NPC Issuance Wiki

NPC Advisory Opinion No. 2021-043 — Data Sharing with the Philippine National Police

Issued Advisory Opinion

Official opinion tags

Text

16 December 2021

Dear [Redacted],

Re: DATA SHARING WITH THE PHILIPPINE NATIONAL POLICE

We write in response to your request for an advisory opinion received by the National Privacy Commission (NPC or the Commission) on whether the personal and sensitive personal information (collectively, personal data) of drug surrenderers undergoing drug rehabilitation may be shared by the Iloilo City Health Office (CHO) with the Philippine National Police (PNP).

We understand that the Iloilo City Police Office (CPO) sent a letter to the CHO requesting for the data of drug surrenderers who are presently undergoing drug rehabilitation under the Iloilo City Community Change Center dubbed as “The Crossroads” (Community-based Drop-in Center).

The CHO denied the request citing Sections 11 (a) and 13 of the Data Privacy Act of 20121 (DPA), stating that the CPO did not provide the specific purpose for which the requested data will be utilized, and it was not shown that the circumstance fits any of the exceptions under Section 13 that would warrant the processing of sensitive personal information.

Further, we understand the PNP Legal Service reiterated the request for the production of the necessary data on the following grounds:

a. The PNP and the DILG, where the CHO belongs, are part of the nucleus of the inter-agency membership in the Dangerous Drugs Board and the drug rehabilitation program is one of the thrusts of the government’s anti-illegal drugs campaign. Being in the same inter-agency cooperation cluster, the PNP is not a third party. The legitimacy of the use of such data is inherent in the PNP’s function to collaborate with other government agencies to perform its duty. The collaboration and sharing of these data are essential in the government’s anti-illegal drugs campaign without further need for the PNP to justify the legitimacy of its purpose;

b. Section 4 (e) of the DPA excludes from its coverage information necessary in order to carry out functions of public authority. These cases must be likewise distinguished from those which are purely private matters and does not involve public interest; and

c. The information from the CHO is essential for the accurate inventory of these cases as compared to those already available at hand and information gathered will be exclusively used for a legitimate purpose only and nothing else.

We understand that the PNP is requesting for the following to be submitted:

Figure 1: Form requiring statistics

Figure 2: Form requiring personal data

You now come to the Commission to seek clarification on the following matters:

  1. Whether a data sharing agreement (DSA) between the CHO and PNP is needed;
  2. Whether the PNP is required to declare the purpose for requesting the data so that the CHO can determine if the data requested is proportional, material, and relevant to the purpose, and whether the CHO may, in the exercise of its judgment, refuse to disclose any requested medical/drug rehabilitation records if the purpose of the request is not clear or specific;
  3. On the premise that the data requested falls under the category of health information, whether there is a need to secure consent of the data subjects for data sharing; and
  4. Whether the consent of the data subjects is needed, with or without a DSA between the CHO and the PNP.

Discussion

Data sharing; data sharing agreement (DSA)

Data sharing is defined under NPC Circular No. 2020-03 as the sharing, disclosure, or transfer to a third party of personal data under the custody of a personal information controller to one or more other personal information controller/s.2

On the other hand, a data sharing agreement or DSA refers to a contract, joint issuance or any similar document which sets out the obligations, responsibilities and liabilities of the PICs involved in the transfer of personal data between or among them, including the implementation of adequate standards for data privacy and security and upholding the rights of the data subjects.3

We wish to clarify that the execution of a DSA under the latest NPC issuance is not mandatory:4

SECTION 8. Data sharing agreement; key considerations. — Data sharing may be covered by a data sharing agreement (DSA) or a similar document containing the terms and conditions of the sharing arrangement, including obligations to protect the personal data shared, the responsibilities of the parties, mechanisms through which data subjects may exercise their rights, among others.

The execution of a DSA is a sound recourse and demonstrates accountable personal data processing, as well as good faith in complying with the requirements of the DPA, its IRR, and issuances of the NPC. The Commission shall take this into account in case a complaint is filed pertaining to such data sharing and/or in the course of any investigation relating thereto, as well as in the conduct of compliance checks.

While the execution of a DSA is not mandatory, it is still advisable to execute one as it is a best practice and a demonstration of accountability amongst the parties to the data sharing. It is best to consult the respective data protection officers (DPOs) of the local government unit (LGU) and the PNP for a better understanding of the data sharing arrangement and whether the agencies should pursue the execution of a DSA.

We also wish to emphasize that the Circular clarified that data sharing may be based on any of the criteria for lawful processing of personal data in Sections 12 and 13 of the DPA5 and may also be allowed pursuant to Section 4 of the law which specifies the special cases.6 The Circular further provides that it does not prohibit or limit the sharing, disclosure, or transfer of personal data that is already authorized or required by law.7

In relation to the above, as sensitive personal information is required by the PNP based on the sample forms provided, the processing, which includes sharing, of the same may fall under any of the instances provided for in Section 13 of the DPA, one of which is when processing is provided for by existing laws and regulations.8

Adherence to general data privacy principles; legitimate purpose; proportionality; purpose limitation; statistics

Regardless of whether the CHO and the PNP executes a DSA, as personal information controllers (PICs), both must adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality in all personal data processing activities.

