NPC Issuance Wiki

NPC Advisory Opinion No. 2020-026 — Public Disclosure of Pertinent Data Needs in the Time of COVID-19

Issued Advisory Opinion

Official opinion tags

Text

Re: PUBLIC DISCLOSURE OF PERTINENT DATA NEEDS IN THE TIME OF COVID-19

Dear [Redacted],

We write in response to your request for an Advisory Opinion received by the National Privacy Commission (NPC) to clarify whether or not the public disclosure of pertinent information of beneficiaries of the different government programs related to COVID-19 response is a violation of the Data Privacy Act of 20121 (DPA).

In particular, you seek guidance on the legality of disclosing information involving but not limited to the following:

  1. General Data Requests • Release (to private requesters) of information related to government programs granting various forms of benefits or incentives; and • The publication of such information in an open data machine-readable format (e.g. XLSX, CSV, JSON) in official government and civil society tracking websites.

  2. Data relevant to benefits granted/received in the Government’s COVID-19 response and operations, including but not limited to the following: • DSWD Social Amelioration Program, e.g. Emergency Subsidy Program (ESP), Assistance to Individuals in Crisis Situations (AICS), Social Pension for Senior Citizens (SocPen), Livelihood Assistance Grants (LAG): program name, beneficiary names, amounts received, barangay, city/municipality, province; • DOLE COVID-19 Adjustment Measures Program (CAMP)/Tulong Panghanapbuhay sa Ating Disadvantaged/Displaced Workers (TUPAD)/AKAP: business name, beneficiary names, amounts received, barangay, city/municipality, province of business and beneficiary; • DA Financial Subsidy to Rice Farmers (FSRF), DA Rice Farmer Financial Assistance (RFFA), Expanded Survival and Recovery (SURE) Aid and Recovery Program: beneficiary names, amounts received, barangay, city/municipality, province; • DOF-SSS Small Business Wage Subsidy: business name, beneficiary names, amounts received, barangay, city/municipality, province of business and beneficiary; and • PhilHealth Advisory No. 2020-022, and Circular Nos. 2020-0009, 2020-0011, and 2020- 0012: Number of recipients of full financial risk protection, and total amount disbursed, by hospital/health facility, between February 1 and April 14, 2020; Number of cases and total claims approved per hospital/health facility, no. of claims and total amount disbursed per patient and per benefit package under each circular.

  3. Data relevant to the Balik-Probinsya Program: beneficiary names; origin and destination barangay, city/municipality, province; types and amounts of benefits received;

  4. Data relevant to the National Food Authority’s Palay Procurement Program: beneficiary names; barangay, municipality, province; volumes procured and total amounts paid; and

  5. Data relevant to fiscal incentives granted: name and location of establishments receiving fiscal incentives, the type and amounts of incentives, years incentives are received.

Furthermore, you seek clarification on the level of detail that can be released without violating the DPA. For Item Nos. 2-4 above, you inquired whether disaggregation by gender and the inclusion of age groups is allowable.

Discussion

The Data Privacy Act of 2012, Not a Hindrance to Transparency in Government; Right to Information

The constitutional right to information and the right to privacy are not contradictory. Both are essential human rights that feature prominently in society and are necessary in a democracy. These rights are complementary, especially in ensuring government’s accountability, and are forms of protection that constantly attempt to restore the balance between the citizen and the State.

The fundamental human right to privacy is protected by the 1987 Constitution as well as the DPA. This is the right of an individual to control the collection of, access to, and use of personal information about him or her that are under the control or custody of the personal information controllers, be it the government or the private sector.

Likewise, the right to information on matters of public concern is a constitutional right afforded to every citizen.2 This constitutional guarantee is a recognition of the importance of the free flow of ideas and information in a democracy; it enables citizens to cope with the exigencies of the times.3 The government must provide the public sufficient access to information that is of public concern, and it is not exempted by law from the operation of the constitutional guarantee to information.

While a freedom of information (FOI) law has yet to be enacted, the right to information is operationalized in the Executive Branch through Executive Order (EO) No. 2, 2016.4

Protection of Personal Information as an Exception to FOI; DPA Special Cases; Criteria for Lawful Processing under Section 12

Pursuant to the Inventory of Exceptions to EO No. 2 (S. 2016),5 information deemed confidential for the protection of the privacy of persons is an exception to the general rule of disclosure in the right of access to information.6 Thus, informational privacy is recognized and the personal information of individuals are protected.

However, the DPA expressly provides under Section 4(c) thereof that information relating to any discretionary benefit of a financial nature given by the government to an individual, such as granting a license or permit, including the name of the individual and the exact nature of the benefit, is classified as a special case, where the provisions of the DPA and its Implementing Rules and Regulations (IRR) do not apply, subject to the qualification that such non-application of the law is only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned.7

Therefore, the DPA itself recognizes that the minimum extent of disclosure of personal information of those granted discretionary financial benefits by the government may be allowed.

For other benefits granted by the government which are given in the course of an ordinary transaction or as a matter of right, the minimum extent of disclosure of personal information of beneficiaries may still find basis under any of the various criteria for lawful processing under Section 12 of the DPA.

