Text
22 October 20211
Re: DATA SHARING OF INCIDENT/DISASTER DATA
Dear [Redacted],
We write in response to your letter seeking guidance from the National Privacy Commission (NPC) on the sharing of personal and sensitive personal information (collectively, personal data) among the Metro Manila Disaster and Risk Reduction and Management Council (MMDRRMC) and various agencies.
We understand that the MMDRRMC is responsible for carrying out the implementation of actions and measures pertaining to all aspects of disaster risk reduction and management in the National Capital Region.
We understand further that the MMDRRMC is structured as a Regional Disaster Risk Reduction and Management Council (RDRRMC) under the Implementing Rules and Regulations (IRR) of Republic Act (RA) No. 10121 otherwise known as the Philippine Disaster Risk Reduction and Management Act of 2010.
As an RDRRMC, the MMDRRMC is mandated to coordinate, integrate, supervise, monitor and evaluate the functions of member agencies and the Local Disaster Risk Reduction Management Councils within its jurisdiction, and be responsible for ensuring risk-sensitive regional development plans, and in case of emergencies, convene the different line agencies and concerned institutions and authorities.
In your letter, you disclosed that it has become standard practice for the MMDRRMC to share and exchange incident/disaster data and information with other government agencies for proper monitoring and documentation of all major and minor incidents and disaster occurrences in Metro Manila on its population, properties, and environment.
You now ask if this data sharing arrangement is in adherence with the provisions of the Data Privacy Act of 20122 (DPA).
Discussion
NPC Circular No. 2020-03; data sharing; mandate; laws and regulations
Data sharing is defined under NPC Circular No. 2020-03 as the sharing, disclosure, or transfer to a third party of personal data under the custody of a personal information controller to one or more other personal information controller/s.3
Further, the said Circular clarified that data sharing may be based on any of the criteria for lawful processing of personal data in Sections 12 and 13 of the DPA4 and may also be allowed pursuant to Section 4 of the law which specifies the special cases.5 The Circular further provides that it does not prohibit or limit the sharing, disclosure, or transfer of personal data that is already authorized or required by law.6
In relation to the above, Sections 12 (c) and (e) allows the processing of personal information when necessary for compliance with a legal obligation or if the processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate. For sensitive personal information, the processing of the same is generally prohibited except in certain instances provided for under Section 13 of the DPA, one of which is when processing is provided for by existing laws and regulations.
The above provisions may be applicable to the data sharing involving the MMDRRMC and other government agencies engaged in disaster risk reduction and management since the data sharing arrangement is mandated by law or regulation.
General data privacy principles; safeguards; data sharing agreement
We would like to note that, although government agencies may have lawful basis for the processing of personal data, such processing must still adhere to the other requirements of the DPA.
As personal information controllers (PICs), government agencies are required to, among others, adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality.
Specifically for proportionality, the processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.
PICs are also required to implement physical, organizational, and technical security measures to ensure the protection of personal data and uphold the rights of data subjects.
The MMDRRMC may consider executing a data sharing agreement (DSA) with its member agencies, where appropriate. A DSA contains, among others, the terms and conditions of the sharing arrangement, including obligations to protect the personal data shared, the responsibilities of the parties, mechanisms through which data subjects may exercise their rights. While the execution of a DSA is not mandatory, it is a sound recourse and demonstrates accountable personal data processing.7
For further guidance on DSAs, please refer to NPC Circular No. 2020-03 available at our website: https://www.privacy.gov.ph/memorandum-circulars/.
Statistics
Finally, should the incident/disaster data and information for the Incident and Situational Reports you mentioned pertain to statistics only, i.e., on the number of dead, missing and injured, the DPA is not applicable.
Statistical information which does not include information from which the identity of an individual is apparent or can be reasonably and directly ascertained, is not personal data, and thus, the sharing of statistics is not covered by the provisions, principles, and requirements under DPA.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Footnotes
-
Tags: criteria for lawful processing; data sharing; law and regulation; general data privacy principles. ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
National Privacy Commission, Data Sharing Agreements [NPC Circular No. 2020-03], § 2 (F) (December 23, 2020). ↩
-
Id. § 6. ↩
-
Id. § 7. ↩
-
Id. § 6. ↩
-
NPC Circular No. 2020-03, § 8. ↩