NPC Issuance Wiki

NPC Advisory Opinion No. 2024-018 — Real-Time Traffic Situation Sharing via Live Streaming for Tollway Surveillance

Issued Advisory Opinion

Official opinion tags

Text

20 December 2024

Re: REQUEST FOR SHARING OF REAL-TIME TRAFFIC SITUTATION VIA LIVE STREAMING FOR THE TOLLWAY SURVEILLANCE MONITORING INFORMATION SYSTEM (TSMIS) PROJECT

Dear [Redacted],

We respond to your request for an Advisory Opinion on the data privacy implications of the Toll Regulatory Board (TRB)‘s request for access to the Closed-Circuit Television (CCTV) Systems video maintained by the toll road operators.

In your letter, you state that you requested toll road operators to share their CCTV footage showing real-time traffic flow in order to implement the TRB’s Tollway Surveillance Monitoring Information System (TSMIS) Project.

However, one of the toll road operators (hereafter, the “Operator”) declined the request reasoning that the DPA generally requires the consent of motorists before publishing images or data captured by their tollway CCTV systems. The Operator also cites Section 18 of the DPA’s Implementing Rules and Regulations (IRR) which mandates that if alternative means are available to comply with data protection requirements without releasing personal data, those means should be prioritized.

The Operator further stated that they are already providing real-time traffic updates through TV and radio networks, as well as publishing updates on their Twitter account and their tollways app. Consequently, they believe that the requested “live feed” from their CCTV systems is unnecessary. Furthermore, they expressed their concern that live streaming of traffic from their CCTV systems via the proposed software (Discord, Skype, or Zoom) may lead to unauthorized processing and cybersecurity risks, as they do not have control over these software and any individuals with access to the stream could record or download the footage.

In response, TRB argues that:

  1. TRB’s request falls under Section 4(e) of the DPA and Section 5(d) of its IRR as a Special Case, since, by law, it has jurisdiction and power to regulate the operation and maintenance of toll facilities which includes the installation of CCTVs.

  2. TRB will neither collect nor process personal information or personally identifiable information. TRB is merely requesting the toll operators to share real-time CCTV footage of traffic situations on the toll expressways, not the personal or identifiable information of motorists using the tollways.

  3. TRB’s access to CCTV footage. Furthermore, TRB will not take control of the CCTV cameras or monitors but will only have access to live footage of traffic conditions on the toll expressways. The toll operators will maintain control over the footage, ensuring that no personal or identifiable information of motorists is included in the shared streams.

  4. TRB will utilize a secure software platform, such as Discord or any other software recommended by the toll operators to prevent any data security incidents. As additional safeguards, TRB will:

    • (i) Limit access to the software to authorized personnel only;
    • (ii) Share only snippets, screenshots, or short clips of the footage with toll expressway users for real-time traffic information;
    • (iii) Establish a retention period for the shared footage.

  5. Necessity and proportionality of the request: The request to share real-time traffic footage via live stream is both necessary and proportionate to the legitimate interests pursued by TRB as a regulatory agency. Firstly, it ensures the proper maintenance of tollway facilities by allowing real-time monitoring of their operations. Secondly, it aids in analyzing traffic patterns, responding to emergencies, and managing traffic incidents on the toll expressways. Lastly, it provides a convenient way to offer toll expressway users real-time footage of traffic conditions.

  6. Impact of denying TRB’s request: Finally, the denial of TRB’s access to the toll operators’ CCTV footage due to perceived risks to data privacy and security could set a negative precedent for regulatory agencies like TRB. Such a decision could be used by regulated entities as a basis to refuse compliance with their obligations under the Concession Agreements or Supplemental Toll Operation Agreement (STOA).

Hence, your present request.

Discussion

Personal Information; Processing; CCTV

The Data Privacy Act of 2012 (DPA)1 defines personal information as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.2

Meanwhile, processing is defined as any operation or any set of operations performed upon personal data including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure, or destruction of data.3

On the other hand, NPC Circular No. 2024-024 defines Closed-Circuit Television or “CCTV” as referring to closed-circuit television or camera surveillance systems in a fixed or stationary location that can capture images of individuals or other information relating to individuals.

