Text
17 January 2023
Re: DISCLOSURE OF CONDOMINIUM UNIT OWNERS’ PERSONAL DATA AND RELATED DOCUMENTS.
Dear [Redacted],
We respond to your request for an Advisory Opinion on whether your client may compel the condominium developer and the Register of Deeds to disclose the following information without violating the Data Privacy Act of 2012 (DPA):
Discussion
1.) Condominium Certificate of Title (CCT) numbers, purchase agreements by the condominium developer to the condominium corporation; 2.) Traceback of CCT numbers from the Register of Deeds; and 3.) Delinquent unit owners by posting via bulletin board and elevator notice their unit numbers and the amount due by a condominium corporation.
You state in your letter that The Infinity is a condominium developed by Nuvoland Philippines, Inc. (NPI). Your client, The Infinity Condominium Corporation (TICC), is the condominium corporation in charge of managing the affairs of The Infinity by virtue of a Deed of Conveyance between NPI and TICC.
Conflict arose when the unit owners/tenants of The Infinity defaulted on their payments of association dues and other assessments. You further stated that TICC is currently facing difficulties in the collection and enforcement of payments from the delinquent unit owners since their whereabouts are unknown to TICC since the owners’ information previously shared by NPI are incomplete or outdated.
To enforce the collection of dues and other assessments, TICC requested the Deeds of Sale and/or Reservation Agreements of the Unit Owners and CCT numbers from NPI. The request was denied on the reasoning that the consent of the unit owners is required before the request may be granted. NPI suggested to request the said documents directly from the unit owners. As an alternative course of action, TICC requested from the Register of Deeds of Taguig City the CCT numbers of the condominium units of The Infinity, but such request was also denied on the ground of data privacy.
You now ask if the NPI and the Register of Deeds’ denial of TICC’s requests are in order.
Personal Information; Sensitive Personal Information; Lawful Processing
The DPA applies to the processing of all types of personal information and sensitive personal information (collectively, personal data), and to any natural or juridical person involved in the processing of personal data.1 Clearly, the scope of the DPA is limited only to the processing of personal data or data relating to natural persons or individuals. Data relating to juridical entities such as corporation name, address, etc., falls outside the scope of the DPA.
Documents such as CCTs, purchase agreements and tracebacks of CCTs, by themselves, are not automatically considered personal data. However, such documents may contain personal data such as name, address, marital status, and citizenship, among others. If the registered owner/s are natural persons, then the processing of those documents fall within the scope of the DPA. However, if the subject property is registered to a juridical person, then processing of the same does not fall within the ambit of the DPA.
We emphasize that CCT numbers, although distinct and unique, do not identify the registered owner of the property or any specific individual for that matter. Instead, the CCT number is issued to identify the property, not the individual. Hence, CCT numbers by themselves are not considered personal information. Accordingly, it also cannot be considered as sensitive personal information since under Section 3 (l)(3) of the DPA, government-issued numbers should be peculiar to an individual which is not the case with CCT numbers.
However, we note that CCT numbers can only be regarded as personal information if the actual certificate of title, in its entirety, is considered. This is the only time that a CCT number can be correlated with the name of the registered owner, a natural person, and therefore, indirectly identify such person. Under this context, the lawful processing of personal information shall have basis under Section 12 (f) of the DPA:
“SECTION 12. Criteria for Lawful processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:
(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed. Except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.”
The disclosure of the requested documents and CCT numbers are necessary in order for TICC to establish its legal claims for unpaid dues and other assessments against the unit owners concerned.
Given the current scenario, Section 13(f) of the DPA may be applicable:
“SECTION 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:
(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural and legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority “(underscoring supplied)
The wording of Section 13(f) of the DPA is interpreted to mean that a court order or an existing court proceeding is not required for this lawful basis to apply. NPC was able to clarify this in the case of BGM v. IPP2:
“In the case of NPC 17-018 dated 15 July 2019, this Commission held that “processing as necessary for the establishment of legal claims” does not require an existing court proceeding. To require a court proceeding for the application of Section 13(f) to this instance would not only be to disregard the distinction provided in the law but the clear letter of the law as well. After all, the very idea of “establishment … of legal claims” presupposes that there is still no pending case since a case will only be filed once the required legal claims have already been established.”
