Text

14 October 2022

Re: PUBLICATION OF INFORMATION OF LIST OF WHOLESALE ELECTRICITY SPOT MARKET (WESM) MEMBERS AND RETAIL CUSTOMER INFORMATION UNDER RETAIL COMPETITION AND OPEN ACCESS (RCOA) AND GREEN ENERGY OPTION PROGRAM (GEOP).

Dear [Redacted],

We respond to your request for an Advisory Opinion on the Independent Electricity Market Operator of the Philippines, Inc.’s (IEMOP) data privacy concerns regarding the publication of: 1) the names of Wholesale Electricity Spot Market (WESM) members; and, 2) the names of registration applicants and the retail or contestable customers registered in the Retail Competition and Open Access (RCOA), also known as retail electricity market.

Discussion

We understand that IEMOP made this inquiry as the Market Operator of WESM and the Central Registration Body (CRB) of the RCOA and Green Energy Option Program (GEOP). IEMOP cites our Advisory Opinion No. 2020-052,1 which dealt with the Energy Regulatory Commission’s (ERC) publication of contestable customers. IEMOP’s position is that it is similarly situated to the ERC since it is also obligated by law and regulation to publish the names of WESM participants and the RCOA contestable customers. Incidentally, the RCOA contestable customers are the same contestable customers subject of the said Advisory Opinion.

We further understand that in accordance with several Department of Energy (DOE) issuances, the following are published by IEMOP on its website:

Information OwnerInformation
WESM Participants1. Participant name (Name of corporation, partnership or individual)
2. Short name (short name designated by IEMOP for the participant)
3. Region (Luzon, Visayas or Mindanao)
4. Category (Generator, Private Distribution Utility, Electric Cooperative, Bulk User/Directly Connected Customer, Ancillary Service Provider, Wholesale Metering Service Provider)
5. Membership (Direct Member or Indirect Member)
6. Resource (facility name; name of power plant, if a generator)
7. Effectivity date of registration (date in which membership has become effective)
8. Registration Status (Registered, Deregistered or Ceased)
Contestable Customers (RCOA/CREM)1. Participant name (Name of corporation, partnership or individual)
2. Short name (short name designated by IEMOP for the participant)
3. Region (Luzon, Visayas or Mindanao)
4. Category (Contestable Customer, Retail Electricity Supplier, Local Retail Electricity Supplier, Supplier of Last Resort, Retail Metering Service Provider)
5. Membership (Direct Member or Indirect Member; Registered with CRB only)
6. Effectivity date of registration (date in which membership has become effective)
7. Registration Status (Registered, Deregistered or Ceased)
WESM Applicants1. Applicant name (Name of corporation, partnership or individual)
2. Short name (short name designated by IEMOP for the applicant)
3. Region (Luzon, Visayas or Mindanao)
4. Category applied for (Generator, Private Distribution Utility, Electric Cooperative, Bulk User/Directly Connected Customer, Ancillary Service Provider, Wholesale Metering Service Provider)
5. Membership type applied for (Direct Member or Indirect Member)
6. Resource (facility name; name of power plant, if a generator)
7. Application Type (New registration or additional facility)
8. Status (For completion)

Furthermore, we understand that WESM members and applicants may be juridical entities or individual persons. Currently, however, the registered members are all juridical entities. In addition, contestable customers may likewise be juridical entities or individuals who are operating as sole proprietorships.

Thus, you seek guidance on the following:

  1. Whether IEMOP may publish the names of WESM members and names of applicants for WESM registration by virtue of the WESM Rules promulgated by the DOE pursuant to Republic Act No. 9136, otherwise known as the Electric Power Industry Reform Act (EPIRA); and

  2. Whether IEMOP may publish the names of retail or contestable customers that are registered to participate in the Retail Competition and Open Access (RCOA) or the retail electricity market on the basis of The Retail Market Manual on Disclosure and Confidentiality of Retail Customer Information (Retail Manual - DCRCI) likewise promulgated by the DOE.

Section 3 of the EPIRA defines the responsibilities of the various government agencies and private entities in relation to the electric power industry. The WESM and the RCOA are part of the electric market industry framework.

Pursuant to DOE Department Circular No. DC2018-01-0002,2 IEMOP was established to be the independent market operator of the WESM. Thus, it is evident that IEMOP is obligated to comply with the EPIRA and is regulated by the DOE through applicable issuances.

