Text
24 November 2021
Re: POSTING OF NAMES OF PASSPORT APPLICANTS ON THE WEBSITE OF THE OFFICE OF CONSULAR AFFAIRS OF THE DEPARTMENT OF FOREIGN AFFAIRS
Dear [Redacted],
We write in response to your request for advisory opinion received by the National Privacy Commission (NPC) which sought confirmation from the NPC whether the Department of Foreign Affairs- Office of Civilian Security and Consular Affairs (DFA-OCSCA) can publicly post on the website of the DFA – Office for Consular Affairs (DFA-OCA) the names of Philippine passport applicants whose passports were unsuccessfully delivered despite repeated attempts.
Discussion
We note from your letter that due to the influx of passport appointments due to the pandemic, the DFA permitted its technical service provider, APO Production Unit, Inc., to integrate a third-party service provider in the passport Online Appointment System (OAS). However, due to logistical issues and ineffectiveness of the former courier service, there are at least one thousand nine hundred sixty-four (1,964) backlogs in passport delivery.
As a solution, the DFA intends to publicly post on its website (https://consular.dfa.gov.ph) the names of Philippine passport applicants whose passports were unsuccessfully delivered despite repeated attempts. This is also in consideration of the fact that the DFA’s efforts in calling and emailing these applicants were equally ineffective. You now ask whether such disclosure is permissible under the Data Privacy Act of 20121 (DPA).
Lawful basis for processing personal information; Section 12; fulfillment of functions; contract
The DPA applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing.2
Under the DPA, the names of the passport applicants are considered as personal information,3 thus, posting of the same on the website of the DFA-OCA constitutes processing4 which should comply with the provisions of the DPA, particularly Section 12 of the law providing for the criteria for lawful processing of personal information, to wit:
SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists: x x x
(b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract; x x x
(e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or xxx”
As applied in this case, Section 12 (e) is applicable and may be the most appropriate lawful basis for processing.
We note that the DFA has the legal mandate to enforce Republic Act No. 82395 or the Philippine Passport Act of 1996. Specifically, Section 4 of the Philippine Passport Act provides for the authority of the DFA to issue passports to citizens of the Philippines in accordance with the said law.
The DFA may also consider Section 12 (b) above, taking into consideration the nature of the relationship among the DFA, the courier, and the data subjects. Posting of the names on the DFA-OCA website may be considered as processing necessary and related to the fulfilment of a contract with a data subject, i.e., delivery of passport.
We note that in your letter, you have cited Section 12 (f) on legitimate interest as a possible basis for processing:
(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.
We wish clarify that generally, government agencies cannot rely on its “legitimate interest” as its as lawful basis for processing. We refer to the restriction in the EU General Data Protection Regulation (GDPR) for guidance:
“Article 6
Lawfulness of processing
- Processing shall be lawful only if and to the extent that at least one of the following applies: x x x
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.”6
Government agencies’ personal data processing activities should be limited to their constitutional or statutory mandates and should not go beyond the same.
Hence, the public disclosure of the names the passport applicants with printed passports waiting for delivery may be anchored on Sections 12 (b) and/or (e) as discussed above.
Adherence to the general data privacy principles; transparency; proportionality; privacy notice
While there may be lawful basis for processing under the DPA, the DFA must always adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality.
Particularly, the principle of proportionality requires that processing of personal information shall be adequate, relevant, suitable, necessary, and not excessive in relation to the declared and specified purpose.7 We note from your letter that the DFA intends to post the full names and the corresponding sites where the passports will be released to the applicants. The DFA must have an assessment and determination that such public posting of the full names of the applicants is the least privacy intrusive manner of processing in relation to the declared purpose, considering all attendant circumstances.
Likewise, the DFA must ensure that the data subjects are informed about the posting of their personal information on the website. This may be done through an appropriate privacy notice.
A privacy notice is “a statement made to a data subject that describes how an organization collects, uses, retains and discloses personal information. A privacy notice may be referred to as a privacy statement, a fair processing statement or, sometimes, a privacy policy.8
If not already included, the DFA should include a privacy notice in its passport application form so that moving forward, its clients may be apprised of the possible posting of their names in case of unsuccessful deliveries of their passports.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
Philippine Passport Act of 1996, Republic Act No. 8239 (1996). ↩
-
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) Official Journal of the European Union, Vol. L119, Art. 6 (1) (f) (4 May 2016). ↩
-
Data Privacy Act of 2012, § 11 (c). ↩
-
IAPP, Glossary of Privacy Terms, available at https://iapp.org/resources/glossary/#paperwork-reduction-act-2 ↩