NPC Issuance Wiki

NPC Advisory Opinion No. 2023-005 — Barangay Inventory of Vaccinated Population

Issued Advisory Opinion

Official opinion tags

Text

17 January 2023

Re: BARANGAY INVENTORY OF VACCINATED POPULATION

Dear [Redacted],

We respond to the Department of the Interior and Local Government’s (DILG) request for an Advisory Opinion on the data privacy concerns regarding the proposed inventory system for the vaccinated population of barangays.

Discussion

We gather that DILG Memorandum Circular (MC) No. 2022-022 was issued pursuant to the pronouncement of President Rodrigo Roa Duterte to restrain the movement of unvaccinated individuals. DILG MC 2022-02 also directs all barangays to create an inventory of vaccinated individuals within their respective barangays, which entails the collection of names, birthdays, ages and vaccination status and details. The objective is to enable the barangays to determine the number of unvaccinated individuals and restrain their movement, except to access essential goods and services.

We further understand that copies of these inventories will be provided to the DILG’s City and Municipal Field Offices, while a statistical summary thereof will be submitted to the DILG Provincial and Regional Offices and the DILG Central Office. To facilitate ease and efficiency in the transfer, the DILG intends to develop an online inventory system which can be updated real time through which the barangays can upload the data collected. Summary of the same may be generated and integrated in DILG’s existing online systems, accessible to DILG officials and employees which shall then be used for policy formulation.

In view of the above, your office seeks guidance on the following:

1.) Whether the proposed online inventory system is feasible and in line with the Data Privacy Act of 20121 (DPA); 2.) On the privacy-related issues and concerns that may arise out of such system; and in this undertaking.

Sensitive Personal Information; Lawful Processing Regulatory Mandate

Under the DPA, the name of an individual is considered personal information. On the other hand, an individual’s age, date of birth and vaccination status (since it relates to health information), are all considered sensitive personal information.2

The DPA provides for instances on when the processing of personal information and sensitive personal information (collectively, personal data) are allowed. In particular, the DPA allows for the processing of personal information when the same is necessary for compliance with a legal obligation to which the personal information controller is subject.3 On the other hand, the processing of sensitive personal information is allowed when such processing is provided for by existing laws and regulations.4

Section 4.2 of DILG MC 2022-02 provides:

4.2 All Punong Barangays are hereby enjoined to:

4.2.1. Cause the preparation of a monthly inventory of vaccinated population in the barangay indicating their status, whether with first dose only, fully vaccinated (with two doses), or with booster dose already (see attached template). Accomplished monthly inventory form shall be in the custody of the barangay for monitoring purposes. a copy of the said report shall be submitted to the DILG Field Office for consolidation not later than the 10 th day of the ensuing month.

4.2.2. Closely monitor the mobility of persons yet to be vaccinated against COVID-19 and to advise them to stay at home to minimize the risk of COVID-19 transmission, provided that utmost respect for human rights is strictly adhered to.

As stated in the letter-request, DILG MC No. 2022-02 mandates Punong Barangays to create an inventory of the vaccinated population within their respective barangays. In turn, data collected will enable Punong Barangays to identify the unvaccinated individuals and closely monitor their mobility.

The processing of personal data by way of collection and inventory is, thus, in accordance with existing laws and regulations, specifically Section 16 of the Local Government Code and DILG MC No. 2022-02, which mandates the creation of an inventory of vaccinated population within their respective barangays.

Adherence to the Data Privacy Principles

Although there is lawful basis for the processing of personal data, the other requirements of the DPA must still be complied with to ensure the protection of personal data and uphold the rights of data subjects.

This means that the barangay, as a personal information controller (PIC), still has the responsibility to ensure that personal data is processed lawfully and fairly. In particular, there must be strict adherence with the basic privacy principles of transparency, proportionality, and legitimate purpose.

The principle of transparency mandated by the DPA dictates that the data subject must be aware of the nature, purpose, and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of a PIC, his or her rights as a data subject, and how these can be exercised. Any information and communication relating to the processing of personal data should be easy to access and understand, using clear and plain language.5

Thus, in line with the right to information of the data subject, PICs are required to apprise the data subject of the following:

  1. Description of the personal data to be processed; 2. Purposes for processing, including: direct marketing, profiling, or historical, statistical or scientific purpose; 3. Basis of processing, when processing is not based on the consent; 4. Scope and method of processing; 5. Recipient/classes of recipients to whom the personal data are or may be disclosed; 6. Methods utilized for automated access, if the same is allowed by the data subject, and the extent to which such access is authorized; 7. Identity and contact details of the PIC or its representative; 8. Retention period; and 9. Existence of rights as data subjects, the right to lodge a complaint before the NPC.6

Relative to the present concern, we note that the principle of proportionality requires that the processing of personal data shall be adequate, relevant, suitable, necessary and not excessive in relation to the declared and specified purpose.7 To comply with this data privacy principle, the Punong Barangay should only collect such personal data which will help in the implementation

of its mandate of identifying the unvaccinated population and eventually closely monitoring their mobility to prevent the further transmission of COVID-19.

