NPC Issuance Wiki

NPC Advisory Opinion No. 2020-024 — Disclosure of Lot Buyers’/Homeowners’ Contact Information for Collection of Monthly Association Dues

Issued Advisory Opinion

Official opinion tags

Text

Re: DISCLOSURE OF LOT BUYERS’/HOMEOWNERS’ CONTACT INFORMATION FOR COLLECTION OF MONTHLY ASSOCIATION DUES

Dear [Redacted],

We write in response to your letter request on whether the disclosure of the contact information of lot buyers/homeowners to the homeowner’s association, for purposes of collection of monthly association dues, is allowed under the provisions of the Data Privacy Act of 20121 (DPA), its Implementing Rules and Regulations (IRR)2 and relevant issuances of the National Privacy Commission (NPC).

In your letter addressed to '''''''''''' ''''''''''''''' '''''' '''''''''''''''''''''' of the Housing and Land Use Regulatory Board (HLURB) which was subsequently endorsed to the NPC, you stated that the newly elected presidents of Royal Villas West Homeowners, Inc. and Ashiyana Tagaytay Classics Homeowners’, Inc. (collectively, HOAs) requested for the contact information of the lot buyers/homeowners of Anhawan Development, Inc. and Royal Asia Multi Properties, Inc. (collectively, Developers), respectively. The purpose for such requests was to facilitate the collection of the monthly association dues.

Discussion

Contact Information; Disclosure; Data Privacy Principles; Legitimate Interest

It is worth noting that under the DPA, contact information of individuals are considered as personal information.3 The Developers, as personal information controllers (PICs), have the responsibility of ensuring the lawful processing of its clients’ personal information in accordance with Section 12 of the DPA.

In particular, Section 12 (f) provides that the processing of personal data may be allowed if the processing is necessary for the purposes of the legitimate interests pursued by the PIC or by a third party to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.4

To determine if there is legitimate interest in processing personal information, PICs must consider the following:5

  1. Purpose test - The existence of a legitimate interest must be clearly established, including a determination of what the particular processing operation seeks to achieve. 2. Necessity test - The processing of personal information must be necessary for the purposes of the legitimate interest pursued by the PIC or third party to whom personal information is disclosed, where such purpose could not be reasonably fulfilled by other means; and 3. Balancing test - The fundamental rights and freedoms of data subjects must not be overridden by the legitimate interests of the PICs or third party, considering the likely impact of the processing on the data subjects.6

Although a personal information controller may have lawful basis for the processing of information, it must still adhere to the basic data privacy principles of proportionality, transparency and legitimate purpose. The processing of personal information must be limited only to the extent that is necessary for the stated purpose and that there are no other means to achieve such legitimate purpose.

Monthly Association Dues; Membership; Magna Carta for Homeowners and Homeowners’ Associations

We note that it is among the rights and duties of every homeowner to enjoy the basic community services and facilities, provided that he or she pays the necessary fees and other pertinent charges.7 It is also among the duties and responsibilities of the Board of Directors or Trustees of a HOA to collect the fees, dues and assessments that may be provided for in the by-laws, as approved by a majority of its members.8

From the foregoing, the disclosure by the Developers of its clients’ contact information to the HOAs depends on the determination of what the term “monthly association dues” pertain to and the type of membership in the said HOAs.

It is important to establish the definition of the term “monthly association dues” referred to in your letter, in accordance with the provisions of the by-laws of the corresponding HOAs. For instance, the fees included in the monthly association dues and if such association dues are required to be paid by all homeowners or limited only to HOA members. It is worth noting that the term “association dues” has not been defined under the Magna Carta for Homeowners and Homeowners’ Association and its IRR. Instead, the said laws provide that the association by-laws shall provide the dues, fees and special assessments to be imposed and its manner of imposition.9

If the HOAs can confirm that the payment of monthly association dues applies to all homeowners regardless of whether or not they are members of the HOAs, then the HOAs, as third parties, have legitimate interests in the disclosures of the homeowners’ contact information.

On the other hand, if payment of the monthly association dues only applies to members of the HOAs, then it is imperative to determine if membership in the HOAs is automatic for all homeowners. Membership in a HOA is optional, unless otherwise provided in the instruments of conveyance or as annotated in the title of the property.10 Hence, if such documents signed by the said homeowners provide for automatic membership in the HOAs by mere ownership, then they are indeed HOA members and are thus obliged to pay the fees, as may be imposed by the HOA officers in accordance with the by-laws.

The Developers and HOAs may also consider entering into a data sharing agreement (DSA) among themselves, considering that they are all personal information controllers under the DPA and with different purposes in the processing of the homeowners’/landowners’ personal information. The DSA shall clearly indicate details, such as but not limited to, the purpose of the sharing, the personal information to be shared and the respective rights and obligations of each party to the agreement.

Given the foregoing, we note that the Developers may lawfully disclose the contact information of the homeowners, provided that the two salient points have been established.

This opinion is based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission and Other Purposes, “Data Privacy Act of 2012” (15 August 2012). ↩

  2. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 (2016). ↩

  3. Data Privacy Act of 2012, § 2 (g). ↩

  4. Id. § 12(f). ↩

  5. See generally, Data Privacy Act of 2012, § 12(f); United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/. ↩

  6. United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ (last accessed July 13, 2019). ↩

  7. An Act Providing for a Magna Carta for Homeowners and Homeowners’ Associations, and for Other Purposes [Magna Carta for Homeowners and Homeowners’ Associations], Republic Act No. 9904, § 5 (2009). ↩

  8. Id. § 12 (b). ↩

  9. Id. § 15 (o). ↩

  10. Rules and Regulations Implementing the Magna Carta for Homeowners and Homeowners’ Associations, Republic Act No. 9904, § 9 (2011). ↩

Backlinks