NPC Issuance Wiki

NPC Advisory Opinion No. 2023-015 — Disclosure to the National Bureau of Investigation of Barangay Records

Issued Advisory Opinion

Official opinion tags

Text

24 August 2023

Re: DISCLOSURE TO THE NATIONAL BUREAU OF INVESTIGATION OF THE RECORD OF BARANGAY INHABITANTS

Dear [Redacted],

We respond to your request for an Advisory Opinion on the above matter.

Discussion

We gather that your office received a letter from the National Bureau of Investigation (NBI) requesting for certified true copies of the list of all inhabitants in the building/s located at 14 General Malvar Street, Brgy. San Antonio, Pasig City. The NBI also asked for the certified true copies of the Record of Barangay Inhabitants by Household, the Individual Record of Barangay Inhabitant, and all other available records pertaining to the inhabitants (Records) that may aid it in its investigation.

We note from the NBI’s letter that their request for information is pursuant to their ongoing investigation brought about by the request of ION Real Estate Development Corporation (IREDC). It appears that professional squatters and squatting syndicates are allegedly occupying a parcel of land situated in Escriva Drive, Brgy. San Antonio, Pasig (the Barangay).

Specifically, you ask the following:

  1. Can your office be compelled to release or share the names and/or records of Barangay inhabitants to the NBI as part of the latter’s investigation to determine if there are professional squatters or squatting syndicates in the address mentioned?

  2. Whether Department of Interior and Local Government Memorandum Circular No. 2008-144 dated 19 September 2008, prohibits sharing and disclosure of RBI Form A and Form B sans consent of the owner.

DILG Memorandum Circular No. 2008-144

Department of Interior and Local Government Memorandum Circular No. 2008-144 dated 19 September 2008 (MC 2008-144) calls for the maintenance and updating of records of all barangay inhabitants to achieve the following purposes:

  • For easy identification of inhabitants;
  • As a tool in planning; and
  • As an updated reference in the number of inhabitants in a specific Barangay.

Relevantly, MC 2008-144 instructed the City/Municipal Mayors and Punong Barangays to adopt necessary measures to ensure that the right to privacy of the inhabitants will be observed in the process of maintaining and updating said records, viz.:

d. Data collected and stored for this purpose shall be kept and treated as strictly confidential and a personal written authorization of the Owner shall be required for access and disclosure of data.

xxx

f. The Chief of Police and Local Civil Registrar may, from time to time, be allowed to verify the records kept by the Barangay Secretary, when circumstances warrant.

(Emphasis supplied).

It is clear from the above-quoted provisions that MC 2008-144 requires the owner’s personal written authorization prior to the access and disclosure of his/her data. Hence, a mere letter request does not suffice. Moreover, the NBI is not among those expressly enumerated in MC 2008-144 to verify the Records kept by the Barangay Secretary.

Section 4 (e); special cases; disclosure to public authority;

To justify its request, the NBI cited Section 4(e) of the Data Privacy Act of 20121 (DPA) and proceeded to claim that the information it requests is exempt from the DPA, viz.:

This request is in pursuant (sic) to Sec. 4 (e) of RA 10173 otherwise known as the Data Privacy Act of 2012 stating that information requested by law enforcement agencies that is necessary to carry out its functions is not covered by the act.

(Emphasis supplied)

To avoid confusion, it is necessary to discuss the proper application of Section 4(e) of the Data Privacy Act of 2012 (DPA). NPC Advisory Opinion No. 2021-028 provides a relevant explanation as to the application of Section 4(e) of the DPA and Section 5(d) of the Implementing Rules and Regulations of the DPA, thus:

The DPA and its Implementing Rules and Regulations (IRR) provide for a list of specified information which do not fall within the scope of the law.2 In particular, information necessary to carry out functions of a public authority are considered special cases under the DPA, to wit:

“SECTION 5. Special Cases. The Act and these Rules shall not apply to the following specified information, only to the minimum extent of collection, access, used, disclosure or other processing necessary to the purpose, function, or authority concerned:

xxx

d. Information necessary in order to carry out the functions of public authority, in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function, including the performance of the functions of the independent, central monetary authority, subject to restriction provided by law. Nothing in this Act shall be construed as having amended or repealed Republic Act No. 1405, otherwise known as the Secrecy of Bank Deposits Act; and Republic Act No. 9510, otherwise known as the Credit Information System Act (CISA);

xxx

Provided, that the non-applicability if the Act or these Rules do not extend to personal information controllers or personal information processors who remain subject to the requirements of implementing security measures for personal data protection: Provided further, that the processing of the information provided in the preceding paragraphs shall be exempted from the requirements of the Act only to the minimum extent necessary to achieve the specific purpose, function or activity.”3 (Underscoring supplied)

The above exemption must be strictly construed. For the exemption to apply, the following are considered:

• The information is necessary in order to carry out the law enforcement or regulatory function of a public authority; • The processing is for the fulfillment of a constitutional or statutory mandate; • There is strict adherence to all due process requirements; • Applies only to the minimum extent of collection, access, use, disclosure, or other processing necessary to the purpose, function, or activity concerned; and • Only the specified information falls outside the scope of the DPA.

