Text
8 November 20211
Re: SUBMISSION OF COPIES OF CONDOMINIUM CERTIFICATE OF TITLE TO THE CONDOMINIUM CORPORATION
Dear [Redacted],
We write in response to your letter received by the National Privacy Commission (NPC) which sought clarification on whether the Data Privacy Act of 20122 (DPA) and its Implementing Rules and Regulations3 (IRR) allow a condominium corporation to request unit owners to submit copies of their Condominium Certificate of Title (CCT) and duplicate unit keys. If so permitted, you likewise ask about the minimum safeguards to be imposed as required by the DPA.
We understand from your letter that your client, Perla Condominium Corporation (PCC), is the condominium corporation managing the affairs of Perla Mansion. We further understand that the Master Deed of PCC provides that the amount of any assessment against a unit owner, including association dues, interest due in case of delinquency, costs of collection and/or suit including attorney’s fees and penalties for delinquency shall constitute a lien on the unit. The Master Deed further allows PCC to validly foreclose on the unit as if a mortgage has been executed on it.
In addition, PCC’s By-Laws allows for the enforcement of collection through any of the remedies provided by the Condominium Act and other pertinent laws, including the filing of an adverse claim with the Register of Deeds should a member default in the payment of any assessment. Given the foregoing, you stated that there is a need to identify the registered owner of the units.
You also provided in your letter that Perla Mansion is an old building with minimal occupancy rate which presents a real possibility that dangerous emergency conditions inside the units will not be addressed immediately. We understand from your letter that there may be a need for PCC to do the necessary inspections given the said risks.
Discussion
Lawful basis for processing; sensitive personal information; consent; establishment, exercise, or defense of legal claims
The DPA applies to the processing of all types of personal and sensitive personal information (collectively, personal data) and to any natural or juridical person involved in the processing of personal data.4 A CCT contains personal data of the registered owner such as the name, marital status, address, and citizenship. Hence, the processing of a CCT falls within the scope of the DPA.
The DPA provides for the various criteria for lawful processing of personal and sensitive personal information in Sections 12 and 13, respectively. As the CCT contains sensitive personal information, PCC should determine the most appropriate lawful basis for processing under Section 13 of the law, taking into account the purpose of the processing and PCC’s relationship with the data subjects. In particular, the following criteria may be considered:
“SECTION 13. Sensitive Personal Information and Privileged Information. — The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:
(a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing; x x x
(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.” (underscoring supplied)
For consent-based processing, the DPA requires consent to be freely given, specific, and informed indication of will whereby the data subject agrees to the collection and processing of his or her personal data.5 It must be evidenced by written, electronic or recorded means and it may be given on behalf of a data subject by a representative specifically authorized by the data subject to do so.6 Consent must be given prior to the processing and must be specific to the stated purpose.7
Hence, if consent is the most appropriate basis, PCC should obtain the consent of the unit owners prior to the collection of copies of their CCTs. The consent must be documented in a form which states the specific purpose for which the CCTs will be used and other details on, among others, the processing involved, identity of the personal information controller, rights of data subjects and ways to exercise the same. PCC must provide the adequate details to enable the data subjects to make an informed decision on the processing of their personal data.
For Section 13 (f), the Commission had the opportunity to clarify the same, specifically on the criterion of the establishment, exercise or defense of legal claims in the case of BGM vs. IPP:8
“In the case of NPC 17-018 dated 15 July 2019, this Commission held that “processing as necessary for the establishment of legal claims” does not require an existing court proceeding. To require a court proceeding for the application of Section 13(f) to this instance would not only be to disregard the distinction provided in the law but the clear letter of the law as well. After all, the very idea of “establishment … of legal claims” presupposes that there is still no pending case since a case will only be filed once the required legal claims have already been established.”
This Commission in the same case went on further and held that: The DPA should not be seen as curtailing the practice of law in litigation. Considering that it is almost impossible for Congress to determine beforehand what specific data is “necessary” or may or may not be collected by lawyers for purposes of building a case, applying the qualifier “necessary” to the second instance in Section 13(f) therefore, serves to limit the potentially broad concept of “establishment of legal claims” consistent with the general principles of legitimate purpose and proportionality. As regards legitimate purpose, the Implementing Rules and Regulations (IRR) of the Data Privacy Act provides that the processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy. This means that the processing done for the establishment of a legal claim should not in any manner be outside the limitations provided by law. The DPA is neither a tool to prevent the discovery of a crime nor a means to hinder legitimate proceedings.” (underscoring supplied)
With the above, PCC may also consider the above criterion in relation to the mentioned liens, possible foreclosures, and other related enforcement actions against unit owners.
General data privacy principles; proportionality; privacy impact assessment
Any personal data processing activity shall adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality.
Specifically for proportionality, the processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.9 The principle also requires that personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.10
As discussed above, PCC intends to request all unit owners to submit copies of their CCTs for annotating liens and foreclosing on the units of delinquent owners, identifying registered owners to properly address correspondences, confirming whether the votes are being cast by the real registered owners during meetings, and ensuring that only authorized persons enter the building premises.
We note that although the foregoing purposes are valid concerns of a condominium corporation, PCC should also consider if there are less intrusive means by which the stated purposes may be achieved. It advisable to conduct a privacy impact assessment (PIA) to identify and provide an assessment of various privacy risks, and propose measures intended to address and mitigate the effect of these risks on the unit owners.
Submission of duplicate unit keys
Regarding your second query on whether PCC is permitted by law to request unit owners to submit duplicate keys of their units, the NPC may not be the appropriate authority to provide an opinion on this concern as the scope of the DPA only applies to the processing of personal data and consequently, the right to informational privacy.
Kindly refer to the Civil Code provisions on Human Relations which may provide the more appropriate guidance and reference on this matter.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Footnotes
-
Tags: Condominium Certificate of Title; lawful processing; consent; establishment, exercise, or defense of legal claims; general data privacy principles; proportionality; privacy impact assessment. ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 (2016). ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, § 4 (2012). ↩
-
Data Privacy Act of 2012, § 3 (c). ↩
-
Ibid. ↩
-
National Privacy Commission, BGM vs. IPP NPC 19-653 (Dec. 17, 2020), available at https://www.privacy.gov.ph/wp-content/uploads/2021/02/NPC-19-653-BGM-vs-IPP-Decision-FINAL-Pseudonymized-21Dec2020.pdf (last accessed 9 July 2021). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (c). ↩
-
Ibid. ↩