Text
5 July 2022
Re: REQUEST FOR PERSONAL INFORMATION OF OFWs DEPLOYED IN THE MIDDLE EAST AND OTHER MUSLIM COUNTRIES
Dear [Redacted],
We respond to your request for an Advisory Opinion on the above matter.
You inform that the Hajj Attaché is an office attached to the National Commission on Muslim Filipinos (“NCMF”). As the current Hajj Attaché to the Kingdom of Saudi Arabia and the Philippine representative to the Office of the Islamic Conference, you have witnessed the abuses committed against Overseas Filipino Workers (“OFWs”).
To address these abuses expeditiously, you requested the Department of Foreign Affairs, Department of Labor and Employment, Overseas Workers Welfare Administration, and the Philippine Overseas Employment Administration (collectively, “Subject Departments”) for the contact details and personal information of all OFWs working in Muslim countries you deal with. It is your position that the NCMF is vested with the legitimate interest, the legal obligation, and the “public task” to obtain the requested data from the Subject Departments. However, you state that the Subject Departments are apprehensive about sharing with your office the OFWs’ personal data, citing possible violation of the Data Privacy Act of 2012 (“DPA”).
Consequently, you seek our opinion to support your request and justify the release of information by the Subject Departments.
Discussion
National Commission on Muslim Filipinos; Mandate
Under Republic Act (RA) 9997,1 the NCMF is mandated to preserve and develop the culture, tradition, institutions, and well-being of Muslim Filipinos, in conformity with the country’s laws and in consonance with national unity and development.
As mentioned throughout its enabling law, the NCMF’s powers and functions specifically pertain to Muslim Filipinos. However, your request to the Subject Departments states that what you are asking for is the personal information of all OFWs (i.e., Muslims and non-Muslims) in the Muslim countries within the jurisdiction of your office. It is our understanding that not all OFWs in these countries are Muslim Filipinos. Hence, the non-Muslim OFWs appear to be beyond the prescribed mandate of the NCMF. As presently worded, your request to the Subject Departments appears to encroach on their jurisdiction since the powers and mandate of the NCMF only pertain to Muslim Filipinos.
While the processing of the personal data of Muslim OFWs may fall within the mandate of the NCMF, said mandate appears to exclude the processing of the personal information of non-Muslim OFWs. Hence, there may be a need to secure the consent of non-Muslim OFWs prior to the collection and disclosure of their personal information to the NCMF.
It is worth noting further that Section 15 of RA 9997 explicitly provides for the extent of the functions of the Hajj Attaché:
Section 15. Hajj Attaché.— The President shall appoint a Hajj Attaché from among the three (3) recommendees of the Commission within fifteen (15) days from the submission of such recommendees by the Commission. The Hajj Attaché shall coordinate with the Ministry of Hajj of the Kingdom of Saudi Arabia on all matters pertaining to the conduct of the annual Hajj. He/She shall be an academic degree holder and must be able to write and speak fluently the Arabic language. He/She shall hold office in the Kingdom of Saudi Arabia and shall enjoy the same rank, salary, and privileges as those of Attachés of the national government. (Emphasis supplied.)
From the foregoing, we note that the authority of the Hajj Attaché is limited to all matters pertaining to the conduct of the annual Hajj to the Kingdom of Saudi Arabia. Thus, there may be a need to also determine whether the NCMF, through the Hajj Attaché, is the appropriate department to handle the above concerns or if it would be more legally sound to refer the concern to other agencies (i.e., the Subject Departments).
Scope; Lawful Basis for Processing Personal Information; Section 12; Legal Obligation; Legitimate Interest
The DPA applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing.2
As discussed above, if after judicious assessment it is determined that the mandate of the NCMF and/or the Hajj Attaché may cover the processing of personal data for the purpose of reaching out to distressed Muslim OFWs, their families, and relatives, then the processing of their personal data may be justified as will be discussed below.
The collection and disclosure of personal information3 of Muslim OFWs constitute processing.4 As applied to your present concern, Section 12 (c) and (e) of the DPA appears to be the most appropriate criteria for lawful processing by the NCMF, thus:
SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists: x x x
(c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;
(e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; xxx”
(Emphasis supplied).
Thus, the NCMF must justify to the Subject Departments that its processing falls within the ambit of the foregoing provisions. Thereafter, the Subject Departments may disclose such personal information to NCMF but subject to the general data privacy principles.5
On the other hand, if sensitive personal information is involved, NCMF’s processing thereof may be permitted under Section 13 (b) of the DPA, viz.:
SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases: x x x
(b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information; x x x
You cited in your letter Section 12 (f) of the DPA on legitimate interest as a possible basis for lawful processing of personal data:
(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.
5 Id. § 3 (g). 6 Id. § 3 (j). 7 Id. § 11.
It is a well-settled rule that the powers and functions of statutorily-created agencies, such as the NCMF, are measured and limited by the law creating them or granting them powers.6
Thus, while NCMF may rely on Section 12 (c), (e), and Section 13 (b) for the processing of personal data of Muslim OFWs, it cannot rely on legitimate interest as a criterion for the processing of the same. It has no such legitimate interest to go beyond its mandate. Any and all processing of personal information and sensitive personal information should be hinged on its legal mandate.
Adherence to the General Data Privacy Principles; Transparency; Proportionality; Privacy Notice
Section 11 of the DPA and Section 18 of its Implementing Rules and Regulations (“IRR”) provide that personal information controllers (“PICs”), such as the NCMF and the Subject Departments, are required to adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality.
The principle of transparency refers to the awareness of the data subjects about the nature, purpose, and extent of the processing of their personal information, including recipients of their personal data. Hence, the Subject Departments must first inform the Muslim OFWs that their personal information will be shared with the NCMF, as well as the nature, purpose, and extent of the processing. If the NCMF determines that its purpose can only be fulfilled by processing the personal information of Muslim OFWs, it should not collect personal information over and beyond that which is required to achieve the declared purpose.
On the other hand, the principle of proportionality requires that the NCMF should ascertain if its purpose cannot be fulfilled by any other less intrusive means.7 Hence, the NCMF should specifically state the type of personal information it needs from these agencies. The request for the “names, contact details, email addresses & other personal information of all Overseas Filipino Workers deployed in the Middle East” may be too broad and excessive and, therefore, violative of the principle of proportionality.
Finally, the principle of legitimate purpose provides that the processing of personal information should be compatible with a declared and specified purpose which is not contrary to law, morals, or public policy.
Lest we be misconstrued, allow us to emphasize that we share the very laudable objective of the Honorable Hajj Attaché to assist distressed OFWs. However, any processing of personal information should be in accordance with the DPA and other existing rules and regulations.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished to us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
Please be guided accordingly.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office
Footnotes
-
An Act Creating the National Commission on Muslim Filipinos Defining its Powers, Functions and Responsibilities and Appropriation Funds Therefor and for other purposes [National Commission on Muslim Filipinos Act of 2009], Republic Act No. 9997, § 4 (2009). ↩
-
Chavez v. National Housing Authority, 530 SCRA 235 (2007). ↩
-
E.g., posting in their website or other appropriate platforms the NCMF or Hajj Attaché’s contact details, address, updates, and announcements. ↩