Text
05 November 2024
Thru: [Redacted]
Re: Requests for Member and Vessel Information by government agencies pursuant to a Senate investigation.
Dear [Redacted],
We respond to your inquiry on whether the requests of the Philippine Coast Guard (PCG) and the Bureau of Immigration (BI) for information and access to records of the Manila Yacht Club (MYC) related to an ongoing Senate investigation violates the Data Privacy Act of 2012 (DPA).1
Discussion
You state that the PCG sent a letter-request to MYC for the list of names of yachts that are MYC members as well as a list of other vessels that arrived and departed from the MYC in the month of July 2024. On the other hand, the BI also sent a letter requesting for a meeting to verify with your records the movement of yachts specifically those with declarations for international travel for the months of May, June, and July 2024. Both government agencies stated that the purpose of their request is for them to provide information in connection with an ongoing investigation of various Senate Committees on the alleged escape of a fugitive using a yacht. Besides the letter-request from the PCG and BI, there was neither a subpoena nor an official directive from any government entity that required the MYC to produce the information requested by the PCG and BI.
You state that MYC is willing to cooperate and have started the process of obtaining the consent of its members. However, your concern in granting the requests is that the MYC may be constrained to disclose, among others, the following documents which contain personal data:
- The signed and executed membership forms of your members;
- The logbook of security personnel;
- Member’s guest list declarations, including the attached government issued IDs of theirs guests;
- The logbook of MYC’s dispatcher records.
You state further that these records also contain the following information which you view as protected by the DPA:
i. The names of your members; ii. The names and personal details of your member’s guests (contained in the government issued IDs presented to the MYC); iii. Member’s official signature; iv. Names of the vessels of members and other details which when put together with other information available to the public may directly and certainly identify MYC members; v. Member’s use of their vessels, specifically the locations visited and frequented; vi. Member’s phone numbers, email address, residence and business address; vii. Government issued IDs such as passports, driver’s license.
Thus, you seek guidance on the following:
- Whether the names of the MYC member’s vessels are considered as personal information under the DPA; and
- Whether granting the requests of the PCG and/or the BI for other information and/or examination of records may be deemed a violation of Section 32 of the DPA?
Considering that the issues you present are interrelated, we shall discuss them jointly.
Personal information; processing by a public authority
The DPA defines personal information as any information from which the identity of an individual is apparent or can be reasonably and directly ascertained, or when put together with other information would directly and certainly identify an individual.2 Meanwhile, sensitive personal information (SPI) are those personal information specifically classified under Section 3(l) of the DPA as sensitive. Both terms are jointly referred to as personal data.
Thus, whether the name of the vessel of an MYC member, or information on yacht movement, constitutes personal information would depend on the context of the disclosure.
The name of a vessel or the movement of yachts for a particular period, by itself, may not be considered as personal information. Hence, there would be no data privacy concern to speak off in that instance. However, if the vessel’s name can be linked to an individual, or if the processing would result in the disclosure of other personal data that would lead to the identification of an individual, such disclosure can qualify as processing of personal data. In which case, the proper basis/bases under the DPA must be established.
Besides the member’s individual consent, the disclosure of personal data of MYC members to law enforcement authorities (LEA) may be justified under the circumstances based on Section 12 (e) and Section 13 (b) and (f) of the DPA, viz.:
For personal information -
(e) The processing is necessary to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate;
xxx
For sensitive personal information -
(b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;
xxx
(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.
(Underscoring supplied.)
Compliance with procedural rules; proportionality
It must be emphasized that the existence of lawful bases does not grant LEAs absolute and unrestricted right to access and process personal data. The LEAs must still comply with the principles of transparency, legitimate purpose, and proportionality. Moreover, they must comply with procedural rules prescribed by law to ensure that individual rights are respected and upheld.
After all, the DPA is anchored on Section 3, Article III of the 1987 Constitution, which provides:
- The privacy of communication and correspondence shall be inviolable except upon lawful order of the court, or when public safety or order requires otherwise, as prescribed by law.
- Any evidence obtained in violation of this or the preceding section shall be inadmissible for any purpose in any proceeding.
The DPA reinforces the constitutional safeguard to the right to privacy in that, while LEAs such as the PCG and BI may obtain personal data from MYC, such processing must still comply with the applicable legal requirements to ensure that requests for information are legally justified, specific, proportional and carried out through the appropriate channels.
We note that under Republic Act No. 9993, or the Philippine Coast Guard Law of 2009, the PCG’s primary mandate involves maritime safety, law enforcement, search and rescue, marine environmental protection, and national security within Philippine waters. Under Section 3 (l) of RA 9993, one of the mandates of the PCG is to assist in the enforcement of laws on fisheries, immigration, tariff and customs, forestry, firearms and explosives, human trafficking, dangerous drugs and controlled chemicals, transnational crimes and other applicable laws within the maritime jurisdiction of the Philippines.
On the other hand, under Commonwealth Act No. 613, or the Philippine Immigration Act of 1940, the BI is principally responsible for the administration and enforcement of immigration, citizenship, and alien admission and registration laws. Section 37(a) of CA 613 authorizes the Commissioner of Immigration (or a designated officer) to issue subpoenas for witnesses and documents relevant to cases involving deportation, exclusion, and other immigration-related issues.
From the foregoing, it appears that disclosing to the PCG and the BI the personal data of MYC members through a mere letter-request could potentially expose all the parties to liability not only for violation of the DPA but also of their respective mandates and internal processes. Nevertheless, both the PCG and BI may still pursue their investigation with MYC if the BI would issue a subpoena to be served and enforced jointly with the PCG. Alternatively, since it is only the BI that has the express power to subpoena, the PCG may separately conduct its investigation by requesting the Senate to issue a subpoena to the MYC.
Requiring the presentation of a subpoena instead of a mere letter-request ensures that the LEAs comply with the principle of proportionality under the DPA and to avoid questions on the admissibility of the evidence they may obtain. Additionally, a subpoena also serves as a safeguard to the data privacy rights of the other members of the MYC who have no connection to the investigation.
As we have stated in previous Advisory Opinions, the DPA is not meant to prevent LEAs from processing personal data when necessary to fulfill their mandates. Rather, the DPA serves to ensure that an individual’s right to informational privacy is respected while promoting the fair, secure, and lawful processing of personal data.
Please be advised that the foregoing was rendered based solely on the information you provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
Please be guided accordingly.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN, IV Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the private Sector, Creating for this Purpose a National Privacy Commission, and for other Purposes [Data Privacy Act of 2012], Republic Act No.10173 (2012). ↩