Text
17 March 2023
Re: REQUEST FOR INFORMATION FROM LABOR UNIONS
Dear [Redacted],
We respond to your request for an Advisory Opinion on whether the refusal of an employer to grant a labor union’s request for access to documents is proper.
Discussion
You state that you represent the National Federation of Labor (NFL) which is a federation of labor unions with a nationwide membership. NFL actively helps its member-unions in negotiating collective bargaining agreements (CBAs) with employers among other advocacies for the rights and welfare of employees. For NFL to effectively negotiate CBAs, its member-unions need financial information from their respective employers. Presently, you mentioned that some of your member-unions sought financial information from their employers who are either hospitals or educational institutions. The information sought include financial statements, balance sheets, enrollment data, and patient/customer data.
For the private hospital unions, they also requested for documents relative to the distribution and amounts of Special Risk Allowance (SRA), Meals and Transportation Allowance (MAT), Health Emergency Allowance (HEA) and One COVID-19 Allowance (OCA) pursuant to Republic Act (R.A.) No. 11469 or the Bayanihan Heal As One Act and R.A. No. 11494, or the Bayanihan to Recover As One Act. The private hospitals, however, refuse to divulge such information citing the Data Privacy Act of 2012 (DPA). For the same reason, private educational institutions have also refused to furnish data on employees, enrollment and “other income sources”, which are usually used as basis for collective bargaining negotiations, pursuant to R.A. No. 6728 or the Government Assistance to Students and Teachers in Private Education Act.
You thus ask whether the abovementioned employers may legally refuse to divulge the requested information citing the DPA.
Scope of the DPA; Nature of Financial Documents
The DPA applies to the processing of all types of personal information and sensitive personal information (collectively, “personal data”) and to any natural or juridical persons involved in the processing of personal data.1
The processing of personal data referred to in the DPA is only limited to natural persons or individuals. Data pertaining to juridical persons (e.g., corporate name, address, financial information) are not considered personal data and, hence, do not fall within the scope of the DPA.
The financial statements, balance sheets, and profit and loss statements (collectively, “financial information”) referred to in the current matter pertain to the employers who are juridical entities. Juridical entities are not considered as data subjects entitled to the protection of the DPA and its Implementing Rules and Regulations (IRR). Thus, the disclosure or processing of a company’s financial information fall outside the scope of the DPA. Consequently, the employers’ refusal to divulge their financial information to the employees’ union due to data privacy concerns is misplaced.
Lawful Processing; Legitimate Interest
On the other hand, a private educational institution’s data on its employees, student enrollment and “other income sources,” as well as a private hospital’s data on its patients and employees and the distribution and amounts of benefits mandated by law are all considered as personal information under the DPA. This is because such information can identify the individuals to which it pertains. Moreover, data on patients and students may involve sensitive personal information under Section 3(l)(2) of the DPA particularly information about an individual’s health and education.
As personal information controllers (PIC), private educational institutions and private hospitals are obliged to strictly process personal information in accordance with the DPA.
The NPC recognizes that employers are required to share information with labor unions for the latter to effectively negotiate CBAs and advocate for the general welfare of employees. Article 242 (c) of the Labor Code of the Philippines provides that legitimate labor organizations have the right to be furnished by their employers with its annual audited financial statements, including balance sheets and the profit and loss statement. However, the law did not mention the other documents that are being requested by your member-unions from their employers such as data on employees, enrollment of students and the distribution of benefits mandated by law. Be that as it may, Section 12 (f) of the DPA appears to be the most appropriate basis for processing such personal data, thus:
SECTION 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:
xxx
(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.2
Legitimate interests are matters that are desired or important to a personal information controller which may include business, financial or other reasonable purpose and which are not contrary to law, morals or public policy.3 Accordingly, the personal information controller or third party to whom personal information is disclosed must clearly identify and establish the existence of a legitimate interest, reasonable purpose and intended outcome.4
NPC discussed the criteria for the processing based on legitimate interest in MAF v. Shopee, Inc.,5 viz.:
Processing based on legitimate interest requires the fulfillment of the following conditions: (1) the legitimate interest is established; (2) the processing is necessary to fulfill the legitimate interest that is established; and (3) the interest is legitimate or lawful and it does not override fundamental rights and freedoms of data subjects.
