NPC Issuance Wiki

NPC Advisory Opinion No. 2024-011 — Request of Death Certificates for the Processing of Insurance Claims

Issued Advisory Opinion

Official opinion tags

Text

12 November 2024

Re: Request of Death Certificates for the Processing of Insurance Claims

Dear [Redacted],

We respond to your request for an Advisory Opinion on the propriety of releasing the death certificate of war veteran-pensioners (pensioners) either to [Redacted] or [Redacted] for the processing of insurance claims.

Discussion

You inform that [Redacted] grants loans to pensioners pursuant to its partnership with the [Redacted]. The loans are paid through the pensioners’ monthly pension from [Redacted]. The pensioners are covered by life insurance that in the event of demise, the proceeds will be applied to the loans and the excess, if any, shall go to the pensioners’ heirs. [Redacted], a wholly owned subsidiary of [Redacted], facilitates the processing of the insurance claims on behalf of [Redacted]. [Redacted] owns an insurance company currently servicing the insurance requirements of [Redacted].1

Upon the death of the pensioners, their heirs are entitled to claim burial and other death benefits from the [Redacted]. The process involves submission of the pensioners’ death certificates which serve as proof of death. The death certificates are also supposed to be submitted to [Redacted] for the processing of insurance claims to settle any outstanding loan of the pensioner. Most of the time, however, the heirs fail to submit a copy of the death certificate to [Redacted]. Accordingly, [Redacted] requested for copies of the death certificates from the Philippine Statistics Office (PSA) and [Redacted], but both offices denied the request citing the Data Privacy Act of 2012 (DPA).

Hence, this request for an Advisory Opinion.

Death Certificate; personal data

A death certificate is an official document setting forth particulars relating to a person’s death.2 It contains the following details relating to an individual, namely:

a) date and place of death, b) full name, c) age, d) sex, e) occupation or profession, f) residence, g) marriage status, h) nationality of the deceased, and i) proximate cause of death.3

Under the DPA, personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.4

On the other hand, sensitive personal information (SPI) refers to personal information:

  1. About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;
  2. About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;
  3. Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and
  4. Specifically established by an executive order or an act of Congress to be kept classified.5

Based on the definitions above, a death certificate contains both personal and sensitive personal information (collectively referred to as “personal data”). As such, the processing of a death certificate requires the establishment of the applicable lawful basis provided for in Sections 12 and 13 of the DPA.

Lawful criteria for processing

[Redacted]’s request for the death certificates of its deceased debtor-pensioners for the settlement of their financial obligations finds bases under Sections 12 (b) and 13 (f) of the DPA which respectively provides:

Section 12. Criteria for Lawful Processing of Personal Information – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

xxx

(b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract.

xxx

Section 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

xxx

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.

The provision of the insurance policy pertinently states:

Section 7. Amount of Claim Payment. – In the event of a claim, xxx shall pay to [Redacted] the amount which shall not exceed the outstanding loan balance at the time of the death of the insured/borrower.

Related to the above provision, the consent clause states:

I/we hereby consent and authorize [Redacted] to collect, use, process, store, update, and disclose all of my information, personal and otherwise, relative to any loan, products, services, facilities or channels that I/we may avail of now or in the future from the bank. xxx

I/we hereby consent to the transfer, disclosure, and communication of any information xxx from [Redacted] to its branches, subsidiary, agents and representatives and third parties xxx selected by [Redacted] (collectively referred to as the “Receiving and Disclosing Parties”) for the following uses, including but not limited to: (i) the provision of any products and services; xxx (viii) management of loan and (ix) disclosure and sharing of information under any applicable law, regulation, court, regulator or legal process. (Emphasis supplied)

In cases where the creditor obtained the insurance policy on the life of its debtors, the processing of the insurance claims usually involves the creditor securing and submitting the necessary proofs of death to the insurance company. In a case with a similar factual milieu,6 the Supreme Court took cognizance of a provision in the mortgage redemption insurance policy7 which states that the death benefit is payable to the creditor upon receipt and approval of the necessary proof of death. Similar to this case, we understand that [Redacted] secured a policy on the life of its debtors as a form of security whereby the proceeds shall cover the pensioners’ inability to repay the loan. Through the insurance policy, the pensioners consented to the processing of their personal information including the disclosure of the same to [Redacted] for the provision of any products or services and/or management of loan. Given the consent provided by the debtor-pensioners, it appears that either [Redacted] or its agent/subsidiary, [Redacted], may request for the release of the debtor-pensioners’ death certificate for purposes of the processing of the insurance claim.

As to the processing based on Section 13(f) of the DPA, please note that such criterion does not require a court order or an existing court proceeding for it to apply. It is enough that the processing is for the establishment of a legal claim. You may refer to NPC Advisory 2024-02 dated 12 August 20248 for the other requirements of processing based on Section 13(f).

General data privacy principles; Reasonable and appropriate security measures

It should be stressed, however, that even if the processing is supported by one of the cited lawful criteria, the processing must strictly adhere to the data privacy principles of transparency, proportionality, and legitimate purpose as well as the implementation of appropriate security measures.

The principle of proportionality is of particular relevance to the present concern. Proportionality, as required under Section 11 of the DPA, requires that the personal data sought must be necessary for purposes for which it is to be used, that it must be adequate and not excessive in relation to the purposes for which they are collected and processed. It also requires that the personal data must be retained only for as long as necessary for the fulfillment of the purposes for which it was obtained. Further, personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.

We note that the insurance policy only requires a satisfactory proof of death of the insured.9 As such, if the insurer’s requirement is only a confirmation of the fact of death, you may also consider as an alternative a certification to that effect from either the [Redacted] or PSA, particularly in view of the PSA’s Memorandum Circular (MC) No. 2019-15 dated 11 June 2019 restricting access to copies of civil registry documents, such as death certificates.

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

For your reference.

Very truly yours,

(Sgd.) FRANKLIN ANTHONY M. TABAQUIN, IV Director IV, Privacy Policy Office

Footnotes

  1. Available at [Redacted] (last accessed 09 October 2024). ↩

  2. Philippine Statistics Authority, Death Certificate, available at https://psa.gov.ph/death-certificate (last accessed 04 September 2024). ↩

  3. §6, Law on Registry of Civil Status, Act No. 3753 (1930). ↩

  4. §3(g), Republic Act No. 10173. ↩

  5. Id., §3(L). ↩

  6. Noda v. Social Security System, G.R. L-57834, 12 November 1981. ↩

  7. The mortgage redemption insurance policy was procured by SSS on the life of its principal debtor. ↩

  8. Guidelines on Personal Data Processing Based on Section 13(f) of the Data Privacy Act of 2012. ↩

  9. §8, General Insuring Provisions, Group Credit Life Insurance Policy. ↩

Backlinks