Text
17 August 2021
RE: REQUESTS FROM GOVERNMENT AGENCIES FOR THE DEPARTMENT OF FOREIGN AFFAIRS TO PROVIDE PERSONAL INFORMATION
Dear [Redacted],
We write in response to your request for an advisory opinion received by the National Privacy Commission (NPC) which sought to guidance on the requests for information received by the Department of Foreign Affairs (DFA) – Office of Consular Affairs (OCA) from various government agencies, specifically law enforcement agencies and financial regulatory agencies.
In your letter, you stated that the Bureau of Internal Revenue (BIR) sent a letter to OCA requesting for information about a particular taxpayer. Said request for information was hinged on Section 5 of the National Internal Revenue Code (NIRC), as amended.
You further stated in your letter that the Presidential Commission on Good Government (PCGG) likewise sent a letter to the OCA requesting for information of persons in relation to a Supreme Court case.
You now come to the NPC for guidance on whether the OCA can disclose personal information and sensitive personal information (collectively, personal data) of OCA’s data subjects without violating the provisions of the Data Privacy Act of 20121 (DPA).
Discussion
Scope of the DPA; special cases; fulfillment of mandate; public authority; law enforcement or regulatory functions
The DPA and its Implementing Rules and Regulations (IRR) provide for a list of specified information that are not covered by certain requirements of the law, which includes information necessary to carry out functions of a public authority, to wit:
“SECTION 5. Special Cases. The Act and these Rules shall not apply to the following specified information, only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned:
xxx
d. Information necessary in order to carry out the functions of public authority, in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function, including the performance of the functions of the independent, central monetary authority, subject to restrictions provided by law…
xxx
Provided, that the non-applicability of the Act or these Rules do not extend to personal information controllers or personal information processors, who remain subject to the requirements of implementing security measures for personal data protection: Provided further, that the processing of the information provided in the preceding paragraphs shall be exempted from the requirements of the Act only to the minimum extent necessary to achieve the specific purpose, function, or activity.” (Underscoring supplied)
We reiterate our discussions in NPC Advisory Opinion No. 2020-015 and 2021-028 wherein we discussed the BIR’s duty and authority to, among others, ensure compliance with the NIRC, as amended, and other relevant tax laws and regulations. Particularly, the authority of the BIR Commissioner to obtain information in the evaluation of the tax compliance of any person, specifically in this case, where the BIR has already identified a tax compliance issue with a particular taxpayer, as mentioned in your letter.
Investigative functions; lawful criteria for processing; Sections 12 and 13
As to the PCGG request, we understand from Section 3(g) of Executive Order No. 12 that the PCGG has the power to seek and secure the assistance of any office, agency, or instrumentality of the government, in relation to the recovery of all ill-gotten wealth by Former President Marcos, his immediate family, relatives, subordinates, and close associates,3 and the investigation of such cases of graft and corruption as the President may assign to the Commission from time to time.4
While the PCGG’s purpose for requesting the addresses of certain persons in relation to the Supreme Court case was not indicated in your letter, we suppose that the said request is pursuant to the exercise of the PCGG’s mandates which includes the conduct investigations, sequestrations, among others.
With this, the request for addresses and other information may then be anchored under Sections 12 and/or 13 of the DPA, depending on type of personal data involved.
Specifically, Section 12 (e) recognizes the processing that is necessary to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate and Section 13 (b) which allows the processing which is provided for by existing laws and regulations and Section (f) on the processing that is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.
Requests through letters; issuance of subpoena; subpoena powers; general data privacy principles; data subject rights; limitations
Another concern you raised is that these requests from the BIR and/or from the PCGG were made through letter requests and not through subpoenas. You proceeded to cite Section 34 (b) (1) of the IRR:
“Section 34. Rights of the Data Subject. x x x
b. Right to object. x x x
When a data subject objects or withholds consent, the personal information controller shall no longer process the personal data, unless:
- The personal data is needed pursuant to a subpoena.”
To clarify, the above provision pertains to the limitations on the exercise of the right to object, specifically when processing is based on consent and the data subject has withdrawn the same, but processing may continue if the personal data is needed pursuant to a subpoena.
We emphasize that the above does not operate to provide a limitation on how personal data can be requested by government agencies.
We also wish to clarify that the issuance of a subpoena may not always be appropriate at a particular stage of an inquiry, investigation, enforcement action, or other applicable government action. Requests for information may come in various forms, i.e., court orders, subpoena, letters, orders, other official communications, among others. It is also important to note that not all government agencies are granted subpoena powers.
We emphasize that the NPC does not presume to know all the means and methods by which government agencies can validly request for personal data. Still, the DPA requires that all agencies processing personal data, whether for law enforcement, regulatory, investigative, or some other mandate, should strictly adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality, and follow all due process requirements as provided by the applicable laws and regulations.
Having said that, the OCA is not precluded to further ask and/or confirm from the BIR and/or the PCGG additional details with respect to the validity of the letter requests and the
standard operating procedures of the agencies on these types of data requests made through letters instead of subpoenas.
Finally, Section 19 of the DPA and Section 37 of its IRR provide for the limitations with respect to the rights of the data subjects where the processing of personal data is for the purpose of investigations in relation to any criminal, administrative, or tax liabilities of the data subject.
This is further clarified in Section 13 of NPC Advisory No. 2021-01 on Data Subject Rights,5 which provides:
“SECTION 13. Limitations. — The exercise of the rights of data subjects shall be reasonable. The same may be limited when necessary for public interest, protection of other fundamental rights, or when the processing of personal data is for the following purposes: xxx
B. Investigations in relation to any criminal, administrative, or tax liabilities of a data subject: provided, that:
- The investigation is being conducted by persons or entities duly authorized by law or regulation; 2. The investigation or any stage thereof relates to any criminal, administrative, or tax liabilities of a data subject as may be defined under existing laws and regulations; and 3. The limitation applies to the extent that complying with the requirements of upholding data subject rights would prevent, impair, or otherwise prejudice the investigation. x x x.”
Considering the foregoing discussions, the OCA may disclose personal data to the BIR and the PCGG without necessarily violating the provisions of the DPA and the rights of the data subjects.
We emphasize that the DPA shall not be used to hamper, or interfere with, the performance of the duties and functions of government agencies. The DPA does not prohibit government agencies from processing personal data pursuant to their respective mandates, taking into consideration the applicable provisions of law, rules and regulations, and the general data privacy principles enunciated in the DPA.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC – Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
Office of the President, Creating the Presidential Commission on Good Government [Executive Order No. 1, s. 1986] (28 February 1986). ↩
-
Id. § 2 (a). ↩
-
Id. § 2 (b). ↩
-
National Privacy Commission, Data Subject Rights [NPC Advisory No. 2021-01] (January 29, 2021). ↩