Text
29 August 2025
Re: RELEASE OF DEATH CERTIFICATES FOR THE PROCESSING OF INSURANCE CLAIMS
Dear [Redacted],
We respond to your request seeking guidance and clarification on the request of Intervest Projects Inc. (IPI) to your office for copies of death certificates of deceased veteran pensioners taking into account the provisions of Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR) and relevant issuances of the National Privacy Commission (NPC).
Discussion
Pertinent to your request is NPC Advisory Opinion No. 2024-011, where it was noted that the Philippine Veterans Bank (PVB) extends loans to Philippine Veterans Affairs Office (PVAO) pensioners pursuant to its partnership with PVAO Direct Remittance Pension Servicing System. The loans are paid through the pensioners’ monthly pension from PVAO. PVB insured the lives of its debtor-pensioners. On behalf of PVB, IPI, a wholly owned subsidiary of PVB, facilitates the processing of the insurance claims upon the death of debtor-pensioners.
For the processing of benefits upon the death of the pensioners, the heirs submit copies of the pensioners’ death certificates to PVAO. Thus, PVAO retains copies of the pensioners’ death certificates primarily to facilitate the administration and release of pension benefits.
Further, you also mentioned that IPI has an existing Data Sharing Agreement (DSA) with the Philippine Statistics Authority (PSA) for the purpose of securing copies of the death certificates. Nonetheless, IPI continues to seek PVAO assistance in securing copies of the pensioners’ death certificates, citing operational difficulties and financial burden in accessing records directly from the PSA.
sharing; general data privacy principles; security measures.
In line with this, you now seek guidance on whether there is a need to execute a DSA with IPI in releasing copies of the pensioners’ death certificates relative to PVB’s insurance claims. You also seek guidance on whether releasing the pensioners’ death certificates to IPI, without informing the pensioners’ relatives or seeking their consent would be violative of the DPA, its IRR or any related NPC issuances.
Death certificate; personal data; Lawful criteria for processing; Data sharing
A death certificate contains both personal information and sensitive personal information (collectively, personal data). As such, the processing2 of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the criteria under Section 12 of the DPA is met. Similarly, the processing of sensitive personal information and privileged information shall be prohibited, except in the cases enumerated under Section 13. Thus, there is a need to satisfy at least one criterion under Sections 12 and 13, respectively, for the processing of personal data to be considered lawful.
From the facts previously disclosed by IPI, it appears that its request may be justified under Section 12(b) on fulfillment of a contract with the data subject and Section 13(f) on establishment or exercise of legal claims. The requested death certificates are necessary to fulfill the contract entered into with the data subject and for PVB to establish its legal claims for the processing of the insurance proceeds to settle the unpaid loans availed by the deceased debtor-pensioners.
It is important to note, however, that it is not enough to merely invoke a lawful basis or legitimate purpose. The requesting party must be able to substantiate its legitimate purpose with supporting documents. Thus, such requests should be evaluated on a case-to-case basis and must always be subject to the personal information controller’s (PIC) guidelines for the release of such document or information.
Further, the death certificates submitted by the heirs to PVAO for the processing of the pensioners’ benefits are already considered to be in PVAO’s official possession. Thus, the PVAO, as a PIC, may process the same for whatever purpose/s it may serve without having to seek the consent of the pensioners’ heirs, taking into account the provisions of the DPA and other relevant laws.
As such, the requested documents may be lawfully released to IPI, subject to PVAO’s internal policies and rules as well as compliance with the applicable and relevant provisions of the DPA.
As to whether or not to execute a DSA, you may refer to NPC Circular No. 2020-03. Under the said Circular, PICs may carry out a DSA. Note that the language used is permissive only. This
but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.
was clarified under NPC Advisory No. 2025-01.3
We emphasize, however, that although DSAs are no longer strictly required in all personal data sharing between or among PICs, it is still considered one of the best practices to execute one as the same demonstrates accountability. A DSA between PVAO and IPI is encouraged, especially so that PVAO is merely a recipient of the requested death certificates. The same likewise demonstrates good faith in complying with the provisions of the DPA, its IRR, and relevant issuances of the NPC.
General data privacy principles; Security measures
As mentioned, although there is lawful basis for the processing of personal data, the other requirements of the DPA must still be complied with to ensure the protection of personal data and uphold the rights of the data subjects. In particular, the same must be in accordance with the general data privacy principles of transparency, legitimate purpose, and proportionality.
As discussed in NPC Advisory Opinion No. 2022-05, :
“LTO must establish a system for handling these types of requests for information to avoid the possibility of abuse. xxx It must also provide for a mechanism to ensure that the information to be disclosed will only be used for the purpose/s indicated.”
Additionally, in NPC Advisory Opinion No. 2021-044, it was recommended that:
“xxx in case a request for personal information is granted, the requesting party should be required to sign an undertaking that the information will only be used for the purpose that was declared xxx and that the proper disposal thereof is ensured xxx. Further, the undertaking must include a clause to the effect that the requestor acknowledges that he/she becomes a PIC by his/her receipt of the requested documents and therefore has the obligations of a PIC as prescribed under the DPA.”
Moreover, the principle of proportionality provides that the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means. It necessitates that only the information requested and necessary for the purpose indicated should be processed. As such, in line with the proportionality principle, we reiterate the discussion in the above cited Advisory Opinion that a certification of death may suffice as an alternative considering that the insurance policy requires only a satisfactory proof of death of the insured. If, however, all contents in the death certificate are necessary and the option to redact sensitive personal information is impossible,
IPI must be able to ensure compliance with the provisions of the DPA and other laws for personal data protection.
Most importantly, it is mandatory for all PICs to implement reasonable and appropriate organizational, physical, and technical security measures for the protection of personal data. As highlighted in existing jurisprudence, processing personal data even involving the government does not, by itself, ensure its security absent any express guarantee that adequate safeguards are in place for protection.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
For your reference.
Very truly yours,
(Sgd.) VIDA ZORA G. BOCAR OIC-Director IV, Privacy Policy Office4