NPC Issuance Wiki

NPC Advisory Opinion No. 2022-009 — Publication of Former Employees’ Names and Severance From Employment

Issued Advisory Opinion

Official opinion tags

Text

2 March 2022

Re: PUBLICATION OF FORMER EMPLOYEES’ NAMES AND SEVERANCE FROM EMPLOYMENT

Dear [Redacted],

We write in response to your request for an advisory opinion received by the National Privacy Commission (NPC or the Commission) on whether publishing former employees’ names and the fact of severance of their employment would violate the Data Privacy Act of 20121 (DPA).

From your letter, we understand that your company, a banking institution, experienced isolated cases wherein the bank’s former employees had misrepresented to existing clients (e.g., branch clients) that they were still authorized to transact on the bank’s behalf. Those former employees would solicit deposits from these clients, sell bank products to extort money or do fraudulent acts such as asking clients to transfer money to their accounts which they would misappropriate for themselves.

We understand further that to curtail these incidents and to protect the interest of the bank and its clients, it is suggested that there be a publication or dissemination of a statement limited to the former employee’s name and his/her severance from employment with the bank through channels of general circulation like newsletters, bank website, official social media account and or within the bank branches or premises.

You now come to the Commission for guidance on the following inquiries:

  1. Whether the publication of employee names and the fact of severance of employment would be lawful under Section 12 (f) of the DPA; and

  2. Whether it would be lawful for the bank as an alternative measure to notify its clients privately and directly, through bank authorized modes of communication, of the severance of employment of such former employee.

Discussion

Public Disclosure of Cessation of Employment; Section 12 (f); Legitimate Interest; Fraud Prevention

The DPA recognizes the processing of personal and sensitive personal information (collectively, personal data), provided the requirements of the law are complied with and subject to the adherence of the data privacy principles of transparency, legitimate purpose, and proportionality.2

Under the DPA, the names of the employee and the fact that they are no longer employed are classified as personal information, the processing of which may be based on any of the lawful bases under Section 12. Specifically in this instance, Section 12 (f) of the DPA provides that the processing of personal information is allowed if the same is necessary for the purpose of the legitimate interests pursued by the personal information controller (PIC) or by a third party:

SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists: x x x

(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.

In the determination of legitimate interest, the following must be considered:3

  1. Purpose test – The existence of a legitimate interest must be clearly established, including a determination of what the particular processing operation seeks to achieve;
  2. Necessity test – The processing of personal information must be necessary for the purpose of the legitimate interest pursued by the PIC or third party to whom personal information is disclosed, where such purpose could not be reasonably fulfilled by other means; and
  3. Balancing test – The fundamental rights and freedoms of data subjects must not be overridden by the legitimate interests of the PIC or third party, considering the likely impact of the processing on the data subjects.

Indeed, legitimate interest as a ground for lawful processing of personal information is a flexible concept that may be applicable in certain instances where processing will not have unwarranted impacts on the rights and freedoms of data subjects.4

We note as well that although the DPA does not particularly identify matters to be considered in the PIC’s determination of its legitimate interests, the EU General Data Protection Regulation (GDPR), the successor of the EU Data Protection Directive (Directive 95/46/EC) which highly influenced the DPA, provides guidance whereby the processing of personal information strictly necessary for fraud prevention purposes constitutes a legitimate interest.5

In this instance, the PIC must establish that the disclosure of personal information will strictly be for the resolution of previously committed frauds and the prevention of potential frauds. Further, the PIC must ensure that only personal information which are necessary and proportionate to the declared legitimate interest may be processed, considering the rights and freedoms of the data subjects.

In any case, PICs that consider relying on this basis should undergo a legitimate interest assessment using the tests as guidance and document the outcome of the assessment. This gives data subjects some guarantee that this criterion for processing will not be misused.6

General Data Privacy Principles; Proportionality

While there may be a lawful basis for the publication of personal information such as employee names and the fact of severance from employment with the bank (i.e., “This person is no longer connected with the bank.”), the DPA mandates that the principle of proportionality should still be adhered to. Hence, disclosing the name and the fact that the employee is no longer employed with the bank is sufficient to meet the stated purpose. Any other information beyond that may be considered disproportional.

This principle requires that the processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. These qualifiers serve as the measures by which a determination can be made on whether processing is proportional and justified in relation to the declared purpose. Further, this principle requires that personal data shall only be processed if the purpose of the processing could not reasonably be fulfilled by other means.

Given that the bank has determined an alternative measure of notifying its clients individually through bank authorized modes of communication, this option should also be taken into account in its assessment of whether public disclosure or publication is proportional.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. Data Privacy Act of 2012, § 11. ↩

  3. See: National Privacy Commission, Advisory Opinion Nos. 2022-002 (Feb. 11, 2022), 2021-10 (March 22, 2021) and 2020-50 (Nov. 26, 2020) citing Data Privacy Act of 2012, § 12 (f) and United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ ↩

  4. See: National Privacy Commission, Advisory Opinion Nos. 2022-002 (Feb. 11, 2022) citing Article 29 Data Protection Working Party, Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC, Adopted on 9 April 2014, available at https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf ↩

  5. See: National Privacy Commission, Advisory Opinion No. 2020-050 (Nov. 26, 2020) citing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) Official Journal of the European Union, Vol. L119, Recital 47 (2016). ↩

  6. Id. ↩

Backlinks