Text
20 September 2022
Re: DATA SUBJECT RIGHTS IN THE PHILIPPINE IDENTIFICATION SYSTEM
Dear [Redacted],
We respond to your email inquiry on the rights of a data subject in relation to the Philippine Identification System (PhilSys) and the provisions of R.A. No. 10173, also known as the Data Privacy Act of 2012 (DPA).1
We understand that the Feedback and Grievance Division (FGD) of the PhilSys Registry Office (PRO) relayed to the Philippine Statistics Authority (PSA) Legal Service that a certain PhilSys registered person requested the deletion of his/her personal data. At the time of your inquiry, the PSA Legal Service has yet to confirm if the registered person was already issued a PhilSys Number (PSN) or PhilSys Card Number (PCN).
As context to your inquiry, you provided two scenarios. The first scenario is that the registered person is already registered in the PhilSys but has not been issued a PSN or PCN. In this scenario, you opine that the registered person has the right to withdraw consent as it is one of the rights of a data subject, and corollary thereto, the registered person has the right to request for the deletion of his/her personal data. In which case, it is your position that the registered person must execute a written request to the PRO’s Data Protection Officer (DPO) stating the request for deletion is in the exercise of his/her right to erasure under the DPA. In relation to deletion, you opine that if the PRO resolves to anonymize the data then the DPO may validly deny the request for deletion of the registrant considering that anonymized data is not considered personal data.
The second scenario is that the registered person has already been issued a PSN or PCN. It is your opinion that since the PSN or PCN has already been issued, the registered person’s right to erasure has already ceased. The most that the registered person can do is to request for the deactivation of her PSN or PCN pursuant to the Implementing Rules and Regulations of R.A. No. 11055.
We further understand that in two separate instances, the NPC confirmed that the processing of information under Republic Act (RA) 110552 is not based on consent. You further mentioned that in an online training conducted by an NPC representative, it was clarified that if consent is not the basis of processing, then there is nothing to withdraw.
You now ask whether a registered person is not entitled to withdraw consent as well as erase or delete his/her personal data since the processing is based on law and not consent, with no distinction as to whether the registrant has already been issued PSN/PCN.
Discussion
Right to Object, When Applicable; Processing Based on Law
The DPA sets the limits of personal data processing, including the lawful bases of processing and the rights of the data subjects.
Involved in this inquiry are two (2) data subject’s rights: 1) the right to object; and 2) right to erasure or blocking. The “right to withdraw consent” you mentioned, stems from the data subject’s right to object as provided by Section 16 (e) of the DPA3 and expounded further by Section 34 (b) of the Implementing Rules and Regulations of the Data Privacy Act of 2012 (IRR),4 which respectively state:
SEC. 16. Rights of the Data Subject. – The data subject is entitled to:
xxx
(e) Suspend, withdraw or order the blocking, removal or destruction of his/her personal information from the personal information controller’s filing system upon discovery and substantial proof that the personal information are incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes or are no longer necessary for the purposes for which they were collected.
Section 34. Rights of the Data Subject. The data subject is entitled to the following rights:
xxx
b. Right to object. The data subject shall have the right to object to the processing of his/her personal data, including processing for direct marketing, automated processing or profiling. The data subject shall also be notified and given an opportunity to withhold consent to the processing in case of changes or any amendment to the information supplied or declared to the data subject in the preceding paragraph.
When a data subject objects or withholds consent, the personal information controller shall no longer process the personal data, unless:
- The personal data is needed pursuant to a subpoena;
- The collection and processing are for obvious purposes, including, when it is necessary for the performance of or in relation to a contract or service to which the data subject is a party, or when necessary or desirable in the context of an employer-employee relationship between the collector and the data subject; or
- The information is being collected and processed as a result of a legal obligation.5
As with any other data subject right, the right to object to the processing of his/her personal data or to withdraw consent are not absolute and must be exercised within the parameters stated under the law. To see whether the right to object or withdraw consent will apply, another aspect to consider is the lawful basis of processing of personal data under the PhilSys.
