Dataflow proceed with the verification requests under Section 12 (b) and 12 (e) of the DPA?
  3. There are some universities and employers who require a specific format for Consent Letters. The format which Dataflow uses states the scope and legitimate purpose for data processing. How can Dataflow best address the situation?
  4. As to evidence of consent defined under Section 3 (b) of the law, are digital signatures acceptable? Can the act of applicants in sending their documents for processing be evidence of consent to the processing of their personal information?

Discussion

Verification documents; personal information; sensitive personal information; lawful criteria for processing

The data privacy principle of legitimate purpose requires that the processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals or public policy.2 The DPA explicitly provides the lawful criteria for processing of personal and sensitive personal information under Sections 12 and 13, respectively.

In general, processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the conditions under Section 12 of the DPA are met.3 While verification or authentication of personal information submitted by an applicant as part of the pre-employment requirements may fall under Section 12 (b) of the DPA or Section 12 (f), said legal bases only apply to personal information and not sensitive personal information.

It is worth emphasizing that the law delineates the differences in the treatment of the different types of personal data. Processing of sensitive personal information is generally prohibited unless any of the conditions provided by Section 13 are met.

Dataflow verifies or authenticates documents on education and employment certificates, passports, practice licenses, among others. By their nature, these documents contain information that may be classified as sensitive personal information under Section 3 (l) of the DPA, such as information about an individual’s education or their government-issued identification numbers.

Because of the limitation provided under Section 13, Dataflow would have to evaluate if the data processing involved in the verification would fall under any of the lawful criteria for processing under Section 13. Particularly in this scenario, the consent of the data subject and/or processing which is required by existing laws and regulations may be applicable.

Verification of documents for government

We understand that Dataflow has clients that are government agencies. When applicants signify their intent to be licensed by these agencies, the latter instructs Dataflow to initiate Primary Source Verification through a letter of advice, a sample of which was attached to your letter.

You inquire on whether you may proceed with the verification on the basis of Section 12 (b) on contract, or Section 12 (e), that “the processing is necessary… to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate.”

Given that the documents to be verified contains sensitive personal information, Section 12 is not the proper basis for processing. As discussed above, Dataflow would have to assess the various criteria under Section 13 to determine the most appropriate basis for processing.

If consent of the data subject is the basis for processing, the same is defined under Section 3 (b) the DPA as “any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so.”

It is apparent in the provision that it is the data subject himself or herself who gives consent, or by an agent specifically authorized by the data subject to do so.

From the attached sample letter of advice or letter of authorization, we note that there is a statement by the government agency authorizing Dataflow to verify the authenticity of documents belonging to the applicant and the details of the applicant: name, ID and description of document. While the letter of authorization clearly states the authority of Dataflow to act on behalf of the regulator for verification purposes, this does not amount to the consent of the data subject as required under the DPA.

Consent of the data subject refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her.4 Consent shall be evidenced by written, electronic or recorded means.5

The DPA, its IRR and the issuances of the NPC do not require a particular format for the consent of the data subject. What matters is that the basic requirements of the law are clearly shown in the consent letter or letter of authorization, such that the data subject specifically agrees to the processing of his or her personal information for the purposes specified by the PIC.

Regarding evidence of consent, the law only requires that consent is evidenced by written, electronic or recorded means. Digital signatures are thus acceptable.

Lastly, since consent of the data subject needs to be explicit, implied consent is not recognized as valid under the law. Thus, the mere act of applicants in sending their documents for processing may not amount to the consent required by law.

This opinion is rendered based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. Rules and Regulations Implementing the Data Privacy Act of 2012, § 18 (b) (2016). ↩

  3. Data Privacy Act of 2012, § 12. ↩

  4. Data Privacy Act of 2012, § 3 (b). ↩

  5. Id. ↩

Backlinks

  • No backlinks found