This Commission in the same case went on further and held that: The DPA should not be seen as curtailing the practice of law in litigation. Considering that it is almost impossible for Congress to determine beforehand what specific data is “necessary” or may or may not be collected by lawyers for purposes of building a case, applying the qualifier “necessary” to the second instance in Section 13(f) therefore, serves to limit the potentially broad concept of “establishment of legal claims” consistent with the general principles of legitimate purpose and proportionality. As regards legitimate purpose, the Implementing Rules and Regulations (IRR) of the Data Privacy Act provides that the processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy. This means that the processing done for the establishment of a legal claim should not in any manner be outside the limitations provided by law. The DPA is neither a tool to prevent the discovery of a crime nor a means to hinder legitimate proceedings.” (underscoring supplied)
https://www.privacy.gov.ph/wp-content/uploads/2021/02/NPC-19-653-BGM-vs-IPP-Decision-FINAL-Pseudonymized-21Dec2020.pdf (last accessed 9 July 2021).
In the same case, the Commission had the occasion to explain that the protection of lawful rights and interests under Section 13 (f) of the DPA is considered as legitimate interest pursuant to Section 12 (f) of the DPA:
“Based on the foregoing, the disclosure to be made by the Respondent of the information of the recipient of Complainant’s personal information, for purposes of identification of the person liable for the alleged fraud, sans the latter’s consent, is necessary for the protection of the lawful rights and interests of the Complainant as contemplated by Section 13 (f) of the DPA.
Although Section 13 (f) applies to sensitive personal information while the information involved in this case is just personal information, the protection of lawful rights and interests under Section 13 (f) by the Respondent is considered as legitimate interest pursuant to Section 12 (f) of the DPA. This section provides that it is lawful to process personal information if it is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.
By application in the instant case, Respondent may not be held liable for unauthorized processing should it disclose the requested information to Complainant as its disclosure would be in pursuance of the latter’s legitimate interest as the same cannot be fulfilled by other means.
It should be stressed, however, that having a legitimate purpose or some other lawful criteria to process does not result in the PIC granting all request to access by the data subjects. Such requests should be evaluated on a case to case basis and must always be subject to the PIC’s guidelines for the release of such information.
(Underscoring supplied)”
TICC is tasked to manage the affairs of The Infinity which includes the collection of dues and assess delinquent unit owners. Such act, along with any other enforcement actions that TICC may have against the delinquent unit owners, may be considered as an establishment or exercise of a legal claim under Section 13(f) of the DPA. As explained above, a court order or a pending court proceeding is not required. With this, the requested documents may be lawfully disclosed to TICC, subject to the respective internal policies and rules of NPI and the Register of Deeds on disclosure (e.g., verification of identity, required documents). However, we wish to emphasize that NPI and the Register of Deeds should establish a system to ensure that the requested information shall be limited only for the legitimate interests stated by the requesting party, and not be subject to abuse. As we stated in Advisory Opinion No. 2022-05:3
“LTO must establish a system for handling these types of requests for information to avoid the possibility of abuse. As a request for personal information for the filing of a legal action falls under the legitimate interests of the requesting party, the system must assess the request if it satisfies the three aforementioned tests. It must also provide for a mechanism to ensure that the information to be disclosed will only be used for the purpose/s indicated. In Advisory Opinion No. 2021-044, it was recommended that in case a request for personal information is granted, the requesting party should be required to sign an undertaking that the information will only be used for the purpose
that was declared: Should the CHMSC grant the request, it is suggested that the Requesting Party be required to sign an undertaking that the use of the documents will only be for the purpose of filing a complaint with the Ombudsman and that the proper disposal thereof is ensured if he does not push through with the filing of the complaint. Further, the undertaking must include a clause to the effect that the requestor acknowledges that he becomes a PIC by his receipt of the requested documents and therefore has the obligations of a PIC as prescribed under the DPA. Thus, LTO should similarly require a requesting party to sign an undertaking that the information that will be acquired will only be used for the purpose which was declared and authorized.”
Further, we note that documents such as Deeds of Sale and Reservation Agreements may contain information which may not be relevant to TICC’s claims. The principle of proportionality provides that “the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.”4 The principle of proportionality necessitates that only the information requested and necessary for the purpose indicated should be processed. With this, NPI may opt to conceal or redact such information that are not relevant to TICC’s claims upon the documents’ disclosure to TICC.
Contractual Obligation; Adherence to the Data Privacy Principles; Proportionality
Condominium unit numbers are considered personal information under the DPA since it can directly and certainly identify the identity of the unit owner when put together with other information.5 Hence, the processing or posting thereof in public spaces within the condominium must comply with the requirements of Section 12 of the DPA.
