NPC Issuance Wiki

NPC Advisory Opinion No. 2022-005 — Request for Names and Addresses of Vehicle Owners from the Land Transportation Office

Issued Advisory Opinion

Official opinion tags

Text

24 February 2022

RE: REQUEST FOR NAMES AND ADDRESSES OF VEHICLE OWNERS FROM THE LAND TRANSPORTATION OFFICE

Dear [Redacted],

We write in response to your inquiry received by the National Privacy Commission (NPC), endorsed by the Department of the Interior and Local Government (DILG), on the Land Transportation Office’s (LTO’s) denial of your request for the names and addresses of the owners of some allegedly noisy vehicles in a certain locality.

We understand that you filed an email complaint with the LTO on “nuisance due to noisy vehicles” in your village. Together with the email complaint, you requested for the names and addresses of the owners of the noisy vehicles for the filing “of formal/legal charges of damages due to the pain and sufferings from the emotional distress and mental anguish cause[d] by the noisy vehicles.”

We also understand that the LTO responded to your email complaint and stated that they already issued proper notices for the owners of the noisy vehicles “to show cause, as part of due process, their defense.” The LTO likewise denied your request, stating that the Data Privacy Act of 20121 (DPA) prohibits disclosure of personal information without consent.

Discussion

Criteria for lawful processing of personal information

The name and address of a vehicle owner are personal information, the processing of which is covered by the DPA. We wish to clarify that the LTO’s statement that the DPA prohibits them from disclosing personal information without consent is not entirely accurate.

Consent is not the only lawful basis for processing personal information. Section 12 of the DPA provides for the various criteria for lawful processing, to wit:

SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

(a) The data subject has given his or her consent; (b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract; (c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject; (d) The processing is necessary to protect vitally important interests of the data subject, including life and health; (e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or (f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.2

The LTO should determine whether the request for the disclosure of the information falls under any other criteria for lawful processing of personal information. We emphasize that consent will not always be the most appropriate lawful basis, considering the relationship of the personal information controller (PIC) with the data subject and purpose of the processing, among others.

Legitimate interests as lawful basis for processing personal information

We understand that the purpose for the request of the names and addresses of the motor vehicle owners is for the filing of a civil action for damages “due to the pain and sufferings from the emotional distress and mental anguish cause[d] by the noisy vehicles.” It is worthy to assess whether the purpose of the request falls under Section 12 (f) of the DPA which provides for legitimate interests as a lawful basis for the processing of personal information.

‘Legitimate interests’ is different from the other criteria for lawful processing of personal information as it is not centered around a specific purpose, nor is it processing that the individual has specifically agreed to – it can, in principle, apply to any type of processing for any reasonable purpose.3

Since processing based on legitimate interests can apply to a wide range of circumstances, there is a need to balance legitimate interests, the necessity of the processing and the rights of the individuals while taking into consideration the circumstances.4

Thus, in the determination of a legitimate interest, the personal information controller (PIC) must consider the following:

  1. Purpose test – The existence of a legitimate interest must be clearly established, including a determination of what the particular processing operation seeks to achieve;
  2. Necessity test – The processing of personal information must be necessary for the purpose of the legitimate interest pursued by the PIC or third party to whom personal information is disclosed, where such purpose could not be reasonably fulfilled by other means; and
  3. Balancing test – The fundamental rights and freedoms of data subjects must not be overridden by the legitimate interests of the PIC or third party, considering the likely impact of the processing on the data subjects.5

The LTO should have assessed the request based on the aforementioned tests considering the specific purpose declared in the request. As a PIC who holds a repository of personal and sensitive personal information, it is expected that it should have policies and processes in place to evaluate whether a request for information constitutes a legitimate interest of a requesting party, among other lawful bases for processing.

The processing of personal information for the filing of formal/legal charges for damages is a legitimate interest. An action for the recovery of damages is characterized as a civil action. A civil action is one by which a party sues another for the enforcement or protection of a right, or the prevention or redress of a wrong.6

While there is an existing administrative case initiated through the email complaint, it will not address the violation of the civil rights of a complainant. Thus, an administrative case does not preclude the filing of a civil action for damages.

The Commission, in BGM vs. IPP,7 had the occasion to explain that the protection of lawful rights and interests under Section 13 (f) of the DPA is considered as legitimate interest pursuant to Section 12 (f) of the DPA:

Based on the foregoing, the disclosure to be made by the Respondent of the information of the recipient of Complainant’s personal information, for purposes of identification of the person liable for the alleged fraud, sans the latter’s consent, is necessary for the protection of the lawful rights and interests of the Complainant as contemplated by Section 13 (f) of the DPA.

Although Section 13 (f) applies to sensitive personal information while the information involved in this case is just personal information, the protection of lawful rights and interests under Section 13 (f) by the Respondent is considered as legitimate interest pursuant to Section 12 (f) of the DPA. This section provides that it is lawful to process personal information if it is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.

