NPC Issuance Wiki

NPC Advisory Opinion No. 2020-048 — Disclosure of Master List of Homeowners for Record and Housekeeping Purposes

Issued Advisory Opinion

Official opinion tags

Text

17 November 2020

Re: DISCLOSURE OF A MASTER LIST OF HOMEOWNERS FOR RECORD AND HOUSEKEEPING PURPOSES

Dear [Redacted],

We write in response to your letter request for advisory opinion in relation to the request of Pinewoods Golf & Country Estate Homeowners Association (the Association) for a master list of homeowners from the property manager, RS Property Management Corp.

We understand that the Association is requesting for the said master list for its own record and proper housekeeping purposes, and that such request was denied by the property manager, claiming that disclosure of the same is violative of data privacy.

You now seek clarification on the application of the Data Privacy Act of 20121 (DPA) in the given circumstance.

Discussion

Scope of the DPA; Lawful Criteria for Processing Personal Information; Legitimate Interest

The DPA applies to all the processing of all types of personal information and to any natural and judicial person involved in personal information processing.2

A homeowner’s association being a juridical entity engaged in activities geared towards the provision of basic community services and facilities for its members-homeowners, may inevitably perform processing of personal information of its individual members-homeowners.3 It is considered as a personal information controller (PIC) and is covered by the DPA. Thus, the Association’s request for the disclosure of personal information from the property manager must have a lawful criterion for processing under the DPA.

With this, we refer to our previously issued Advisory Opinion No. 2020-0244 on the disclosure of the contact information of lot buyers/homeowners to the homeowner’s association (HOA) by the developers, for purposes of collection of monthly association dues. We opined therein that the HOA may have legitimate interests in the disclosure to it of the homeowners’ contact information, subject to confirmation of certain matters, i.e. who are required to pay the association dues and membership in the HOA.5

Section 12 (f) of the DPA recognizes the processing of personal information that is necessary for the purposes of the legitimate interests pursued by the PIC or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.

The Association in this case may determine if it can rely on legitimate interest as a basis for processing, taking into consideration the following:

  1. Purpose test - The existence of a legitimate interest must be clearly established, including a determination of what the particular processing operation seeks to achieve;
  2. Necessity test - The processing of personal information must be necessary for the purposes of the legitimate interest pursued by the PIC or third party to whom personal information is disclosed, where such purpose could not be reasonably fulfilled by other means; and
  3. Balancing test - The fundamental rights and freedoms of data subjects must not be overridden by the legitimate interests of the PIC, considering the likely impact of the processing on the data subjects.6

We wish to point out that the above criterion is applicable only when processing personal information. If the Association will also be processing sensitive personal information,7 Section 13 of the DPA listing down the various criteria for lawful processing of sensitive personal information will apply instead.

General Data Privacy Principles; Proportionality; Security Measures; Data Subject Rights

While there may be a possible lawful basis for the Association to process personal or even sensitive personal information (collectively, personal data), taking into consideration the discussions above on determining the appropriate lawful basis, it must still adhere to the data privacy principles of transparency, legitimate purpose, and proportionality.

Specifically for proportionality, the processing of information must be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose, and that personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.8

In addition, the Association, as a PIC, must also implement reasonable and appropriate organizational, technical, and physical security measures to protect personal data against any accidental or unlawful destruction, alteration, and disclosure, as well as against any other unlawful processing,9 as well as uphold the rights of data subjects,10 i.e. the individual homeowners.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. Supra note 1., § 4. ↩

  3. See: NPC Advisory Opinion No. 2018-019 citing AN ACT PROVIDING FOR A MAGNA CARTA FOR HOMEOWNERS AND HOMEOWNERS’ ASSOCIATIONS, AND FOR OTHER PURPOSES, “Magna Carta for Homeowners and Homeowners’ Associations”, Republic Act No. 9904 (07 January 2010), § 4. ↩

  4. NPC Advisory Opinion No. 2020-024 (16 June 2020), available at https://www.privacy.gov.ph/wp-content/uploads/2020/10/Redacted-Advisory-Opinion-No.-2020-024.pdf. ↩

  5. Id. ↩

  6. See: NPC Advisory Opinion No. 2018-061 (06 September 2018) citing Data Privacy Act of 2012, § 12(f); United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulationgdpr/legitimate-interests/what-is-the-legitimate-interests-basis/. ↩

  7. See: Data Privacy Act of 2012, § 3 (l): (l) Sensitive personal information refers to personal information: (1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; (2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and (4) Specifically established by an executive order or an act of Congress to be kept classified. ↩

  8. Rules and Regulations Implementing the Data Privacy Act of 2012, § 18 (c). ↩

  9. Data Privacy Act of 2012, § 20 (a). ↩

  10. Id. § 16. ↩

Backlinks

  • No backlinks found