NPC Issuance Wiki

NPC Advisory Opinion No. 2026-006 — Processing of Personal Data for the Beep5 Program of the Department of Transportation

Issued Advisory Opinion

Official opinion tags

Source

Text

PRIVACY POLICY OFFICE

ADVISORY OPINION NO. 2026-0061

14 August 2026

[Redacted]

Re: PROCESSING OF PERSONAL DATA FOR THE BEEP5 PROGRAM OF THE DEPARTMENT OF TRANSPORTATION

Dear [Redacted]:

This pertains to the Department of Transportation’s (DOTr) request for an Advisory Opinion on the further processing of personal data of beep cardholders taking into consideration the provisions of Republic Act No. 10173,2 also known as the Data Privacy Act of 2012 (DPA).

We understand that the DOTr authorized AF Payments Inc. (AFPI), through a Data Outsourcing Agreement (DOA), to act as its personal information processor (PIP). In particular, AFPI was authorized to manage and process beep card applications and to issue the cards.

AFPI, in collaboration with Meralco Pioneer Insurance Inc. (M Pioneer) as underwriter, conducted a proof of concept for an insurance product called beep5 (the Program). Under the DOA, AFPI may disclose personal information to a third party only with the prior approval of the DOTr.

The Program provides automatic, free insurance coverage against unexpected, unforeseen, or unscheduled rail disruptions and trip curtailments for eligible beep card subscribers who are senior citizens and persons with disability (concessionary beep cardholders) enrolled during a specific period. Under the Program mechanics, when disruptions occur, such as a 55-minute delay or premature disembarkation, AFPI identifies potentially eligible concessionary beep cardholders, and eligible cardholders are notified via short message service (SMS) using mobile numbers provided in the original beep card application.

Following the Program launch, several train disruptions occurred across rail operators. AFPI determined that approximately eight hundred (800) beep cardholders were eligible to claim a financial benefit of ₱500.00 directly credited to their beep cards.

The Card Application Number (CAN) of those eligible for the insurance will be provided to M Pioneer for processing. DOTr states that M Pioneer does not participate in identifying eligible concessionary beep cardholders under the Program and that its role is limited to providing a funding pool for the disbursement of benefits through the unique CAN of concessionary beep cardholders. The letter request further states that no other personal data will be disclosed to M Pioneer except the CAN.

We note, however, that the annexes appear to contemplate activities beyond a purely funding pool. In particular: (1) Annex A (Mechanics) indicates that M Pioneer will be the one to notify patrons via SMS; and (2) Annex B (SMS Template) states that patrons ‘may chat with us on messenger at M Pioneer Insurance,’ suggesting a customer-facing communications and assistance function. Additionally, the annexes refer to an accidental death benefit of ₱5,000.00. This would entail additional processing, yet the request does not explain how such processing will be operationalized given the stated limitation that only the CAN will be disclosed.

You further mentioned that the consent form and privacy notice signed by the concessionary beep cardholders were primarily for beep card application and system maintenance. Consequently, the cardholders were not informed about the further processing of their personal data for the free insurance or benefit program. Hence, this request for an Advisory Opinion seeking clarification on whether the processing of personal information in furtherance of the Program constitutes a secondary purpose requiring additional consent, or if it falls under legitimate interest or the fulfillment of contract with the cardholders as data subjects.

Scope; processing; personal information controller; Personal information processor

The DPA applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing.3 Processing is defined under the DPA as any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating, or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.

The person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf is called the personal information controller (PIC).4 On the other hand, any natural or juridical person to whom a PIC may outsource the processing of personal data pertaining to a data subject is called the personal information processor (PIP).5

In this case, the DOTr is considered the PIC because it determines the purposes and means of the processing. As the PIC, the DOTr retains control and remains accountable for personal data even when processing is outsourced.

On the other hand, AFPI, the entity that processes personal data of individuals on behalf of the DOTr, is the PIP.

