Text
11 November 2022
Re: Disclosure of Students’ Personal Data For Case Build-up Purposes
Dear [Redacted],
We respond to your request for an Advisory Opinion on whether the University of the Philippines Diliman (University) may disclose its students’ personal data in connection with an “on-going case build-up” preparatory to the filing of a case for violation of Republic Act No. 11053 or the Anti-Hazing Act of 2018.1
As you have narrated, a lawyer wrote the University’s Office of the Vice Chancellor for Student Affairs asking for a list of the subject fraternity’s: 1) alleged current members, 2) student and alumni members, and 3) new recruits. The following specific information pertaining to the listed individuals were also requested:
- Full name;
- Address;
- Phone number and/or email address;
- Enrolment, course, degree, and campus; and
- For new recruits, in addition to the above, their parents’ name, addresses, phone number and/or email address.
The lawyer’s request for the forgoing is purportedly intended for a case build-up, and to invite or summon potential witnesses and/or co-complainants or co-plaintiffs.
You are thus concerned if the disclosure of such information is in line with the Data Privacy Act of 2012 (DPA).2
Discussion
Information requested are personal information and sensitive personal information
The requested information are classified as personal information and sensitive personal information (collectively, personal data) under the DPA.
Specifically, names and contact details (addresses, phone numbers, and email addresses) of the students and their parents are considered as personal information under the DPA. On the other hand, the requested information on enrolment, course, degree, and campus may be considered as sensitive personal information since it pertains to an individual’s education.
Lawful basis for processing under Section 13; establishment of legal claims
The disclosure of personal and sensitive information is considered as processing under the DPA. Consequently, the same should be based on the most appropriate lawful criterion for processing under Sections 12 and 13, respectively.
In the present case, the avowed purpose for the request for information is to build-up a case and invite or summon potential witnesses and/or co-complainants for the filing of a case for violation of the Anti-Hazing Act of 2018.
For the sensitive personal information requested, the disclosure may find basis under Section 13 (f), viz.:
SECTION 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases: x x x
(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.3 (emphasis supplied)
The term “establishment” may include activities to obtain evidence by lawful means for prospective court proceedings.4
On the other hand, the disclosure of personal information may be justified as falling under legitimate interest criterion in Section 12 (f):
SECTION 12. Criteria for Lawful Processing of Personal Information. The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists: x x x
(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution. (emphasis supplied)
In the case of BGM vs. IPP,5 the Commission articulated that the protection of lawful rights and interests under Section 13(f) is considered as legitimate interest pursuant to Section 12(f):
Although Section 13(f) applies to sensitive personal information, the protection of lawful rights and interests under Section 13(f) by the Respondent is considered as legitimate interest pursuant to Section 12(f) of the DPA. This section provides that it is lawful to process personal information if it is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.
By application in the instant case, Respondent may not be held liable for unauthorized processing should it disclose the requested information to Complainant as its disclosure would be in pursuance of the latter’s legitimate interest as the same cannot be fulfilled by other means.
Thus, the disclosure of the requested personal data for the declared purpose finds support under the DPA. We emphasize that the DPA is neither a tool to prevent the discovery of a crime nor a means to hinder legitimate proceedings.6
Proportionality of processing; necessity of personal data requested vis-à-vis the specified and declared purposes
Nonetheless, utmost consideration must also be given to the general data privacy principle of proportionality. The University should evaluate whether the personal data requested is relevant and is not excessive to the purpose. Note that while the law may allow processing when there is a lawful basis for the same, the processing of personal data remains to be subject to the proportionality principle which requires that the processing shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.7
As such, the University should determine whether to disclose all requested information taking into consideration the information stated in the request letter and its necessity and relevance to the declared purposes.
Should the University deem it proper to grant the request, it is recommended that the requesting party be made to sign an undertaking that the use of the requested information will only be for the purpose for which it is requested (i.e., filing a complaint for violation of the Anti-Hazing Act of 2018). Further, the proper disposal of such personal data should be ensured should the parties decide not to pursue the filing of the case. Likewise, the undertaking must include a clause to the effect that the requesting party acknowledges that he or she becomes a personal information controller (PIC) upon receipt of the requested documents and, therefore, is bound to observe the obligations of a PIC under the DPA.8
Lastly, should the information be provided, its use should be limited to the declared purpose of filing formal/legal charges by the concerned or affected individual who allegedly suffered damages. Thus, the sharing, posting or any publication of such information in any public-facing platform such as social media pages or public groups is prohibited. We caution that should there be processing beyond the stated purpose, the same may be penalized under the appropriate provisions of the DPA, such as Unauthorized Processing of Personal Information, Processing of Personal Information for Unauthorized Purposes or Unauthorized Disclosure.9
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
Please be guided accordingly.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office
Footnotes
-
An Act Prohibiting Hazing and Regulating Other Forms of Initiation Rites of Fraternities, Sororities, and Other Organizations, and Providing Penalties for Violations thereof, Amending for the Purpose Republic Act No. 8049, Entitled “An Act Regulating Hazing and Other Forms of Initiation Rites in Fraternities, Sororities, and Organizations and Providing Penalties therefor [Anti-Hazing Act of 2018], Republic Act No. 11053 (2018). ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
National Privacy Commission, NPC Advisory Opinion No. 2021-36 (Sept. 23, 2021) citing National Privacy Commission, NPC 19-653 (Dec. 17, 2020). ↩
-
National Privacy Commission, NPC 19-653 (17 December 2020). ↩
-
National Privacy Commission, NPC Case No. 17-018 (15 July 2019). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (c) (2016). ↩
-
National Privacy Commission, NPC Advisory Opinion No. 2021-044 (29 December 2021). ↩
-
See: National Privacy Commission, NPC Advisory Opinion No. 2022-005 (24 February 2022). ↩