NPC Issuance Wiki

NPC Advisory Opinion No. 2024-012 — Right to Inspect Corporate Records Vis-à-Vis the Data Privacy Act of 2012

Issued Advisory Opinion

Official opinion tags

Text

16 October 2024

Re: RIGHT TO INSPECT CORPORATE RECORDS VIS-À-VIS THE DATA PRIVACY ACT OF 2012.

Dear [Redacted],

We respond to your request for an Advisory Opinion regarding the relation between the right of a stockholder to inspect corporate records under Section 73 of the Revised Corporation Code of the Philippines (RCC)1 and the Data Privacy Act of 2012 (DPA).2

You state that your client, Tibiao Bakery Inc. (TBI), received a request from a law office representing certain stockholders to be furnished with a statement of account detailing the advances made by TBI to its officers and employees, including their names, dates, and amounts of the advances, and the relevant supporting board resolution.

In response, TBI allowed the examination of its books and records subject to the following conditions:

  • The examination of books and records of TBI pertaining to the advances to its directors, officers, stockholders and employees is allowed subject to compliance with Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA)
  • That the data subject should give his or her consent, specific to the purpose prior to the processing;
  • That [Redacted], in his capacity as administrator of the Estate of [Redacted], has given his consent to examine the books and records of the corporation pertaining to the advances of the late [Redacted];
  • That the examination shall be limited only to those who gave their consent; and
  • That the undersigned is requested to submit a request for Advisory Opinion to the NPC.

On the agreed date of the examination, the law office argued that they were not required to obtain the consent of the other stockholders as their request is based on Section 73 of the RCC in relation to Sections 12(c) and 13(b) of the DPA. As such, they have an unqualified and absolute right to inspect corporate records.

Thus, TBI presents the following issues:

  • Whether TBI must secure the prior consent of the data subjects who are the subject of the demand to inspect; or
  • If TBI is allowed by law to favorably act on the demand to inspect even in the absence of the aforesaid prior consent, if it is obligated to provide the demanded “statement of account,” notwithstanding the language of Section 73 of the Revised Corporation Code.

Discussion

The right to inspect corporate records vis-a-vis the right to data privacy.

For a thorough understanding of the matter at hand, it is imperative to consider the provisions of the applicable laws and relevant jurisprudence regarding the concerns you raise.

Section 73 of the RCC recognizes the stockholders’ right to inspect corporate records, viz.:

SEC. 73. Books to be Kept; Stock Transfer Agent. — Every corporation shall keep and carefully preserve at its principal office all information relating to the corporation including, but not limited to:

xxx

(d) A record of all business transactions;

(e) A record of the resolutions of the board of directors or trustees and of the stockholders or members;

xxx

Corporate records, regardless of the form in which they are stored, shall be open to inspection by any director, trustee, stockholder or member of the corporation in person or by a representative at reasonable hours on business days, and a demand in writing may be made by such director, trustee or stockholder at their expense, for copies of such records or excerpts from said records. The inspecting or reproducing party shall remain bound by confidentiality rules under prevailing laws, such as the rules on trade secrets or processes under Republic Act No. 8293, otherwise known as the “Intellectual Property Code of the Philippines”, as amended, Republic Act No. 10173, otherwise known as the “Data Privacy Act of 2012”, Republic Act No. 8799, otherwise known as “The Securities Regulation Code”, and the Rules of Court.

xxx

Any officer or agent of the corporation who shall refuse to allow the inspection and/or reproduction of records in accordance with the provisions of this Code shall be liable to such director, trustee, stockholder or member for damages, and in addition, shall be guilty of an offense which shall be punishable under Section 161 of this Code: Provided, That if such refusal is made pursuant to a resolution or order of the board of directors or trustees, the liability under this section for such action shall be imposed upon the directors or trustees who voted for such refusal: Provided, further, That it shall be a defense to any action under this section that the person demanding to examine and copy excerpts from the corporation’s records and minutes has improperly used any information secured through any prior examination of the records or minutes of such corporation or of any other corporation, or was not acting in good faith or for a legitimate purpose in making the demand to examine or reproduce corporate records, or is a competitor, director, officer, controlling stockholder or otherwise represents the interests of a competitor.

