NPC Issuance Wiki

NPC Advisory Opinion No. 2020-045 — Disclosure of Unit Owners Details for Securing Proxies

Issued Advisory Opinion

Official opinion tags

Text

6 November 2020

Re: DISCLOSURE OF UNIT OWNERS DETAILS FOR SECURING PROXIES

Dear [Redacted],

We write in response to your request for an advisory opinion which sought clarification on whether or not Advisory Opinion No. 2018-0111 which allows for the disclosure of unit numbers of members of the condominium association in accordance with the Data Privacy Act of 20122 (DPA) also applies to the disclosure of the condominium corporation members’ other personal information such as the names, addresses, e-mail addresses, and telephone or mobile numbers for the purpose of assisting a member in contacting them to secure their proxies, in relation to Section 73 of the Revised Corporation Code3 (RCC) on inspection of corporate records.

Discussion

Advisory Opinion No. 2018-011; scope; processing of personal information

Advisory Opinion No. 2018-011 delved on the issue of whether or not the unit numbers of the members of the condominium corporation, specifically the unit numbers of members in good standing, may be disclosed to other members for purposes verifying the conclusion that there was no quorum during the General Assembly.

In this scenario, however, a member is seeking access to other members’ personal information, specifically names, addresses, e-mail addresses, and telephone or mobile numbers, in order to secure their proxies.

We note that a condominium corporation has an obligation to provide access to its corporate records, which includes the current ownership structure and lists of stockholders or members,4 as well as copies of the latest reportorial requirements submitted to the Securities and Exchange Commission,5 to any director, trustee, stockholder or member as provided under Section 73 of the RCC.

Said provision may be read together with Section 12(c) of the DPA, which recognizes personal information processing that is necessary for compliance with a legal obligation to which the personal information controller is subject as a lawful basis.

However, the above may not be squarely applicable in this scenario. The corporation has no legal obligation to disclose the requested contact details of members for purposes of a certain member wishing to be appointed as a proxy for voting purposes.

Nevertheless, the corporation may consider other possible lawful criteria for processing under the DPA, i.e. Section 12(a) on consent and/or Section 12(f) on legitimate interest.

Consent refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her.6 The corporation, through its corporate secretary, may secure consent from the members to in order to disclose their contact details.

On the other hand, for the determination of legitimate interest, the corporation must assess and consider the following:7

  1. Purpose test – The existence of a legitimate interest must be clearly established, including a determination of what the particular processing operation seeks to achieve;
  2. Necessity test – The processing of personal information must be necessary for the purpose of the legitimate interest pursued by the PIC or third party to whom personal information is disclosed, where such purpose could not be reasonably fulfilled by other means; and
  3. Balancing test – The fundamental rights and freedoms of data subjects must not be overridden by the legitimate interests of the PIC or third party, considering the likely impact of the processing on the data subjects.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

Footnotes

  1. National Privacy Commission, NPC Advisory Opinion No. 2018-011 (March 22, 2018). ↩

  2. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  3. An Act Providing for the Revised Corporation Code of the Philippines [Revised Corporation Code of the Philippines], Republic Act No. 11232 (2019). ↩

  4. Revised Corporation Code of the Philippines, § 73(b). ↩

  5. Id. § 73(f). ↩

  6. Data Privacy Act of 2012, § 3(b). ↩

  7. See generally: Data Privacy Act of 2012, § 12(f) and United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/. ↩

Backlinks