NPC Issuance Wiki

NPC Advisory Opinion No. 2021-011 — Request Of A Voter For The Erasure Of Name From The Certified List Of Overseas Voters Posted In Philippine Embassies

Issued Advisory Opinion

Official opinion tags

Text

30 March 2021

Re: REQUEST OF A VOTER FOR THE ERASURE OF NAME FROM THE CERTIFIED LIST OF OVERSEAS VOTERS POSTED IN PHILIPPINE EMBASSIES

Dear [Redacted],

We write in response to your request for clarification on whether the European Union (EU) General Data Protection Regulation1 (GDPR) applies to the processing of personal data by Philippine embassies abroad.

The above concern is in relation to a request from a Philippine voter in the EU to have his/her name removed from the posted Certified List of Overseas Voters (CLOV) in a particular embassy. We note from your email that pursuant to Republic Act (RA) No. 9189,2 as amended by RA No. 10590, otherwise known as the Overseas Voting Act of 2013 (OVA), Philippine embassies abroad are required to post the CLOV on their premises.

Discussion

COMELEC; Overseas Voting Act

The Commission on Elections (COMELEC), through the Office for Overseas Voting, oversees and supervises the effective implementation of the OVA. Under the said law, qualified citizens of the Philippines abroad may exercise their right to vote. We note the provision on Section 20 of the OVA, as amended, which reads:

“SEC. 20. Preparation and Posting of Certified List of Overseas Voters. - The Commission shall prepare the Certified List of Overseas Voters or CLOV not later than ninety (90) days before the start of the overseas voting period, and furnish within the same period electronic and hard copies thereof to the appropriate posts, which shall post the same in their bulletin boards and/or websites within ten (10) days from receipt thereof. x x x (underscoring supplied)

Hence, Philippine embassies, consulates, and other foreign service establishments are legally obligated to post the CLOV within ten days from receipt of such list from the COMELEC pursuant to the OVA.

EU GDPR; territorial scope; EU Data Protection Directive; Vienna Convention; Embassies; Extraterritorial Application of the DPA

To clarify, Article 3 of the GDPR enumerates the territorial scope of the law, namely:

  1. The processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.
  2. The processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behavior as far as their behavior takes place within the Union.
  3. The processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.

The GDPR only applies when an organization is processing personal data in the context of the activities of an establishment in the EU, or when non-EU organizations process personal data of data subjects in the EU, or in all diplomatic establishments of EU member-states located all over the world.

Conversely, the GDPR may not apply to embassies and consulates of non-EU member-states notwithstanding the fact that the non-EU embassy is within the territory of an EU member-state. In the European Data Protection Board Guidelines 3/2018 on the territorial scope of the GDPR,3 it was discussed in this wise:

“x x x by virtue of international law, certain entities, bodies or organisations established in the Union benefit from privileges and immunities such as those laid down in the Vienna Convention on Diplomatic Relations of 1961, the Vienna Convention on Consular Relations of 1963 or headquarter agreements concluded between international organisations and their host countries in the Union. In this regard, the EDPB recalls that the application of the GDPR is without prejudice to the provisions of international law, such as the ones governing the privileges and immunities of non-EU diplomatic missions and consular posts, as well as international organisations.”

We note that the Vienna Convention on Diplomatic Relations4 recognizes that while the premises of diplomatic missions remain under the jurisdiction of the host state, such are afforded special privileges and immunities.

Thus, the GDPR may not necessarily be applicable when the processing of personal data is done within the Philippine embassies in the EU. Nevertheless, the provisions of the Data Privacy Act of 20125 (DPA) will apply to the same.

Data subject rights; right to erasure or blocking; limitation; lawful criteria for processing personal information

On the matter of the request for deletion of the name from the posted certified list of overseas voters, Section 16 (e) of the DPA provides that a data subject has the right to suspend, withdraw or order the blocking, removal or destruction of his or her personal information from the personal information controller’s filing system in certain instances. This may be read together with the right to object under Section 34 (b) of the Implementing Rules and Regulations6 (IRR) of the DPA.

These rights are further clarified in NPC Advisory No. 2021-01 on Data Subject Rights, which provides:

“SECTION 7. Right to Object. — The data subject shall have the right to object to the processing of his or her personal data where such processing is based on consent or legitimate interest.

xxx

C. When a data subject objects, the PIC shall cease the processing of personal data and comply with the objection, unless the processing falls under any other allowable instances pursuant to in Sections 12 or 13, other than consent and legitimate interest.

Should there be other grounds to continue processing the personal data, the PIC shall have the burden of determining and proving the appropriate lawful basis or compelling reason to continue such processing. The PIC shall communicate and inform the data subject of said lawful basis or compelling reason to continue processing.

xxx

SECTION 10. Right to Erasure or Blocking. — A data subject has the right to request for the suspension, withdrawal, blocking, removal, or destruction of his or her personal data from the PIC’s filing system, in both live and back-up systems.

A. This right may be exercised upon discovery and substantial proof of any of the following:

  1. The personal data is: a) incomplete, outdated, false, or unlawfully obtained; b) used for an unauthorized purpose; c) no longer necessary for the purpose/s for which they were collected; or d) concerns private information that is prejudicial to the data subject, unless justified by freedom of speech, of expression, or of the press, or otherwise authorized;
  2. The data subject objects to the processing, and there are no other applicable lawful criteria for processing;
  3. The processing is unlawful; or
  4. The PIC or PIP violated the rights of the data subject. x x x.”

However, it seems that none of the above instances is applicable in this scenario involving the posted voter list. Note that while a data subject has a right to object and request for erasure, such rights are not absolute. These may be limited, as in this instance, when the processing is in compliance with the provisions of the OVA and the COMELEC’s and the embassies’ legal obligation under the said law.

In this case, Section 20 of the OVA mandates the COMELEC to prepare the CLOV and furnish copies thereof to the appropriate embassies, consulates and other foreign service establishments for posting.

Thus, the COMELEC and the embassy may be justified in denying the request for erasure and may continue to post the said list. With this, the COMELEC and/or the embassy should clearly and fully inform the data subject of the reason for the denial of the request.7

General data privacy principles; transparency; privacy notice; proportionality

Finally, we take this opportunity to remind the COMELEC that any personal data processing should always adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality.

We recommend the posting of a privacy notice which would provide information on the OVA, the CLOV, the rationale for its posting by embassies, and any other information relevant to the same. Furthermore, the CLOV should only contain such personal data that is necessary to achieve the purpose of the processing under the OVA, in keeping with the practice of data minimization.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Footnotes

  1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) Official Journal of the European Union, Vol. L119 (4 May 2016). ↩

  2. An Act Amending Republic Act No. 9189, Entitled “An Act Providing For A System Of Overseas Absentee Voting By Qualified Citizens Of The Philippines Abroad, Appropriating Funds Therefor And For Other Purposes [The Overseas Voting Act of 2013], Republic Act No. 10590 (2013). ↩

  3. European Data Protection Board, Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) Version 2.1, available at https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en_1.pdf (last accessed 31 March 2021). ↩

  4. Vienna Convention on Diplomatic Relations, available at https://legal.un.org/ilc/texts/instruments/english/conventions/9_1_1961.pdf (last accessed 26 March 2021). ↩

  5. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  6. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 (2016). ↩

  7. National Privacy Commission, NPC Advisory Opinion No. 2021-01, Data Subject Rights. ↩

Backlinks

  • No backlinks found