Text
27 February 2023
Re: DATA SHARING AGREEMENT WITH A SPECIALIZED AGENCY OF THE UNITED NATIONS
Dear [Redacted],
We respond to your request for an advisory opinion on the proposed data sharing agreement (DSA) between the Department of Agriculture (DA) and the Food and Agriculture Organization (FAO).
You state that the DA is currently collaborating with the FAO for the establishment of the Rice Competitiveness Enhancement Fund – Impact Monitoring System (RCEF-IMS). The FAO is a specialized agency of the United Nations (UN) for food, nutrition, agriculture, fisheries, and forestry. Its mandate is to achieve food security for all and plays a role in interventions that support people and communities living in rural areas and those whose livelihood depend on natural resources.
One of the deliverables under the collaboration involves the integration of the components’ databases and reporting platforms for seamless sharing. Since the DA maintains the Registry System for Basic Sectors in Agriculture (RBSA), which is an electronic database of basic information of farmers, farm laborers, fishermen, and target beneficiaries of agriculture-related program and services of the government, the collaboration would necessarily involve the disclosure to the FAO of confidential information about the program and the personal data of the program beneficiaries.
In its desire to comply with R.A. 10173, or the Data Privacy Act of 2012 (DPA),1 and relevant issuances of the National Privacy Commission (NPC), the DA proposed to FAO that they execute a Data Sharing Agreement (DSA). Unfortunately, the FAO refused invoking their status as a Specialized Agency of the UN System which subscribes to the privileges and immunities under public international law and relevant treaties, including the immunity from all legal processes. The FAO posits that since the DSA is grounded on Philippine law, the execution thereof would equate to a waiver of its immunities.
The DA, on the other hand, recognizes its obligation to comply with the security requirements in the protection of personal data within its control under Section 22 of the DPA. Since the FAO will gain access to confidential information and personal data, including sensitive personal information of program beneficiaries, there must be a DSA to lay down the obligations and responsibilities of the parties in handling personal data.
As a middle ground, and to preserve the FAO’s immunities and privileges, the DA proposed the execution of an Undertaking where the FAO will pledge to investigate and impose disciplinary action for confidentiality violations and report any incident of data breach to the DA in case of violation of Philippine data privacy laws. In support of the proposed Undertaking, the DA cited Section 6 of the DPA on the extraterritorial application of the law. FAO denied the proposal and maintained that it cannot be subject to or apply Philippine laws as it will be inconsistent with FAO’s neutral character and its legal status under international law and regulations and policies that have been adopted by the Member States of the UN. Despite such stance, the FAO committed to investigate and, if appropriate, impose disciplinary action on the sole basis of their internal rules and not pursuant to the DPA or any other Philippine law. Such commitment, however, was not formalized through a written document.
Considering the opposing position of the parties, you seek guidance on the following:
- Whether the extra-territorial application of the DPA has material application to the situation at hand;
- Whether the execution of a DSA or an Undertaking citing data privacy laws of the Philippines shall be tantamount to waiver of immunities and privileges of the FAO; and
- Whether the execution of a DSA or an Undertaking detailing the responsibilities and obligations of the FAO, based solely on the FAO’s internal rules, and without invoking any data privacy laws of the Philippines, shall be sufficient compliance for data protection as required by the DPA.
Discussion
Scope of the DPA; Extraterritorial Application
Section 6 of the DPA provides:
SEC. 6. Extraterritorial Application. – This Act applies to an act done or practice engaged in and outside of the Philippines by an entity if:
(a) The act, practice or processing relates to personal information about a Philippine citizen or a resident;
(b) The entity has a link with the Philippines, and the entity is processing personal information in the Philippines or even if the processing is outside the Philippines as long as it is about Philippine citizens or residents such as, but not limited to, the following:
(1) A contract is entered in the Philippines; (2) A juridical entity unincorporated in the Philippines but has central management and control in the country; and (3) An entity that has a branch, agency, office or subsidiary in the Philippines and the parent or affiliate of the Philippine entity has access to personal information; and
(c) The entity has other links in the Philippines such as, but not limited to: (1) The entity carries on business in the Philippines; and (2) The personal information was collected or held by an entity in the Philippines.
Applying the above provisions to the current situation, the extraterritorial application of the DPA applies because the personal data involved in the sharing is that of the beneficiaries who are Philippine citizens.
While we recognize the immunity and privileges accorded to the FAO pursuant to the United Nations and Convention on the Privileges and Immunities of the Specialized Agencies of the United Nations (Convention),2 such privilege does not equate to a blanket exemption from compliance with Philippine law including the DPA. The Supreme Court held in Khosrow Minucher v. Court of Appeals,3 that: ”… the privilege is not an immunity from the observance of the law of the territorial sovereign or from ensuing legal liability; it is, rather, an immunity from the exercise of territorial jurisdiction.” As such, the provisions of the DPA shall apply to the proposed sharing of the personal data between the DA and FAO.
DSA Not Mandatory; Compliance With the Provisions of the DPA
Under Section 21 (a) of the DPA, a personal information controller (PIC) is accountable for complying with the requirements of the law and shall use contractual or other reasonable means to provide a comparable level of protection while the personal data are being processed by a third party.4
The NPC previously issued NPC Circular No. 2016-02 which makes it mandatory for government agencies to execute a Data Sharing Agreement when sharing personal data to a third party. This was superseded by NPC Circular No. 2020-03,5 which provides:
SECTION 8. Data sharing agreement; key considerations. — Data sharing may be covered by a data sharing agreement (DSA) or a similar document containing the terms and conditions of the sharing arrangement, including obligations to protect the personal data shared, the responsibilities of the parties, mechanisms through which data subjects may exercise their rights, among others.
