NPC Issuance Wiki

NPC Advisory Opinion No. 2021-024 — Public Disclosure Of Information On Social Welfare And Development Agencies, Service Providers, And Civil Society Organizations

Issued Advisory Opinion

Official opinion tags

Text

7 July 2021

Re: PUBLIC DISCLOSURE OF INFORMATION ON SOCIAL WELFARE AND DEVELOPMENT AGENCIES, SERVICE PROVIDERS, AND CIVIL SOCIETY ORGANIZATIONS

Dear [Redacted],

We write in response to your request for advisory opinion received by the National Privacy Commission (NPC) to provide guidance on the various concerns with respect to the processing of data pertaining to Social Welfare and Development Agencies (SWDAs), Service Providers (SPs), and Civil Society Organizations (CSOs) registered, licensed, and accredited by the Department of Social Welfare and Development (DSWD) considering the provisions of the Data Privacy Act of 20121 (DPA).

Specifically, you ask for clarification on the following:

  1. Whether the public disclosure of pertinent information of the SWDAs, SPs and CSOs is a violation of the DPA:

    • Data for research and other purpose, in compliance to Executive Order No. 2 dated 23 July 2016 on Freedom of Information (FOI) (E.O. No. 2, s. 2016) to be released to private individuals, National Government Agencies, Local Government Units, Non-Government Organizations, Business Entities and other interested parties;
    • Data about SWDAs that were granted or received benefits, particularly those organizations who received cash incentives from the DSWD;
    • Information of Blacklisted SWDAs and CSOs; and
    • Information sharing among offices under the DSWD such as Field Offices.

  2. Whether consent or privacy notice is required for the following scenarios:

    • Processing of application for Registration, Licensing and Accreditation of SWDAs, SPs and CSOs; and
    • Posting of general information, i.e., Name of SWDA/SPs/CSOs, address, landline number, cellphone number, email address, contact person, certificate details, programs and services, clientele, and areas of operation, at the DSWD website.

  3. Various questions on consent as a lawful basis for processing in the given scenarios above.

Discussion

Scope of the DPA; Information of Juridical Entities; Disclosure in Accordance with Governing Law or Regulation

We wish to clarify that the DPA only applies to the processing of personal information of natural persons and not information of juridical entities recognized under the law, such as corporations, associations, and partnerships.

From a reading of available DSWD regulations, we understand that SWDAs, SPs, and CSOs are juridical entities. Hence, information of these juridical entities is outside the scope of the DPA. Disclosure of the same is governed by some other law or regulation.

We take note of the following DSWD issuances:

• DSWD Memorandum Circular No. 17, Series of 2018 on the Revised Guidelines Governing the Registration, Licensing of Social Welfare and Development (SWD) Agencies and Accreditation of SWD Programs and Services (MC 17, s.2018); • Memorandum Circular No. 01, Series of 2020 on Policies and Procedures on the Accreditation of Social Welfare and Development (SWD) Programs and Services of SWD Agencies Operating in One Region: Supplemental to Memorandum Circular No. 17 s2018 (MC 01, s.2020); and • Memorandum Circular No. 13, Series of 2019 on the Guidelines on the Accreditation of Civil Society Organizations (CSOs) To Implement DSWD Programs Using DSWD Funds (MC 13, s.2019),

all of which laid out with clarity the legal bases of DSWD’s power and authority to register, license and accredit SWDAs, SPs and CSOs. Pertinent to this discussion, we further cite certain objectives stated in MC 17, s.2018:

“2. This guideline likewise emphasizes the objectives of Registration, Licensing, and Accreditation, namely:

2.1 To regulate enforce SWD standards to public and private organizations in the country that are engaged or planning to engage in SWD programs and services endeavors through registration, licensing, and accreditation; 2.2 x x x 2.3 To protect the clients against abuses, exploitations and inefficiency from organizations engaging in SWD entities; 2.4 x x x 2.5 To promote transparency and accountability of SWDAs to their respective donors, clients and general public.”2

Likewise, DSWD MC 13, s.2019 mentions the regulatory power of DSWD over CSOs engaged in the delivery of social welfare and development programs and services.3

In relation to the above, where disclosure of personal and/or sensitive personal information (collectively, personal data) of individuals connected to the SWDA, SP, or CSO is involved, the DPA will apply.

