Text
26 April 2021
Re: REQUEST FOR INFORMATION IN AID OF IMPLEMENTING THE HAGUE CHILD ABDUCTION CONVENTION
Dear [Redacted],
We write in response to your request for an advisory opinion on whether the Department of Justice (DOJ) can request personal information from other Philippine government agencies in relation to the requests for assistance of Contracting States to locate the whereabouts of children and Taking Parents, in accordance with the Hague Convention on the Civil Aspects of International Child Abduction or the Hague Child Abduction Convention (HCAC), without violating the provisions of the Data Privacy Act of 20121 (DPA).
We understand that the DOJ, through the Office of the Chief State Counsel, is the designated Philippine Central Authority for the HCAC. The objects of the said convention are as follows: (1) to secure the prompt return of children wrongfully removed from or retained in any Contracting State; and (2) to ensure that rights of custody and of access under the law of one Contracting State are effectively respected in the other Contracting State. We understand that in most requests by HCAC Contracting States to the DOJ, the Taking Parents are Filipino nationals.
We understand further that when the DOJ receives an application under the HCAC, it requests the Bureau of Immigration to verify if the subject child and the Taking Parent entered the Philippines and/or if they subsequently left the country. Thereafter, the DOJ requests the assistance of the National Bureau of Investigation to locate the child and the Taking Parent.
Your present concern is in relation to a situation wherein a child and a Taking Parent’s whereabouts are unknown. We note that you mentioned that Philippine passport holders are no longer required to accomplish Arrival Cards. Thus, it may be difficult to obtain lead information on the possible whereabouts of the child and Taking Parent.
In view of the foregoing, you are exploring options on possibly requesting for information from the Department of Foreign Affairs, Land Transportation Office, Commission on Elections, or the Philippine Statistics Authority, among others, to look for information on the possible whereabouts of the child and the Taking Parent, without violating the provisions of the DPA.
You likewise ask if there is a need for the DOJ to have a data sharing arrangement with the said agencies.
Discussion
HCAC; DOJ; mandate; lawful basis for processing personal and sensitive personal information
Article 7 of the HCAC provides:
“CHAPTER II – CENTRAL AUTHORITIES
xxx
Article 7
Central Authorities shall co-operate with each other and promote co-operation amongst the competent authorities in their respective States to secure the prompt return of children and to achieve the other objects of this Convention.
In particular, either directly or through any intermediary, they shall take all appropriate measures – a) to discover the whereabouts of a child who has been wrongfully removed or retained; b) to prevent further harm to the child or prejudice to interested parties by taking or causing to be taken provisional measures; c) to secure the voluntary return of the child or to bring about an amicable resolution of the issues; d) to exchange, where desirable, information relating to the social background of the child; e) to provide information of a general character as to the law of their State in connection with the application of the Convention; f) to initiate or facilitate the institution of judicial or administrative proceedings with a view to obtaining the return of the child and, in a proper case, to make arrangements for organising or securing the effective exercise of rights of access; g) where the circumstances so require, to provide or facilitate the provision of legal aid and advice, including the participation of legal counsel and advisers; h) to provide such administrative arrangements as may be necessary and appropriate to secure the safe return of the child; i) to keep each other informed with respect to the operation of this Convention and, as far as possible, to eliminate any obstacles to its application.”
From the foregoing, the DOJ as the designated Central Authority to discharge the duties which are imposed by the HCAC, is mandated to take appropriate measures to discover the whereabouts of a child, among others. This is read together with the mandate of the DOJ
derived from Executive Order No. 2923 or the Administrative Code of 1987.
The DPA recognizes such mandates and thus, the processing of personal and sensitive personal information (collectively, personal data) which may be necessary and appropriate for the objects of the HCAC may be allowed under the law. Sections 12 and 13 of the DPA provide for the various lawful criteria for processing, depending on the type of personal data being processed.
The DOJ may consider Sections 12 (c) where processing is necessary for compliance with a legal obligation and 12 (e) - necessary in order to fulfill functions of public authority, and/or Sections 13 (b) where the processing is provided for by existing laws and regulations, and 13 (f) where the processing is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.
General data privacy principles; data subject rights; safeguards; personal information controllers
While there may be a lawful basis for processing under the DPA in relation to the HCAC and other laws and regulations, we wish to reiterate that the DOJ, as a personal information controller (PIC), must always adhere to the principles of transparency, legitimate purpose, and proportionality.
Specifically for proportionality, the processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose and personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.2
Hence, the DOJ should judiciously assess the proposal to request information from other government agencies as well as the types of information to be requested, if the same are proportional vis-à-vis the objects of the HCAC.
Data subject rights must likewise be upheld, and the DOJ should have mechanisms in place which enable the free exercise of such rights, subject to limitations under the applicable laws. The DOJ is also required to implement reasonable and appropriate security measures to protect personal data.
We remind government agencies that the processing personal data for the fulfillment of a statutory mandate should always strictly adhere to all required substantive and procedural processes and must not unreasonably infringe on the rights and freedoms of individuals guaranteed by the Constitution.3
Data sharing; data sharing agreement
As to your query on data sharing, the same is defined as the sharing, disclosure, or transfer to a third party of personal data under the custody of a personal information controller to one or more other personal information controller/s (PICs).4 A data sharing agreement or DSA
refers to a contract, joint issuance or any similar document which sets out the obligations, responsibilities and liabilities of the PICs involved in the transfer of personal data between or among them, including the implementation of adequate standards for data privacy and security and upholding the rights of the data subjects.5
While not mandatory based on NPC Circular No. 2020-03, the DOJ may opt to execute DSAs with the identified government agencies as the same is a best practice and a demonstration of accountability amongst the parties to the data sharing:
“SECTION 8. Data sharing agreement; key considerations. — Data sharing may be covered by a data sharing agreement (DSA) or a similar document containing the terms and conditions of the sharing arrangement, including obligations to protect the personal data shared, the responsibilities of the parties, mechanisms through which data subjects may exercise their rights, among others.
The execution of a DSA is a sound recourse and demonstrates accountable personal data processing, as well as good faith in complying with the requirements of the DPA, its IRR, and issuances of the NPC. The Commission shall take this into account in case a complaint is filed pertaining to such data sharing and/or in the course of any investigation relating thereto, as well as in the conduct of compliance checks.”6
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (c) (2016). ↩
-
See: National Privacy Commission, NPC Advisory Opinion No. 2019-022 (May 9, 2019). ↩
-
National Privacy Commission, Data Sharing Agreements [NPC Circular No. 2020-03], § 2 (F) (23 December 2020). ↩
-
NPC Circular No. 2020-03, § 2 (g). ↩
-
Id. § 8. ↩