NPC Issuance Wiki

NPC Advisory Opinion No. 2020-019 — Public Disclosure of the List of Social Amelioration Program Beneficiaries

Issued Advisory Opinion

Official opinion tags

Text

28 April 2020

Re: PUBLIC DISCLOSURE OF THE LIST OF SOCIAL AMELIORATION PROGRAM BENEFICIARIES

Dear [Redacted],

We write in response to your letter requesting for an advisory opinion from the National Privacy Commission (NPC) on whether the public disclosure of the list of beneficiaries of the Social Amelioration Program (SAP) would be considered a violation of the Data Privacy Act of 20121 (DPA).

We understand that the Department of Social Welfare and Development (DSWD) was tasked by the Inter-Agency Task Force for the Management of Emerging Infectious Diseases (IATF-EID) to spearhead the implementation of the SAP as provided for under the Bayanihan to Heal As One Act.2

Pursuant thereto, the DSWD entered into a Memorandum of Agreement and Data Sharing Agreement (DSA) with local government units (LGUs) to lay down the terms and conditions in the conduct of the physical profiling of and payout to the target beneficiaries.

As instructed by the Secretary of the Department of the Interior and Local Government (DILG), some LGUs publicly posted physically or electronically, the list of said beneficiaries.

Discussion

Lawful processing of personal and sensitive personal information

The DPA applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing.3 Under the law, the names of the beneficiaries of the SAP are considered personal information,4 and its disclosure to the public constitute processing5 which should comply with the requirements specifically on the criteria for lawful processing of personal information found under Section 12 thereof.

For sensitive personal information,6 Section 13 of the DPA generally prohibits its processing, except in certain cases enumerated therein. Furthermore, the processing should adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality.7

While we understand that there is no formal issuance as of yet from the DILG, the public disclosure of the list may find basis for processing under Section 12 of the DPA, specifically paragraphs (c) and (e), to wit:

• The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;8 and • The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate.9

Based on the Memorandum Circular No. 09, series of 2020, or the “Omnibus Guidelines in the Implementation of the Emergency Subsidy Program of the DSWD,” LGUs shall perform the following:

  1. Facilitate the execution of the required MOA and abide by their roles and responsibilities; 2. Provide the list of target beneficiaries/clients; 3. Facilitate distribution, accomplishment and encoding of Social Amelioration Card (SAC) forms; 4. Facilitate the preparation and approval of the payroll; 5. Ensure the timely delivery of payment to the beneficiaries based on the approved payroll; 6. Monitor the delivery of assistance; 7. Submit liquidation reports within fifteen (15) working days from the completion of the distribution; and 8. Perform other actions or undertake activities consistent with the provisions of the guidelines.10

In addition, the DILG Secretary directed all barangays to post the list of the beneficiaries in conspicuous public places within their communities in response to reports from field offices on the lack of transparency in the distribution of SAC forms and assistance to target beneficiaries.11 Aside from ensuring transparency, the public disclosure was also intended to guarantee the completeness and accuracy of the list received by the barangays.12

The DILG further claims that the disclosure enables the residents to be adequately informed if they will receive the financial assistance from the government.13 Similarly, they are able to provide feedback if they think that they should be part of the list, following the procedures for the appeal system provided under the Memorandum.14

From the foregoing, the disclosure of the list is clearly sought to allay concerns of possible misuse of public funds by making sure that the emergency subsidy is delivered only to the target beneficiaries.

Hence, it is meant to enable the LGUs to comply with their legal obligation as indicated above in an efficient and transparent manner. Consideration must also be made of the fact that the entire country is currently under the state of national emergency arising from the COVID-19 pandemic, where such public disclosure of personal information may be necessary to fulfill the respective LGUs’ mandate.

Right to information on matters of public concern; COVID-19 pandemic response; utilization of public funds

We emphasize that the DPA has the twin task of protecting the fundamental human right of privacy and ensuring the free flow of information.15 As such, the DPA will not operate to hinder the LGUs in disclosing information which it deems essential for the public to know, especially when there is an increasing public demand for transparency on the distribution of the financial assistance.

The right of the people to information on matters of public concern is a constitutionally vested right. Thus, the public disclosure may also be anchored on the LGU’s compliance with Section 7, Article III of the 1987 Constitution,16 in conjunction with Section 28, Article II of the same which states that, “Subject to reasonable conditions prescribed by law, the State adopts and implements a policy of full public disclosure of all its transactions involving public interest.”

