NPC Issuance Wiki

NPC Advisory Opinion No. 2020-051 — Use of CCTV Cameras in Common Areas of Residential Condominiums

Issued Advisory Opinion

Official opinion tags

Text

26 November 2020

Re: REQUEST FOR PERSONAL DATA BY THE NATIONAL BUREAU OF INVESTIGATION AND THE PHILIPPINE ARMY

Dear [Redacted],

We write in response to your request for advisory opinion received by the National Privacy Commission (NPC) in relation to the above captioned.

We understand that the Research and Analysis Division of the National Bureau of Investigation (NBI) Intelligence Service requested for the number/list of foreigners who availed of the Special Resident Retiree’s Visa (SRRV) based on an inquiry being conducted by the said division, while the 15th Army Intelligence Battalion of the Philippine Army (the Army) requested for pertinent information/data on the 28,000 Chinese National Retirees to conduct record check on the influx of Chinese nationals in the Philippines.

Specifically, the request sought to clarify the following matters vis-à-vis the provisions of the Data Privacy Act of 20121 (DPA):

  1. Whether the Philippine Retirement Authority (PRA) can legally submit the requested information (i.e. names, addresses, status etc.) of SRRV holders as a response to a mere letter request?
  2. Whether the PRA can divulge the requested information without owner’s consent?
  3. Assuming PRA can divulge the requested information without owner’s consent, what are the legal processes/formalities that must be complied with under the DPA and related laws?
  4. Whether the PRA can disclose the requested information to the NBI without getting the approval of PRA’s Board of Trustees (Board)?

Discussion

Scope of the DPA; mandate; investigatory and

intelligence functions; public authority

The DPA applies to the processing of all types of personal information and to any natural and juridical person involved in the processing of personal information.2 The DPA also states that the processing of personal information shall be allowed, subject to compliance with the requirements of the DPA and other laws allowing disclosure of information to the public and in adherence to the principles of transparency, legitimate purpose, and proportionality.

We understand that the PRA is a government owned and controlled corporation created by virtue of Executive Order No. 1037.3 It is mandated to develop and promote the Philippines as retirement haven as a means of accelerating the social and economic development of the country, strengthening its foreign exchange position at the same time providing further best quality of life to the targeted retirees in a most attractive package.4 As part of this mandate, the PRA issues SRRV, a special non-immigrant visa for foreign nationals who would like to make the Philippines their second home or investment destination.

On the other hand, the NBI is mandated pursuant to Republic Act (RA) No. 10867 or the National Bureau of Investigation Reorganization and Modernization Act to undertake investigation and detection of crimes and offenses, conduct intelligence operations, among other functions.5

Similarly, the 1987 Constitution states that the mandate of the Armed Forces of the Philippines (AFP) is to protect the people and the State, secure the State sovereignty, and the integrity of the national territory.6 Also, Section 48 of the 1987 Administrative Code provides that the Army shall be responsible for the conduct of operations on land,7 and it has the following functions:

  1. Organize, train and equip forces for the conduct of prompt and sustained operations on land;
  2. Prepare such units as may be necessary for the effective prosecution of the national defense plans and programs and armed forces missions, including the expansion of the peacetime army component to meet any emergency;
  3. Develop, in coordination with the other Major Services, tactics, techniques and equipment of interest to the army for field operations;
  4. Organize, train and equip all army reserve units; and
  5. Perform such other functions as may be provided by law or assigned by higher authorities.8

Lawful criteria for processing of personal information

Processing, which includes disclosure, of personal and sensitive personal information (collectively, personal data) by government agencies is recognized under the DPA.

The law provides for the various criteria for lawful processing. For personal information, this may be disclosed pursuant to the applicable provisions of Section 12, particularly Section 12 (c) where the processing is necessary for compliance with a legal obligation, or Section 12 (e) where processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate.

For sensitive personal information, release or disclosure is generally prohibited unless it is permitted under Section 13 of the DPA. For the given scenario, Section 13 (b) recognizes the processing that is provided for by existing laws and regulations, while Section 13 (f) provides for the processing for the establishment, exercise or defense of legal claims, or when provided to government or public authority.

