Text
21 September 2022
Re: CIVIL REGISTRY DOCUMENT REQUEST BY A PERSON OTHER THAN THE OWNER
Dear [Redacted],
We respond to your request for an Advisory Opinion on the Philippine Statistics Authority’s (PSA) denial of your request for a copy of another person’s civil registry documents on data privacy grounds.
You mentioned that you intend to process your deceased father’s Government Service Insurance System (GSIS) benefits. You submitted your deceased father’s Certificate of No Marriage (CENOMAR) which apparently lists two (2) marriages: the first to a Ms. [Redacted], and the second to your mother.
We understand that GSIS informed you that Ms. [Redacted] may be disqualified from claiming your deceased father’s benefits if you can submit Ms. [Redacted]‘s Death Certificate or her CENOMAR showing a subsequent marriage. Thus, you requested the PSA for a copy of Ms. [Redacted]‘s Death Certificate but was denied citing data privacy grounds.
You thus seek advice on your possible remedies to obtain the requested documents from the PSA. Further, you are also asking if you can file a complaint before the National Privacy Commission (NPC) in relation to PSA’s denial of your request for Ms. [Redacted]‘s civil registry documents.
Discussion
Sensitive personal information; lawful processing; establishment, exercise or defense of legal claims under Section 13(f)
A Death Certificate is an official document setting forth particulars relating to a deceased individual. It contains data such as (a) date and place of death, (b) full name, (c) age, (d) sex, (e) occupation or profession, (f) residence, (g) civil status, (h) nationality of the deceased, and (i) probable cause of death. Some of these items are sensitive personal information under the DPA.
The processing of sensitive personal information is generally prohibited under the DPA. However, the DPA provides for exceptions to this rule. Section 13 (f) of the DPA specifically recognizes processing for the establishment, exercise, or defense of legal claims, thus:
SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases: x x x
(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interest of natural or legal persons in court proceedings or the establishment, exercise, or defense of legal claims, or when provided to government or public authority.
In line with the DPA’s policy to protect the fundamental right of every individual to privacy, the PSA issued Memorandum Circular (MC) 2019-15 which provides for a list of people allowed to request for civil registry documents/certifications from the PSA, to wit:
The court or proper public official whenever absolutely necessary in administrative, judicial or other official or other proceedings to determine the identity of the person. Provided that there must be a duly issued subpoena duces tecum and ad testificandum for the production of the civil registry document.
Request from other government agencies pursuant to their mandate provided that the requesting government agency executed Data Sharing Agreement with PSA in accordance with NPC Circular 16-02.
Thus, the PSA is not totally precluded from providing a copy of the requested Death Certificate in the absence of the owner of the personal data or a next of kin.
However, PSA’s requirement that the request should be pursuant to a pending case and that there is a duly issued subpoena directing the release of the personal data requested unduly restricts the lawful basis to process under the DPA. Moreover, not all administrative agencies have the power to issue subpoenas.
PSA’s requirement is an erroneous interpretation of Section 13(f) of the DPA which was discussed in the case of BGM vs. IPP,1 citing NPC 17-018 dated 15 July 2019. The NPC ruled therein that “processing as necessary for the establishment of legal claims does not require an existing court proceeding”. Further, the very idea of “establishment … of legal claims” presupposes that there is still no pending case since a case will only be filed once the required legal claims have already been established. The NPC further ruled that:
The DPA should not be seen as curtailing the practice of law in litigation. Considering that it is almost impossible for Congress to determine beforehand what specific data is “necessary” or may or may not be collected by lawyers for purposes of building a case, applying the qualifier “necessary” to the second instance in Section 13(f) therefore, serves to limit the potentially broad concept of “establishment of legal claims” consistent with the general principles of legitimate purpose and proportionality
Therefore, PSA’s interpretation that lawful processing under Section 13 (f) requires the existence of an actual case should be reviewed and revised to properly conform to the DPA considering that it is intended to carry out the policy “to protect the fundamental right of every individual to privacy”.
In line with this, the NPC also stated in the BGM case that the protection of lawful rights and interests under Section 13(f) of the DPA is considered as legitimate interest pursuant to Section 12(f) of the law. Thus, the following tests may be considered by the PIC in deciding on a request pursuant to Section 13(f), viz:
- Purpose test – The existence of a legitimate interest must be clearly established, including a determination of what the particular processing operation seeks to achieve;
- Necessity test - The processing of personal information must be necessary for the purpose of the legitimate interest pursued by the PIC or third party to whom personal information is disclosed, where such purpose could not be reasonable fulfilled by other means; and
- Balancing test – The fundamental rights and freedoms of data subjects must not be overridden by the legitimate interst of the PIC or third party, considering the likely impact of the processing on data subjects.2
In this regard, we highlight that the appreciation of the facts and the evaluation of conditions for the release of documents under their control and custody fall primarily with the concerned agency as they are in the best position to apply their mandate.3
In other words, even if your request for processing is supported by a lawful criteria, it does not equate to the PIC granting a blanket authority for you to access personal information and/or sensitive personal information of the data subject. Your request would still be evaluated on a case-to-case basis and must always be subject to the PIC’s guidelines for the release of such information.4
Data Privacy Principle of Legitimate Purpose and Proportionality
We take this opportunity to harmonize the restrictions in the PSA’s (MC) 2019-15 vis-a-vis the recent issuances by the NPC. The grant by the PSA of access to personal data does not necessarily mean that the entire form or record requested will be disclosed. An issuance from the PSA either confirming or denying the marriage or death of the person subject of the record requested may be sufficient and aligned with the data privacy principle of proportionality.
On the other hand, the PSA also allows the disclosure of personal data through a request from another government agency pursuant to its mandate. Hence, you may want to explore the possibility of requesting GSIS to issue a formal request addressed to PSA in the confirmation of the death and/or status of marriage of Ms. [Redacted].
As to the filing of a complaint before the NPC, we suggest that you exhaust first the remedies discussed above. Although PSA’s reason for not disclosing the requested information is based on an erroneous interpretation of Section 13(f) of the DPA, the mere refusal to disclose information and/or relevant documents to a data subject is not punishable under the DPA. Also, a particular agency’s procedure for document requests must still be complied with even if access to the personal data has legitimate basis under the DPA.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
Please be guided accordingly.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office
Footnotes
-
National Privacy Commission, NPC 19-653 (17 December 2020) ↩
-
See generally, Data Privacy Act of 2012, § 12 (f); United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ [last accessed on 8 September 2022]. ↩
-
NPC Advisory Opinion 2019-037 (8 August 2019) ↩
-
Id. ↩