Text
27 January 2026
Re: COLLECTION OF GOVERNMENT EMPLOYEE DATA BY PAGCOR FOR ENFORCEMENT OF CASINO ENTRY PROHIBITION
Dear [Redacted],
We write in response to your request for an Advisory Opinion as you seek guidance on the collection and sharing of government employee data by PAGCOR for the enforcement of the Casino entry prohibition.
We understand that PAGCOR maintains the National Database of Restricted Persons (NDRP), which includes individuals legally prohibited from entering or playing in casinos. You mentioned that government officials and employees are among those prohibited individuals, as mandated by:
a. Presidential Decree No. 1067-B, as amended by VPD No. 1869, which prohibits government officials connected with the operation of the government, members of the Armed Forces of the Philippines, and students or persons under 21 years of age from entering or playing in gambling casinos;
b. Memorandum Circular No. 06, s. 2016, issued by the Office of the President, which reiterates the prohibition and considers even the mere entry of government officials and employees into casinos as “conduct prejudicial to the best interest of the service”;
c. Section 2 of Republic Act No. 6713 (Code of Conduct and Ethical Standards for Public Officials and Employees), which mandates public officials to uphold the highest standards of ethics and integrity in public service.
In your letter, it was signified that despite these clear prohibitions, PAGCOR has encountered resistance from some government agencies in providing updated lists of their personnel for inclusion in the NDRP. These agencies expressed reservations, citing potential violations of the Data Privacy Act of 2012 (RA 10173).1
Thus, you now seek the NPC’s guidance on the following:
-
Whether the disclosure by government agencies of lists of their employees or government employees under their control or custody to PAGCOR, for the purpose of enforcing the above-stated legal prohibition, requires consent or constitutes any of the criteria for lawful processing under the Data Privacy Act of 2012;
-
Whether such personal information is considered public personal data which may fall under exceptions of the Data Privacy Act of 2012;
-
What safeguards or data sharing protocols must be observed to ensure compliance with the principles of transparency, legitimate purpose, proportionality, and standards security measures; and
-
Whether Data Sharing Agreement (DSA) or Non-Disclosure Agreement (NDA) is still necessary between PAGCOR and Licensees considering that the latter’s access to the NDRP is limited to inquiry purposes only to screen entry of a person into the casino or gaming establishments.
In response to your request for guidance, we shall address each of the foregoing inquiries individually in the succeeding discussion.
Discussion
Disclosure of employee lists; Lawful criteria for processing personal information
Section 12 of the DPA provides that the processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:
(a) The data subject has given his or her consent;
(b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract;
(c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;
(d) The processing is necessary to protect vitally important interests of the data subject, including life and health;
(e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or
(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.2
Of particular relevance to your query are the following provisions:
Section 12(b) – processing is necessary for compliance with a legal obligation to which the personal information controller is subject; and
Section 12(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
Additionally, Section 5 of the Implementing Rules and Regulations (IRR) of the DPA clarifies that government agencies may process personal data without consent when such processing is directly connected to their mandate and necessary for the discharge of official functions.3
Hence, the disclosure by government agencies of lists of their officials and employees to PAGCOR is undertaken to give effect to an explicit legal prohibition. Both the disclosing agencies and PAGCOR are acting pursuant to statutory and executive issuances.
Accordingly, the need for disclosure constitutes compliance with a legal obligation of both the disclosing agency and PAGCOR to enforce the prohibitions mandated in the above-cited statutory and executive issuances.
As such, the data subject’s consent is not required, as reliance on consent would undermine enforcement and defeat the purpose of the law. Considering that there are ample lawful bases under Section 12 of the DPA, PAGCOR may cite either Section 12(b) or (e) to government agencies, which does not require the consent of data subjects in processing personal information.
Personal information; Exemptions to the application of the Data Privacy Act of 2012
The DPA defines personal information as any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.4
While the DPA protects personal information regardless of the data subject’s status, Section 4(e) of the DPA also expressly provides that the Act does not apply to information necessary for the performance of a constitutional or statutory mandate of a public authority. This exemption recognizes that certain government functions inherently require the processing of personal data in order to be effectively carried out.