As to M Pioneer, based on the representations in your inquiry, it receives only the CAN of concessionary beep cardholders to disburse benefits and does not participate in identifying eligible cardholders. If M Pioneer merely receives the CAN and processes it only as instructed by the DOTr through AFPI for the Program, it is generally treated as a PIP. Should M Pioneer process other data apart from the CAN, or process personal data apart from the instructions of DOTr or AFPI, it may be considered a PIC.

Personal information; Sensitive personal information

You stated that the Program provides insurance coverage to eligible concessionary beep cardholders in cases of rail disruptions and trip curtailment. For this purpose, AFPI will process the cardholder’s personal data to (a) determine eligibility, and (b) notify eligible cardholders via SMS. Thereafter, AFPI will forward the CAN to M Pioneer for the processing of the insurance benefit, which will be credited to the cardholder’s beep card.

Under the DPA, the processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one condition under Section 12 exists. Personal information is defined as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual. Thus, the mobile number used to notify the cardholder is personal information if the individual can be identified when combined with other information.

On the other hand, the processing of sensitive personal information and privileged information is generally prohibited, unless it falls under any of the cases mentioned under Section 13. Sensitive personal information is defined as personal information:

  1. About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;

  2. About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;

  3. Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and

  4. Specifically established by an executive order or an act of Congress to be kept classified.6

On the facts presented, the CAN, while it may function as a unique identifier within the beep card application, cannot be categorically treated as sensitive personal information absent a clear factual basis that it is an identifier issued by a government agency peculiar to an individual within the contemplation of Section 3(l)(3) of the DPA. Additionally, while the CAN may not, by itself, reveal the identity of the cardholder, it may constitute personal information insofar as DOTr and AFPI can link it to a specific individual through their records.

Lawful basis for processing; Special cases

Under the DPA, the processing of personal information and sensitive personal information must meet at least one of the conditions for lawful processing under Sections 12 and 13, respectively, among other requirements under the law.

It is worth noting, however, that the PIC in this case is a government agency. The DPA does not apply to certain categories of information, including information necessary to carry out functions of public authority. The pertinent provision reads:

Sec. 4. Scope. – The Act applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing xxx xxx xxx.

This Act does not apply to the following: xxx xxx xxx (e) Information necessary in order to carry out the functions of public authority which includes the processing of personal data for the performance by the independent, central monetary authority and law enforcement and regulatory agencies of their constitutionally and statutorily mandated functions. xxx

Further, the Implementing Rules and Regulations (IRR) of the DPA states that:7

The non-applicability of the Act or these Rules do not extend to personal information controllers or personal information processors, who remain subject to the requirements of implementing security measures for personal data protection: Provided further, that the processing of the information provided in the preceding paragraphs shall be exempted from the requirements of the Act only to the minimum extent necessary to achieve the specific purpose, function, or activity. (Emphasis supplied)

In the case of Philippine Stock Exchange v. Secretary of Finance, the Supreme Court explained “necessary” to mean that the personal data sought by the State must be acquired through “‘narrowly tailored’ means, which are only necessary to accomplish the regulatory agencies’ given mandate.”8

The Commission explained the foregoing in NPC Advisory No. 2022-01 wherein the exemption is not absolute, to wit:9

The exclusion of such information from the scope of the law is interpreted as an exemption from complying with the requirements of Sections 12 or 13 on lawful criteria for processing; and the collection, access, use, disclosure, or other processing is limited to the minimum extent necessary to achieve the purpose, function, or activity concerned.

The same was also discussed in NPC Advisory Opinion No. 2018-060,10 viz:

xxx xxx xxx the exclusion particularly pertains to information necessary in carrying out the functions of the BSP. This does not mean that all information collected by the BSP is outside the scope of the DPA. Being an exception to the rule, it must be established that the information claimed to be outside the scope of the DPA is:

  1. Necessary in order to carry out the functions of the public authority; and
  1. Processing of personal data is for the fulfillment of a constitutional or statutory mandate.

Thus, only the information required to be processed pursuant to the said function is not covered by the law, while the BSP, as an entity, is still covered by the DPA. The BSP is mandated under the DPA to adhere to the data privacy principles of transparency, legitimate purpose and proportionality, implement appropriate security measures for personal data protection, and ensure that data subjects are able to exercise their rights as provided for by law.

