Text
27 November 2020
Re: PUBLICATION OF CONTESTABLE CUSTOMERS’ INFORMATION IN THE ENERGY REGULATORY COMMISSION’S WEBSITE
Dear [Redacted],
We write in response to your request for an advisory opinion received by the National Privacy Commission (NPC or Commission), which sought to clarify whether or not the Energy Regulatory Commission (ERC) may publish the names of those determined as contestable customers and their generic location, pursuant to the Retail Competition and Open Access (RCOA) scheme under Republic Act No. 91361, in accordance with the provisions of the Data Privacy Act of 20122 (DPA).
In your letter-request, we understand that the RCOA is a scheme which allows qualified end-users to choose among licensed suppliers of electricity, resulting in competitive prices offered in the market called the Competitive Retail Electricity Market (CREM). To implement this scheme, the ERC is mandated to provide transparency by publishing the list of qualified contestable customers in the ERC’s website.
In this regard, the Commission’s opinion is being sought on whether the publication of names of identified contestable customers and their generic location on the ERC website is in compliance with the DPA.
Discussion
Scope of the Data Privacy Act of 2012; personal information; natural persons; juridical persons
The DPA applies to the processing of all types of personal information and to any natural and juridical person involved in processing personal information. Personal information is defined as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.
R.A. 9136 defines a contestable customer/market as an electricity end-user who has the choice of a supplier of electricity, as may be determined by the ERC.3 Further examination of the law would reveal that a contestable customer is one with a monthly average peak demand of at least one megawatt (1MW) for the preceding twelve (12) months upon initial implementation of open access. After two (2) years, the threshold level for the contestable market shall be reduced to seven hundred fifty kilowatts (750kW). Subsequently and every year thereafter, the ERC shall evaluate the performance of the market and on the basis of such evaluation, gradually reduce the threshold level in determining a contestable customer.4
We likewise note from your letter that you provided specific names of a bank, a petroleum company, and a real estate company as examples of contestable customers.
Based on the foregoing, it appears that the information the ERC aims to publish is not personal information as the same pertains to information of juridical persons and not individuals or natural persons. The name of a corporation and its generic location are a juridical person’s information and is not considered personal information. Article 44 of the Civil Code of the Philippines defines juridical persons, to wit:
“Article 44. The following are juridical persons:
(1) The State and its political subdivisions;
(2) Other corporations, institutions and entities for public interest or purpose, created by law; their personality begins as soon as they have been constituted according to law;
(3) Corporations, partnerships and associations for private interest or purpose to which the law grants a juridical personality, separate and distinct from that of each shareholder, partner or member.”
Taking into consideration the threshold monthly average peak demand for electric supply mentioned in the law is quite substantial, we assume the same can only be attained by those with corporate accounts and that the publication would most likely only pertain to corporate entities, and hence, is outside of the scope of the DPA.
Lawful criteria for processing personal information; legal obligation; fulfilment of mandate
In the event where the contestable customer is an individual or a sole proprietorship whose name and generic location would be subject to publication, Section 12 of the DPA states that the processing of personal information shall be permitted if necessary for compliance with a legal obligation to which the personal information controller is subject5 or when necessary in order to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate.6
In this instance, the ERC may cite the pertinent provisions of the Electric Power Industry Reform Act of 2001 (EPIRA) and/or other applicable laws and regulations to justify the publication of names and generic locations of individuals identified as qualified contestable customers as a legal obligation of the ERC and/or part of the fulfillment of its mandate. As a personal information controller, ERC should adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality, and has the obligation to implement reasonable and appropriate organizational, physical, and technical security measures for protection of personal data.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
Footnotes
-
An Act Ordaining Reforms in the Electric Power Industry, Amending for the Purpose Certain Laws and for Other Purposes [Electric Power Industry Reform Act of 2001], Republic Act No. 9136 (2001). ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
Electric Power Industry Reform Act of 2001, § 31. ↩
-
Ibid. ↩