It has been the National Privacy Commission’s (NPC) stand that RA 11055 that provides the basis for the processing of personal data of Filipinos and resident aliens under the PhilSys. Section 9 of the R.A. No. 11055 which provides: ”… every citizen or resident alien shall register personally…,” embodies the legal obligation of Filipino citizens and resident aliens to register under the PhilSys thereby necessitating the processing of their personal data. In connection to such requirement, Section 8 of RA 11055 lists the mandatory demographic and biometric information to be collected from registered persons.
Since it is the law and not consent that is the basis for processing under the PhilSys, the right to withdraw consent by the data subject does not apply. There is no consent to speak of since the registration to PhilSys is a legal obligation imposed upon every citizen or resident alien. To be clear, both the right to object and the right to withdraw consent do not apply in any of the scenarios mentioned above.
Right to Erasure or Blocking Under the PhilSys
On the other hand, the right to erasure or blocking has its own limitations as well. Section 34 (e) of the DPA’s IRR enumerates the instances when the right to erasure may be exercised:
Section 34. Rights of the Data Subject. The data subject is entitled to the following rights:
xxx
e. Right to Erasure or Blocking. The data subject shall have the right to suspend, withdraw or order the blocking, removal or destruction of his/her personal data from the personal information controller’s filing system.
This right may be exercised upon discovery and substantial proof of any of the following:
(a) The personal data is incomplete, outdated, false, or unlawfully obtained; (b) The personal data is being used for purpose not authorized by the data subject; (c) The personal data is no longer necessary for the purposes for which they were collected; (d) The data subject withdraws consent or objects to the processing, and there is no other legal ground or overriding legitimate interest for the processing; (e) The personal data concerns private information that is prejudicial to data subject, unless justified by freedom of speech, of expression, or of the press or otherwise authorized; (f) The processing is unlawful; (g) The personal information controller or personal information processor violated the rights of the data subject.
xxx
However, R.A. 11055 and its Revised IRR do not provide for grounds for deletion or erasure of the registered person’s PSN/PCN or their personal data. Instead, it provides for grounds for deactivation of the PSN, viz.:6
Section 9. Deactivation of PSN
A. The PSN shall be deactivated on the following grounds:
- loss of Filipino citizenship;
- loss of resident alien status;
- failure to submit to initial biometric capture at age five (5) for persons who were registered at age four (4) and below;
- failure to submit to biometric capturing at age 15 for persons who were registered at age 14 and below;
- death of the registered person; and
- upon the request of the registered person.
B. After due process, the PSA may deactivate the PSN on the following grounds:
- presentation of false or fictitious supporting document/s during registration or during application for change of entries;
- misrepresentation in any form during and after registration in the PhilSys; and
- fraudulent application of biometric exception.
We emphasize that deactivation is not equivalent to deletion in the system. RA 11055 is silent on the provision for deletion. Likewise, the law and its Revised IRR do not make the distinction on instances when an individual has or has not been issued a PSN or PCN. Thus, in the absence of express provisions in the law allowing for deletion in the system, the right to erasure, or to demand for absolute deletion from the PhilSys, is not applicable to registered persons in the PhilSys.
Finally, we take this opportunity to discuss your position that if the PRO resolves to anonymize the data, the DPO may then validly deny the request for deletion of the registrant considering that anonymized data is not considered personal data. We respectfully submit that the same misapplies the concept of anonymization.
In Advisory Opinion No. 2018-068, the Commission discussed anonymization at length, viz:
Information is anonymous when such information “does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.”
We note also that ISO/IEC 29100 defines anonymization as a process by which personally identifiable information (PII) is irreversibly altered in such a way that a PII principal can no longer be identified directly or indirectly, either by the PII controller alone or in collaboration with any other party.
Any information is considered anonymized if there is no possible means to identify the data subject, that is, the PIC and/or any other person are incapable of singling out an individual in a data set, from connecting two records within a data set (or between two separate data sets) and from any information in such dataset.
However, removing some identifiers, such as patient and physician names, contact information, and location, may not be enough to ensure that the PIC and/or any other person can no longer identify the data subject. Anonymization may necessitate additional measures to guarantee that the anonymity of the information is irreversible.7
In addition, anonymization, like any other processing activity, should be carried out with a legitimate purpose that is clear and specified. In this case, anonymization may not utilized for the purpose of denying the deletion request.
The NPC, as the implementing agency tasked to regulate the processing of personal data, must harmonize the DPA’s provisions with other laws and regulations.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
Please be guided accordingly.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office