Text
07 November 2024
Re: REQUEST TO OBTAIN A COPY OF PERSONAL DATA FOR AUDIT PURPOSES
Dear [Redacted],
We respond to your request for an Advisory Opinion on whether the Registrar (Registrar) may comply with the request of the Commission on Audit (COA) for a list of deceased persons without violating Republic Act No. 10173, or the Data Privacy Act of 2012 (DPA).1
You state in your letter that the COA requested the Registrar for a list of deceased persons containing personal information and sensitive personal information (collectively called personal data). Specifically, the COA asked the Registrar for a list containing the complete names and dates of birth of persons who died or were issued death certificates from January 2020 to December 2023. The COA’s request is in connection with its audit of Social Security System (SSS) pension fund payments. You also state that although the Registrar possesses the requested information, you hesitate from providing COA with the requested personal data since you posit that the consent of the deceased’s nearest surviving next of kin is necessary under the circumstances. Furthermore, COA’s request covers all deceased persons in Victorias City regardless of whether they are SSS members or not. Considering that the Registrar has no means to validate who among the deceased individuals were SSS members, you are concerned that even the personal data of non-SSS members may be disclosed to COA in the process.
Thus, you seek guidance as to whether you may legally accede to the COA’s request.
Discussion
Personal and Sensitive Personal Information
Personal and sensitive personal information are defined under Section 3 of the DPA, as follows:
(g) Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.
xxx
(l) Sensitive personal information refers to personal information:
(1) About an individual’s xxx age xxx;
It is clear that the name of a deceased individual is considered personal information. On the other hand, the complete date of birth qualifies as sensitive personal information as it can be used to ascertain an individual’s age.
Therefore, the processing of such information should be anchored on any of the criteria for lawful processing outlined in Sections 12 and 13 of the DPA for personal and sensitive personal information, respectively. It is worthy to note, however, that Section 4(e) of the DPA establishes a special case when the processing is in the performance of an agency’s constitutional or statutory function or mandate.
Constitutional or Statutory Mandate of the Commission on Audit
Under the 1987 Constitution,2 the COA is considered as the guardian of public funds, vesting it with broad powers over all accounts pertaining to government revenue and expenditures and the uses of public funds and property including the exclusive authority to define the scope of its audit and examination, establish the techniques and methods for such review, and promulgate accounting and auditing rules and regulations.3 Section 11, Chapter 4, Subtitle B, Title I, Book V of Executive Order No. 292, otherwise known as the Administrative Code of 1987, mirrors this constitutional mandate of COA.
Additionally, Section 3, Rule IV of the 2009 Revised Rules of Procedure of the Commission on Audit provides for the responsibility of the auditor to obtain sufficient evidence to support his/her findings as well as to safeguard the same.4
We reiterate our stance in NPC Advisory Opinion No. 2020-016 in which we acknowledged the authority of the COA as an independent constitutional body and recognized its power, authority, and duty to examine, audit and settle all accounts and expenditures of the funds and properties of the Philippine government. We also stated therein that the DPA should not be interpreted to hamper, or interfere with, the performance of the duties and functions of duly constituted authorities. Further, the COA, in carrying out its mandate, enjoys the presumption of regularity in the performance of its duties. The determination of what methods to utilize in the collection or gathering of personal data in performing its auditing functions shall be left to the COA’s sound discretion.
We emphasize that the DPA, its IRR, and related NPC issuances should be read in conjunction with existing laws. The DPA has the twin task of protecting the right to privacy while ensuring the free flow of information and should not be used as an excuse for non-compliance with other existing laws, rules and regulations.5 The 1987 Constitution explicitly grants the COA with enough latitude to determine, prevent and disallow irregular, unnecessary, excessive, extravagant or unconscionable expenditures of government funds.6
Accordingly, the COA must be provided with the necessary information to effectively carry out its audit function and examine government expenditures.
Principle of Proportionality
There is a legal presumption granted to COA that it will lawfully process personal data pursuant to its mandate, and that the processing shall be limited to achieving the specific purpose, function, or activity. Nevertheless, COA remains subject to the requirements under the DPA, its IRR, and NPC issuances. This includes implementing security measures to secure and protect personal data mandated under NPC Circular No. 2023-06.7 Significantly, maintaining compliance with the law requires strict adherence to the data privacy principles outlined in the DPA, one of which is the principle of proportionality, to wit:
Section 11. General Data Privacy Principles. The processing of personal information shall be allowed, subject to compliance with the requirements of this Act and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.
Personal information must be:
xxx
(c) Accurate, relevant and, where necessary for purposes for which it is to be used the processing of personal information, kept up to date; inaccurate or incomplete data must be rectified, supplemented, destroyed or their further processing restricted;
(d) Adequate and not excessive in relation to the purposes for which they are collected and processed;
(Emphasis supplied).
The principle of proportionality was further elaborated in Section 18 of the Implementing Rules and Regulations (IRR) of the DPA:
Section 18. Principles of Transparency, Legitimate Purpose and Proportionality. The processing of personal data shall be allowed subject to adherence to the principles of transparency, legitimate purpose, and proportionality.
xxx
c. Proportionality. The processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.
(Emphasis supplied).
Thus, it is essential to ensure that the information to be disclosed for audit purposes should only be limited to what is necessary to achieve the objectives of the audit. Consequently, we suggest that the Registrar coordinate with the COA to seek guidance on the personal data needed for the audit, particularly since the latter’s request appears to be too extensive and disproportionate for its purpose.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
For your reference.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN, IV Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes. ↩
-
Section 2, Article IX-D of the 1987 Constitution ↩
-
Yap v. Commission on Audit, G.R. No. 158562, 23 April 2010. ↩
-
Commission on Audit, Issuances, Revised Rules of Procedure, available at https://www.coa.gov.ph/issuances/2009-revised-rules-of-procedures-of-the-commission-on-audit/ (last accessed 11 October 2024). ↩
-
See: National Privacy Commission, Advisory Opinion No. 2018-035 (20 July 2018). ↩
-
Sanchez v. Commission on Audit, G.R. No. 127545, 23 April 2008. ↩
-
Security of Personal Data in the Government and the Private Sector. ↩