Applying the foregoing text, the Section 4(e) special case does not appear to cover the Program. The provision extends only to processing necessary for the performance by the independent central monetary authority and by law enforcement and regulatory agencies of their constitutionally and statutorily mandated functions. While the DOTr exercises regulatory functions over rail transport, the grant of a free insurance benefit to concessionary cardholders is a passenger welfare initiative rather than an exercise of regulatory function. Nevertheless, processing undertaken by a public authority in the fulfillment of its mandate may proceed under Section 12(e) of the DPA. Thus, to the extent that the Program implements DOTr’s mandate “to establish and administer comprehensive and integrated programs to improve the transportation system of the country,”11 Section 12(e) may serve as lawful basis for the processing. Otherwise, the DOTr may refer to the other criteria enumerated under Sections 12 and 13 to justify the additional processing of personal data.

We note, however, that the processing of personal data was outsourced. Primarily, it is the PIC that establishes the basis for processing considering that the PIP will only act solely upon the documented instructions of the PIC. The defining feature of the controller-processor relationship is that the processor can only act on the documented instructions of the controller. Thus, the PIP must ensure that the processing strictly aligns with the documented instructions of the PIC. The PIP shall not process personal data beyond the scope and purpose authorized by the PIC, otherwise the PIP will be considered a PIC.12

In this regard, we note that under the DOA, AFPI is authorized to process personal data solely upon the documented instructions of the DOTr and only for the management and processing of concessionary beep card applications and the issuance of the cards. The Program does not appear among the processing activities documented therein. Accordingly, the DOTr should amend or supplement the DOA, or issue appropriate documented instructions, to expressly authorize the processing of personal data for the Program before undertaking further processing.

As to the establishment of basis to process personal data, you stated that while Section 14 of the beep™ Terms and Conditions states that AFPI reserves the right to “provide or offer new features, designs, functions and/or services”, you seek clarification if the further processing of the cardholders’ data requires additional consent or if it falls under the legitimate interest of the DOTr. The use of consent as a lawful basis for processing by public authorities is permissible under the DPA and may be appropriate when the processing activity is not related to, or an extension of any processing required by law or regulation.13 From the discussions above, consent of the data subjects or the cardholders may be useful if the agency determines that this processing activity is merely an extension of the processing required by law or regulation, and not necessary pursuant to its mandate.

Moreover, Section 12 of NPC Circular No. 2023-07 (Guidelines on Legitimate Interest) provides that:14

As a general rule, legitimate interest shall not apply to the processing carried out by public authorities in the performance of their constitutional or statutory mandates.

Legitimate interest may be considered the appropriate lawful basis for specific processing activities carried out by government agencies that are not expressly provided in their mandate and do not fall squarely on any of the other criteria for processing under Section 12 of the DPA or as a special case under Section 4 of the DPA. Legitimate interest may apply as lawful basis for ancillary processing activities performed in the ordinary course of business. In such cases, the PIC must conduct a legitimate interest assessment.

Applied here, if the Program is implemented pursuant to the DOTr’s mandate, legitimate interest under Section 12(f) is not the appropriate lawful basis for processing, including the disclosure of the CAN to M Pioneer. Should any processing activity under the Program fall outside the DOTr’s mandate and not fall squarely under any other criterion for lawful processing, legitimate interest may be considered, provided that a legitimate interest assessment is first conducted.15 As to the reliance on Section 14 of the beep™ Terms and Conditions, a general reservation of the right to offer new features or services does not, by itself, establish that the processing is necessary for the fulfillment of a contract with the data subject under Section 12(b).

Notwithstanding the foregoing, the PIC and its PIPs are required to adhere to the data privacy principles of transparency, legitimate purpose and proportionality, implement reasonable and appropriate security measures for personal data protection, and ensure that data subject rights are upheld all throughout the process.

