Text
23 September 2021
Re: DISCLOSURE OF LOAN DOCUMENTS PURSUANT TO A LEGAL CLAIM
Dear [Redacted],
We write in response to your request for advisory opinion received by the National Privacy Commission (NPC or the Commission) to provide clarity on whether the release of loan documents containing personal data is allowed under the Data Privacy Act of 20121 (DPA), particularly in relation to Section 13 (f) on the establishment of legal claims.
From your letter, we understand that Atty. RAN, on behalf of his client, Mr. CGS, wrote to the Home Development Mutual Fund (Pag-IBIG Fund) Loans Origination Department – Cebu Housing Hub requesting for certified copies of the vouchers on the check payment/s made to Ms. CVG.
We understand further that Mr. CGS allegedly lent money to Ms. CVG, through her brother, Mr. RV. Allegedly, Mr. RV bought two (2) Pag-IBIG Fund acquired assets (subject lots). Atty. RAN mentioned that the intention was to re-sell the lots and the proceeds used to pay Mr. CGS. However, when Mr. CGS demanded payment, Mr. RV declared that the properties are yet to be sold. Upon verification, Mr. CGS found out that the properties were purportedly bought by a certain Mr. ZPJ through a Pag-IBIG Fund housing loan with the proceeds released to the seller, Ms. CVG. Thus, Atty. RAN stated the vouchers are material evidence in his client’s pursuit of justice in the event the Ms. CVG and her brother fail to settle their obligation.
Finally, we understand there is a disagreement between Pag-IBIG Fund and Atty. RAN as shown through the exchange of letters between parties. According to Pag-IBIG Fund, the requested documents pertain to personal data involving the housing loan borrower Mr. ZPJ and the seller, Ms. CVG, which are protected under the DPA and would thus require their consent prior to the disclosure of the information to third parties.
On the other hand, Atty. RAN claims the following: (1) the request falls under Section 13 (f) which states that the processing of sensitive personal information is allowed where the processing concerns the establishment, exercise or defense of legal claims…”; (2) Pag-IBIG Fund has been informed that his client, Mr. CGS, has a legal claim over the proceeds of the subject sale transaction between Mr. ZPJ and Ms. CVG who stood for her brother (or father, as alleged in his letter dated 30 April 2021) in the acquisition of the subject lots; and (3) it is simply impossible and illogical to obtain the consent of Ms. CVG who allegedly anticipates to be sued criminally for misrepresentations made to his client.
Thereafter, Pag-IBIG Fund replied citing an Advisory Opinion of this Commission (number not stated) which supposedly mentioned the EU General Data Protection Regulation (GDPR) relating legal claims to those that pertain to court proceedings, administrative or out-of-court procedure, and hence the provision referred to by Atty. RAN does not apply to the request.
We understand further that Atty. RAN reiterated his claim that the request is covered by Section 13 (f) and furnished a copy of the Memorandum of Agreement (MOA) between his client, Mr. RV, and Ms. CVG regarding their joint venture to acquire and sell Pag-IBIG Fund lots for profit.
You now come to the Commission for guidance on whether the request of Atty. RAN, on behalf of his client, falls within the exemption of the prohibition of processing of sensitive personal information under Section 13 (f) of the DPA, specifically on the “establishment, exercise or defense of legal claims.” You likewise seek clarity if the release of the requested documents or information is not prohibited even without the consent of the data subject.
Discussion
Lawful Processing; Establishment, Exercise Or Defense Of Legal Claims
The focal point of the query is Section 13 (f) of the DPA, which provides:
SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases: x x x
(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.2 (emphasis supplied)
In the interpretation of the phrase “establishment, exercise or defense of legal claims,” the Commission reiterated its stand in the case of BGM vs. IPP,3 viz:
In the case of NPC 17-018 dated 15 July 2019, this Commission held that “processing as necessary for the establishment of legal claims” does not require an existing court proceeding. To require a court proceeding for the application of Section 13(f) to this instance would not only be to disregard the distinction provided in the law but the clear letter of the law as well. After all, the very idea of “establishment … of legal claims” presupposes that there is still no pending case since a case will only be filed once the required legal claims have already been established.”
…
The DPA is neither a tool to prevent the discovery of a crime nor a means to hinder legitimate proceedings.4
Given the above, the establishment of legal claims requiring the processing of sensitive personal information is permitted under the DPA. The term establishment may include activities to obtain evidence by lawful means for prospective court proceedings. As such, the DPA does not require the establishment of actual or ongoing court proceedings in the application of Section 13 (f).
In the situation at hand, Mr. CGS, through his counsel, Atty. RAN, seeks to obtain information relating to the proceeds of the sale of the two subject lots by virtue of the MOA between him on the one hand and Mr. RV and Ms. CVG, on the other. To establish this legal claim, certified copies of the vouchers on the check payment/s made to Ms. CVG from the alleged sale with Mr. ZPJ are deemed necessary. Section 13 (f) would be the lawful criterion for such request if such vouchers contain sensitive personal information.
If, however, only personal information is involved, the disclosure of the vouchers may still find basis under Section 12 (f) of the DPA which provides:
SEC. 12. Criteria for Lawful Processing of Personal Information. The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists: x x x
(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution. (emphasis supplied)
The Commission’s pronouncement in the same case of BGM v. IPP may be applied in the same vein:
Although Section 13(f) applies to sensitive personal information while the information involved in this case is just personal information, the protection of lawful rights and
interests under Section 13(f) by the Respondent is considered as legitimate interest pursuant to Section 12(f) of the DPA.5
Thus, Pag-IBIG Fund may release certified copies of the requested loan documents, sans the consent of the data subjects involved, keeping in mind the purpose of the request and the data privacy principle of proportionality.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
Data Privacy Act of 2012, § 13 (f). ↩
-
National Privacy Commission, NPC 19-653 (Dec. 17, 2020), available at https://www.privacy.gov.ph/wpcontent/uploads/2021/02/NPC-19-653-BGM-vs-IPP-Decision-FINAL-Pseudonymized-21Dec2020.pdf (last accessed 07 September 2021). ↩
-
Citations omitted. ↩
-
See footnote 4; citing CID Case No. 17-K-003 dated 19 November 2019 and NPC 18-135 dated 06 August 2020. ↩