NPC Issuance Wiki

NPC Advisory Opinion No. 2021-015 — Transfer Of Employee Records From SSS To GSIS

Issued Advisory Opinion

Official opinion tags

Text

28 April 2021

Re: TRANSFER OF EMPLOYEE RECORDS FROM SSS TO GSIS

Dear [Redacted],

We write in response to your request for advisory opinion received by the National Privacy Commission (NPC) to provide guidance on the legality of the disclosure or transfer of employee records without their consent to facilitate the transfer of remitted premiums or contributions from Social Security System (SSS) to the Government Service Insurance System (GSIS) considering the provisions of the Data Privacy Act of 20121 (DPA).

From your letters dated 12 April 2021 and 14 April 2021 together with the Civil Service Commission (CSC) Resolution No. 19006283 provided, we understand that the Anti-Red Tape Authority (ARTA) is currently handling a complaint lodged by Duty Free Philippines Corporation (DFPC) employees against DFPC. One of the issues involved in the complaint is the transfer of the employees’ premiums or contributions from SSS to GSIS.

We further understand that the facts and events which led to the filing of the complaint, critical to this inquiry, are as follows:

• The DFPC is a government owned and controlled corporation (GOCC) with original charter created by R.A. No. 9563 or The Tourism Act of 2009 and a corporate body created out of Duty Free Philippines (DFP), an agency attached to the Department of Tourism (DOT). Prior to its charter, the DFPC was then a division of the defunct Philippine Tourism Authority (PTA) which was a corporate body attached to the DOT, as provided under Presidential Decree No. 564. • On 30 June 1988, the PTA entered into a Contract of Professional Services (CPS) with the Employment Consultant of the Philippines, Inc. (ECPI) for the latter to provide DFPC with manpower requirements. On 11 May 1989, ECPI assigned its rights, duties and interests under the CPS to DFP Services, Inc. (DFPSI) through a Deed of Assignment. Deemed employees of DPSI and not DFPC, the employee’s the terms and conditions of employment were governed by the Labor Code of the Philippines. Consequently, the employees’ premiums or contributions were remitted to Social Security System (SSS). • On 18 January 1998, the Department of Labor and Employment (DOLE) issued a Resolution declaring DFPC as the direct employer of the DFPSI employees, on the grounds of labor-only contracting. The Supreme Court, in its Resolution dated 7 December 1998, affirmed the DOLE Resolution. Pursuant to the DOLE Resolution, DFPC terminated the manpower services contract with DFPSI effective 31 December 1999. Accordingly, DFPC became the direct and immediate employer of the DFPSI employees. However, the employees’ premiums were continuously remitted to the SSS instead of the GSIS. • In the case of DFP vs. Mojica2, the Supreme Court declared that following: “…since DFP [Duty Free Philippines] is under the exclusive authority of the PTA, it follows that its officials and employees are likewise subject to the Civil Service rules and regulations,” thus consequently affirming that DFPC employees are government employees. Accordingly, the premium contributions of the employees should have been remitted to the GSIS and not the SSS. • On 3 June 2019, the CSC issued a Resolution ruling among others, that the period to be reckoned with in which the DFPC employees are to be considered as government employees should be 31 December 1999, the date the manpower services contract between DFPC and DFPSI was terminated and not on 30 September 2005, when the Supreme Court rendered its decision in the Mojica case. • It was only in 2016 that DFPC started remitting the premiums or contributions of the employees to the GSIS.

In relation to the foregoing, a complaint was filed by the DFPC employees with ARTA. We understand that the role of ARTA is to help resolve DFPC employees’ issues and concerns, which include the transfer of their premiums or contributions from SSS to GSIS. The employees covered are those employed with DFPC from 31 December 1999 to 31 December 2015, whether such employees have retired, resigned, still employed or have been separated from DFPC.

In an online meeting held last 16 March 2021, the parties agreed for DFPC to coordinate with SSS to submit to ARTA a list of all covered employees together with relevant details. ARTA posits that the list would require disclosure of personal information which may have some data privacy implications.

You now seek guidance on the following queries:

  1. Can the SSS directly transfer all the records of the covered employees from them directly to GSIS based only on the DOLE and CSC Resolutions? 2. Is the individual consent of all the covered employees necessary for the transfer of the SSS records?

Discussion

Under Section 12 (c) of the Data Privacy Act of 2012, processing of personal information is allowed when it is necessary for compliance with a legal obligation to which the personal information controller is subject, while Section 13 (b) allows the processing of sensitive personal information when the same is provided for by existing laws and regulations.

As stated in both Commonwealth Act No. 1863 and R.A. No. 8291, otherwise known as the GSIS Act of 19974 (collectively, GSIS Laws), the Government Service Insurance System covers all government employees, subject to some exceptions. According to these GSIS laws, membership is compulsory for employees while in government service. In addition, these laws mandate covered employers and employees to pay premiums or contributions.

Through the Resolution of DOLE dated 18 January 1998 and the subsequent Supreme Court pronouncement in the Mojica case, the status of DFPC employees as government employees was affirmed. This was latter echoed by the CSC in its Resolution. It is then evident that DFPC and DFPC employees are indeed subject to the provisions of the GSIS Laws, including the payment of premiums or contributions.

From the foregoing, SSS may transfer the records of the covered DFPC employees, which may contain personal information and sensitive personal information, directly to the proper agency provided by law, GSIS.

Since the disclosure of DFPC employees’ personal data is grounded upon law, consent from the employees is no longer necessary for the transfer of their SSS records to the GSIS. Under the DPA, consent of the data subject is only required when the same is the basis for the processing. It is worth noting that consent is only one of the lawful criteria for processing both personal information and sensitive personal information.

On the matter of ARTA obtaining the list of DFPC employees and their records, while it may be permitted by virtue of ARTA’s mandate to facilitate and handle the issues and concerns subject of the complaint before it, the principle of proportionality requires that processing of personal information be adequate, relevant, suitable, necessary and not excessive in relation to the purpose of the processing.5

Therefore, it would be advisable for ARTA to facilitate the direct transfer of the employee records from SSS to GSIS without having to obtain the actual list or records of the employees, if possible. Limiting the number of parties having access to the records containing personal data minimizes any possible risks of data privacy violations.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012); Civil Service Commission Resolution No. 1900628 (Jun. 3, 2019). ↩

  2. Duty Free Philippines vs. Mojica, 471 SCRA 776 (2005). ↩

  3. An Act to Create and Establish a “Government Service Insurance System,” To Provide for Its Administration, And to Appropriate the Necessary Funds Therefor [Government Service Insurance Act], Commonwealth Act No. 186 (1936). ↩

  4. An Act Amending Presidential Decree No. 1146, As Amended, Expanding and Increasing the Coverage and Benefits of The Government Service Insurance System, Instituting Reforms Therein and For Other Purposes [The Government Service Insurance Act of 1977], Republic Act No. 8291 (1997). ↩

  5. See Section 11 of the DPA and Section 18 (c) of the Implementing Rules and Regulation of the Data Privacy Act of 2012. ↩

Backlinks

  • No backlinks found