Public Disclosure of Pertinent Data in Relation to COVID-19 Response Programs; General Data Privacy Principles; Proportionality; Release of Statistical Data

We now respond to the specific items mentioned above:

On Item no. 1 on the general data requests of private requesters for information related to government programs granting various forms of benefits, and the publication of such information in an open data machine-readable format in official government and civil society tracking websites, in keeping with the principles of transparency and accountability, government agencies in charge of implementing such programs may disclose or release to private requesters such information relating to the government program. Where such requests pertain to personal information of beneficiaries, as discussed above, the minimum extent of disclosure may be allowed.

Nonetheless, such disclosure should strictly adhere to the principle of proportionality, which requires that “the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.”8 Hence, the disclosure or release should only be limited to those personal information which are necessary to the purpose. Data minimization should be employed in all cases of public disclosure. Further, pseudonymization of names or even the exclusion of the “name” field altogether may be considered before these lists are released to the public, if it is possible that the stated purpose can be achieved just the same.

We reiterate that releasing sensitive personal information may be excessive, no longer considered as necessary, and may constitute an unwarranted invasion of privacy.9

As to the manner of publication, the DPA nor the Commission does not require a specific form. While government agencies are encouraged to disclose these information in way that enhances the ability of the citizens to access such information, this is with the strong reminder that such disclosure is strictly for the purpose of promoting transparency and public participation. It should not be construed as a basis for unbridled processing that undermines the rights and freedoms of these beneficiaries, considering that they may be vulnerable data subjects.

On Item Nos. 2-4 on data relevant to benefits granted in line with the government’s COVID-19 response and operations, i.e. for the DSWD, DOLE, DA, DOF-SSS, Balik Probinsya, NFA programs, etc., personal information relating to the beneficiaries’ names, amounts received, and the pertinent barangay, city/municipality and province, may be disclosed but always taking into account the principles of transparency, legitimate purpose, and proportionality, as well as other applicable provisions of the DPA. Thus, if the purpose may be achieved by omitting personal information or through the use of pseudonymization, this may be considered.

On the release of information which are not personal information, such as:

• information of juridical persons (i.e., establishment/business names and addresses, amounts received, etc.); • aggregate or statistical data relating to PhilHealth Advisory No. 2020-022, and Circular Nos. 2020-0009, 2020-0011, and 2020-0012 (i.e., number of recipients of full financial risk protection, total amount disbursed (by hospital/health facility) between February 1 and April 14, 2020, number of cases and total claims approved per hospital/health facility, and number of claims per benefit package under each circular); and • disaggregated data on sex and age groups under Item Nos. 2-4 (i.e. statistics on the number of males and females and applicable age groups of those who availed of benefits),

the above do not involve personal information where an individual is identifiable, hence, these are outside the scope of the DPA. The release of such information may be governed by other laws or regulations.

Pseudonymization; Health Information

However, in relation to the Philhealth issuances and the request for the “total amount disbursed per patient,” we recommend that the information be de-identified or pseudonymized prior to release or disclosure.8

Pseudonymization has been defined as “the processing of personal data in a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.”10

Actual patient names should not be released, considering that these may already be deemed as health information which is sensitive personal information, in relation to the fact that these patients who availed of Philhealth benefits or assistance are COVID-19 suspected, probable, or confirmed cases.

Personal Information Controllers; Accountability in Processing Personal Data

Finally, we remind government agencies, civil society organizations (CSO), and the private requesters that while personal information of beneficiaries may be disclosed to fulfill the requirements of transparency, accountability and good governance, the data privacy principle of proportionality dictates that only those information relevant, suitable, necessary, and not excessive may be processed. Further, these personal information shall only be used for the specified and legitimate purpose indicated.

Once such personal data are released to the CSOs and the private requesters, they automatically become personal information controllers, having obligations and responsibilities under the DPA, its IRR, and other issuances of the NPC.

These would include, but is not limited to, implementing reasonable, appropriate and adequate safeguards to protect personal data (i.e. having a data protection officer, providing privacy notices, conducting privacy impact assessments, having a privacy manual, managing personal data breaches, etc.), upholding data subject rights, and in general, being accountable for all personal data processing activities that they undertake.

This opinion is rendered based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. PHIL. CONST. art. 3 § 7. ↩

  3. Baldoza v. Dimaano, A.M. No. 1120-MJ (1976). ↩

  4. Office of the President, Operationalizing in the Executive Branch the Constitutional Right to Information and the State Policies of Full Public Disclosure and Transparency in the Public Service and Providing Guidelines Therefor, Executive Order No. 2 [E.O. No. 2] (July 23, 2016). ↩

  5. Office of the President, Inventory of Exceptions to Executive Order No. 2 (S. 2016), Memorandum from the Executive Secretary (Nov. 24, 2016). ↩

  6. Id. No. 4. ↩

  7. Data Privacy Act of 2012, § 4 (c) and Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 5 (2016). ↩

  8. Rules and Regulations Implementing the Data Privacy Act of 2012, § 18 (c) (2016). ↩ ↩2

  9. See: National Privacy Commission, NPC Advisory Opinion No. 2020-019 (April 28, 2020). ↩

  10. See: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC [EU GENERAL DATA PROTECTION REGULATION], Article 4(5) (2016). ↩

Backlinks