Under the DPA, Section 12 (e) provides that the processing of personal information shall be permitted when it is necessary to fulfill the functions of a public authority which includes the processing of personal data for the fulfillment of its mandate. If sensitive personal information is involved, processing may be based on Section 13 (b) which recognizes processing that is provided for by existing laws and regulations.

The DSWD may process any personal data of individuals, who may be directors, officers, employees or members of SWDAs, SPs, and CSOs which may include their names, contact information, business addresses, when such processing is necessary to fulfill its functions in the registration, licensing and accreditation of said entities, including monitoring and oversight functions.

Any processing of personal data in relation to disclosure of information of Blacklisted SWDAs and CSOs and sharing of information between DSWD offices may be anchored on the above provisions as well.

Freedom of Information Requests; General Data Privacy Principles

On Freedom of Information (FOI) requests for research purposes and SWDAs who received cash incentives, the DSWD may disclose data relating to SWDAs, SPs and CSOs following the guidelines provided by E.O. No. 2, s. 2016.

The people’s right to be informed on matters of public concern is recognized in this instance, especially when the SWDAs, SPs and CSOs implement social welfare and development programs which make use of public funds. For the sake of transparency and accountability, information on the SWDAs, SPs and CSOs, as juridical entities, and even related personal data, where necessary and proportional to the purpose of the request, may be disclosed.

We underscore the principle of proportionality under the DPA which requires that the processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.4 Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.5

We thus advise that any disclosure or publication of personal data should only contain relevant information necessary to achieve the purpose of ensuring transparency and accountability. Keep in mind that any processing of sensitive personal information is prohibited unless allowed under the instances enumerated in Section 13 of the DPA.

As discussed above, the lawfulness of the processing of personal data is primarily based upon the mandate of the DSWD and its compliance to legal obligations. Hence, the consent of data subjects is not the most appropriate lawful basis for the given scenarios. Further, we wish to highlight that consent is only one of the various criteria for lawful processing and is not required in all instances.

But to assist the DSWD, we provide the following guidance for reference:

• Consent is freely given if the data subject has a genuine choice and control over whether to consent to the processing of personal data about and/or relating to him or her. It is not freely given if there is any element of pressure, intimidation, possibility of adverse consequences for refusal to give consent, or any other inability to exercise free will by the data subject. • As to specificity, consent should be granular. Blanket consent is not sufficient. Personal information controllers (PICs) should present to the data subject a list of purposes and allow the data subject to select which purpose/s he or she consents to. • Consent given can be withdrawn at any time. Should the data subject withdraw consent, PICs are obliged to cease the processing without undue delay. • Where consent is withdrawn by the data subject, the same shall not affect the lawfulness of the processing before the withdrawal of such consent. • PICs shall not obtain consent if the same is not appropriate and necessary in relation to the purpose of processing, and especially in instances where the PIC is already aware that such processing will continue despite the withdrawal of consent because of some other undisclosed lawful basis that can be relied on.

Finally, in keeping with the principle of transparency and upholding the right to be informed, DSWD should inform the data subjects or the personnel of the SWDAs, SPs and CSOs that their personal data will be made publicly available pursuant to applicable laws and regulations.

This is made through a privacy notice which is a statement made to a data subject that describes how the PIC collects, uses, retains, and discloses personal information, the rights of a data subject and how these are exercised.6

This requirement is separate and distinct from having a lawful basis for processing and should not be confused with a consent form which is necessary only if consent is the basis for processing.

Finally, as to the sample privacy notice provided, we suggest that the same be modified given the discussion above.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC – Director IV, Privacy Policy Office

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. Department of Social Welfare and Development, Revised Guidelines Governing the Registration, Licensing of Social Welfare and Development (SWD) Agencies and Accreditation of SWD Programs and Services, Memorandum Circular No. 07, Series of 2018 [DSWD M.C. 07, s.2018] (August 29, 2018). ↩

  3. Department of Social Welfare and Development, Guidelines on the Accreditation of Civil Society Organizations (CSOs) To Implement DSWD Programs Using DSWD Funds, DSWD Memorandum Circular No.13, Series of 2019 [DSWD MC 13, s.2019] (July 26, 2019). ↩

  4. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (c) (2016). ↩

  5. Ibid. ↩

  6. See: National Privacy Commission, Data Subject Rights NPC Advisory No. 2021-01, § 6 (c) (Jan. 29, 2021). ↩

Backlinks

  • No backlinks found