As can be seen above, the said requests may be predicated on the inquiry and records check being conducted by the NBI and the Army, respectively, taking into account that the processing by these government agencies of personal data based on a particular legal obligation, fulfillment of a mandate, or a requirement under a law or regulation. We are also mindful of the principle of presumption of regularity of duty in which we presume that the processing of personal data made by the NBI and the Army is in the regular exercise of their functions. Thus, the consent of the data subject may not be the most appropriate lawful basis for processing in the given scenario.

From the foregoing, the NBI and the Army, acting based on their statutorily mandated functions to investigate and to conduct intelligence operations, may be permitted to process the personal data. This is of course with the obligation of adhering to the general data privacy principles enunciated in the DPA as well as strict observance of all due process requirements. Compliance with the proper procedures is necessarily included in the proper exercise of a legal mandate.

General data privacy principles; proportionality;

legitimate purpose; due process requirements; standard procedures

Specifically for the principles of legitimate purpose and proportionality, it may be prudent for the PRA to clarify what particular personal data should actually be released by virtue of the letter requests as well as additional details on the purpose/s for processing, especially since the request for and release of “pertinent information/data on the 28,000 Chinese National Retirees” as requested by the Army may be overly broad. There must be specificity, lest these requests be construed as violative not just of the provisions of the DPA, but the constitutional guarantee against unreasonable searches and seizures as well. We note that the reasonableness of any government intrusion is weighed against the reasonable expectation of privacy of the individual considering the provisions of the DPA and other surrounding circumstances.

For this purpose, the PRA is not precluded to further ask and/or confirm from both the NBI and the Army the veracity of the letter requests, if the issuance of a letter request is the standard operating procedure for such types of requests, if there are any written orders or documented process flows on who are the authorized signatories of such requests, etc., just to ensure that the letter requests are validly issued, considering that in the case of the NBI, the

agency has already been granted subpoena powers under the National Bureau of Investigation Reorganization and Modernization Act.9

You should coordinate with your data protection officer (DPO) as well as the DPOs of the NBI and the Army to resolve this matter.

We wish to emphasize that while the DPA shall not be used to hamper, or interfere with, the performance of the duties and functions of duly constituted public authorities, government agencies do not have the blanket authority to access or use the personal data of individuals under the custody of another agency. Government agencies as personal information controllers, must be able to show that their personal data processing activities are necessary to their statutory functions, and that the processing is limited to achieving such specific purpose, function, or activity based on mandate.

Request for aggregate data/statistics

On the NBI request for the number of foreigners who availed of the SRRV, this only involves the disclosure of aggregate data which are statistical in nature, and hence, the provisions and principles under the DPA may not necessarily apply.

Statistical information which does not include information from which the identity of an individual is apparent or can be reasonably and directly ascertained, is not personal information, and thus, not covered by the provisions of the DPA.

Approval of PRA’s Board of Trustees for disclosure of personal data

Finally, as to the question of whether the PRA can disclose the requested information without getting the approval of PRA’s Board, the determination of the same is internal to the PRA. Kindly review your own charter as well as any other internal policies on the matter.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. Data Privacy Act of 2012, § 4. ↩

  3. Creating the Philippine Retirement Park System, Providing Funds Therefor and Other Purposes, Executive Order No. 1037, s. 1985 (1985). ↩

  4. Philippine Retirement Authority, About Us, available at https://pra.gov.ph/mandate-vision-and-mision/ (last accessed 22 November 2020). ↩

  5. An Act Reorganizing and Modernizing the National Bureau of Investigation (NBI) And Providing Funds Therefor [NBI Reorganization and Modernization Act], Republic Act No. 10867, § 4 (2016). ↩

  6. See: PHIL. CONST. art. 2 § 3. ↩

  7. Executive Order No. 292, Title VIII, Subtitle II, Chapter 8, § 48. ↩

  8. Id. § 49. ↩

  9. An Act Reorganizing and Modernizing the National Bureau of Investigation (NBI) And Providing Funds Therefor [NBI Reorganization and Modernization Act], Republic Act No. 10867, § 4 (b) (2016). ↩

Backlinks

  • No backlinks found