NPC Issuance Wiki

NPC Advisory Opinion No. 2025-003 — Collection of and Access to Member's Birth, Marriage, and Death Certificates

Issued Advisory Opinion

Official opinion tags

Text

13 May 2025

Re: COLLECTION OF AND ACCESS TO MEMBER’S BIRTH, MARRIAGE, DEATH CERTIFICATES, AND OTHER PERSONAL RECORDS

Dear [Redacted]:

We respond to your request for an advisory opinion on whether any privacy issues may arise should you seek the consent of the members of the Armed Forces and Police Savings and Loan Association, Inc. (AFPSLAI) in the collection of several civil documents through the following authorization statement:

“I hereby authorize AFPSLAI to secure from the Philippine Statistics Authority (PSA), the Local Civil Registrar, or appropriate agency, a copy of my birth certificate, marriage contract, CENOMAR, and such other pertinent PSA records, for insurance, pension, membership, refund and other lawful purpose.”

You state that the collection of such documents is intended to update member records especially in instances of a member’s death. These documents are also being collected to support the Credit Redemption Insurance claims, in which AFPSLAI becomes a beneficiary on on behalf of deceased members with outstanding loans.

Accordingly, you seek to obtain the member’s consent via the above authorization statement to ascertain the propriety of member claims and to safeguard the interest of both AFPSLAI and its members.

Discussion

Definition of personal data; Lawful criteria for processing

Republic Act No. 10173 or the Data Privacy Act of 20121 (DPA) mandates the protection of personal information. Under the DPA, personal information is defined as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.2 On the other hand, the DPA classifies the following as sensitive personal information,3 viz.:

xxx

(1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;

(2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;

(3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns;

xxx

Further, processing is defined under the DPA as any operation or any set of operations performed upon personal information, including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.

Considering the above provisions, the birth certificate, marriage contract, Certificate of No Marriage Record (CENOMAR), and such other pertinent PSA records of AFPSLAI members necessarily contain personal and sensitive personal information. As such, collection of such documents by AFPSLAI from its members constitutes processing under the DPA. Thus, the processing must comply with Sections 12 and 13 of the DPA, respectively, to wit:

SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

(a) The data subject has given his or her consent;

(b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract;

(c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;

(d) The processing is necessary to protect vitally important interests of the data subject, including life and health;

(e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or

(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.

SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

(a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing;

(b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;

(c) The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing;

(d) The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, That such processing is only confined and related to the bona fide members of these organizations or their associations: Provided, further, That the sensitive personal information are not transferred to third parties: Provided, finally, That consent of the data subject was obtained prior to processing;

(e) The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured; or

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.

You posit that the consent of AFPSLAI members is necessary to access their records as such access arises from their membership with the AFPSLAI which constitutes a contractual relationship. That said, we wish to clarify that the AFPSLAI, as a Personal Information Controller (PIC), must adhere to the general data privacy principles of Transparency, Legitimate Purpose, Proportionality, and Fairness, which are elaborated in NPC Circular No. 2023 – 04 or the Guidelines on Consent.4 In relying on consent as a basis, AFPSLAI must ensure such consent was freely given, specific to the declared purpose, manifested through a clear assenting action, and evidenced by written, electronic, or recorded means.

However, consent is not the only applicable legal basis in this case. AFPSLAI may also rely on Section 12(c) since the processing involved is necessary for compliance with a legal obligation, and Section 13(f), since the processing is necessary for the protection of lawful rights and interests or the establishment, exercise, or defense of legal claims. As a regulated entity by the Banko Sentral ng Pilipinas (BSP), AFPSLAI has a legal obligation to comply with the BSP’s issuances which requires the presentation and collection of PSA documents. Also, as applied in this case, accessing such records may be allowed in situations like assessing the propriety of credit redemption insurance claim, or resolving conflicting claims among beneficiaries. Section 3 of NPC Advisory 2024-02, or Guidelines on Personal Data Processing Based on Section 13 (f) of the Data Privacy Act of 2012,5 clarifies:

SECTION 3. Processing under Section 13 (f) of the DPA as legitimate interest. — Processing under Section 13 (f) of the DPA may be considered legitimate interest under Section 12 (f) of the DPA, which is a lawful basis for processing personal information.

A. Processing personal information that is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings or necessary for the establishment, exercise, or defense of legal claims3 may be considered as legitimate interest under Section 12 (f) of the DPA. As such, Section 13 (f) in relation to Section 12 (f) of the DPA may be a lawful basis for processing personal information for this purpose.

B. The PIC must fulfill the requisites for processing based on legitimate interest in NPC Circular 2023-07 or the Guidelines on Legitimate Interest.

Further, Advisory Opinion No. 2022-0096 provides that, in the determination of legitimate interest, the following must be considered:

  1. Purpose test – The existence of a legitimate interest must be clearly established, including a determination of what the particular processing operation seeks to achieve;
  2. Necessity test – The processing of personal information must be necessary for the purpose of the legitimate interest pursued by the PIC or third party to whom personal information is disclosed, where such purpose could not be reasonably fulfilled by other means; and
  3. Balancing test – The fundamental rights and freedoms of data subjects must not be overridden by the legitimate interests of the PIC or third party, considering the likely impact of the processing on the data subjects.

Thus, in cases where consent may not be obtained, AFPSLAI may anchor its processing on other lawful criteria (i.e. legal obligation, legal claims).

Principle of Proportionality; Privacy Notice

We wish to note however, that even if there exists legal bases in the processing of the members’ personal data, AFPSLAI, as a PIC, is still required to comply with the general data privacy principles of transparency, legitimate purpose, and proportionality.7

Notably, the principle of proportionality dictates that the processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared specified purpose. Thus, the collection of personal data through these documents should be limited to its declared, specified, and legitimate purpose.

In this regard, AFPSLAI may utilize their privacy notices to clearly articulate the legal basis/bases for the processing of their members’ data, particularly for documents required by the BSP and/or other regulatory agencies. Such privacy notices serve to inform the data subjects of the lawful basis being relied upon, especially in instances where consent is not the sole or primary basis for the processing.

Having an adequate privacy notice reinforces the principles of transparency and legitimate purpose, and may further be supported by customizing privacy clauses to reflect the scope and extent of the documents that are being processed.

Data Subject Rights; Safeguards; Establishment of Guidelines

Ultimately, in any processing of personal data, we respectfully remind AFPSLAI to give due regard to the fundamental rights and freedoms of data subjects. As a PIC, AFPSLAI bears the responsibility of ensuring that its data subjects are informed of their rights under the DPA, and that appropriate mechanisms are in place to enable the exercise of such rights. For a thorough guidance on the matter, you may read through NPC Advisory No. 2021-019 on Data Subject Rights.

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

For your reference.

Very truly yours,

(Sgd.) FRANKLIN ANTHONY M. TABAQUIN, IV Director IV, Privacy Policy Office

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, (2012). ↩

  2. Ibid., Section 3(g). ↩

  3. Ibid., Section 3(l). ↩

  4. National Privacy Commission, Guidelines on Consent, NPC Circular No. 2023 – 04 (07 November 2023). ↩

  5. National Privacy Commission, Guidelines on Personal Data Processing Based on Section 13 (f) of the Data Privacy Act of 2012, NPC Advisory 2024-02 (12 August 2024). ↩

  6. NPC Advisory Opinion No. 2022-009 (02 March 2022); see also Opinion Nos. 2022-002 (Feb. 11, 2022), 2021-10 (March 22, 2021) and 2020-50 (Nov. 26, 2020). ↩

  7. DPA, Sec. 11. ↩

Backlinks

  • No backlinks found