Text
9 February 2021
Re: INFORMATION SHARING AND THE PHILIPPINE MARITIME MANPOWER FACTBOOK
Dear [Redacted],
We write in response to your letter requesting for clarification on whether the sharing of information between the National Maritime Polytechnic (NMP) and the other regulatory government agencies such as the Maritime Industry Authority (MARINA), Commission on Higher Education (CHED), Philippine Overseas Employment Administration (POEA), Philippine Coast Guard (PCG), and Overseas Workers Welfare Administration (OWWA) (collectively, data source agencies) is covered by NPC Circular No. 16-02 on Data Sharing Agreements (DSAs) involving Government Agencies.
We note from your letter and the attached draft Memorandum of Agreement (MOA) and annexures on the Data Needs for the Philippine Maritime Manpower Factbook (Factbook) and the Situation Briefer on the Effects of COVID-19 (collectively, data needs) that for the regular and timely production of the Factbook, the data source agencies will share to the NMP industry-related administrative data and statistics.
Discussion
National Maritime Polytechnic
We understand that the NMP is a government agency created pursuant to Presidential Decree No. 1369.1 It is mandated to conduct research and studies on the latest maritime technologies and other related matters for the maritime industry.2
Pursuant to the above, the NMP produced the comprehensive Factbook which is a consolidated country report containing relevant industry-related data and statistics. We understand that the Factbook is updated at regular intervals and data source agencies have been identified to contribute relevant information.
Data Privacy Act of 2012; scope; personal information; data sharing; NPC Circular No. 2020-03; sharing of statistics
At the outset, please note that NPC Circular No. 2020-03 on Data Sharing Agreements has expressly repealed NPC Circular No. 16-02. The new Circular may be accessed at our website at: https://www.privacy.gov.ph/wp-content/uploads/2021/01/Circular-Data-Sharing-Agreement-amending-16-02-21-Dec-2020-clean-copy-FINAL-LYA-and-JDN-signed-minor-edit.pdf.
To determine whether data sharing falls within the scope of the Data Privacy Act of 20123 (DPA) and NPC Circular No. 2020-03, it is important to first determine whether the subject matter of the DSA is personal information.
To clarify, Section 4 of the DPA provides that the law applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing, whereas Section 3(g) of the same defines personal information as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.
Further, NPC Circular No. 2020-03 defines DSA as a contract, joint issuance, or any similar document which sets out the obligations, responsibilities, and liabilities of the personal information controllers involved in the transfer of personal data between or among them, including the implementation of adequate safeguards for data privacy and security, and upholding the rights of the data subjects.
We observed from the draft MOA and the data needs that the NMP is only requesting for the number of individuals involved in a specific situation, to wit:
- Number of seafarers deployed for CY 2018-2019 from the POEA and for CY 2017-2019 from the MARINA;
- Number of persons involved in maritime accidents from the PCG;
- Number of enrollees for Bachelor of Science in Marine Transportation (BSMT) and Bachelor of Science in Marine Engineering (BSMarE) for CY 2020-2021 from CHED;
- Number of repatriated seafarers for CY 2020 from OWWA, among others.
From the foregoing, the various data source agencies will not share any personal information with the NMP. As such, the data needs subject matter of the draft MOA are aggregate data, which are statistical in nature. Consequently, the provisions, principles, and other requirements under the DPA and NPC issuances may not necessarily apply.
Statistical information which does not include information from which the identity of an individual is apparent or can be reasonably and directly ascertained, is not personal information, and thus, not covered by the provisions of the DPA.4 Therefore in this scenario, the execution of a DSA may not be necessary in the sharing of information related to the production and updating of the Factbook.
The above is based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. Note that this communication does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Footnotes
-
Creation of a National Maritime Polytechnic, Presidential Decree No. 1369 (1978). ↩
-
Id. ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
See: National Privacy Commission, Advisory Opinion No. 2020-028 (15 July 2020). ↩