Based on your statements, the screenshots of submitted CCTV footage from tollways reveal, at best, only vehicle plate numbers. The nature of tollways, where vehicles are moving at high speeds, makes it difficult to immediately identify an individual based solely on CCTV footage without employing high technology applications like automated license plate recognition (ALPR), facial recognition, and integrated data analytics that enhance the ability to identify vehicles and individuals.

Applying the definition provided by the DPA, plate numbers, on their own or without additional information that could directly and certainly identify an individual, cannot be considered personal information. Thus, without access to other databases, plate numbers only identify a vehicle and not the user or its owner.

Scope of the DPA; Public Authority; Limitations on Data Subjects’ Rights

Generally, the DPA applies to the processing of all types of personal information and to any natural and juridical person involved in the processing of personal information. However, the DPA and its IRR provide a list of specified information which do not fall within its scope. Particularly, Section 5(d) of the IRR states that:

Section 5. Special Cases. The Act and these Rules shall not apply to the following specified information, only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned:

xxx

d. Information necessary in order to carry out the functions of public authority, in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function, including the performance of the functions of the independent, central monetary authority, subject to restrictions provided by law.

xxx

Provided, that the non-applicability if the Act or these Rules do not extend to personal information controllers or personal information processors who remain subject to the requirements of implementing security measures for personal data protection: Provided further, that the processing of the information provided in the preceding paragraphs shall be exempted from the requirements of the Act only to the minimum extent necessary to achieve the specific purpose, function or activity.

However, for this exemption to apply, the following must be established:

  1. The information is necessary in order to carry out the law enforcement or regulatory function of a public authority;
  2. The processing is for the fulfillment of a constitutional or statutory mandate;
  3. There is strict adherence to all due process requirements;
  4. Applies only to the minimum extent of collection, access, use, disclosure, or other processing necessary to the purpose, function, or activity concerned; and
  5. Only the specified information falls outside the scope of the DPA. The public authority, considered as a personal information controller under the DPA, must still comply with the other requirements of the DPA such as the implementation of reasonable and appropriate physical, organizational and technical security measures, uphold the rights of data subjects and adhere to the data privacy principles of transparency, legitimate purpose, and proportionality.5

Presidential Decree No. 11126 vests the TRB with the jurisdiction to regulate the operation and maintenance of toll facilities. As such, the CCTV footage that the TRB requests qualifies as information that is necessary for TRB to carry out its regulatory function. In other words, TRB’s processing of CCTV footage is permitted under the DPA as this is necessarily included in its mandate to determine and decide the kind, type and nature of public improvements that will be constructed and/or operated on toll facilities, including the establishment, operation and maintenance of Service Facilities throughout the tollways.

Further, the TRB’s request may also find support under Section 7 of NPC Circular No. 2024-02, to wit:

SECTION 7. Third-party access request. — A third-party access request is a request to access CCTV footage made by a person other than the data subject involved in the footage or the latter’s authorized representative. If a data subject involved in the footage or their authorized representative requests access to CCTV footage, the presence of another person’s image within the CCTV footage does not automatically classify such request as a third-party access request. Further, in handling third-party access requests, the same policies and procedures outlined in the previous section shall apply.

x x x

B. Subject to the criteria provided for the lawful processing of personal data under Sections 12 and 13 of the DPA, CCTV footage may be disclosed in the following instances:

x x x

  1. Other third-party requests. Third-party access requests for CCTV footage and images shall be evaluated with greater scrutiny to prevent violation of the privacy rights of the data subjects concerned.

a) Upon determination of PICs that the requesting third party’s needs outweigh those of the data subjects to whom the CCTV footage and images pertain, it may release information to such requesting third party.

b) PICs must determine on a case-to-case basis if they will accede to such request taking into consideration the general principles of privacy, the rights and freedoms of the data subjects whose images are recorded by the CCTV systems, and a lawful basis for processing under Section 12 or Section 13 of the DPA.

Based on the foregoing, the Operator should consider TRB’s regulatory function as an appropriate lawful basis under the DPA in allowing viewing access to live CCTV footage in its toll facilities.

