NPC Issuance Wiki

NPC Advisory Opinion No. 2021-006 — Data Classification for the Disclosure of Procurement-Related Documents

Issued Advisory Opinion

Official opinion tags

Text

5 March 2021

Re: DATA CLASSIFICATION FOR THE DISCLOSURE OF PROCUREMENT-RELATED DOCUMENTS

Dear [Redacted],

We write in response to your email inquiry received by the National Privacy Commission (NPC) seeking clarification on whether it is necessary for the Bids and Awards Committee (BAC) of the Bangko Sentral ng Pilipinas - Security Plant Complex (BSP-SPC) to have its data classification approved or enrolled with the NPC, and whether there is an established procedure for the same.

We understand that the BAC of the BSP-SPC would like to establish consistency in releasing procurement-related documents to the public and to all other relevant parties especially since requests for bidding documents are oftentimes received by the BSP-SPC from interested parties, i.e., losing bidders and uninvited non-government organizations (NGOs), in order for them to determine BSP-SPC’s compliance with Republic Act No. 91841 (R.A. 9184) otherwise known as the Government Procurement Reform Act and its revised Implementing Rules and Regulations2 (IRR).

Discussion

Data Privacy Act of 2012; scope; data classification approval

We wish to clarify that the Data Privacy Act of 20123 (DPA) would only apply to the processing of all types of personal information and to any natural and juridical person involved in personal information processing. Personal information is defined as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.4

Where procurement-related documents would contain personal information, the provisions of the DPA may apply to the processing, which includes disclosure of the same, to the public and requesting parties.

Relevant to this matter, the NPC does not have a data classification approval process. As a personal information controller (PIC), the BSP can internally determine a classification of what data and/or documents are being processed, whether these involve personal and/or sensitive personal information (collectively, personal data), and whether the provisions of the DPA are applicable to the same, including the most appropriate lawful basis for processing.

We note that government procurement is governed by certain principles:

  • Transparency in the procurement process and in the implementation of procurement contracts through wide dissemination of bid opportunities and participation of pertinent NGOs.5
  • Public monitoring of the procurement process and the implementation of awarded contracts with the end in view of guaranteeing that these contracts are awarded pursuant to the provisions of the law, and that all these contracts are performed strictly according to specifications.6

With the above in mind, our procurement laws require that procurement opportunities and related documents, i.e., Annual Procurement Plan, Request For Quotation, Invitation to Bid, Supplemental/Bid Bulletin, Notice to Bidders, Contracts Awarded (NTP, NOA, PO, & WO), among others, are made public by the procuring entity though posting in the official agency website, Transparency Seal, the Philippine Government Electronic Procurement System (PhilGEPS), and even physically posting hardcopies of relevant documents in conspicuous places in the office premises of the procuring entity.

Hence, the disclosures above are required by a particular law or regulation and procuring entities must comply. This is read together with the DPA provisions, particularly Section 12 (c) where the processing of personal information is necessary for compliance with a legal obligation to which the PIC is subject, or 12 (e) where personal information is processed for the fulfillment of the functions of a public authority, or Section 13 (b), where processing sensitive personal information is provided for by existing laws and regulations.

Assessment; general data privacy principles

For other procurement-related documents containing personal data the disclosure of which is not specifically stated under laws, rules, and regulations, requests for disclosure may be assessed by the procuring entity on a case-to-case basis, taking into account the general data privacy principles, specifically the following considerations:

  • The purpose of the request must be legitimate and not contrary to law, morals, or public policy, and the personal data requested must be necessary to the declared, specified, and legitimate purpose;
  • The document requested is not excessive in relation to the declared and specified purpose of the request;
  • Redaction of personal data, where appropriate, should also be considered; and
  • Determine whether abstracts, statistics, or aggregated data will suffice for the purpose of the request.

We also take note of some provisions of the revised IRR of RA No. 9184:

Section 9. Security, Integrity and Confidentiality xxx xxx xxx

c) Confidentiality – The PhilGEPS shall ensure the privacy of parties transacting with it. For this purpose, no electronic message or document sent through the system shall be divulged to third parties unless such electronic message or document was sent after the sender was informed that the same will be made publicly available. The PhilGEPS shall protect the intellectual property rights over documents, including technical designs, submitted in response to Invitations to Bid.

Section 29. Bid Opening xxx xxx xxx

The bidders or their duly authorized representatives may attend the opening of bids. The BAC shall ensure the integrity, security, and confidentiality of all submitted bids. The abstract of bids as read and the minutes of the bid opening shall be made available to the public upon written request and payment of a specified fee to recover cost of materials.

The above should also be considered in the assessment of whether procurement-related documents may be disclosed or not.

Finally, it is best that you consult with your data protection officer who may assist you in this endeavor.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Footnotes

  1. An Act Providing for the Modernization, Standardization and Regulation of the Procurement Activities of the Government and for Other Purposes [Government Procurement Reform Act], Republic Act No. 9184 (2003). ↩

  2. Revised Rules and Regulations Implementing the Government Procurement Reform Act, Republic Act No. 9184 (2016). ↩

  3. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  4. Data Privacy Act of 2012, § 3 (g). ↩

  5. See: Government Procurement Reform Act, § 3 (a). ↩

  6. Id. § 3 (e). ↩

Backlinks