Text
11 December 2020
Re: DISCLOSURE OF UNIT OWNERS’ PERSONAL INFORMATION
Dear [Redacted],
We write in response to your letter received by the National Privacy Commission (NPC) which requested for an advisory opinion regarding the request of three (3) members of the Oceanway Residences Condominium Corporation (ORCC) for the property management to provide them the names, unit numbers, email addresses, and phone numbers of all members of the ORCC.
We understand from your letter that such request was made for purposes of determining the unit owners since some units may have already been returned to the developer for failure to pay the installments, to update and confirm the bona fide members in good standing, and to prepare for the next members’ meeting and solicit proxies, if necessary.
You now ask on whether such disclosure is allowed under the Data Privacy Act of 2012 (DPA). Specifically, you seek clarification on the following issues:
- Is the disclosure of the names, unit numbers, email addresses, and phone numbers of all unit owners of a condominium corporation to some of its members who requested for such information allowed under the DPA?
- Is the property manager allowed to disclose if a particular member is in good standing or is delinquent in the payment of dues? If so, do the requesting members have the right to confront a particular member if he or she is updated in the payment of dues without prying into said member’s privacy?
- Is the property manager allowed to disclose if a particular occupant/resident has already fully paid the purchase price of his or her unit? If so, do the requesting members have the right to confront a particular occupant/resident if he or she has fully paid the unit without prying into the latter’s privacy?
- Is it required to obtain the consent of every member in writing before the disclosure of their personal information?
Discussion
Advisory Opinion No. 2019-027; personal information; lawful processing
The main issue discussed under NPC Advisory Opinion No. 2019-027 was whether or not the DPA allows a unit owner to be granted access to the personal information of other tenants and unit owners to confirm if the property is being used for commercial purposes.
The NPC opined therein that while Section 12 of the law, read together with the provisions of the Magna Carta for Homeowners and Homeowners’ Associations, may provide a lawful basis for processing, the same is still subject to the principle of proportionality. Hence, it was concluded therein that the pertinent Association may act on the possible complaint of one member for a violation of the Association’s House Rules without necessarily providing such member with the personal data of the alleged violators.
General data privacy principles; proportionality
Similarly, while the Revised Corporation Code of the Philippines (RCC) mandates that a corporation has a legal obligation to provide access to and allow inspection of corporate records and documents, which includes the current ownership structure and lists of stockholders or members to any director, trustee, stockholder or member,1 such legal obligation must still adhere to the general data privacy principles under the DPA.
In the instant matter, it must be determined whether the verification of the unit owners, who among such owners are in good standing or delinquent, preparations for members’ meetings and the possible solicitation of proxies, are undertakings which actually require ORCC to disclose personal information of all members to the three (3) requesting members, or if there is a more appropriate manner of addressing such matters without necessarily disclosing personal information.
With regard to your first query, we reiterate our position that ORCC may provide to the requesting members only such information which are allowed or required to be disclosed under the RCC.
With this, we note that for purposes of preparing for upcoming members’ meetings, the personal information of members need not be disclosed to the requestors since it is the Corporate Secretary’s duty to send out notices. For soliciting proxies, ORCC has no legal obligation as well to disclose the contact details of members for purposes of certain member/s wishing to be appointed as a proxy.2 Nevertheless, ORCC may consider other possible lawful criteria for processing under the DPA, i.e. Section 12 (a) on consent and/or Section 12 (f) on legitimate interest.3
For your second and third queries, there may also be no legal obligation on the part of ORCC to provide the requested information to the requestors, who we understand are just members and not officers or trustees. The concerns on delinquency and non-payment of installments and the appropriate actions which may be taken thereon may be governed by ORCC’s Articles of Incorporation, By-Laws, and other internal policies. It is best that you check these rules to ascertain the proper and authorized persons to address these concerns.
As for your last query, consent is just one of the possible lawful criteria for the processing of personal information. ORCC should decide on the most appropriate lawful basis under Section 12.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
Footnotes
-
An Act Providing for the Revised Corporation Code of the Philippines [Revised Corporation Code of the Philippines], Republic Act No. 11232, § 73 (2019). ↩
-
See: National Privacy Commission, NPC Advisory Opinion No. 2020-045 (6 November 2020). ↩
-
Id. ↩