Text
26 August 2020
Re: DATA SHARING FOR DEDUPLICATION
Dear [Redacted],
We write in response to your letter requesting for an advisory opinion from the National Privacy Commission (NPC) on whether the Social Security System (SSS) was justified in refusing to provide the Department of Social Welfare and Development (DSWD) the requested dataset (i.e. birthdates of the beneficiary-employees) in relation to the Small Business Wage Subsidy (SBWS) Program.
We understand that the DSWD was tasked by the Inter-Agency Task Force for the Management of Emerging Infectious Diseases (IATF-EID) to be the repository of all data from the different Social Amelioration Programs (SAPs) of various National Government Agencies (NGAs) with the task of conducting deduplication to ensure that repetition of beneficiaries as recipients of SAP is prevented.
To facilitate an efficient and effective validation of the beneficiaries of the SAP Emergency Subsidy Program (ESP) as well as to properly identity and/or eliminate those member-beneficiaries of the SSS whose households have already received at least one (1) cash subsidy under the SBWS, there is a need to share data among and between concerned government agencies, including the SSS and the DSWD.
Discussion
Data Sharing; Proportionality
The Implementing Rules and Regulations (IRR) of the Data Privacy Act of 2012 (DPA) defines data sharing as the disclosure or transfer to a third party of personal data under the control or custody of a personal information controller (PIC).
A data sharing agreement (DSA) refers to a contract, joint issuance, or any similar document that contains the terms and conditions of a data sharing arrangement between two or more PICs. For government agencies, the sharing or transfer of personal data under its control or custody to a third party through a DSA shall always be for the purpose of facilitating the performance of a public function or the providing public service.
All data sharing arrangements, whether or not covered by a DSA, is required to adhere to the principles of transparency, legitimate purpose, and proportionality, and the implementation of adequate safeguards for data privacy and security.
Having said that, data sharing between government agencies should strictly adhere to the principle of proportionality, which requires that “the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and a specified purpose. Personal data shall be processed only if the purpose of the processing could not be reasonably fulfilled by other means.” Hence, the data sharing should only be limited to personal information necessary to achieve the specific purpose of such processing.
We understand from the Draft Data Sharing Agreement among Department of Finance (DOF), DSWD, and SSS sent to the NPC for review that the SSS shall share to the DWSD the SBWS Report with the following information:
- Name of employers whose employees benefited;
- Name of employees benefited; and
- Region of employer.
The purpose of such sharing is for the DSWD to crossmatch the DSWD datasets with the SBWS Report.
From the foregoing, the date of birth of the beneficiaries of the SBWS Program was not part of the data elements that the SSS has agreed to share with the DSWD. At the outset therefore, the SSS may be justified in refusing to share with the DSWD additional details that are beyond the scope of their agreement.
We understand that the DSWD intends to use the birthdates of the beneficiaries of the SBWS Program as additional variable in crosschecking the eligibility of the ESP beneficiaries. We note, however, that pursuant to the current agreement, the DSWD may actually request from the SSS the name and region of the employer of the beneficiaries of the SBWS Program. These may then serve as additional basis or variable to confirm the eligibility of the beneficiaries of the ESP.
Nevertheless, if the DSWD has determined that the birthdates of the beneficiaries are indeed indispensable to achieve the purpose of the processing, and such purpose cannot be fulfilled by any other means, the latter may request for an amendment of the DSA to include birthdate as an additional data element to be shared.
Processing of the dates of birth of the SBWS beneficiaries may be allowed under the DPA considering the same is made in the fulfillment of the mandate of the DSWD, either as a special case under Section 4 or under a lawful criterion for processing sensitive personal information based on an existing law or regulation pursuant to Section 13 (b).
We wish to reiterate that the DPA is not meant to prevent government institutions from processing personal data when necessary to fulfill their respective mandates. Rather, it aims to protect the right to informational privacy while ensuring free flow of information.
This opinion is based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner