Text
6 October 2021
Re: REQUEST FOR THE STATUS OF APPLICATION AND THE LIST OF BENEFICIARIES OF THE SITIO ELECTRIFICATION PROGRAM (SEP)
Dear [Redacted],
We write in response to your request for guidance on whether the Local Government of Infanta, Quezon (Infanta LGU) can lawfully request for certain information from the Quezon II Electric Cooperative, Inc. (QUEZELCO II) in relation to the Sitio Electrification Program (SEP) without violating the provisions of the Data Privacy Act of 20121 (DPA).
We understand that the QUEZELCO II launched the SEP in 2019. The Infanta LGU supports the implementation of the SEP to ensure basic utilities are provided to far-flung communities in the Quezon Province, including Infanta.
We understand further that the LGU received concerns in relation to the SEP, specifically on matters of jurisdiction. It was raised that some households that have been energized by QUEZELCO II fall within the cadastral map of Infanta, and therefore the issuance of electrical permit and other requirements falls within the Infanta LGU’s jurisdiction. It is claimed that there were instances where the necessary permits were instead issued by another LGU.
To address this, the Infanta LGU requested from QUEZELCO II copies of the SEP applications, including the supporting documents to verify the validity of the applications. QUEZELCO II denied the request stating that consent of the applicants was needed. The Infanta LGU thereafter just requested QUEZELCO II to provide the status of application of each target beneficiary using the List of Households provided by the QUEZELCO II to the Infanta LGU. Specifically, the following are requested: 1) whether each beneficiary already has an approved electrical permit, 2) what is the issuing LGU, and 3) the status of energization by QUEZELCO II.
You now seek clarification whether the Infanta LGU can be provided with the above information considering the provisions of the DPA.
Discussion
Lawful Basis For Processing Personal And Sensitive Personal Information (Collectively, Personal Data); Sections 12 And 13
The DPA provides for the various lawful bases for processing personal information under Section 12, and sensitive personal information under Section 13.
We wish to clarify that consent of the data subject is just one of the possible lawful bases for processing. In this scenario where an LGU is requesting for information relating to the exercise of its mandate, consent may not be the most appropriate lawful basis.
As defined, consent refers to “any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so.”2
Note that consent is not an appropriate basis for processing in instances where there is a clear imbalance of power between the data subject and the personal information controller (PIC) as it is unlikely that consent will be freely given.
Given the above, the LGU can rely on other lawful bases for processing, specifically its mandate under the Local Government Code of the Philippines3 or any other applicable laws, rules, and regulations in relation to Sections 12 (c) and (e) on processing for compliance with legal obligations or when necessary to fulfill functions of a public authority, for the processing of personal information. For sensitive personal information, Sections 13 (b) and (f) on processing that is based on laws as well as that which is necessary for the establishment, exercise, or defense of legal claims may be applicable.
General Data Privacy Principles; Proportionality; Safeguards
We wish to reiterate that while there may be a lawful basis for processing under the DPA, the Infanta LGU must still adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality.
Specifically for proportionality, the processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose and personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other less intrusive means.4
In keeping with the said principle, we acknowledge the concession made by the Infanta LGU when it revised and limited its request to the three items mentioned above instead of insisting on having copies of all applications and supporting documents submitted by the target beneficiaries. Making a re-evaluation of whether the original list of requested information is necessary for the declared and specific purpose is consistent with the practice of data minimization.
Lastly, as a PIC, the Infanta LGU is expected to implement the necessary organizational, technical, and physical safeguards for the protection of any personal data it collects and processes. It is bound by obligations under the DPA, its IRR, and issuances of the NPC, specifically NPC Circular No. 16-01 on the Security of Personal Data in Government Agencies.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
Data Privacy Act of 2012, § 3 (b). ↩
-
An Act Providing for a Local Government Code of 1991 [Local Government Code of 1991], Republic Act No. 7160 (1991). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (c) (2016). ↩