NPC Issuance Wiki

NPC Advisory Opinion No. 2023-018 — Request for Condominium Tenant Data by Philippine Drug Enforcement Agency

Issued Advisory Opinion

Official opinion tags

Text

ADVISORY OPINION NO. 2023-018

29 September 2023

RE: REQUEST FOR PERSONAL DATA OF CONDOMINIUM TENANTS BY PHILIPPINE DRUG ENFORCEMENT AGENCY (PDEA)

Dear [Redacted],

We respond to the Philippine Drug Enforcement Agency-National Capital Region’s (PDEA-NCR) request for an Advisory Opinion regarding the data privacy concern of condominium building administrators/managers/owners (collectively, “CAMOs”) relative to the PDEA-NCR’s request for information pursuant to its investigations.

Discussion

You mention that PDEA-NCR’s anti-drug operations reveal that condominium units have been utilized as clandestine laboratories, drug dens, or as a venue for other illegal drug-related activities. As such, PDEA-NCR requested various CAMOs for information on the current tenants/owners of condominium units within the National Capital Region (NCR) and any information about suspected illegal drug activities.

However, reports from several PDEA-NCR district offices reveal that most of the CAMOs hesitate to provide the requested information due to the perceived violation of the data privacy rights of the condominium unit owners/tenants. You also inform that barangay officials share in PDEA-NCR’s dilemma in connection with their barangay drug clearing programs.

Thus, you ask if the CAMOs within PDEA-NCR’s jurisdiction can rightfully refuse the request for information citing the Data Privacy Act of 2012 (DPA).1

Personal Data; Special Cases; Lawful Processing; Mandate of PDEA

The DPA applies to the processing of personal and sensitive personal information (collectively, personal data) and to any natural and juridical person involved in the processing within and outside the Philippines. Information about the identity of a person and his or her corresponding address qualifies as personal data that is subject to protection under the DPA. The processing of personal data must be based on any of the grounds provided in Sections 12 or 13 of the DPA. Some of the provisions relevant to your concern are the following:

SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists: xxx

(a) The data subject has given his or her consent;

xxx

(e) The processing is necessary in order to respond to a national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority, which necessarily includes the processing of personal data for the fulfillment of its mandate;2

xxx

SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

(a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing;

(b) The processing of the same is provided for by existing laws and regulations: Provided, that such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects is not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;3 (Emphasis Supplied)

xxx

On the other hand, Section 5 of the Implementing Rules and Regulations (IRR) of the DPA provides for a list of special cases where the application of the DPA may be limited or qualified, thus:

Section 5. Special Cases. The Act and these Rules shall not apply to the following specified information, only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned:

xxx

e. Information is necessary in order to carry out the functions of public authority, in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function, including the performance of the functions of the independent, central monetary authority, subject to restrictions provided by law. Nothing in this Act shall be construed as having amended or repealed Republic Act No. 1405, otherwise known as the Secrecy of Bank Deposits Act; Republic Act No. 6426, otherwise known as the Foreign Currency Deposit Act; and Republic Act No. 9510, otherwise known as the Credit Information System Act (CISA);

xxx

Provided, that the non-applicability of the Act or these Rules do not extend to personal information controllers or personal information processors who remain subject to the requirements of implementing security measures for personal data protection: Provided further, that the processing of the information provided in the preceding paragraphs shall be exempted from the requirements of the Act only to the minimum extent necessary to achieve the specific purpose, function or activity.

We note that under Section 84 (b) of the Republic Act (RA) 9165,4 PDEA has the mandate to:

Section 84. Powers and Duties of the PDEA. – The PDEA shall: xxx

(b) Undertake the enforcement of the provisions of Article II of this Act relative to the unlawful acts and penalties involving any dangerous drug and/or controlled precursor and essential chemical and investigate all violators and other matters involved in the commission of any crime relative to the use, abuse or trafficking of any dangerous drug and/or controlled precursor and essential chemical as provided for in this Act and the provisions of Presidential Decree No. 1619; x x x

(Underscoring supplied)

RA 9165 also states that one of the powers of PDEA is the issuance of a subpoena relative to the conduct of an investigation, thus:

Section 84. Powers and Duties of the PDEA. – The PDEA shall: xxx

c) Administer an oath, issue a subpoena and subpoena duces tecum relative to the conduct of an investigation involving the violations of this act;5

(Underscoring supplied)