xxx

It can be drawn from the law and jurisprudence that the right to inspect is subject to the following conditions:

a. It can only be exercised for a purpose germane to his interest as a stockholder;3 b. It must be exercised in good faith, for specific and honest purpose, and not to gratify curiosity, or for speculative or vexatious purposes;4 c. It must be exercised during reasonable hours on business days; d. Copies of corporate records or excerpts from said records must be at the expense of the requesting director, trustee, or stockholder; and e. It is subject to other applicable laws.

This right is also subject to defenses, as in:

a. That the requesting stockholder has improperly used information before; b. There is a lack of good faith in the request for inspection;5 c. There is a lack of legitimate purpose; d. The requesting party is not a stockholder of record, or is a competitor, director, officer, controlling stockholder or otherwise represents the interests of a competitor; e. There are trade secrets or other Intellectual Property Rights that are entitled to protection; and f. Limitations provided by the Data Privacy Act of 2012.

In advocating for your position, you cited a portion of the ruling in Gokongwei, Jr., v. Securities and Exchange Commission,6 to wit:

In Grey v. Insular Lumber, this Court held that “the right to examine the books of the corporation must be exercised in good faith, for specific and honest purpose, and not to gratify curiosity, or for specific and honest purpose, and not to gratify curiosity, or for speculative or vexatious purposes. The weight of judicial opinion appears to be, that on application for mandamus to enforce the right, it is proper for the court to inquire into and consider the stockholder’s good faith and his purpose and motives in seeking inspection. Thus, it was held that “the right given by statute is not absolute and may be refused when the information is not sought in good faith or is used to the detriment of the corporation.

However, we wish to emphasize that the Supreme Court also ruled in the same case that:

The stockholder’s right of inspection of the corporation’s books and records is based upon their ownership of the assets and property of the corporation. It is, therefore, an incident of ownership of the corporate property, whether this ownership or interest be termed an equitable ownership, a beneficial ownership, or a ownership. This right is predicated upon the necessity of self-protection. It is generally held by majority of the courts that where the right is granted by statute to the stockholder, it is given to him as such and must be exercised by him with respect to his interest as a stockholder and for some purpose germane thereto or in the interest of the corporation. In other words, the inspection has to be germane to the petitioner’s interest as a stockholder, and has to be proper and lawful in character and not inimical to the interest of the corporation.

xxx

It appears to be the general rule that stockholders are entitled to full information as to the management of the corporation and the manner of expenditure of its funds, and to inspection to obtain such information, especially where it appears that the company is being mismanaged or that it is being managed for the personal benefit of officers or directors or certain of the stockholders to the exclusion of others.

Also, in the case of Terelay Investment and Development Corporation, vs. Cecilia Teresita J. Yulo,7 the Supreme Court held that:

In general, however, officers and directors have no legal authority to close the office doors against shareholders for whom they are only agents, and withhold from them the right to inspect the books which furnishes the most effective method of gaining information which the law has provided, on mere doubt or suspicion as to the motives of the shareholder. While there is some conflict of authority, when an inspection by a shareholder is contested, the burden is usually held to be upon the corporation to establish a probability that the applicant is attempting to gain inspection for a purpose not connected with his interests as a shareholder, or that his purpose is otherwise improper. The burden is not upon the petitioner to show the propriety of his examination or that the refusal by the officers or directors was wrongful, except under statutory provisions.

