NPC Issuance Wiki

NPC Advisory Opinion No. 2021-007 — Data Sharing Arrangements of the Philippine Veterans Affairs Office with Other Government Agencies

Issued Advisory Opinion

Official opinion tags

Text

5 March 2021

Re: DATA SHARING ARRANGEMENTS OF THE PHILIPPINE VETERANS AFFAIRS OFFICE WITH OTHER GOVERNMENT AGENCIES

Dear [Redacted],

We write in response to your letter received by the National Privacy Commission (NPC) requesting for an Advisory Opinion on the various issues and concerns relating to data sharing of the Philippine Veterans Affairs Office (PVAO) with other government agencies.

We understand that PVAO is mandated under Republic Act (R.A.) No. 6948, as amended by R.A. No. 7696, otherwise known as An Act Standardizing and Upgrading the Benefits for Military Veterans and their Dependents, to ensure the qualifications of the pension applicants through the determination of the authenticity, validity, and credibility of the documents and information submitted to them. PVAO is also mandated to continuously monitor the status of the pensioners to ensure that they are still alive and whether their surviving spouses have remarried.

We understand further that PVAO has partnered with various government agencies to facilitate the verification of information of pensioners. For information on pensioners on whether living or deceased, current civil status of a pensioner’s surviving spouse and current address, PVAO is coordinating with:

  1. For information on pensioners on whether living or deceased, current civil status of a pensioner’s surviving spouse and current address:
    • a. Civil Registrar Office (CRO), through the local government and with the assistance of the Department of the Interior and Local Government (DILG);
    • b. Philippine Statistics Authority (PSA); and
    • c. Philippine Postal Corporation (PhilPost)
  2. For military service records:
    • a. Office of the Adjutant General – Non-Current Records Division (OTAG – NRD) and
    • b. Major Services Pension Gratuity Branch AFP

In this regard, you now seek clarification on the following matters:

  1. Since the local civil registry (LCR) is under the control and supervision of their respective local government units (LGUs) and the latter are under the jurisdiction of the DILG, can PVAO enter into a Memorandum of Agreement/Understanding and data sharing agreement (DSA) with DILG rather than entering into several DSAs with each and every LCR?

  2. PVAO, to ensure the authenticity of documents and determine the present status of the pensioner, uses the “record-deceased” submitted to it by PSA to check if any of those listed are PVAO claimants. This was restricted upon the enactment of the DPA. Does this arrangement require a DSA between PVAO and PSA?

  3. To perform its mandate, PVAO has been requesting information from the LCR, PSA, and OTAG-NRD which were created to serve as the depository of information for the government. In line with this, the following queries were raised:

    a. Is PVAO still considered a third party for the purpose of data sharing with the aforesaid government agencies? b. Is it safe to say that information provided by the data subjects to the aforesaid government agencies be used and processed by the government in general, so that all government agencies may process the information as long as it is in accordance with their mandated functions? c. Further, are government agencies sharing data with other government agencies pursuant to the performance of their functions still need to comply with the requirements of the Data Privacy Act of 2012 (DPA)?

  4. Are information shared among offices under the Department of National Defense (DND), such as the Armed Forces of the Philippines (AFP) and PVAO considered data sharing?

To address the foregoing concerns, we provide the following clarifications:

Discussion

Data sharing; data sharing agreements; adherence to general data privacy principles

Data sharing is the sharing, disclosure, or transfer to a third party of personal data under the custody of a personal information controller to one or more other personal information controller/s (PICs).1 A data sharing agreement or DSA refers to a contract, joint issuance or any similar document which sets out the obligations, responsibilities and liabilities of the PICs involved in the transfer of personal data between or among them, including the implementation of adequate safeguards for data privacy and security and upholding the rights of the data subjects.2

All data sharing arrangements, whether or not covered by a DSA, are governed by the following principles:

a. Adherence to the data privacy principles of transparency, legitimate purpose, and proportionality; b. Fulfillment of all applicable requirements prescribed by the DPA, its Implementing Rules and Regulations (IRR) and other issuances of the NPC; c. Recognition of upholding the rights of affected data subjects, unless otherwise provided by law; d. Ensuring that the shared and collected data are accurate, complete, and where necessary for the declared, specified and legitimate purpose, kept up to date; and e. Implementation of reasonable and appropriate organizational, physical, and technical security measures intended for the protection of personal data against any accidental or unlawful destruction, alteration, and disclosure as well as against any other unlawful processing.3

In this regard, any data sharing between or among government agencies are still required to strictly adhere to the foregoing principles. Needless to say, these data sharing arrangements involving government agencies are expected to be pursuant to their respective lawful mandates and official functions.

Government agencies; processing based on constitutional or statutory mandate

We reiterate that processing personal data pursuant to the fulfillment of a government agency’s function or when the processing is provided for by the existing laws and regulations are recognized under the various provisions of the DPA.4 However, this does not mean that government agencies are already exempted from complying with all other provisions of the DPA. As PICs, since the requirements of the DPA are not limited to having lawful basis in the processing of personal data.

Stated differently, although government agencies may have legal bases for the processing of personal data, such processing must still adhere to the other requirements of the law. As PICs, government agencies are required to, among others, implement safeguards to ensure the protection of personal data as well as the rights of data subjects.

Parties to a DSA; personal information controllers

Regarding your first query as to who may be the proper party to the DSA with the LCRs, we wish to clarify that the execution of a DSA under the latest NPC issuance is not mandatory:5

SECTION 8. Data sharing agreement; key considerations. – Data sharing may be covered by a data sharing agreement (DSA) or a similar document containing the terms and conditions of the sharing arrangement, including obligations to protect the personal data shared, the responsibilities of the parties, mechanisms through which data subjects may exercise their rights, among others.

This means that data sharing may be conducted with or without a DSA. However, it is imperative that data sharing arrangements must strictly adhere to the foregoing principles.

Regarding your third query, it is important to emphasize that while some government agencies may be considered as repositories of information, PICs cannot be exempted from the requirements of the DPA merely by saying that the information was provided by the data subjects to another government agency. As PICs, each government agency must ensure that they are complying with the requirements of the DPA when they process personal data.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. National Privacy Commission, Data Sharing Agreements [NPC Circular No. 2020-03], § 2 (F) (23 December 2020). ↩

  3. Id. ↩

  4. See: Data Privacy Act of 2012, § 4 (c), (c) – for processing personal information, or 13 (b) & (f) – for processing sensitive personal information. ↩

  5. NPC Circular No. 2020-03, § 8. ↩

Backlinks

  • No backlinks found