It is worth mentioning that in the case of Akbayan v. Aquino,17 the Supreme Court held that:

“In determining whether or not a particular information is of public concern, there is no rigid test which can be applied. ‘Public concern’ like ‘public interest’ is a term that eludes exact definition. Both terms embrace a broad spectrum of subjects which the public may want to know, either because these directly affect their lives, or simply because such matters naturally arouse the interest of an ordinary citizen. xxx” (underscoring supplied)

Considering the serious threat of the COVID-19 pandemic not just to the citizens’ health and safety but also to their means of livelihood, they would naturally want to know any information about the government’s actions in these extraordinary times. Consequently, information about the utilization of public funds for the implementation of the Emergency Subsidy Program in accordance with Bayanihan Act is a matter of public concern, especially for the target beneficiaries who may suffer the greatest impact of the enhanced community quarantine (ECQ).

General data privacy principles; proportionality

Note, however, that said public disclosure of personal information should strictly adhere to the principle of proportionality. This principle requires that “the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if purpose of the processing could not reasonably be fulfilled by other means.”18

In this case, uploading the list of SAP beneficiaries online may be deemed to be the only way to achieve the purpose of ensuring the meaningful exercise of the public of their right to access information of public concern. This is mainly because of the physical limitations imposed by the ECQ where the posting in barangay halls and other areas may be pointless or ineffective.

Nonetheless, the LGUs are equally urged to apply the proportionality principle in determining the types of personal data that they will disclose, particularly when the original list of SAP beneficiaries contains sensitive personal information.

For this reason, LGUs are reminded that releasing sensitive personal information may be excessive and no longer be considered as necessary for the purpose of the disclosure and may constitute an unwarranted invasion of privacy. Sensitive personal information includes but is not limited to the following:

• Marital status • Date of birth/age • Religion • Government-issued ID numbers, i.e. GSIS, Passport, PhilHealth, PRC, SSS, UMID, or Senior Citizen ID number, etc.

We reiterate that the processing of sensitive personal information is prohibited, except for the instances provided for under Section 13 of the DPA, i.e., the data subject has given consent, processing is provided for by existing laws and regulations, necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing, among others.19

In view of the foregoing, the public disclosure of the list of SAP beneficiaries by the LGUs may not constitute a violation of the DPA insofar as it complies with the requirements established by law and jurisprudence for allowable public disclosures of information on matters of public concern.

While the processing may be justified, the DILG and the LGUs should be mindful of its concomitant responsibilities as personal information controllers. They should consider posting a privacy notice in their respective websites and other official channels to properly inform the SAP beneficiaries and the general public of the rationale for such public disclosure of personal data, their rights of data subjects, appropriate security measures being implemented to protect their personal data, among others.

This opinion is rendered based on the information you have provided. It does not adjudicate issues between parties nor impose any sanctions or award damages, and shall not be used in the nature of a standing rule binding on the NPC when evaluating other cases regardless of the similarity of the facts and circumstances. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. An Act Declaring The Existence Of A National Emergency Arising From The Coronavirus Disease 2019 (Covid-19) Situation And A National Policy In Connection Therewith, And Authorizing The President Of The Republic Of The Philippines For A Limited Period And Subject To Restrictions, To Exercise Powers Necessary And Proper To Carry Out The Declared National Policy And For Other Purposes [Bayanihan to Heal As One Act], Republic Act No. 11469 (2020). ↩

  3. Data Privacy Act of 2012, § 4. ↩

  4. Id. § 3 (g) - Personal information pertains to any information from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual. ↩

  5. Id. § 3 (j) - Processing refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data. ↩

  6. Id. § 3 (l) - Sensitive personal information refers to personal information: 1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; 2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; 3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and 4) Specifically established by an executive order or an act of Congress to be kept classified. ↩

  7. Id. § 11. ↩

  8. Id. § 12 (c). ↩

  9. Id. § 12 (e). ↩

  10. Department of Social Welfare and Development, Memorandum Circular No. 09, series of 2020: Omnibus Guidelines in the Implementation of the Emergency Subsidy Program (ESP) of the DSWD, April 9, 2020, available at https://www.dswd.gov.ph/issuances/MCs/MC_2020-009.pdf (last accessed April 28, 2020). ↩

  11. See: Department of the Interior and Local Government, DILG to Punong Barangays: Post list of SAP beneficiaries in barangay hall for transparency, April 18, 2020, available at https://www.dilg.gov.ph/news/DILG-to-Punong-Barangays-Post-list-of-SAP-beneficiaries-in-barangay-hall-for-transparency/NC-2020-1100 (last accessed April 28, 2020). ↩

  12. Ibid. ↩

  13. Ibid. ↩

  14. Ibid. ↩

  15. Data Privacy Act of 2012, § 2. ↩

  16. PHIL. CONST. art. 3 § 7 - The right of the people to information on matters of public concern shall be recognized. Access to official records, and to documents, and papers pertaining to official acts, transactions, or decisions, as well as to government research data used as basis for policy development, shall be afforded the citizen, subject to such limitations as may be provided by law. ↩

  17. G.R. No. 170516, July 16, 2008. ↩

  18. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (c) (2016). ↩

  19. Data Privacy Act of 2012, § 13. ↩

Backlinks