Lastly, the data privacy principle of legitimate purpose, which states that processing of personal data shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy. In adherence to this data privacy principle, the barangays, as PICs should make sure that personal data to be collected from data subjects should only be used for the specific and identified purpose/s indicated in DILG MC No. 2022-02. We caution that should there be processing beyond the stated purpose, the same may be penalized under the appropriate provisions of the DPA, such as Unauthorized Processing of Personal Information, Processing of Personal Information for Unauthorized Purposes or Unauthorized Disclosure.8

As stated in your letter, personal data to be collected for the said purpose are names, birthdays, ages and vaccination status and details. We note that the Punong Barangay’s mandate may already be achieved through the collection of names and vaccination status and details. The collection of the birthday and age of an individual, on the other hand, appears excessive to the purpose of identifying the unvaccinated individuals, unless there are other justifications for the collection of the same.

Further, the respective barangays should also consider indicating a specific period in its inventory of vaccinated and unvaccinated individuals to ensure the accuracy of the information. This inventory should likewise be kept updated within the specified period in case some individuals may eventually get vaccinated and no longer be considered as unvaccinated individuals.

Reasonable and Appropriate Security Measures

The barangays, as PICs, should also responsible for the implementation of appropriate and reasonable physical, organizational and technical security measures to ensure the privacy of personal data. Under the DPA, implementation of these security measures shall aim to maintain the availability, integrity, and confidentiality of personal data and are intended for the protection of personal data against any accidental or unlawful destruction, alteration, and disclosure, as well as against any other unlawful processing. These measures shall be implemented to protect personal data against natural dangers such as accidental loss or destruction, and human dangers such as unlawful access, fraudulent misuse, unlawful destruction, alteration and contamination.9

In relation to the present concern, we suggest that both the DILG and the barangays implement applicable organizational security measures to limit system access to authorized personnel trained for the purpose of handling such personal data. This should also be made applicable to the other DILG offices to whom personal data may be transferred or transmitted to. In line with the implementation of physical security measures, barangays must ensure that the premises and the equipment which will store the data collected from the inventory are duly protected (e.g. offices are properly secured by locks and bolts). On the other hand, technical security measures refer to the means by which a personal information controller protects its electronic system from unlawful, unauthorized and accidental access. Since the inventory system may be accessed online, we recommend looking into the technical security measures specifically stated in NPC Circular 16-01 relating to online accessible systems, for guidance and application. You may access a copy of NPC Circular 16-01 at our website or you may click on this link: https://www.privacy.gov.ph/memorandum-circulars/npc-circular-16-01-security-of-personal- data-in-government-agencies/

The respective barangays may also take into further consideration the conduct of a privacy impact assessment (PIA) which shall, among others, assist the barangays in the identification, assessment, evaluation and management of the risks involved in the processing of personal data through the use of the online inventory system.10 For a more comprehensive discussion on the conduct of a PIA, you may refer to NPC Advisory No. 2017-03 available at https://www.privacy.gov.ph/wp-content/files/attachments/nwsltr/NPC_AdvisoryNo.2017- 03.pdf.

Statistical Data

You also mentioned in your letter that a statistical summary will be provided to the DILG Provincial and Regional Offices and the DILG Central Office, which shall then be used eventually for policy formulation.

We note that personal data collected for other purposes may be processed for, among others, statistical purposes.11 However, we emphasize that such further processing is to be strictly construed. Data must be purely statistical and free from any factors that will enable others to reasonably identify the individuals involved. Further, it must only be used strictly for policy formulation purposes only.

We further note that the barangays are still responsible for ensuring the privacy of the raw personal data from which the statistical summary may come from. This means that all personal data initially collected from the barangay’s constituents are still subject to the provisions and protection of the DPA. Therefore, even if only statistical data were submitted to the DILG, in which individuals may not be easily or reasonably identified, the raw data collected from the constituents, which remains in the barangay’s custody, should remain to be protected by appropriate security measures as mandated under the DPA. Further, the raw data remains subject to the compliance with the DPA. This means that if these raw data were to be used for any other purpose or activity other than those outlined in DILG MC 2022-02, the barangay may be subjected to possible findings of non-compliance or violations under the DPA.

Considering the foregoing discussions, the feasibility and compliance of the proposed online inventory system would depend largely on the observance by the barangays and the DILG of the requirements of the DPA, its IRR and other NPC issuances and the above recommendations in the processing of personal data pursuant to DILG MC 2022-02.

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

Please be guided accordingly.

Very truly yours,

(Sgd.) FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office

Footnotes

  1. Republic Act 10173. ↩

  2. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, § 3(g) & 3(l) (2012). ↩

  3. Data Privacy Act of 2012, § 12 (c). ↩

  4. Id. § 13 (b). ↩

  5. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18(a) (2016). ↩

  6. Id. § 11 (d). ↩

  7. Data Privacy Act of 2012, § 11 (d). ↩

  8. See: National Privacy Commission, NPC Advisory Opinion No. 2022-005 (24 February 2022). ↩

  9. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 25 (2016). ↩

  10. NPC Advisory No. 2017-03. ↩

  11. Data Privacy Act of 2012, § 11 (f). ↩

Backlinks

  • No backlinks found