Text
Re: IMPLEMENTATION OF THE UNIFIED IDENTIFICATION CARD SYSTEM FOR PERSONS WITH DISABILITIES
Dear [Redacted],
We respond to your request for an advisory opinion regarding the following queries:
Discussion
- Whether NPC Circular 2023-03 or the Guidelines on Identification Cards is applicable to the Unified ID System for PWDs; 2. Whether there are existing guidelines as to the collection, utilization, and processing of biometric data of data subjects; and 3. Whether the DSWD is allowed to process biometric data for the purpose of verifying the identity of the PWDs who are availing benefits using their PWD IDs.
You have stated that the Unified ID System aims to address the issue regarding the illegal issuance, sale, and utilization of fake PWD IDs, and to boost the efficiency in the delivery of basic services to the vulnerable sector, pursuant to Republic Act No. 10754 or the Act Expanding the Benefits and Privileges of Persons with Disability.
In addition, for the implementation of this system, the DSWD plans to issue both physical and digital IDs. The DSWD also plans to collect, utilize and process the biometric data of applicants, such as fingerprints and facial scans, to further enhance the verification process for PWD IDs.
To ensure clarity, we will address each question individually.
Applicability of NPC Circular 2023-03 to the Unified ID System for PWDs
NPC Circular No. 2023-03 prescribes the minimum requirements and standards for the lawful collection, processing, and issuance of identification cards containing personal data.
However, as provided by Section 1 of the Circular:
“ID cards issued by government agencies pursuant to their respective regulatory mandate, such as but not limited to, driver’s license, passport, Professional ID card of a Registered Professional, including for this purpose the Integrated Philippines (IBP) Lawyers ID, Tax Identification Number (TIN) card, shall be excluded from the scope of this Circular “
The rationale for this exclusion is that the personal data reflected or disclosed in such identification cards is integral to the exercise of the regulatory or statutory mandate of the issuing agency.
Applying this provision to the instant case, the proposed Unified PWD ID, which will be issued pursuant to Republic Act No. 10754 and related issuances, may likewise be considered outside the scope of NPC Circular No. 2023-03, as the information it contains would be in direct furtherance of the government agency’s regulatory functions.
Nonetheless, it bears emphasis that while the issuance of the Unified PWD ID itself may be excluded from the coverage of NPC Circular No. 2023-03, the collection, storage, and processing of personal data—including personal and sensitive personal information, such as biometric data—for purposes of implementing the Unified ID System remain subject to the provisions of the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and other relevant issuances of the Commission. Thus, compliance with the principles of transparency, legitimate purpose, and proportionality, as well as the adoption of appropriate organizational, physical, and technical security measures, are strongly enjoined.
Guidelines Governing Biometric Data
While the National Privacy Commission (NPC) has yet to issue guidelines specifically on the processing of biometric data, their collection and processing are still very much governed by the Data Privacy Act of 2012, its Implementing Rules and Regulations, and various NPC issuances.
The NPC also has ongoing policy development initiatives concerning biometric data governance. We encourage stakeholders such as your good office to provide us with your inputs and suggestions to ensure that the proposed guidelines will be able to address any pressing concerns. You may monitor further updates on these initiatives through the Commission’s official website, or you may get in touch with the NPC through our office, should you wish to have further discussion on these proposed guidelines.
Processing of Biometric Data
Section 4(e) of the DPA states that when the information is necessary in order to carry out the functions of public authority, which includes the processing of personal data for the performance by the independent, central monetary authority and law enforcement and regulatory agencies of their constitutionally and statutorily mandated functions. The provisions of the DPA would not be applicable.
Given that Republic Act No. 10754 mandates the effective implementation of benefits and privileges for PWDs, preventing fraud and ensuring targeted delivery of services, the collection and processing of biometric data for this specific purpose may be considered
essential to carry out the functions of the concerned government agencies. Consequently, such processing may fall under the scope of the public authority exemption under Section 4(e) of the DPA.
However, it must be emphasized that even when the processing of personal data falls within an exemption, data protection principles and security safeguards remain applicable as a matter of good practice and accountability. Accordingly, if the DSWD pursues the processing of biometric data for this purpose, it must ensure that:
-
Adequate technical, organizational, and physical security measures are in place to protect the data from unauthorized access, use, or disclosure;
-
Data subjects are informed through clear and accessible privacy notices regarding the purpose, scope, and retention period of the data collected;
-
A Privacy Impact Assessment (PIA) is conducted prior to the implementation of the Unified ID System; and
-
Data retention is strictly limited to the period necessary to achieve the declared and legitimate purpose.
These measures will not only mitigate privacy risks but also demonstrate the DSWD’s commitment to responsible and transparent processing of biometric data in line with the principles of the DPA.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
For your reference.
Very truly yours,
(Sgd.) VIDA ZORA G. BOCAR OIC-Director, Privacy Policy Office2