NPC Issuance Wiki

NPC Advisory Opinion No. 2021-044 — Disclosure of Academic Records in Support of Administrative and Criminal Complaints

Issued Advisory Opinion

Official opinion tags

Text

29 December 2021

Re: DISCLOSURE OF ACADEMIC RECORDS IN SUPPORT OF ADMINISTRATIVE AND CRIMINAL COMPLAINTS

Dear [Redacted],

We write in response to your request for an Advisory Opinion received by the National Privacy Commission (NPC or Commission) regarding the release of certain academic records by Carlos Hilado Memorial State College (CHMSC) in relation to the filing of an administrative case and criminal complaint before the Ombudsman against a faculty member.

In your letter, it states that a certain faculty member of the CHMSC (“Requesting Party”) requested copies of the academic records of another CHMSC faculty member (“Data Subject”).

These academic records were to be used as evidence in support of a complaint the Requesting Party filed against the Data Subject with CHMSC and as evidence in filing a criminal case before the Office of the Ombudsman. The Requesting Party specifically asked for the following:

  1. Official Transcript of Records for Master of Arts in Education Major in Educational Management issued by CHSMC;
  2. Official Transcript of Records for Doctor of Philosophy in Educational Management issued by another specified university;
  3. Certification from the Office of the Registrar that the Data Subject has not completed the requirements for the MA degree as of his date of graduation and the actual date of completion;
  4. Certification from Dean of College of Education of CHSMC for the Data Subject’s submission of his hardbound thesis; and
  5. Approval Sheet page of the thesis of the Data Subject submitted to the Graduate School of CHSMC.

We understand that the Requesting Party is questioning the authenticity of the signature in the Approval Sheet of the thesis as well as the regularity in the issuance of Official Transcript of Records by CHMSC.

Finally, we understand that the Requesting Party in his letter-request cited multiple provisions of the Data Privacy Act of 20121 (DPA) as justification for the disclosure of the requested academic records, specifically Sections 4, 11, and 12 of the DPA.

Discussion

Special Cases; Information About Government Officers or Employees; Information About an Individual’s Education; Sensitive Personal Information

The Requesting Party cited Section 4 of the DPA regarding information about an individual working for the government as justification for the release of the academic records. Section 4 of the DPA provides for its scope and the special cases in which the law may not be applicable.

Section 4 (a) of the DPA, as expounded in Section 5 (a) (1) of the Implementing Rules and Regulations2 (IRR) of the DPA states that:

Section 5. Special Cases. The Act and these Rules shall not apply to the following specified information, only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned:

a. Information processed for purpose of allowing public access to information that fall within matters of public concern, pertaining to:

  1. Information about any individual who is or was an officer or employee of government that relates to his or her position or functions, including:

a) The fact that the individual is or was an officer or employee of the government; b) The title, office address, and office telephone number of the individual; c) The classification, salary range, and responsibilities of the position held by the individual; and d) The name of the individual on a document he or she prepared in the course of his or her employment with the government;

xxx

Provided, that the non-applicability of the Act or these Rules do not extend to personal information controllers or personal information processors, who remain subject to the requirements of implementing security measures for personal data protection: Provided further, that the processing of the information provided in the preceding paragraphs shall be exempted from the requirements of the Act only to the minimum extent necessary to achieve the specific purpose, function, or activity.3

The exclusion of the above information from the scope of the law is limited to the minimum extent of collection, access, use, disclosure or other processing necessary to achieve the specific purpose, function or activity concerned. Specifically, access to such information pertaining to government officials or employees is recognized to the extent that the same will uphold the right to information on matters of public concern.

Nevertheless, the exemption does not extend to personal information controllers (PICs) or personal information processors (PIPs), who remain subject to the requirements of implementing security measures for personal data protection.4

In this instance, the requested information relates to the Data Subject’s position or functions in CHMSC, particularly as his academic records form part of his qualifications as a member of CHMSC faculty. This falls squarely under Section 5 of the DPA’s IRR which may warrant the grant of the request, but only to the minimum extent necessary to achieve the specific purpose of the Requesting Party.

Filing of Complaint Before the Office of the Ombudsman; Section 13(f)

In addition, we note that aside from the administrative complaint before the CHMSC, another purpose of the request is to support a complaint before the Office of the Ombudsman. This processing of sensitive personal information of the Data Subject for the complaint before the Office of the Ombudsman may also find basis under Section 13 of the DPA.

Specifically, Section 13 (f) recognizes the processing which concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.5

The criterion “necessary for the establishment of legal claims,” was interpreted by the Commission in the case of BGM vs. IPP6 citing the case of NPC 17-018, to wit:

The DPA should not be seen as curtailing the practice of law in litigation. Considering that it is almost impossible for Congress to determine beforehand what specific data is “necessary” or may or may not be collected by lawyers for purposes of building a case, applying the qualifier “necessary” to the second instance in Section 13(f) therefore, serves to limit the potentially broad concept of “establishment of legal claims” consistent with the general principles of legitimate purpose and proportionality.

As regards legitimate purpose, the Implementing Rules and Regulations (IRR) of the Data Privacy Act provides that the processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy. This means that the processing done for the establishment of a legal claim should not in any manner be outside the limitations provided by law. The DPA is neither a tool to prevent the discovery of a crime nor a means to hinder legitimate proceedings.

In determining whether a request based on the aforementioned provision should be granted, the legitimacy of the purpose and the proportionality of the request shall be taken into consideration. In this instance, we note that the request indicates a specific set of documents and declares a clearly defined purpose.

Considering as well that there is a pending complaint before CHMSC involving the same matter, CHMSC should have enough information to be able to make a proper determination on both the legitimacy and proportionality of the request.

Should the CHMSC grant the request, it is suggested that the Requesting Party be required to sign an undertaking that the use of the documents will only be for the purpose of filing a complaint with the Ombudsman and that the proper disposal thereof is ensured if he does not push through with the filing of the complaint. Further, the undertaking must include a clause to the effect that the requestor acknowledges that he becomes a PIC by his receipt of the requested documents and therefore has the obligations of a PIC as prescribed under the DPA.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission and for other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 (2016). ↩

  3. Id. § 5 (a). ↩

  4. National Privacy Commission, NPC Advisory Opinion No. 2017-056 (Sept. 20, 2017) citing the Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 5 (2016). ↩

  5. Data Privacy Act of 2012, § 13 (f). ↩

  6. National Privacy Commission, NPC 19-653 (Dec. 17, 2020) ↩

Backlinks