Given this, working on the assumption that the updated personnel lists requested by PAGCOR are limited to essential identifiers such as name, designation, and agency affiliation, the processing of such information is directly necessary for the enforcement of a statutory prohibition mandated by law.
Accordingly, such processing falls within the scope of the exemption under Section 4(e) of the DPA. Even assuming applicability of the Act to PAGCOR’s processing, this is further supported by the lawful processing conditions provided under Section 12 thereof. Thus, the personal information requested in the updated personnel lists requested by PAGCOR can be considered as public personal data falling within the exemption contemplated under Section 4(e) of the DPA of 2012.
Adherence to Data Privacy Principles
Section 11 of the DPA requires that personal information controllers adhere to the fundamental principles of transparency, legitimate purpose and proportionality in processing of personal data.
Further, Sections 20 and 21 of the DPA and relevant IRR provisions require the implementation of reasonable and appropriate organizational, physical, and technical security measures.
Accordingly, PAGCOR and the concerned government agencies must ensure that government personnel are informed of the existence of the NDRP, including its purpose and legal basis. The personal information collected and shared must be limited to what is strictly necessary to enforce the casino entry prohibition and must be used solely for that purpose. Processing should not extend to unrelated or incompatible uses.
Further, we encourage you to review NPC Circular No. 23-06, which outlines the security measures applicable to both the government and private sector. The safeguards your institution implements should be aligned with those set out in the Circular to ensure the protection of personal data against unauthorized access, disclosure, or misuse. These include, among others, controlled access mechanisms, secure information systems, and clearly defined data retention and disposal policies.
Execution of DSA or NDA between PAGCOR and its licensees
With respect to the execution of a NDA, the Commission respectfully defers to PAGCOR’s management to determine its necessity as an additional contractual safeguard.
It is relevant to note that, under NPC Advisory No. 2025-01, personal information controllers engaged in data sharing are not prohibited from sharing, disclosing, or transferring personal data where such processing is authorized or required by law. As earlier established, the collection and use of personal data for the purpose of enforcing the statutory prohibition against casino entry by government officials and employees are anchored on legal mandates. The DPA does not operate to impede such lawful processing, provided that data protection principles and security requirements are observed.
As you mentioned, the licensees shall be given access to the NDRP, solely for inquiry purposes, limited to screening whether an individual is prohibited from entering casino or gaming establishments. Where such access does not allow licensees to download, store, extract, or otherwise further process personal data, and where control over the database and the determination of processing purposes and means remain with PAGCOR, the arrangement may be characterized as authorized access rather than data sharing between independent personal information controllers. This authorized access may form part of the functions stated in the licensing agreement, which includes the implementation of applicable laws and regulations, such as the prohibition of entry of government officials and employees in casinos.
Accordingly, where no transfer of personal data occurs and PAGCOR remains the personal information controller, the execution of a Data Sharing Agreement may not be necessary. This is consistent with the principle that the DSA requirement applies only where personal data is shared between separate controllers. Nonetheless, it bears emphasis that PAGCOR must ensure that access by licensees is strictly limited, monitored, and governed by clear rules and technical controls.
In sum, the collection, disclosure, and use of personal data by PAGCOR for the purpose of enforcing the statutory prohibition against casino entry by government officials and employees are supported by clear legal mandates and public interest considerations. Such processing does not require the consent of the data subjects and is permissible under the applicable exceptions and lawful processing grounds provided under the Data Privacy Act of 2012, provided that it is limited to what is necessary for the enforcement purpose.
Nevertheless, PAGCOR and concerned government agencies remain duty-bound to observe the fundamental principles of transparency, legitimate purpose, proportionality, and security, and to implement appropriate safeguards to protect personal data from unauthorized access, disclosure, or misuse. Where access to personal data is extended to PAGCOR licensees for inquiry-only purposes, such access must be strictly controlled and governed by clear agreements and technical measures to ensure accountability.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
For your reference.
Very truly yours,
(Sgd.) VIDA ZORA G. BOCAR OIC-Director IV, Privacy Policy Office (Per PCSO s. 095, s. 2025)
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for other purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Section 12 of RA 10173. ↩
-
Section 5(d) of the Implementing Rules and Regulations of the DPA. ↩
-
Section 3(g) of RA 10173. ↩