The execution of a DSA is a sound recourse and demonstrates accountable personal data processing, as well as good faith in complying with the requirements of the DPA, its IRR, and issuances of the NPC. The NPC shall take this into account in case a complaint is filed pertaining to such data sharing and/or in the course of any investigation relating thereto, as well as in the conduct of compliance checks.
(Underscoring supplied).
Thus, pursuant to NPC Circular No. 2020-03, the execution of a DSA is no longer mandatory but is considered as a best practice and a demonstration of accountability by the PIC in relation to data sharing.
In the present case, the DA has other recourses besides the execution of a DSA to ensure that it is compliant with the DPA. Section 21 (a) of the DPA does not restrict the PIC with the use of contracts to protect the personal data transferred to a third party because it also allows “other reasonable means.”
We understand that the personal data that will be shared with the FAO is under the control and custody of the DA. As the entity ultimately accountable under the DPA, the DA may opt to propose provisions relating to data sharing in the form of a policy or any similar written document. What may be included in this policy are documentation on the legitimate purpose of the data sharing with the FAO as well as the terms, conditions, and limitations of the sharing. Security measures for the protection of personal data to be shared and other details relevant to the data sharing may also be included as additional provisions. This policy may be presented to the FAO without its consent which is not an essential element in the determination of possible violations under the DPA anyway. In issuing a policy instead of insisting on the execution of a DSA, the DA is able to demonstrate accountability over the protection of the personal data subject of the data sharing.
We emphasize that the execution of a DSA does not necessarily equate to compliance with the DPA but it is only a portion of the obligations the PIC under the DPA.
Execution of Undertaking Not Based on DPA; Waiver of Immunity
We understand that the DA proposed the execution of an Undertaking detailing the responsibilities and obligations of the FAO based solely on the FAO’s internal rules, and without invoking any data privacy laws of the Philippines. As discussed above, the DA does not need to resort to contractual agreements in order to protect the personal data it shares to FAO.
As to whether the execution of the DSA by the FAO amounts to a waiver of its immunity and privileges, we hesitate to render an opinion on this issue as the NPC’s jurisdiction is limited to the interpretation of the DPA and data privacy matters. Since that issue relates to the interpretation of international laws and its territorial application, the NPC may not be the proper authority to render a determination thereon.
Adherence to Doctrine of Immunity; Recourse in Case of Violation by Specialized Agency
In Lasco v. United Nations Revolving Fund for Natural Resources Exploration,6 the Supreme Court held:
As a matter of state policy as expressed in the Constitution, the Philippine Government adopts the generally accepted principles of international law. Being a member of the United Nations and a party to the Convention on the Privileges and Immunities of the Specialized Agencies of the United Nations, the Philippine Government adheres to the doctrine of immunity granted to the United Nations and its specialized agencies.
We note that in the exercise of its quasi-judicial functions, the NPC is bound to give due deference to diplomatic immunity. Subject to exemptions found in the Convention and jurisprudence, diplomatic immunity shall prevail should a scenario arise where the FAO or its members violate the DPA in relation to the data sharing.
We understand that there may be an apprehension on the part of the DA in terms of accountability in case the FAO is found liable for violating the DPA. If that happens, the NPC shall determine after investigation and hearing the liable party in cases of violations of the DPA. If the FAO is found to be liable for violating the DPA in relation to the data sharing but invokes its immunity, this does not make the DA automatically liable just because the other party may not be sued or prosecuted.
In any case, there still exists a recourse against an erring Specialized Agency. According to the Lasco case:
This is not to say that petitioners have no recourse. Section 31 of the Convention on the Privileges and Immunities of the Specialized Agencies of the United Nations states that “each specialized agency shall make a provision for appropriate modes of settlement of: (a) disputes arising out of contracts or other disputes of private character to which the specialized agency is a party.
Sections 29 and 30 of Article VIII of the Convention also provides:
SECTION 29. The United Nations shall make provisions for appropriate modes of settlement of:
(a) Disputes arising out of contracts or other disputes of a private law character to which the United Nations is a party;
(b) Disputes involving any official of the United Nations who by reason of his official position enjoys immunity, if immunity has not been waived by the Secretary-General.
SECTION 30. All differences arising out of the interpretation or application of the present convention shall be referred to the International Court of Justice, unless in any case it is agreed by the parties to have recourse to another mode of settlement. If a difference arises between the United Nations on the one hand and a Member on the other hand, a request shall be made for an advisory opinion on any legal question involved in accordance with Article 96 of the Charter and Article 65 of the Statute of the Court. The opinion given by the Court shall be accepted as decisive by the parties.
Please be advised that this Advisory Opinion was rendered based solely on the information you provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
Please be guided accordingly.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN, IV Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
United Nations, Convention on the Privileges and Immunities of the United Nations (February 13, 1946). ↩
-
Khosrow Minucher v. Court of Appeals, G.R. No. 142396, [February 11, 2003]. ↩
-
National Privacy Commission, NPC Circular No. 2020-03 on Data Sharing Agreements [NPC Circular No. 2020-03] (23 December 2020). ↩
-
Lasco v. United Nations Revolving Fund for Natural Resources Exploration, G.R. Nos. 109095-109107, [February 23, 1995]. ↩