Under the WESM Rules promulgated by the DOE, IEMOP is required to publish the following:

a) A list of registered WESM members, including the names and categories in which they are registered; and b) A list of applicants for WESM registration, including the name of the applicant and the status of its application.3

On the other hand, the Retail Manual on Disclosure and Confidentiality of Retail Customer Information (Retail Manual – DCRCI)4 designates the IEMOP to be the Central Registration Body that is required to publish “Retail Customer Information” of contestable customers, including their names and short names.5

The abovementioned information published by IEMOP is based on the non-confidential information enumerated in Clause 5.4 of the Retail Manual – DCRCI, which are:

  1. Service address of the registered facility
  2. Contact details
  3. Supply details a. incumbent supplier b. past supplier/s c. duration of supply contract d. names of counterparties
  4. Details contained in the ERC’s Certificates of Contestability, as applicable.

The Data Privacy Act of 20126 (DPA) governs the processing of personal data. Under the DPA, the processing of personal data shall only be allowed under certain conditions provided in Sections 12 and 13 depending on whether the information involved is classified as personal information or sensitive personal information.

In this regard, we reiterate the discussion in Advisory Opinion No. 2020-052 where we stated that information on juridical entities is outside the scope of the DPA. Thus, the publication of WESM members or applicants for registration and contestable customers in the RCOA that are juridical entities may be done in accordance with applicable laws, rules, and regulations without violating the DPA.

We also discussed in Advisory Opinion No. 2020-052 that the publication of personal information of an individual or a sole proprietorship who may qualify as a WESM member or as a contestable customer is allowed subject to Section 12 of the DPA, thus:

In the event where the contestable customer is an individual or a sole proprietorship whose name and generic location would be subject to publication, Section 12 of the DPA states that that the processing of personal information shall be permitted if necessary for compliance with a legal obligation to which the personal information controller is subject or when necessary in order to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate.

In this instance, the ERC may cite the pertinent provisions of the Electric Power Industry Reform Act of 2001 (EPIRA) and/or other applicable laws and regulations to justify the publication of names and generic locations of individuals identified as qualified contestable customers as a legal obligation of the ERC and/or part of the fulfillment of its mandate.

Under the DPA, the processing of personal data is allowed when it is necessary for compliance with a legal obligation. In RLA v. PLDT Enterprise,7 the National Privacy Commission (NPC) discussed the elements that should exist for valid processing based on a legal obligation: “(1) if the legal obligation the PIC cites as lawful criteria exists and applies to the PIC; (2) if the processing that the PIC performs is necessary to comply with the legal obligation; and (3) if all the conditions imposed by the legal obligation for the processing of the personal information have been complied with.”7

A survey of the relevant DOE regulations cited clearly show that the IEMOP has a legal obligation to publish the information provided above. As such, as long as the elements mentioned above are complied with, IEMOP can publish the names of WESM members and the names of applicants for WESM registration, by virtue of the WESM Rules. Similarly, the names of retail or contestable customers that are registered to participate in the RCOA may also be published on the basis of the Retail Manual – DCRCI.

Nevertheless, IEMOP, as a PIC, is still mandated to adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality. It also has the obligation to implement reasonable and appropriate organizational, physical, and technical security measures for protection of personal data, and ensure that it processes information in a manner that upholds the data privacy rights of its data subjects.

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

Please be guided accordingly.

Very truly yours,

(Sgd.) FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office

Footnotes

  1. National Privacy Commission, NPC Advisory Opinion No. 2020-052 (20 November 2020). ↩

  2. Department of Energy, Department Circular No. DC-2018-01-002, “Adopting Policies for the Effective and Efficient Transition to the Independent Market Operator for the Wholesale Electricity Spot Market” (17 January 2018). ↩

  3. Wholesale Electricity Spot Market Rules (WSEM Rule), available at https://www.wesm.ph/downloads/download/TWFya2V0IFJlcG9ydHM=/MTkyMg== (last accessed 10 June 2022). ↩

  4. Promulgated by the DOE through Department Circular Nos. DC2013-07-0014, DC2021-06-005, and DC2021-06-0012. ↩

  5. Ibid. ↩

  6. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  7. National Privacy Commission, RLA v. PLDT Enterprise [NPC Resolution No. 2018-010] (10 December 2021). ↩ ↩2