Text
24 August 2020
Re: DISCLOSURE OF BENEFICIARIES’ PERSONAL DATA
Dear [Redacted],
We write in response to your request for an Advisory Opinion received by the National Privacy Commission (NPC) to provide guidance on whether the names and other personal information of beneficiaries of the Tertiary Education Subsidy (TES) and the Free Higher Education (HE) programs under Republic Act (RA) No. 10931 or the “Universal Access to Quality Tertiary Education Act” may be released to requesting government agencies and legislators by the Unified Student Financial Assistance System for Tertiary Education (UniFAST), considering the provisions of the Data Privacy Act of 2012 (DPA).
We understand that the information request by the various government agencies and legislators will be “used as reference of said agencies for the implementation of their respective mandates, projects and for other purposes.”
Discussion
UniFAST; Beneficiary Data; Processing
We understand that the UniFAST is a government agency created under RA No. 10687 or the “Unified Student Financial Assistance System for Tertiary Education (UniFAST) Act” and attached to the Commission on Higher Education (CHED). Aside from its mandate under RA No. 10687 to harmonize, reform, strengthen, expand, rationalize, and re-focus all legislated or ongoing Student Financial Assistance Program (StuFAPs), it is also involved with the implementation the TES and Free HE under RA No. 10931.
We understand based on your letter request that in the implementation of the various programs, UniFAST accepts applications from students and collects various personal and sensitive personal information (collectively, personal data) such as the following information, among others: full name, birth date, student identification number, home address, course enrolled, year level, school, tuition fee and parents’ names.
Disclosure of List of Free HE, TES, and StuFAPS Beneficiaries; Lawful Criteria for Processing Personal and Sensitive Personal Information; Mandate; Legitimate Purpose
The DPA provides for the lawful criteria of processing personal data under Sections 12 (processing of personal information) and Section 13 (processing of sensitive personal information). Specifically, disclosure may find support under the following provisions, to wit:
SECTION 12. Criteria for Lawful Processing of Personal Information. — The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:
(e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate;
SECTION 13. Sensitive Personal Information and Privileged Information. — The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:
(b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;
(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.
The above should be read together with the provisions of the UniFAST Act, the Universal Access to Quality Tertiary Education Act, and the corresponding IRRs as possible legal bases for the release of personal data by UniFAST Board to other government agencies and the legislators.
Particularly, we note Rule 4.2 (r) of the UniFAST Act IRR where the UniFAST Board may disclose information to other government agencies involved in the tracking of its student borrowers, specifically for the purpose of investigating and checking the whereabouts of delinquent student borrowers and setting up mechanisms for blacklisting of defaulting students.
We also note the provisions on monitoring and evaluation by the Joint Congressional Oversight Committee on Universal Access to Tertiary Education Act as well as the Congressional Oversight Committee on the UniFAST Act.
In relation to this, we reiterate our previous Advisory Opinion regarding the request for information from the House of Representatives on the list of beneficiaries of the DSWD Pantawid Pamilyang Pilipino Program (4Ps) and Social Pension for Indigent Senior Citizens Program for oversight functions:
Congressional oversight embraces “all activities undertaken by Congress to enhance its understanding of and influence over the implementation of legislation it has enacted. Clearly, oversight concerns post-enactment measures undertaken by Congress: (a) to monitor bureaucratic compliance with program objectives, (b) to determine whether agencies are properly administered, (c) to eliminate executive waste and dishonesty, (d) to prevent executive usurpation of legislative authority, and (d) to assess executive conformity with the congressional perception of public interest.”
We refer to the Rules of the House of Representatives which declares that “efficient and effective access to and dissemination of appropriate and accurate information are imperative in lawmaking.” Further, the said rules state that “Committees shall have oversight responsibilities to determine whether or not laws and programs addressing subjects within their jurisdictions are being implemented and carried out in accordance with the intent of Congress and whether or not they should be continued, curtailed, or eliminated.”
In view of the foregoing, the request for information and processing to be done by the Committee on Appropriations may be founded on the fulfillment of the mandate of the said Committee exercising its oversight function.
Notwithstanding the foregoing discussions, it may be prudent for the UniFAST Board to further clarify and seek additional information from the specific government agencies and legislators as to the details of the purpose for their requests.
Stating that the information is to be used for “reference for the implementation of their respective mandates, projects and for other purposes” is overly broad and ambiguous. This should be clarified further by these agencies and legislators prior to the release of any information by the UniFAST Board. The DPA underscores the responsibility of the heads of agencies in securing the processing of all sensitive personal information maintained by the government, its agencies and instrumentalities, including ensuring that the personal data is covered with a consistent level of protection when disclosed or transferred. We emphasize that the processing of personal data should always be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy.
General Data Privacy Principles; Proportionality; Data Sharing Agreement
Abiding by the general data privacy principles, the disclosure of the beneficiaries’ personal data should strictly adhere to the principle of proportionality, which requires that “the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.”
Hence, any disclosure of beneficiary data should only be limited to those personal data which are necessary to the purpose declared by the requesting government agencies and legislators. An evaluation should likewise be made on whether statistics or aggregate data will suffice instead of providing individual level data.
Finally, where the processing and disclosure is indeed anchored upon any lawful criterion as discussed above, the UniFAST Board and the other party to whom the information will be disclosed should consider executing a data sharing agreement (DSA) in accordance with Section 20 of the DPA IRR and NPC Circular No. 16-02 on DSAs Involving Government Agencies, where necessary and appropriate based on the circumstances of the sharing arrangement. Sharing or disclosure of personal data by or to a government agency presupposes that the same is to facilitate the performance of a public function or the provision of a public service.
This opinion is rendered based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner