Text
21 June 2023
Re: PROPOSED ORDINANCE ON THE ESTABLISHMENT OF A BARANGAY DATABASE OF ALL HOUSEHOLDS AND INDIVIDUALS IN THE PROVINCE OF PALAWAN.
Dear [Redacted]:
We respectfully provide you with our Advisory Opinion regarding your request for comments on the data privacy implications of the proposed Ordinance mentioned above (the “Ordinance”).
We gather from the Whereas clauses of the Ordinance that it was authored owing to the perceived need of the Province of Palawan to have a barangay-level counterpart to Republic Act No. 11315, or the Community-Based Monitoring System Act (CBMSA).1 In essence, the CBMSA’s declared policy is to establish a database for conducting poverty analysis and needs prioritization with the end in view of designing appropriate policies and interventions for social services, but with due regard to the fundamental human right to privacy and the data protection principles under Republic Act No. 101732 or the Data Privacy Act of 2012 (DPA).
However, the CBMSA is implemented only at the Municipal/City Levels because of its complexity and costly requirements. Thus, the Ordinance was drafted for a similar purpose as the CBMSA but for the use of every barangay of component municipalities of the Province of Palawan. The Ordinance seeks to establish a database not only of inhabitants but also demographic and socio-economic data that will provide profiles necessary for crafting barangay-level policies and development plans for poverty-related measures. Concomitantly, a local barangay ID System will be implemented for each barangay. Hence, your request for comments on the Ordinance.
Discussion
Personal and Sensitive Personal Information; Lawful Criteria for Processing of Personal Data
The DPA and its Implementing Rules and Regulations (IRR) apply to the processing3 of all types of personal information by any natural or juridical person in the government or private sector.
The DPA defines personal information as “any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.”4 On the other hand, Section 3(l) of the DPA provides for what information are considered as sensitive personal information.5
To be lawful, the processing of personal information and sensitive personal information (collectively, personal data) must be supported by any of the lawful criteria provided in either Section 12 or Section 13 of the DPA.
Based on the provisions of the Ordinance, we understand that the establishment of the Registry of Barangay Inhabitants (RBI) for each barangay in the Province of Palawan is for the purpose of complying primarily with DILG Memorandum Circular (MC) 2020-117,6 which directs all barangays to submit updated, aggregated, and disaggregated demographic data of each barangay to the Barangay Information System (BIS). Hence, assuming that the Ordinance will be enacted, the processing of personal data finds justification under either Section 12 or Section 13 of the DPA, depending on whether the personal data is considered as personal information or sensitive personal information.
Going over the list contained in Section 6 of the Ordinance, the following are considered as personal information: the individual’s full name, address, length of stay in the barangay, place of birth, highest educational attainment and occupation-related details, and the fact of the issuance of a birth certificate. For the processing thereof, Section 12(e) of the DPA appears to be the most appropriate basis, viz.:
SEC. 12. Criteria for Lawful Processing of Personal Information. The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:
(e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate;7
On the other hand, the following are considered as sensitive personal information: the date of birth, marital status, gender, and highest educational attainment, the individual’s solo parenthood, tribal affiliation, ethnicity, religion, impairment/disability, school attendance, nutritional status, and pregnancy-related information (for females). For this sensitive personal information, their processing finds basis under Section 13(b) of the DPA, viz:
(b) The processing of the same is provided for by existing laws and regulations: Provided, that such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;8
Nevertheless, it must be pointed out that even though there may be lawful bases for collecting the personal data of barangay inhabitants in relation to the purposes stated in the Ordinance, the barangays concerned are still required to comply with its duties and responsibilities as a personal information controller (PIC) under the DPA. Hence, they still have the obligation to adhere to the general data privacy principles, uphold data subject rights, and implement reasonable and appropriate security measures for the protection of personal data.
Data Privacy Principles: Transparency, Legitimate Purpose, and Proportionality
The data privacy principle of transparency requires that data subjects must be made aware of the nature, purpose, and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of the personal information controller, and the rights of the data subjects and how these can be exercised.9
We note that the Ordinance contains a provision directing enumerators to exhaustively explain to the respondents why a particular item of personal data is collected and why its processing is necessary to achieve the objectives of the Ordinance. Likewise, it provides an extensive list of personal information required to be collected. However, it does not include a provision on how the inhabitants will be informed of the extent of processing, the risks and safeguards involved, their rights as data subjects and how such rights may be exercised. For the proper observance of the principle of transparency, the data subjects must be made aware on how and to what extent the barangay intends to use their personal data, and if their personal data will be shared with any other government agencies or private entities. Thus, we recommend that a provision to such effect be included in the Ordinance.
On the other hand, the principle of legitimate purpose10 states that the processing of personal information shall be compatible with a declared and specified purpose, which is not contrary to law, morals or public policy. Thus, we suggest that the legal basis of the Ordinance, which
is to comply with DILG Memorandum Circular No. 2020-117, must also be indicated to ensure adherence to this privacy principle.
Lastly, the principle of proportionality requires that the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.11 It must be emphasized that personal data must only be processed if the purpose of processing could not be reasonably fulfilled by other means.
The Sangguniang Panlalawigan of Palawan may consider the requirement of collecting statistical or aggregate data as sufficient in fulfilling the Ordinance’s objectives. For example, the Ordinance can consider collecting the number of family members living in the household - adults and children, instead of collecting the names of all the occupants, to fulfill the purpose of determining the total number of inhabitants covered within the jurisdiction of a barangay.
As to additional sensitive personal information required by the Ordinance which include the blood type, place of origin, and religion, these data do not appear to be necessary in the fulfillment of the Ordinance’s objectives. We suggest that the barangay refrain from collecting these personal data.
It is worth emphasizing also that there must be a guarantee that adequate safeguards are in place before processing of information, such as provisions on retention periods and records disposal.12 The Ordinance lacks provisions on such safeguards. Hence, we also recommend that provisions relative thereto be included to ensure that personal data processed is kept secure. For reference as to what security measures should be put in place, you may refer to NPC Circular 16-01 – Security of Personal Data in Government Agencies.
Barangay ID System; Sensitive Personal Information
The Ordinance states that the Barangay ID to be issued to the inhabitants for the sole purpose of establishing barangay residency shall contain, among others, the name, place and date of birth, address, sex, blood type, photo, QR code, logo of province and barangay, and expiry date.
As stated in the above discussion, the processing of personal data should also adhere to the data privacy principles of transparency, legitimate purpose, and proportionality. We advise the Sanggunian to carefully evaluate if all the information to be included in the Barangay ID are required for its declared purpose/s.
We also advise that a privacy notice be posted in highly conspicuous areas of the barangay hall. The privacy notice should contain what personal data shall be reflected in the ID and the corresponding purpose/s for its issuance. The barangay inhabitants must also be made aware of the corresponding purpose/s at the earliest practicable opportunity, preferably before any personal data are collected from them.
We trust that the above discussion would guide the Sanggunian in evaluating the privacy implications of the Ordinance.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
Please be guided accordingly.
Very truly yours,
(Sgd.) VIDA ZORA G. BOCAR OIC Director IV, Privacy Policy Office
Footnotes
-
Enacted on 17 April 2019. ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
Id., § 3(j). Processing refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data. ↩
-
Guidelines in the Establishment of the Barangay Profile System (BPS) Module under Barangay Information System (BIS), September 4, 2020. ↩
-
Emphasis supplied. ↩
-
Emphasis supplied. ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18(a). ↩
-
Data Privacy Act of 2012, Republic Act No. 10173, § 11(f). ↩