NPC Issuance Wiki

NPC Advisory Opinion No. 2021-016 — Data Privacy Implications Of Uploaded Contracts In The Development Bank Of The Philippines’ Website

Issued Advisory Opinion

Official opinion tags

Text

28 April 2021

Re: DATA PRIVACY IMPLICATIONS OF UPLOADED CONTRACTS IN THE DEVELOPMENT BANK OF THE PHILIPPINES’ WEBSITE

Dear [Redacted],

We write in response to your request for an advisory opinion received by the National Privacy Commission (NPC) which sought to clarify the data privacy and security implications of the website posting requirements mandated by National Budget Circular No. 5421 and Government Procurement Policy Board (GPPB) Circular No. 02-2020,2 issued in accordance to the requirements of Republic Act No. 91843 otherwise known as the Government Procurement Reform Act and its revised Implementing Rules and Regulations4 (IRR), and how these can be reconciled with the provisions of the Data Privacy Act of 20125 (DPA).

We understand that the Development Bank of the Philippines (DBP) is considering the implementation of various measures to mitigate possible risks that may arise in complying with the aforementioned issuances, after an assessment made that the type of information from the documents required to be posted may result into identity theft and possible falsification of documents. Among the security measures that DBP is considering are as follows:

  1. Redaction of sensitive data, particularly on the acknowledgement page, in the notarized contracts including, but not limited to, actual signatures of parties, personal details such as identification numbers (e.g., tax identification numbers, passport numbers, driver’s license numbers), and copies of actual identification cards of DBP officials and the latter’s contractors/suppliers; 2. Exclusion of publishing of copies of identification cards of authorized signatories attached to signed contracts; 3. Possibility of placing the words: “[Signed]” in the published versions of the records instead of displaying the actual signatures of the official signatories – since scanned signatures may easily be copied and be manipulated to create fictitious records/documents; and 4. Exclusion of uploading documents or attachments that disclose details of the Bank’s IT infrastructure and security defenses.

Discussion

Scope of the Data Privacy Act of 2012; personal information

The DPA applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing. Personal information is defined as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.6

Where procurement-related documents would contain personal information, the provisions of the DPA may apply to the processing, which includes disclosure of the same, to the public and requesting parties.

In NPC Advisory Opinion No. 2021-006,7 the Privacy Policy Office had the occasion to discuss some of the principles governing procurement in the government in relation to the lawful criteria for processing personal data. These same principles may be the basis for the aforementioned issuances requiring the posting of various procurement-related documents, thus:

“Government procurement; disclosure of procurement-related documents; lawful basis for processing

We note that government procurement is governed by certain principles:

• Transparency in the procurement process and in the implementation of procurement contracts through wide dissemination of bid opportunities and participation of pertinent NGOs. • Public monitoring of the procurement process and the implementation of awarded contracts with the end in view of guaranteeing that these contracts are awarded pursuant to the provisions of the law, and that all these contracts are performed strictly according to specifications.”

Even if there is a lawful basis for processing personal data, the DPA further mandates all personal information controllers (PICs) to implement reasonable and appropriate organizational, technical, and physical security measures to protect personal data being processed, which may include the practice of redacting personal data, where appropriate.

Nevertheless, while the DPA mandates all PICs to undertake appropriate safeguards, the same must be read together with other existing laws, specifically in this case, government procurement laws and regulations, such as RA No. 9184 and its revised IRR as well as all relevant GPPB and Department of Budget and Management (DBM) issuances. As such, the security measures proposed to be undertaken by the DBP should still be consistent with the transparency and accountability principles underlying all government procurement activities, i.e., should there be specific requests for access to said procurement documents, the DBP should make such documents available for viewing or authentication purposes pursuant to the principle of transparency mandated by RA No. 9184.

Finally, the NPC recognizes DBP’s judicious assessment and efforts to implement additional safeguards which may be implemented. But in order to have a streamlined and standard process across all procuring entities as to how procurement documents are to be made public, a consultation with the GPPB, DBM, and other pertinent government agencies may be necessary.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Footnotes

  1. Department of Budget and Management, Reiterating Compliance with Section 93, The Transparency Seal Provision, of the General Appropriations Act of 2012 [National Budget Circular No. 542] (August 29, 2012). ↩

  2. Government Procurement Policy Board, Guidelines in the Posting and Submission of Annual Procurement Plans, Procurement Monitoring Reports and Agency Procurement Compliance and Performance Indicator Results [GPPB Circular No. 02-2020] (May 20, 2020). ↩

  3. An Act Providing for the Modernization, Standardization and Regulation of the Procurement Activities of the Government and for Other Purposes [Government Procurement Reform Act], Republic Act No. 9184 (2003). ↩

  4. Revised Rules and Regulations Implementing the Government Procurement Reform Act, Republic Act No. 9184 (2016). ↩

  5. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  6. Data Privacy Act of 2012 § 3 (g). ↩

  7. NPC Advisory Opinion No. 2021-006. ↩

Backlinks

  • No backlinks found