Text
23 June 2025
Re: DATA SHARING PROTOCOLS BETWEEN GOVERNMENT AGENCIES TO STREAMLINE IDENTITY VERIFICATION
Dear [Redacted]:
This pertains to your request for guidance on the requirements for data sharing between the Philippine Veterans Affairs Office (PVAO) and the Philippine National Police (PNP) under the Data Privacy Act of 2012 (DPA),1 its Implementing Rules and Regulations (IRR), and other related issuances.
Discussion
You inform that when the PNP was established in 1990, members of the Philippine Constabulary (PC) were given the option to join either the PNP or the Armed Forces of the Philippines (AFP). Under Republic Act No. 6948,2 or the law governing the pensions benefits of military personnel, the term “beneficiaries” does not only include AFP veterans who served for at least six (6) years but also former PC members who opted to join the PNP. Hence, the common pensioners of PVAO and the PNP.
Currently, PVAO is implementing a Single ID System Program (the “Program”), which streamlines the identification and updating of the records of pensioners and reduces the cost and simplifies transactions for veterans and their eligible dependents. At present, Single IDs are only issued to retired AFP personnel and PVAO pensioners aged sixty-five (65) and above. But PVAO intends to extend the Program to future PVAO pensioners who are PNP retirees below sixty-five (65) years old to allow them to access non-pension benefits, such as medical care and hospitalization assistance. However, PVAO faces challenges in validating the identity and documentary requirements of these future PVAO pensioners from the PNP as there are no mechanisms in the processing of data between PVAO and the PNP; hence, your present request.
Data Sharing Agreements
NPC Circular No. 2020-03 (On Data Sharing Agreements) defines “data sharing” as the sharing, disclosure, or transfer to a third party of personal data under the custody of a personal information controller (PIC) to one or more other PICs.3 Data sharing may be covered by a DSA or a similar document containing the terms and conditions of the sharing agreement, including obligations to protect the personal data shared, the responsibilities of the parties, mechanisms through which data subjects may exercise their rights, among others.4
Please note that only PICs (such as PVAO and the PNP in this case) can be parties to a data sharing agreement. Please note further that a DSA need not be strictly in the form of a contract as the same may also be executed through a joint issuance or any similar document (e.g., policy or Memorandum of Agreement, etc).5 We emphasize, however, that despite the permissive language of NPC Circular 2020-03 regarding the execution of a DSA, it is highly recommended for PICs to execute one or any similar document as a matter of best practice and for purposes of accountability. The execution of a DSA is a sound recourse and demonstrates accountable personal data processing, as well as good faith in complying with the requirements of the DPA, its IRR, and issuances of the NPC.
For the basic contents of a DSA, you may refer to Section 9 of NPC Circular No. 2020-03.
Lawful processing; statutory mandate
Since data sharing is considered as processing of personal data, the parties to the DSA must satisfy at least one of the criteria set forth under Section 12 (for personal information) or Section 13 (for sensitive personal information and privileged information) of the DPA. In the present case, the processing of personal data may find basis under Section 12 (c) or Section 13 (b), to wit:
Sec. 12. Criteria for Lawful Processing of Personal Information – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists: xxx (c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject; xxx
Section 13. Sensitive Personal Information and Privileged Information – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases: xxx (b) The processing of the same is provided for by existing laws and regulations: Provided, that such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information; xxx
Adherence to general data privacy principles; Appropriate security measures
In addition to establishing the appropriate lawful basis, any data sharing between or among government agencies, regardless of form or arrangement, must comply with the following principles under NPC Circular No. 2020-03 on Data Sharing Agreements:
a) Adherence to the data privacy principles of transparency, legitimate purpose, and proportionality; b) Fulfillment of all applicable requirements prescribed by the DPA, its Implementing Rules and Regulations (IRR), and other issuances of the NPC; c) Recognition of upholding the rights of affected data subjects, unless otherwise provided by law; d) Ensuring that the shared and collected data are accurate, complete, and where necessary for the declared, specified and legitimate purpose, kept up to date; and e) Implementation of reasonable and appropriate organizational, physical, and technical security measures intended for the protection of personal data against any accidental or unlawful destruction, alteration, and disclosure as well as against any other unlawful processing.6
In this regard, worthy of note is the concurring opinion of Justice Caguioa in the case of Integrated Bar of the Philippines vs. Purisima,7 where the Supreme Court struck down for being violative of privacy rights a Revenue Regulation requiring the registration of appointment books of professionals containing their clients’ names and the date and time of consultation. Justice Caguioa wrote:
xxx I would like to add that this requirement violates the general principle of proportionality that is espoused in Republic Act No. 10173 or the Data Privacy Act of 2012, viz:
Sec. 18. Principles of Transparency, Legitimate Purpose and Proportionality. – The processing of personal data shall be allowed subject to adherence to the principles of transparency, legitimate purpose, and proportionality. xxx
c. Proportionality. The processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.
xxx requiring self-employed professionals to disclose their clients’ names and their appointment schedules is already excessive vis-à-vis the declared purpose of RR 4-2014 xxx
Justice Lazaro-Javier likewise gave the concurring opinion in the same case that the assailed provision is void as it violates the requirement for data sharing between government agencies under NPC Circular on Data Sharing Agreements in that there are mechanisms by which to conduct such data sharing.
As such, it is crucial for PICs, such as PVAO and PNP, to ensure that only personal data necessary, adequate, relevant, and not excessive in relation to the specified and declared purpose are processed.
In addition to the foregoing, government agencies, as PICs, are likewise required to ensure that there are mechanisms in place for the protection of personal data as well as the rights of the data subjects.
In the case of Ople vs. Torres,8 the Supreme Court emphasized:
We can even grant, arguendo, that the computer data file will be limited to the name, address and other basic personal information about the individual. Even that hospitable assumption will not save A.O. No. 308 from constitutional infirmity for again said order does not tell us in clear and categorical terms how these information gathered shall be handled. It does not provide who shall control and access the data, under what circumstances and for what purpose. These factors are essential to safeguard the privacy and guaranty the integrity of the information. Well to note, the computer linkage gives other government agencies access to the information. Yet, there are no controls to guard against leakage of information. xxx
It is plain and we hold that A.O. No. 308 falls short of assuring that personal information which will be gathered about our people will only be processed for unequivocally specified purposes. xxx
As can be gleaned therefrom, the mere fact that personal data is shared with a government agency does not, by itself, ensure its security absent any express guarantee that adequate safeguards are in place for data protection. NPC Circular 2023-06 (Security of Personal Data in the Government and the Private Sector) outlines the minimum standards and requirements for the security of personal data. A PIC or a personal information processor (PIP) may implement more detailed or stricter policies and procedures that reflect industry-specific operating requirements. As such, the PIC or PIP is in the best position to determine the reasonable and appropriate organizational, physical, and technical security measures to implement, considering that it has the most knowledge of its own operations and IT infrastructure.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
For your reference.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN, IV Director IV, Privacy Policy Office