Text
18 December 2024
Re: PUBLICATION OF FORMER EMPLOYEES’ PERSONAL DATA
Dear [Redacted],
We respond to your request for an Advisory Opinion on whether your client’s intended action of publicizing its former employees’ names, photographs, offenses or infractions committed, pending criminal cases, if applicable, and their severance from employment could be justified under Section 12(f) of the Data Privacy Act of 2012 (DPA).1
You state that your client is a large construction company, and it has encountered various instances of unethical and unlawful conduct by its employees.2 Necessarily, such conduct has affected the company’s integrity and reputation.
To address and mitigate unlawful practices, safeguard the interests and goodwill of the company, and inform the public to prevent former employees from engaging or committing other similar misconduct, your client expressed its intention to publish in newspapers of general circulation the identity, photographs, offenses, pending criminal cases, and employment severance details of the employees involved.
Thus, you seek guidance if the disclosure of the mentioned personal data through publication can be justified under Section 12(f) of the DPA.
Discussion
Personal Data; Sections 12 and 13 of the DPA
Oftentimes, when an employee is separated from employment, employers find it necessary to notify their clients that such employee is no longer connected with them. This common practice is recognized by the NPC. However, to ensure the protection of personal data, we must consider the circumstances surrounding the present matter.
As stated in your letter, your client intends to publish notices to forewarn the public against transacting with the employees involved and to prevent the possibility of such employees misrepresenting their association with the company, considering that some of them were charged in court by the company.
The DPA defines personal information as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.3 On the other hand, the DPA classifies the following as sensitive personal information, viz.:
(2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;4
(Emphasis supplied).
Further, processing is defined under the DPA as any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.5
Applying the foregoing to your present concern, the employees’ names, photographs and the fact of their severance from the company is considered as personal information, while offenses, pending criminal cases, and employment severance details are considered sensitive personal information under the DPA.
As regards the personal information intended to be published, we stated in Advisory Opinion No. 2019-0246 that:
It has been the common practice for companies to publish notices in newspapers and other media that a certain person appearing in the photograph used to be their employee, but is now no longer connected with the company, and a warning that transactions with the said person on behalf of the company will no longer be honored. The above is still allowed under the DPA. The basis for processing may be Section 12(f) which provides for the processing that is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution. Legitimate interest refers to matters that are desired by or important to a PIC, which must not be contrary to law, morals or public policy. This includes business, financial or other reasonable purpose.
On the other hand, NPC Circular 2023-077 provides that in the determination of legitimate interest, the following must be considered:
SECTION 3. General Considerations. — Section 12(f) of the DPA permits the processing of personal information when the processing is necessary for the legitimate interests pursued by the PIC or a third party to whom the personal information is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject that require protection under the Philippine Constitution.
A. Legitimate interest refers to any actual and real interest, benefit, or gain that a PIC or third party may have in or may derive from the processing of specific personal information.
B. Processing based on a legitimate interest may only be relied on for the processing of personal information. It cannot be relied upon when the processing involves sensitive personal information and privileged information.
C. The third party in Section 12(f) of the DPA refers to any natural or juridical person to whom personal information is disclosed and who is not the PIC, the personal information processor (PIP), or the data subject of the specific processing activity.
D. The fundamental rights and freedoms of data subjects protected under the Philippine Constitution and the effect and impact of the specific processing activity on such rights and freedoms shall be assessed and weighed against the legitimate interest of the PIC or third party through a legitimate interest assessment.
Indeed, your client’s interest in preventing former employees from engaging in fraudulent activities may well be considered as a legitimate interest contemplated by the DPA. This is particularly important to ensure that customers only engage with authorized employees, especially if these former employees transact with the public. Therefore, the publication of severance from employment is justified, provided that such processing will not have unwarranted impacts on the rights and freedoms of data subjects—in this case, the former employees.
However, there appears to be no applicable lawful criteria to publish sensitive personal information8 of these former employees, which include infractions committed and potential and/or pending cases. Disclosing their offenses and cases may be excessive to the primary purpose of the public notices, which is to forewarn the public against transacting with these individuals and to prevent the possibility of these employees misrepresenting their association with the company. To post case details before a final judgment has been rendered by the court may subject these former employees to public ridicule and prejudice. Furthermore, the publication may also be violative of an individual’s right to due process, which is a basic right guaranteed and protected by the 1987 Philippine Constitution, alongside the right to privacy.
With this, we suggest informing your client to reevaluate its proposed public notice mechanisms. The publication of severance of employment alone may be sufficient to inform the public, and to include additional information such as pending criminal action/s could be considered intrusive and violative of Section 13 of the DPA.
General Data Protection Principles; Proportionality
It must be emphasized that even if there exists a legal basis for processing, the DPA prohibits excessive processing of personal data. As such, the Personal Information Controller (i.e., your client) is still required to comply with the general data privacy principles of transparency, legitimate purpose, and proportionality.9
Notably, the principle of proportionality dictates that the processing of personal data shall be adequate, relevant, suitable necessary and not excessive in relation to a declared specified purpose. Thus, disclosure of personal data through public notices should be limited to its declared, specified, and legitimate purpose. Since the primary intent is to warn the public to prevent transactions with the former employees in the name of the company, the publication of severance of employment may already be sufficient and proportionate to achieve the purpose sought.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
For your reference.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN, IV Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communication Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
E.g. Bribery, kickbacks, theft, misappropriation of company assets, and allegations of sexual harassment, among others. ↩
-
DPA, Sec. 3(g) ↩
-
DPA, Sec. 3(l) ↩
-
DPA, Sec. 3(j) ↩
-
National Privacy Commission (NPC) Advisory Opinion No. 2019-024 (07 May 2019) ↩
-
NPC Circular 2023-07 (13 December 2023) ↩
-
DPA, Sec. 3(l) ↩
-
DPA, Sec. 11. ↩