For the lawful criteria of legitimate interest to apply, the foregoing conditions must be satisfied. Thus, your union-members must establish their legitimate interest in the personal data they request by: first, establishing that the processing shall be for the sole purpose of pursuing the legitimate interest of the labor union to effectively negotiate for the benefits of its members; second, the disclosure or processing shall only be limited to the personal information specifically requested by the labor union and which are necessary and proportionate to achieve its legitimate interest; and, third, the processing of personal information must be done in the least intrusive way so as not to impede the rights of the data subjects. In the scenario you provided, the data subjects are the employees and students.
For the processing of sensitive personal information involved in the current matter, Section 13 (f) of the DPA appears to apply, to wit:
SECTION 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited except in the following cases:
xxx
(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.”6
The National Privacy Commission (NPC) clarified in BGM v. IPP,7 that the term “processing as necessary for the establishment of legal claims” does not require an existing court proceeding:
In the case of NPC 17-018 dated 15 July 2019, this Commission held that “processing as necessary for the establishment of legal claims” does not require an existing court proceeding. To require a court proceeding for the application of Section 13(f) to this instance would not only be to disregard the distinction provided in the law but the clear letter of the law as well. After all, the very idea of “establishment … of legal claims” presupposes that there is still no pending case since a case will only be filed once the required legal claims have already been established.”
This Commission in the same case went on further and held that: The DPA should not be seen as curtailing the practice of law in litigation. Considering that it is almost impossible for Congress to determine beforehand what specific data is “necessary” or may or may not be collected by lawyers for purposes of building a case, applying the qualifier “necessary” to the second instance in Section 13(f) therefore, serves to limit the potentially broad concept of “establishment of legal claims” consistent with the general principles of legitimate purpose and proportionality. As regards legitimate purpose, the Implementing Rules and Regulations (IRR) of the Data Privacy Act provides that the processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy. This means that the processing done for the establishment of a legal claim should not in any manner be outside the limitations provided by law. The DPA is neither a tool to prevent the discovery of a crime nor a means to hinder legitimate proceedings.
To reiterate, the labor unions’ request for student and patient data stems from their right to advocate for the welfare of all employees. Access to the requested data may provide the necessary means for them to have knowledge about the current financial status of their employers and effectively negotiate during policy and decision-making. The said acts may be considered as a labor union’s establishment of its legal claims from employers.
General Data Privacy Principles; Proportionality; Reasonable and Appropriate Security Measures
Granting that the disclosure of personal information is supported by a lawful basis, employers, as personal information controllers, are still obliged to comply with the other requirements of the DPA. The processing of personal information must be done lawfully and fairly and with strict adherence to the basic data privacy principles of transparency, proportionality and legitimate purpose.
The principle of proportionality is of particular significance to the current scenario. To reiterate, employers must only provide such personal information that are adequate and necessary for the labor union’s declared purpose. Stated differently, the disclosure shall only be limited to the personal information that is relevant to the labor union’s purpose which is collective bargaining.
Further, employers should also guarantee the protection of the disclosed personal information and uphold the rights of the data subjects through the implementation of reasonable and appropriate physical, organizational and technical security measures. For instance, employers may establish policies, if there are none yet, in dealing with requests of this nature. Employers should also take into consideration the means by which the disclosure shall be made (e.g., electronically or through a hard copy personally handed to the labor union representative). It is worth noting that the implementation of the said reasonable and necessary security measures shall still be subject to the requirements of labor laws and other applicable laws.
Please note that NFL is also required to ensure the protection of the personal data that was disclosed to them. To reiterate, the disclosed personal data must only be used for the declared purpose and shall only be accessed by authorized persons or persons who are involved in the negotiations with employers. Further, NFL must also ensure that the disclosed data shall be deleted or destroyed once it has already served its purpose, subject to the relevant laws and policies on retention.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
For your reference.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, § 4 (2012). ↩
-
National Privacy Commission, NPC Advisory Opinion No. 2022-005 (24 February 2022) citing United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ [last accessed on 27 February 2023] ↩
-
Ibid. ↩
-
National Privacy Commission, MAF v. Shopee Philippines, Inc. NPC 21-167 (Sept. 22, 2022). ↩
-
National Privacy Commission, BGM v. IPP NPC 19-653 (Dec. 17, 2020). ↩