Text
26 May 2020
Re: COLLECTION OF FEES RELATIVE TO RIGHT TO CORRECTION OF DATA SUBJECTS’ PERSONAL INFORMATION
Dear [Redacted],
This pertains to your request for advisory opinion received by the National Privacy Commission (NPC) which sought to clarify whether a personal information controller (PIC), such as an airline company, which collects personal information of its passengers for purposes of booking a flight, may charge and collect reasonable fees for accommodating a data subject’s request to rectify or correct his or her personal information, particularly his or her name in a passenger ticket.
We understand that the fees collected shall be used to defray administrative costs that will be incurred by the PIC in manually amending the personal data of the data subjects, and in reissuing a new ticket with the corrected personal information.
Discussion
Right to Rectification; Charging of Fees
The Data Privacy Act of 20121 (DPA) recognizes the data subjects’ right to dispute the inaccuracy or error in his or her personal data and have the PIC correct it immediately and accordingly, unless the request is vexatious or otherwise unreasonable.2
The DPA has no provisions regarding the charging of fees relative to a data subject’s request for rectification. Nevertheless, the EU General Data Protection Regulation (GDPR),3 the successor of the EU Data Protection Directive (Directive 95/46/EC) which heavily influenced the DPA, provides guidance on the matter:
- Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:
(a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request.
The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.
From the foregoing, requests to correct or rectify clerical or typographical errors in the records of the data subject, particularly his or her name, should be processed free of charge. It is only when such request is manifestly unfounded or excessive that reasonable fees may be charged. And where such fees are thus charged, the same shall not be so prohibitive as to have the effect of discouraging the exercise of data subjects’ rights.
As applied in the case of an airline company, we understand that these proposed fees shall defray costs to accommodate the increasing number of requests by passengers for rectifying their names, and will be charged only to those passengers whose bookings were made through the website of the airline company.
With this, it seems that such requests from individual passengers are not in the nature of being “manifestly unfounded or excessive.” Moreover, as these requests pertain to bookings made online, there should likewise be some form of mechanism whereby data subjects may also easily exercise their right to rectification online as well, without necessarily imposing much administrative costs on the part of the airline company with regard to correcting names and reissuing tickets.
The foregoing considered, passenger requests for simple name corrections should be carried out free of charge.
This opinion is based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) Official Journal of the European Union, Vol. L119, Art. 12 (5) (2016). ↩