Specifically for legitimate purpose, this principle requires that the processing shall be limited to and compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy.9

In addition, the principle of proportionality requires that the processing shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose and that personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.10

Hence, it is incumbent upon the PNP to declare the specific purpose/s for requesting the data in accordance with Section 11 (a) of the DPA as appropriately cited by the CHO in its letter to the PNP.

It bears stressing that the blanket statement of the PNP that “The legitimacy of the use of such data is inherent in the PNP’s function to collaborate with other government agencies to perform its duty. The collaboration and sharing of these data are essential in the government’s anti-illegal drugs campaign without further need for the PNP to justify the legitimacy of its purpose;” does not conform with the requirements of purpose limitation under the DPA.

The PNP should identify the specific provisions of laws, rules, and regulations mandating it to process the personal data of drug surrenderers and communicate the same to the CHO.

We also note the statement from the PNP that “The information from the CHO is essential for the accurate inventory of these cases as compared to those already available at hand and information gathered will be exclusively used for a legitimate purpose only and nothing else.”

If the purpose is for ensuring accuracy of the inventory of cases, then the first form (see Figure 1) requiring statistics should already suffice. Collecting individual level data which includes sensitive personal information for this purpose may be deemed to be excessive and no longer relevant, suitable, or necessary as the statistics or aggregated data should be enough to meet the PNP’s requirements.

We reiterate our pronouncement in Advisory Opinion No. 2018-077 on the processing of personal data of vulnerable data subjects:

We underscore that the interpretation of any provision of the DPA must be in a manner mindful of the rights and interests of the data subject. Processing operations performed about vulnerable data subjects like minors, the mentally ill, asylum seekers, the elderly, patients, those involving criminal offenses, or in any other case where an imbalance exists in the relationship between a data subject and a personal information controller or personal information processor, require special protection.11

In this scenario, the involved data subjects are drug surrenderers. Clearly, there exists an imbalance between such data subjects and the LGU currently processing their personal data under the pertinent rehabilitation programs and/or the PNP requesting to have access to such personal data. A judicious assessment is necessary to determine if sharing and further processing of such personal data is reasonable and appropriate, taking into account existing laws and regulations applicable on the matter.

Section 4 (e); special cases

We wish to clarify that even if the PNP’s processing falls under Section 4 (e) as a special case, as the PNP Legal Service discussed in its letter to the CHO, this only means that the provisions on the lawful criteria for processing of personal data under Sections 12 and 13 of the DPA does not apply and the exemption from the requirements is only to the minimum extent necessary to achieve the specific purpose, function, or activity.12

Further, the PNP as a PIC is still subject to the other requirements under the DPA, its IRR, and issuances of the NPC, i.e., adhering to the general data privacy principles, upholding data subject rights, implementing appropriate and reasonable physical, organizational, and technical security measures for personal data protection, among others.

Generally, the processing of sensitive personal information is prohibited, unless such processing falls under the exceptions provided under Section 13. As mentioned above, Section 13 (b) recognizes the processing that is provided for by existing laws and regulations.13

In this instance, consent is not required for lawful processing as it is not the most appropriate lawful basis. PICs should choose the lawful basis that most closely reflects the true nature of the relationship with the data subject and the purpose of the processing.

In other words, the consent of the drug surrenderers is not required for the sharing of their personal data if such data sharing in anchored on laws, rules, and regulations mandating government agencies to share personal data.

It would be important to document the specific legal basis for the PNP to collect the personal data of the drug surrenderers who are presently undergoing drug rehabilitation and consider the discussion above on the sufficiency of statistics to be submitted in lieu of personal data, bearing in mind purpose limitation and data minimization requirements.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. National Privacy Commission, Data Sharing Agreements NPC Circular No. 2020-03, § 2 (F) (December 23, 2020). ↩

  3. Id. § 2 (G). ↩

  4. Id. § 8. ↩

  5. Id. § 6. ↩

  6. Id. § 7. ↩

  7. Id. § 6. ↩

  8. Data Privacy Act of 2012, § 13 (b). ↩

  9. See: Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (b) (2016). ↩

  10. Id. § 18 (c). ↩

  11. National Privacy Commission, NPC Advisory Opinion No. 2018-077 (Oct. 25, 2018), citing Data Privacy Act of 2012, § 38, National Privacy Commission, Registration of Data Processing Systems and Notifications Regarding Automated Decision-Making, Circular No. 17-01 [NPC Circular 17-01], § 5 (c) (3) (July 31, 2017), Article 29 Data Protection Working Party, Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679, Item III (B)(a)(7), 4 April 2017, available at http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=611236. ↩

  12. Rules and Regulations Implementing the Data Privacy Act of 2012, § 5. ↩

  13. Data Privacy Act of 2012, § 13 (b). ↩

Backlinks