Text
30 June 2021
Re: DISCLOSURE OF ADDRESSES OF TERMINATED EMPLOYEES TO THE OFFICE OF THE PROSECUTOR FOR A CRIMINAL CASE
Dear [Redacted],
We write in response to your letter seeking clarification from the National Privacy Commission (NPC) on whether the disclosure of addresses of terminated employees to the Office of the Prosecutor in connection with the criminal case filed by a company violates the Data Privacy Act of 20121 (DPA).
We understand from your letter that a certain company terminated several employees following all Department of Labor and Employment-prescribed procedures, and upon establishing factual and legal bases, the company subsequently filed a criminal case for libel against the said terminated employees.
Discussion
Processing of Personal Data; Lawful Basis; Sections 12 and 13
The DPA recognizes the processing of personal and sensitive personal information (collectively, personal data) provided the requirements of the law are complied with and subject to the adherence of the data privacy principles of transparency, legitimate purpose, and proportionality.
In particular, Section 12 (f) of the DPA allows the processing of personal information if the same is necessary for the purpose of the legitimate interests pursued by the personal information controller or by a third party. On the other hand, Section 13 (f) permits the processing of sensitive personal information if it is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims.
The decision of the Commission in the case of BGM vs. IPP,2 may apply in this scenario. The Commission cited Section 12 (f) in relation to Section 13 (f) of the DPA as a possible lawful criterion for processing personal information (as applied in this case, the addresses of the terminated employees) in relation to the protection of lawful rights and interests and legal claims (in this scenario, the criminal case for libel with the Office of the Prosecutor):
“Based on the foregoing, the disclosure to be made by the Respondent of the information of the recipient of Complainant’s personal information, for purposes of identification of the person liable for the alleged fraud, sans the latter’s consent, is necessary for the protection of the lawful rights and interests of the Complainant as contemplated by Section 13 (f) of the DPA.
Although Section 13(f) applies to sensitive personal information while the information involved in this case is just personal information, the protection of lawful rights and interests under Section 13(f) by the Respondent is considered as legitimate interest pursuant to Section 12(f) of the DPA. This section provides that it is lawful to process personal information if it is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.”
By application in the instant case, Respondent may not be held liable for unauthorized processing should it disclose the requested information to Complainant as its disclosure would be in pursuance of the latter’s legitimate interest as the same cannot be fulfilled by other means.” (citing CID Case No. 17-K-003 dated 19 November 2019 and NPC 18- 135 dated 06 August 2020)
From the foregoing, the disclosure by the company of the addresses of terminated employees to the Office of the Prosecutor in connection with the criminal case filed with the same may be allowed under the DPA based on the above considerations.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
National Privacy Commission, NPC 19-653 (Dec. 17, 2020), available at https://www.privacy.gov.ph/wp-content/uploads/2021/02/NPC-19-653-BGM-vs-IPP-Decision-FINAL-Pseudonymized-21Dec2020.pdf, (last accessed 30 June 2021). ↩