NPC Issuance Wiki

NPC Advisory Opinion No. 2020-029 — Request for Personal Information of Complainants Under the Katarungang Pambarangay Process for Thesis Purposes

Issued Advisory Opinion

Official opinion tags

Text

Re: REQUEST FOR PERSONAL INFORMATION OF COMPLAINANTS UNDER THE KATARUNGANG PAMBARANGAY PROCESS FOR THESIS PURPOSES

Dear [Redacted],

We write in response to your letters requesting for an advisory opinion from the National Privacy Commission (NPC) on whether a particular barangay could provide certain information on the Katarungang Pambarangay1 process to an individual as part of her data collection for her thesis without violating Republic Act (R.A.) No. 10173, or the Data Privacy Act of 20122 (DPA).

We understand that an individual who is currently taking her master’s degree is requesting for the following information:

  1. Names of all the complainants in 2019;
  2. Complainants’ addresses;
  3. Date of filing the complaint; and
  4. Date when the decision was made.

Discussion

We understand further that the barangay officials are hesitant to provide the information for fear of committing a violation of applicable laws.

Scope of the DPA; processing for research purposes; special case

The DPA applies to all types of processing of personal information and to any natural and juridical person involved in personal information processing, subject to certain qualifications.3 Under the law, the names of the complainants and their addresses are considered personal information, and its disclosure constitutes processing which should meet the requirements such as the criteria for lawful processing of personal information found under Section 12 thereof.

However, the law provides for special cases where the processing of certain personal information is excluded from its scope. These include personal information processed for journalistic, artistic, literary or research purposes.4 The Implementing Rules and Regulations (IRR) of the DPA states that personal information that will be processed for research purpose, intended for a public benefit, subject to the requirements of applicable laws, regulations, or ethical standards, is outside of the scope of the law.5

Nevertheless, this exemption is not absolute. This is interpreted to the effect that there is a presumption that personal information may be lawfully processed under such special cases.6 Specifically in this case, a researcher may lawfully process personal information even without meeting the conditions under Sections 12 or 13 of the DPA, but the processing shall be limited to that which is necessary to achieve the specific purpose, function, or activity, and the researcher, as a personal information controller, is still required to implement measures to secure and protect personal information.7

Stated simply, researchers are still obliged to implement reasonable and appropriate security measures for the protection of personal information, uphold the data subject rights, and adhere to the data privacy principles and other provisions of the DPA.

Nature of research; obligations of researchers

In determining whether the release of the abovementioned personal information may be allowed under the DPA, it is necessary to understand the nature of research which is contemplated by the DPA and its IRR.

As stated in NPC Advisory Opinion No. 2019-0178 which discussed the implications of the DPA to the conduct of academic research vis-à-vis access to documents and records in the custody of government, “research is an activity that aims to develop or contribute to knowledge that can be generalized (including theories, principles, relationships), or any accumulation of information using scientific methods, observation, inference, and analysis.”9 This includes data gathering for thesis or dissertations.

We reiterate the discussion on the aforesaid Advisory Opinion, to wit:

“…apart from the laws and regulations on privacy, any code of ethics or any rules and regulations on research issued and implemented by institutions involved in research must be complied with by the researchers. After all, personal information used for research remains to be subject to a range of policies, including internal ones maintained by organizations, and other laws, as enacted or issued by the appropriate legislating authority.

xxx xxx xxx

…researchers should always keep in mind that though the DPA recognizes that the processing of personal data is critical to quality research, the rights and freedoms of individuals is likewise of utmost importance. This view is consistent with Section 38 of the DPA, which calls for an interpretation of the law that is mindful of the rights and interests of data subjects.”10

Moreover, the DPA “recognizes that research is critical to nation-building and serves the interest of the public.”11 It bears stressing that the DPA offers flexibility on processing for research purposes as long as it is in consistent with ethical and legal standards, meaning that there may be instances when the consent requirements may be waived if such waiver is consistent with legal and ethical principles.12 Likewise, the rights of data subjects may also be limited where such limitation is necessary to maintain research integrity.13

Data subject’s rights; limitation on rights

We note, however, that Section 19 of the DPA provides for the non-applicability of the rights of data subjects where the processing of personal information is only for the needs of scientific and statistical research and, on the basis of such, no activities are carried out and no decisions are taken regarding the data subject. At the same time, the personal information shall be held under strict confidentiality and shall be used only for the declared purpose.

Nonetheless, we reiterate that any limitations on the rights of the data subject shall only be to the minimum extent necessary to achieve the purpose of said research.14

General data privacy principles; proportionality; evaluation of request

While personal information processed for research purposes is a special case, PICs are still obliged to adhere to the data privacy principles of transparency, legitimate purpose, and proportionality.

Specifically for this request, the principle of proportionality requires that the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.15 Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.16

Considering the foregoing, the request should be evaluated carefully in terms of whether the specific information requested is indispensable in achieving the research purpose.

In relation to such evaluation, the barangay officials, or even the Lupong Tagapamayapa (Lupon), created for the implementation of the Katarungang Pambarangay, pursuant to Section 399, Chapter VII of the Local Government Code of 1991, has the obligation to examine the particular request, keeping in mind their functions under the governing law, applicable rules and regulations, and data privacy principles enunciated in the DPA.

These barangay officials are not precluded from seeking further clarification from the researcher as to the details of her thesis, such as the exact purpose for collecting the names of the complainants and their addresses in relation to the study, whether such personal information is indispensable to the purpose, if statistics or aggregated data will suffice, whether redacting the personal information in the documents to be provided may be acceptable, among other considerations.

This opinion is rendered based on the information you have provided. It does not adjudicate issues between parties nor impose any sanctions or award damages. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

Footnotes

  1. An Act Providing for a Local Government Code of 1991 [Local Government Code of 1991], Republic Act No. 7160 (1991), Book III, Title I, Chapter VII. ↩

  2. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  3. Id. § 4. ↩

  4. Data Privacy Act of 2012, § 4 (d). ↩

  5. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 5 (c) (2016). ↩

  6. See: National Privacy Commission, NPC Advisory Opinions No. 2017-035 (July 27, 2017), 2018-054 (Dec. 4, 2018), 2019-017 (March 5, 2019), and 2020-004 (Feb. 3, 2020). ↩

  7. Id. ↩

  8. National Privacy Commission, NPC Advisory Opinion No. 2019-017 (March 5, 2019). ↩

  9. Philippine Health Research Ethics Board Ad Hoc Committee for Updating the National Ethical Guidelines, National Ethical Guidelines for Health and Health Related Research, Introduction, p. 5 (2017). ↩

  10. Ibid. ↩

  11. National Privacy Commission, NPC Advisory Opinion No. 2019-017 (March 5, 2019). ↩

  12. National Privacy Commission, NPC Advisory Opinion No. 2018-054 (Dec. 4, 2018). ↩

  13. Id. ↩

  14. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 37 (2016). ↩

  15. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (c) (2016). ↩

  16. Ibid. ↩

Backlinks