The public authority, considered as a personal information controller under the DPA, must still comply with the other requirements of the DPA such as the implementation of reasonable and appropriate physical, organizational and technical security measures, uphold the rights of data subjects and adhere to the data privacy principles of transparency, legitimate purpose and proportionality.”4

Applying the foregoing, Section 5 of R.A. No. 108675 provides for the general investigative jurisdiction of the NBI. Meanwhile, Executive Order No. 153, Series of 2002,6 as amended by Executive Order No. 231, listed the NBI as one of the relevant agencies called to give their support, assistance, and cooperation in the identification of professional squatters and squatting syndicates, monitor and launch operations, through the proper agency or body, to curtail their activities.7

Thus, there is no doubt that the NBI’s request for information is within its investigative mandate. However, Section 4 (b) of RA 10867 itself requires the NBI to issue a subpoena when it conducts its investigation.

Hence, the officials of the Barangay may provide the personal information requested by the NBI provided that a formal subpoena has been issued to ensure that the request is authorized, proper, and lawful under existing rules and regulations.

Processing provided for by existing laws and regulations; public authority;

It is readily apparent from the sample form of the Records sent to us that they contain both personal information8 and sensitive personal information,9 the processing of which must be supported with the appropriate legal criteria provided under the DPA.

In processing personal information, the Barangay and the NBI may rely on Section 12 (e) of the DPA, which provides that the processing of personal information shall be permitted when it is necessary to fulfil the functions of a public authority which includes the processing of personal data for the fulfillment of its mandate.

Meanwhile, the processing of sensitive personal information must find basis under Section 13 of the DPA. Among the sensitive personal information included in the Records are date of birth, age, civil status, citizenship, and thumbmark.

Section 13 (f) recognizes processing for the establishment, exercise, or defense of legal claims, viz.:

SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

xxx

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interest of natural or legal persons in court proceedings or the establishment, exercise, or defense of legal claims, or when provided to government or public authority.10

It must be noted that in determining whether a request based on the aforementioned provision should be granted, “the legitimacy of the purpose and the proportionality of the request (should) be taken into consideration.”11

We emphasize that, similar to the processing of personal information, the release of sensitive personal information to NBI personnel should also be upon a subpoena. Further, the Barangay should establish a system to avoid abuse and ensure that the requested information shall be limited only to the legitimate interest stated by the requesting party. As we stated in Advisory Opinion No. 2022-00512 regarding a similar concern:

LTO must establish a system for handling these types of requests for information to avoid the possibility of abuse. As a request for personal information for the filing of a legal action falls under the legitimate interests of the requesting party, the system must assess the request if it satisfies the three aforementioned tests. It must also provide for a mechanism to ensure that the information to be disclosed will only be used for the purpose/s indicated. In Advisory Opinion No. 2021-044, it was recommended that in case a request for personal information is granted, the requesting party should be required to sign an undertaking that the information will only be used for the purpose that was declared: Should the CHMSC grant the request, it is suggested that the Requesting Party be required to sign an undertaking that the use of the documents will only be for the purpose of filing a complaint with the Ombudsman and that the proper disposal thereof is ensured if he does not push through with the filing of the complaint. Further, the undertaking must include a clause to the effect that the requestor acknowledges that he becomes a PIC by his receipt of the requested documents and therefore has the obligations of a PIC as prescribed under the DPA. Thus, LTO should similarly require a requesting party to sign an undertaking that the information that will be acquired will only be used for the purpose which was declared and authorized.

General data privacy principles; legitimate purpose; proportionality

We reiterate that the Barangay, as a Personal Information Controller (PIC), must adhere to the general data privacy principles under the DPA. In particular, the principle of proportionality requires that the processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.13 Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.14

We thus advise that any disclosure of personal data should only contain relevant information necessary to achieve the purpose of determining if there are professional squatters or squatting syndicates in the subject property.

The Barangay may consider redacting personal information and sensitive personal information that may be considered as excessive and not relevant, suitable, or necessary to the purpose. It may also ask the NBI to detail its request instead of a general request for “all other available records pertaining to the inhabitants that may aid [the NBI] in its investigation”.

Please be advised that this Advisory Opinion was rendered based solely on your provided information. Any extraneous fact that may be subsequently furnished to us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

Very truly yours,

(Sgd.) ATTY. FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. Id. § 4 (e) (2012). ↩

  3. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 5 (d) (2016). ↩

  4. See: National Privacy Commission, NPC Advisory Opinion No. 2019-022 (07 May 2019) and NPC Advisory Opinion No. 2020-015 (24 Feb 2020). ↩

  5. NBI Reorganization and Modernization Act. ↩

  6. Instituting the National Drive to Suppress and Eradicate Professional Squatting and Squatting Syndicates, Amending Executive Order Nos. 178, s. 1999 and 129, s. 1993, and for Other Purposes, Executive Order No. 153, [December 10, 2002] ↩

  7. Id. § 3 ↩

  8. Data Privacy Act of 2012, § 3 (g). ↩

  9. Id. § 3 (l). ↩

  10. Id. § 13 (f). ↩

  11. See: National Privacy Commission, NPC Advisory Opinion No. 2021-044 (Dec. 29, 2021). ↩

  12. National Privacy Commission, NPC Advisory Opinion No. 2022-005, 24 February 2022. ↩

  13. Rules and Regulations Implementing the Data Privacy Act of 2012, § 18 (c) (2016). ↩

  14. Ibid. ↩

Backlinks