Text
30 October 2020
Re: DISCLOSURE OF PERSONAL INFORMATION OF LOT OWNERS TO HOMEOWNERS’ ASSOCIATION
Dear [Redacted],
We write in response to your letter seeking clearance from the National Privacy Commission (NPC) to allow the City Assessor of Marikina to disclose the names and addresses of lot owners in the Loyola Grand Villas (LGV) to the Loyola Grand Villas Homeowners’ Association, Inc. (LGVHAI).
Discussion
We understand based on the information you provided that the LGVHAI is the legitimate Homeowners’ Association (HOA) of LGV. The association formed by its developer, V.V. Soliven Realty, abandoned the subdivision and did not turn over to LGVHAI the list of all the buyer of the lots in the subdivision.
As stated in your letter, the LGVHAI tried to determine the owners of all the lots which are supposed to be its members, but to date, there are about forty lots in the village whose owners are unknown to the LGVHAI. In fact, the LGVHAI asked the City Assessor’s Office of Marikina to determine the lot owners based on the tax declaration. However, contending that the tax declaration is protected under the Data Privacy Act of 2012 (DPA), the Assessor’s Office of Marikina declined to provide the names and addresses of the lot owners without a clearance from the NPC.
As stated in your letter, the said clearance is a requirement imposed by the City Assessor to the Loyola Grand Villas Homeowners’ Association, Inc. (LGVHAI) prior to the disclosure of the requested personal data.
Rights and Powers of HOA; Scope of the DPA; Criteria for Lawful Processing of Personal Data; Proportionality
At the outset, the LGVHAI as the legitimate HOA declared by the court, has the power to manage the internal affairs of the subdivision. Relative thereto, Section 49 of the Magna Carta for Homeowners and Homeowners’ Associations1 provides:
Section 49. Rights and Powers of the Association. – An association shall have the following rights and powers: xxx
(i) Impose or collect reasonable fees for the use of open spaces, facilities, and services of the association to defray necessary operational expenses, subject to the limitations and conditions imposed under the law, the regulations of the board and the association’s by- laws; (underscoring supplied)
The DPA applies to all the processing of all types of personal information and to any natural and judicial person involved in personal information processing. In NPC Advisory Opinion No. 2018-019, we stressed that a HOA, being a juridical entity engaged activities geared towards the provision of basic community services and facilities for its members-homeowners, may inevitably perform processing of personal information of its individual members homeowners. It is therefore considered as a personal information controller2 (PIC) and is covered by the DPA.
In this case, the names and addresses of the lot owners are considered personal information under the DPA. Accordingly, any processing activities relating to personal information should comply with Section 12 of the DPA, to wit:
SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:
(a) The data subject has given his or her consent;
(b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract;
(c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;
(d) The processing is necessary to protect vitally important interests of the data subject, including life and health;
(e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or
(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution. (underscoring supplied)
From the foregoing, the processing of personal data of lot owners made by LGVHAI may find support under the DPA, taking into account that the same is necessary in furtherance of the legitimate interests of the LGVHAI (i.e. inclusion of lot owners to the masterlist of HOA members, sending of notices, and collection of monthly dues).
Hence, the City Assessor’s Office of Marikina and Quezon City, following the proportionality principle,3 may release the names and addresses of the lot owners without disclosing the actual Tax Declarations upon LGVHAI’s compliance with the existing policies and procedures of the City Assessor, including the payment of reasonable fees (if any) for the release of the requested personal data.
Powers and Functions of the NPC; Clearance from the NPC on the Disclosure of Personal Data is Not Necessary
The powers and functions of the NPC are explicitly provided in Section 7 of the DPA and Section 9 of its Implementing Rules and Regulations (IRR). It must be noted that neither the DPA nor its IRR gives power to the NPC to issue clearance to authorize, among others, the disclosure and/or processing of personal data. The DPA provides for the various criteria for lawful processing of personal data and PICs should make the determination on what particular criteria they shall rely on for their personal data processing activities.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
Footnotes
-
An Act Providing for a Magna Carta for Homeowners and Homeowners’ Associations, and For Other Purposes [Magna Carta for Homeowners and Homeowners’ Associations], Republic Act No. 9904 (2010). ↩
-
RA No. 10173, §3(h). ↩
-
See: Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (c) (2016) – (c) Proportionality. The processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means. ↩