NPC Issuance Wiki

NPC Advisory Opinion No. 2023-021 — Access to Documents Relative to a Business Permit Application

Issued Advisory Opinion

Official opinion tags

Text

19 October 2023

Re: ACCESS TO DOCUMENTS RELATIVE TO A BUSINESS PERMIT APPLICATION.

Dear [Redacted]:

We respond to your request for an Advisory Opinion on whether a non-party may be allowed access to the documents attached to a business permit application pursuant to Section 4 of the Data Privacy Act of 2012 (DPA), and the public’s right to information.

We gather that your law firm requested the Business Permit and License Office (BPLO) of San Juan City for the production of an individual’s Business Permit Application, its attachments, and the corresponding Permit to Operate Business (PTOB). As justification, you reasoned that the information you seek are excluded from the scope of the Data Privacy Act of 2012 (DPA)1 particularly Section 4 (c) of the DPA.

However, the BPLO denied your request on the grounds of confidentiality and data privacy. Nevertheless, the BPLO stated that they can issue the approved PTOB but not the submitted application documents and attachments which led to the issuance of the PTOB.

You acknowledge that Section 4 of the DPA provides for instances where the DPA does not apply; and the non-applicability of the DPA to the information mentioned therein is only to the minimum extent of processing necessary to achieve the specific purpose, function, or activity concerned.2 However, you posit that any member of the public should be able to scrutinize government transactions that are of a discretionary and financial nature so that the public may, among others, be properly guided in their “social transactions” and as a recognition of the public’s right to access information on matters of public concern. Thus, you ask if your client should be granted access by the BPLO to the submitted Business Permit application and its attachments based on the public’s constitutional right to access information on matters of public concern which, you state, is expressly recognized as a limitation to the DPA.

Discussion

Scope of the DPA; Section 4 – Special Cases; Disclosure Under Special Cases

Section 4 (c) of the DPA speaks of information relating to any discretionary benefit of a financial nature such as the granting of a license or permit given by the government to an individual, including the name of the individual and the exact nature of the benefit.

In the issuance of a PTOB, the applicant will submit documentary requirements requested by the BPLO.3 Once all requirements are submitted, the BPLO will register and/or issue the concomitant license or permit as part of their regulatory mandate. The BPLO, however, does not have discretionary powers to determine who gets issued a PTOB or not. As such, Sec. 4 (c) of the DPA is not the applicable provision concerning your request for disclosure of documents.

The more appropriate basis for disclosure of the requested data would be Sections 12 (f) and 13 (f) of the DPA. The requested information appears to be necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims.4

In [[decisions/2019/cid-17-k-003-krl-vs-trinity-university-of-asia-aa-mc-ncb-rg-gv-gct-rr-mr-pb|KRL v. Trinity University of Asia, etc.]],5 the NPC clarified that a document containing sensitive personal information of an individual used for the purpose of establishing legal claims under Section 13 (f) of the DPA may be considered as a legitimate interest. The same case further held that in cases involving personal information, the protection of lawful rights and interests under Section 13 (f) of the DPA is considered as a legitimate interest contemplated by Section 12 (f) of the DPA.

Data Privacy Principles; Proportionality

Despite the existence of a legal basis for processing, the DPA does not permit unbridled processing of personal data. Personal Information Controllers (PICs) are still required to adhere to the general data privacy principles set forth under the law.

One such principle is the principle of proportionality which states that the processing of personal data shall be adequate, relevant, suitable, necessary and not excessive in relation to a declared specified purpose. It also states that personal data shall only be processed if the purpose of the processing cannot be reasonably fulfilled by any other means. Thus, disclosure of personal data to requesting individuals should be limited to its declared, specified, and legitimate purpose. In addition, only those personal data needed in relation to the declared and stated purpose should be disclosed to the requesting entities.

Please be advised that this Advisory Opinion was rendered based solely on the information you provided. Any extraneous fact that may be subsequently furnished to us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

Please be guided accordingly.

Very truly yours,

FRANKLIN ANTHONY M. TABAQUIN, IV Director IV, Privacy Policy Office

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. Section 5, IRR of the DPA. ↩

  3. San Juan City, Business Permit and Licensing Office, available at https://www.sanjuancity.gov.ph/SanJuanCity/Makabagong_SJ_DLForms ↩

  4. Id. § 13 (f) ↩

  5. CID Case No. 17-K-003. ↩

Backlinks

  • No backlinks found