We understand that TICC is contemplating on posting and/or publishing in public spaces within the condominium building the unit numbers and corresponding amounts due from the delinquent owners. While we recognize that Section 6 of the TICC By-Laws allows TICC to file an adverse claim for delinquent units,6 this does not equate to a legal obligation contemplated under Section 12 (c) of the DPA. When a PIC claims lawful processing on the basis of a legal obligation, the burden is on the PIC to show that all that is required by that particular lawful criterion is present. A PIC must be able to prove that the legal obligation it cites as basis exists and applies to the processing it performed, and that the processing is necessary to comply with the legal obligation.7
Instead, Section 12 (b) of the DPA on contractual obligation may be considered as a more appropriate lawful basis, to wit:
SECTION 12. Criteria for Lawful Processing of Personal Information – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:
xxx
(b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract.
In your letter, you stated that the Amended Master Deed provides that an owner, upon acceptance of the unit or the execution of the Deed of Absolute Sale, whichever comes first, automatically becomes a member of the Condominium Association and agrees to pay to TICC the owner’s pro-rata share in the expenses of The Infinity. This creates a contractual obligation contemplated by Section 12 (b) of the DPA on the part of the unit owner and may allow for the lawful processing of personal information.
However, we note that although there is lawful basis for the processing of personal information, the other requirements of the DPA must still be complied with to ensure the protection of personal data and uphold the rights of data subjects.
This means that TICC, as a personal information controller, still has the responsibility to ensure that personal data is processed lawfully and fairly. There must be strict adherence with the basic privacy principles of transparency, proportionality, and legitimate purpose.
We emphasize the principle of proportionality which requires that the processing of personal data shall be adequate, relevant, suitable, necessary and not excessive in relation to the declared and specified purpose.8 In this regard, TICC should only disclose such personal data which will help in the achievement of its responsibility as condominium corporation to collect the dues and assessments from the delinquent owners. Further, TICC should consider less intrusive means of identifying and/or notifying the unit owners. As stated in an NPC Decision bearing similar circumstances:
“The PIC should only process as much information as is proportional or necessary to achieve its clearly defined and stated purposes. In this case, it is the collection of unpaid dues provided under a valid contract with its unit owners. While it is necessary to process the delinquent unit owners’ personal information in order to assess and collect payments pursuant to a contract, the processing in the form of issuing the letter was neither necessary nor proportional. The purpose of the letter was not for the collection of delinquent dues. Rather, the evidence on record shows that DSL disclosed Complainants’ personal information as delinquent unit owners to cast doubt on their capability to manage the affairs of the condominium corporation in light of the recently held election of the Board of Directors.”9
In the current scenario, publication/posting of unit numbers in public spaces within the condominium may be too intrusive for the declared purpose and may not even be a guarantee that such posting/publication will lead TICC to the unit owner.
On the other hand, the posting/publication must only be considered as a last resort if there is absolutely no way for TICC to get hold of the requested information and documents. In such instance, the processing of personal information must still adhere to the proportionality principle wherein TICC must only disclose such personal information that is adequate and necessary for the declared purpose, which is the collection of unpaid dues.
We would like to emphasize that, as a regulator, the National Privacy Commission (NPC) does not issue a “legal confirmation.” The NPC’s Advisory Opinions do not serve to confirm the legal opinions/positions of its stakeholders. Should a stakeholder already have an opinion or decision regarding its processing activities, the “confirmation” of NPC is not required nor given. Instead, NPC’s Advisory Opinions provide guidance on the interpretation of the DPA, its IRR and other issuances of the NPC.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
Please be guided accordingly.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, § 4 (2012). ↩
-
National Privacy Commission, BGM v. IPP NPC 19-653 (Dec. 17, 2020), available at https://www.privacy.gov.ph/wp-content/uploads/2021/02/NPC-19-653-BGM-vs-IPP-Decision-FINAL-Pseudonymized-21Dec2020.pdf (last accessed 9 July 2021). ↩
-
NPC Advisory Opinion No. 2022-05, 24 February 2022. ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 (2016), § 18 (c). ↩
-
Section 6 of the TICC By-Laws, as provided in the letter request of Duran & Duran-Schulze Law. ↩
-
NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, and NPC 21-015, 03 February 2022, page 7. ↩
-
NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, and NPC 21-015, 03 February 2022, page 8. ↩