Data Privacy Principles; Security Measures; Accountability of the PIC

It must be emphasized that even if the TRB’s request to the Operator may be considered as a special case, this only means that it need not establish a lawful criteria for its processing of personal data under Sections 12 of the DPA. The TRB, as a Personal Information Controller (PIC), is still subject to the other requirements under the DPA, its IRR, and issuances of the NPC. Moreover, the TRB must also adhere to the general data privacy principles of transparency, legitimate purpose, proportionality7, and accountability.

The principle of proportionality states that the processing of personal data shall be adequate, relevant, suitable necessary, and not excessive in relation to a declared specified purpose. It also states that personal data shall only be processed if the purpose of the processing cannot be reasonably fulfilled by any other means. Thus, TRB’s access to CCTV footage should be limited to its specified purpose and to specific requested footage.

On the other hand, the principle of legitimate purpose supposes that the processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy. In this regard, the TRB should ensure that the access to real-time footage serves its mandate to respond to tollway concerns, emergencies, and to aid in the management of traffic in tollways. The TRB, in collaboration with other toll operators, should establish comprehensive guidelines governing the sharing and access to these footage, ensuring compliance with the data privacy principles.

Meanwhile, the principle of transparency requires that the data subject must be aware of the nature, purpose, and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of the personal information controller, his or her rights as a data subject and how these can be exercised. Thus, the TRB must provide the appropriate privacy notices to apprise data subjects that it will take CCTV recordings. A privacy notice is a statement made to a data subject that describes how an organization collects, uses, retains, and discloses personal information. A privacy notice may be referred to as a privacy statement, a fair processing statement, or, sometimes, a privacy policy.8

Lastly, the principle of accountability requires PICs to be responsible for personal data processed using CCTV systems and shall use contractual or other reasonable means to ensure proper safeguards are in place when the processing is subcontracted to Personal Information Processors (PIPs).9 The TRB may ensure compliance by adhering to the general principles of privacy, implementing safeguards, keeping appropriate records, upholding data subject rights and their other obligations under the DPA, IRR, and relevant issuances of the NPC.

In the present case, we suggest that the TRB and tollway operators post privacy notices in conspicuous areas where CCTVs are operated, like toll gates, which must cite the lawful criteria upon which the processing is based, as well as to duly inform affected data subjects.

Finally, by virtue of NPC Circular 2023-06,10 TRB should ensure the implementation of organizational, physical, and technical security measures when it receives the requested footage and information, and have mechanisms in place to enable the free exercise of data subject rights, where appropriate. We recommend that the TRB ensure that it has proper guidelines in processing CCTV footage, especially those containing personal information, taking into consideration the above discussions.

We advise that TRB adopt a more secure platform for accessing CCTV footage from toll operators. The TRB should collaborate with these toll operators to determine appropriate platforms for access and ensure that access is strictly limited to a designated personnel to prevent potential cybersecurity risks and unauthorized access.

Furthermore, we recommend implementing “view-only” access controls to minimize the risk of any accidental, unauthorized, or unlawful processing. Once viewing access is granted to the TRB, it is crucial that the use of the footage be strictly limited to its intended purpose of resolving the concerns, and emergencies, and aiding in the management of traffic in tollways.

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished to us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

For your reference.

Very truly yours,

(Sgd.) FRANKLIN ANTHONY M. TABAQUIN, IV Director IV, Privacy Policy Office

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communication Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. Id., Sec. 3(g) ↩

  3. Id., Sec. 3(j) ↩

  4. National Privacy Commission, NPC Circular No. 2024-02 (9 August 2024). ↩

  5. National Privacy Commission, NPC Advisory Opinion 2021-028 (16 July 2021). ↩

  6. Authorizing The Establishment Of Toll Facilities On Public Improvements, Creating A Board For The Regulation Thereof And For Other Purposes [Toll Operation Decree], Presidential Decree No. 1112. ↩

  7. Section 18, Implementing Rules and Regulations of the Data Privacy Act of 2012. ↩

  8. National Privacy Commission, NPC Advisory Opinion 2022-015 (23 June 2022). ↩

  9. Sec. (3), NPC Circular 2024-02. ↩

  10. National Privacy Commission, NPC Circular No. 2023-06 (01 December 2023). ↩

Backlinks

  • No backlinks found