Congruently, the DPA applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing.8 It defines personal information as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.9 Meanwhile, sensitive personal information refers to personal information:

(1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; (2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and (4) Specifically established by an executive order or an act of Congress to be kept classified.10

In the present case, the corporate records requested to be inspected contain both personal information and sensitive personal information (collectively referred to as “personal data”). Significantly, Section 12(c) and Section 13(b) state:

SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

xxx

(c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;

…

SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

xxx

(b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;

xxx

The DPA has the twin task of protecting the fundamental human right of privacy while ensuring the free flow of information.11 It cannot conveniently be invoked to curtail the existing rights of the stockholders of a corporation, particularly to their right of inspection of corporate books and records, provided such activities are in accordance with prevailing laws and regulations.

Based on the foregoing, TBI may favorably act on the requesting stockholders’ request to access its corporate records. But TBI has the prerogative to determine the propriety of the other party’s request to access its corporate records and documents, since this right, while inherent, may be subject to limitations, defenses, and relevant laws like the DPA.

The allegations of bad faith and improper use of information cannot operate as a valid ground to refuse an inspection, if not sufficiently proven.12 It must be established that the scope or manner of the request and the conditions under which it was made are so frivolous that the huge cost to the business will, in equity, be unfair to the other stockholders.13

As mentioned above, Sections 12(c) and Section 13(b) provide for the lawful basis for the processing of the corporate records in the present case. This necessarily means that the other stockholders need not consent to the inspection. Nevertheless, TBI, as a personal information controller (PIC) may limit the scope of the inspection or redact such information that is not relevant to the request consistent with the general privacy principles of transparency, legitimate purpose, and proportionality,14 and in recognition of the rights of the data subjects affected.15 In Advisory Opinion 2019-011,16 we emphasized that:

The data subject concerned has the right to be informed of the request for disclosure. Moreover, the corporation has the obligation to examine or inquire about the particular demand thereby disclosing only those personal information that are necessary, not excessive, relevant and adequate to fulfill the legitimate purpose of the demand, as required by Section 74 [now Section 73] of the Corporation Code.

TBI must also implement reasonable and appropriate organizational, physical and technical measures to ensure the confidentiality and security of personal data,17 as mandated by the DPA and as supported by NPC Circular 23-06.18

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

For your reference.

Very truly yours,

(Sgd.) FRANKLIN ANTHONY M. TABAQUIN, IV Director IV, Privacy Policy Office

Footnotes

  1. An Act Providing for the Revised Corporation Code of the Philippines, [Revised Corporation Code of the Philippines], R.A. 11232 (2019) ↩

  2. An Act Protecting Individual Personal Information in Information and Communication Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  3. Gokongwei, Jr., v. Securities and Exchange Commission, G.R. No. L-45911 (April 11, 1979) ↩

  4. M.E. Grey v. Insular Lumber Company, G.R. No. L-45144 (April 3, 1939) ↩

  5. Terelay Investment and Development Corp. v. Cecilia Teresita J. Yulo, G.R. No. 160924, (August 5, 2015) ↩

  6. Ibid, 6. ↩

  7. Ibid, 8. ↩

  8. Data Privacy Act of 2012, §. 16. ↩

  9. Data Privacy Act of 2012, §. 3(g). ↩

  10. Data Privacy Act of 2012, §. 3(l). ↩

  11. Data Privacy Act of 2012, §. 2. ↩

  12. Sy Tiong Shiou et al v. Sy Chim, G.R. No. 174168 (March 30, 2009) ↩

  13. Philippine Associated Smelting and Refining Corporation vs. Pablito O. Lim, et al, G.R. No. 172948 (October 05, 2016) ↩

  14. Data Privacy Act of 2012, §. 11. ↩

  15. Data Privacy Act of 2012, § 16-18. ↩

  16. National Privacy Commission, Advisory Opinion 2019-011 (14 January 2019) ↩

  17. Data Privacy Act of 2012, §. 20. ↩

  18. National Privacy Commission, NPC Circular 23-06 (01 December 2023) ↩

Backlinks