Further, PDEA’s Code of Professional Conduct and Ethical Standards provides for a list of officials who may issue a subpoena, to wit:

l. Issuance of Subpoena from PDEA – The officers or officials authorized to issue the subpoena pursuant to Section 84(c) of R.A. 9165 include the Director General, and as a delegated authority, the Deputy Directors for Operations and Administration, the Service Directors of Legal and Prosecution Service, Investigation and Intelligence Service, Internal Affairs Service, and Compliance Service of the National Head Office, and the respective Regional Directors within their areas of jurisdiction, as well as the Director (Head) of Special Enforcement Service.6

Considering that PDEA’s own rules require the issuance of a subpoena duces tecum, then such procedure must be observed in requesting information involving personal data from the CAMOs instead of a mere letter. The issuance of a subpoena duces tecum in lieu of a letter-request does not only ensure that due process is observed by PDEA, but it also demonstrates judicious assessment and evaluation of circumstances surrounding the request. It goes without saying that a subpoena also denotes the legitimacy of the operation and its purpose.

Thus, if PDEA-NCR were to course the request for personal information through a validly issued subpoena duces tecum, CAMOs can no longer refuse to furnish them with the information, as it falls under PDEA’s mandate and is in line with the DPA.

Nevertheless, it is necessary to point out that having a basis for processing personal data under the law does not give PICs unbridled authority over the personal data collected. PICs, such as PDEA, must still adhere to the guidelines on how to properly process personal information under the DPA.

You also cited in your request our Advisory Opinion 2021-028,7 and insisted on its application to your situation. To recall, Advisory Opinion 2021-028 involves somehow a similar situation in that a letter was sent by the Bureau of Internal Revenue (BIR) to a condominium corporation requesting the disclosure of personal data of tenants. In allowing the disclosure pursuant to Section 4 of the DPA, we discussed therein the following requirements, viz:

• The information is necessary in order to carry out the law enforcement or regulatory function of a public authority; • The processing is for the fulfillment of a constitutional or statutory mandate; • There is strict adherence to all due process requirements; • Applies only to the minimum extent of collection, access, use, disclosure, or other processing necessary to the purpose, function, or activity concerned; and • Only the specified information falls outside the scope of the DPA. The public authority, considered as a personal information controller under the DPA, must still comply with the other requirements of the DPA such as the implementation of reasonable and appropriate physical, organizational and technical security measures, uphold the rights of data subjects and adhere to the data privacy principles of transparency, legitimate purpose, and proportionality.

At first glance, PDEA-NCR’s present concern appears to be similar to the situation presented in Advisory Opinion 2021-028. However, the difference lies in the fact that the BIR rules allow the issuance of an “access to records letter” pursuant to Sec. 5(b) of the National Internal Revenue Code, unlike the PDEA rules which requires a subpoena duces tecum.6 Consequently, for PDEA-NCR’s processing to be legal under the DPA, its rules on the issuance of a subpoena duces tecum must be complied with.

Adherence to Data Privacy Principles

While the DPA recognizes the mandate of different government agencies, the law is categorical in stating that the processing of personal information must still adhere to the principles of transparency, legitimate purpose, and proportionality. Personal information must be collected for specified and legitimate purposes determined and declared before, or as soon as reasonably practicable after collection, and later processed in a way compatible with such declared, specified and legitimate purpose only.8

For the principle of proportionality, it requires that the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not be fulfilled by other means.9 It also states that personal data shall only be processed only if the purpose of the processing could not be reasonably fulfilled by any other means.10 In addition, only those personal data that are needed in relation to the declared and stated purpose should be disclosed to the requesting entities, such as PDEA-NCR.

Thus, in keeping with the data privacy principles, particularly on proportionality, any request for information containing personal data, including the method of request should undergo evaluation and judicious assessment to determine what specific personal data should be disclosed and if the request is proportional to the purpose sought by the requesting agency.

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

Please be guided accordingly.

Very truly yours,

(Sgd.) FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. Id., §12 (a), (e). ↩

  3. Id., §13 (a), (b). ↩

  4. An Act Instituting the Comprehensive Dangerous Drugs Act of 2002, Repealing Republic Act No. 6425, otherwise known as the Dangerous Drugs Act of 1972, as amended, providing funds therefor and for other purposes [Comprehensive Dangerous Drugs Act of 2002] (2002), §84(b). ↩

  5. Comprehensive Dangerous Drugs Act of 2002, §84(c). ↩

  6. PDEA Code of Professional Conduct and Ethical Standards, §1(l). ↩ ↩2

  7. National Privacy Commission, NPC Advisory Opinion No. 2021-028 (16 July 2021). ↩

  8. Republic Act No. 10173, §11(a). ↩

  9. Id. §13(c). ↩

  10. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, §18 (c) (2016). ↩

Backlinks

  • No backlinks found