By application in the instant case, Respondent may not be held liable for unauthorized processing should it disclose the requested information to Complainant as its disclosure would be in pursuance of the latter’s legitimate interest as the same cannot be fulfilled by other means.

It should be stressed, however, that having a legitimate purpose or some other lawful criteria to process does not result in the PIC granting all request to access by the data subjects. Such requests should be evaluated on a case to case basis and must always be subject to the PIC’s guidelines for the release of such information.

Thus, the processing of personal information for the establishment of legal claims is permitted under the DPA. “Establishment” may include activities to obtain evidence by lawful means for prospective court proceedings.

General data privacy principle; proportionality; accountability

While there may be lawful basis for your request, any disclosure of personal information should still be proportional to the stated purpose.

The principle of proportionality provides that “the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.”8

You are requesting LTO for the names and registered addresses of the owners of noisy vehicles you have identified through photographs of their plate numbers. The purpose of which is for the filing of “formal/legal charges of damages.” Since your request is only for the said information, LTO cannot provide more than that. The principle of proportionality necessitates that only the information requested and necessary for the purpose indicated should be processed.

While the letter request you sent to LTO is a mass request for information of several individuals, the request for each motor vehicle owners’ information should be treated as individual requests. To this effect, LTO must require further information from you, the requesting party, to ensure a comprehensive evaluation of whether to grant each request for information and decide on a case-by-case basis. You, on the other hand, must be able to provide sufficient information to support each of the requests. In Advisory Opinion 2022-003, we opined that additional information may be required by the granting party to ascertain the validity of the purpose for the request:

To satisfy the DOH on the legitimacy of the purpose of the request, it may opt to require the requestor to provide additional information on the case. But this requirement shall still adhere to the principle of proportionality, and whatever additional information received shall be used solely for the purpose of aiding the DOH in deciding whether to release the requested documents.

LTO must establish a system for handling these types of requests for information to avoid the possibility of abuse. As a request for personal information for the filing of a legal action falls under the legitimate interests of the requesting party, the system must assess the request if it satisfies the three aforementioned tests. It must also provide for a mechanism to ensure that the information to be disclosed will only be used for the purpose/s indicated.

In Advisory Opinion No. 2021-044, it was recommended that in case a request for personal information is granted, the requesting party should be required to sign an undertaking that the information will only be used for the purpose that was declared:

Should the CHMSC grant the request, it is suggested that the Requesting Party be required to sign an undertaking that the use of the documents will only be for the purpose of filing a complaint with the Ombudsman and that the proper disposal thereof is ensured if he does not push through with the filing of the complaint. Further, the undertaking must include a clause to the effect that the requestor acknowledges that he becomes a PIC by his receipt of the requested documents and therefore has the obligations of a PIC as prescribed under the DPA.

Thus, LTO should similarly require a requesting party to sign an undertaking that the information that will be acquired will only be used for the purpose which was declared and authorized.

Lastly, we wish to underscore that should the information be provided, its use is limited to the declared purpose of filing formal/legal charges by the concerned or affected individual who allegedly suffered damages. Thus, the sharing, posting or any publication of such information in any public-facing platform such as social media pages or your public Facebook group, “BF Resort Village People,” is prohibited. While you may coordinate your efforts in filing an action for damages through such platforms, you must do so in a way that will not result in the publication of the information that you might acquire from LTO.

We caution that should there be processing beyond the stated purpose, the same may be penalized under the appropriate provisions of the DPA, such as Unauthorized Processing of Personal Information, Processing of Personal Information for Unauthorized Purposes or Unauthorized Disclosure which carry penalties of “imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00)”,9 one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00),10 or “imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00)”,11 respectively.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC – Director IV, Privacy Policy Office

cc:

  • VIVIAN P. SUANSING, Director III/Officer-in-Charge, Bureau of Local Government Supervision, Department of the Interior and Local Government
  • ROBERTO A. VALERA, Deputy Director, Law Enforcement Service, Land Transportation Office
  • JO-ANN R. ALCID, Program Director; ATTY. VERNICE C. LIWAG-PRIETO, Detailed Public Attorney, Department of Justice Action Center

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. Data Privacy Act of 2012, § 12. ↩

  3. United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ [last accessed on 18 January 2022]. ↩

  4. Id. ↩

  5. See generally, Data Privacy Act of 2012, § 12 (f); United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ [last accessed on 18 January 2022]. ↩

  6. 1997 Rules of Procedure, as Amended, Rule 1, § 3 (a). ↩

  7. National Privacy Commission, BGM vs. IPP, NPC 19-653 (Dec. 17, 2020). ↩

  8. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 (2016), § 18 (c). ↩

  9. Data Privacy Act of 2012, § 25(a). ↩

  10. Id. § 28, par. 1. ↩

  11. Id. § 32. ↩

Backlinks