We emphasize that, while outsourcing the processing of personal data is allowed, accountability ultimately rests with the PIC. Thus, the PIC must ensure that its PIPs remain compliant with the said requirements. We reiterate that PIPs must process personal data strictly in accordance with the documented instructions of the PIC. Failure to do so subjects the PIPs to the same obligations as that of the PIC, including the responsibility to establish the basis for processing, among others. We reiterate the discussions in NPC Advisory Opinion No. 2018-038,16 which likewise involved the processing of personal data for concessionary beep cards by the DOTr and AFPI, wherein the Commission stated that the scope and limitation of the processing activities to be performed by the PIP should be clearly defined in the outsourcing agreement.

General data privacy principles; Security measures

In compliance with the right of the data subjects to be informed as to the processing of their personal data and with the transparency principle, the DOTr and its PIPs shall post privacy notices containing the following:17

  1. Description of the personal data to be processed;

  2. Purposes for processing, including: direct marketing, profiling, or historical, statistical or scientific purpose;

  3. Basis of processing, when processing is not based on consent;

  4. Scope and method of processing;

  5. Recipient/classes of recipients to whom the personal data are or may be disclosed;

  6. Methods utilized for automated access, if the same is allowed by the data subject, and the extent to which such access is authorized;

  7. Identity and contact details of the PIC or its representative;

  8. Retention period; and

  9. Existence of their rights as data subjects, including the right to lodge a complaint before the NPC.

As can be gleaned therefrom, further processing of personal data necessitates informing the affected data subjects of the specific recipients to whom their data will be disclosed. As such, at the outset of the processing of personal data of the beep cardholders or as soon as practicable and reasonable, they must be informed, through the posting of appropriate privacy notices, that their personal data will be disclosed to AFPI and M Pioneer. Considering that the Program has already been implemented, the appropriate remedial measure is to provide the affected data subjects with a supplemental privacy notice at the earliest practicable opportunity.

Moreover, it is crucial for the PIC and its PIPs to comply with the proportionality principle. This requires that the processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means. It necessitates that only the information requested and necessary for the purpose indicated should be processed.

Accordingly, the DOTr, AFPI, and M Pioneer must strictly limit the processing, including the collection of data, to information directly relevant and adequate for the specific purpose. The processing must be conducted through the least intrusive means possible.

Most importantly, it is mandatory for all PICs and PIPs to implement reasonable and appropriate organizational, physical, and technical security measures for the protection of personal data. In particular, a Privacy Impact Assessment must be conducted for all systems that process personal data of individuals.18

In view of the foregoing, we respond to the specific queries as follows. First, AFPI, as a PIP of the DOTr, may process the personal information of concessionary beep cardholders to determine their eligibility under the Program without obtaining additional consent, provided the processing is undertaken pursuant to the DOTr’s mandate and upon its documented instructions. The lawful basis in such case is Section 12(e) of the DPA rather than Section 12(f), as legitimate interest does not apply to processing carried out by public authorities in the performance of their mandates. Second, AFPI may disclose the CAN to M Pioneer without invoking legitimate interest or obtaining express consent, for as long as M Pioneer processes the CAN solely as a PIP of the DOTr upon the latter’s documented instructions, since the disclosure is incidental to an outsourcing arrangement and does not constitute data sharing. The posting of the supplemental privacy notice and the implementation of reasonable and appropriate security measures remain required as discussed above. In all cases, the DOA and related agreements must clearly define the scope and limitations of the processing activities of the PIPs and should be amended or supplemented to expressly cover the Program.

Please be advised that this Advisory Opinion was rendered based solely on the information provided. Any extraneous fact that may be subsequently furnished to us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

For your reference.

Very truly yours,

REINIER JEFFREY E. ABDON
Director IV, Privacy Policy Office

Footnotes

Footnotes

  1. Tags: Special cases, regulatory function, mandate, personal information processor, outsourcing. ↩

  2. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, § 1 (2012). ↩

  3. Id. § 4. ↩

  4. Id. § 3(h). ↩

  5. Id. § 3(i). ↩

  6. Id. § 3(l). ↩

  7. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 5 (2016). ↩

  8. Philippine Stock Exchange, Inc. v. Secretary of Finance, 924 PHIL. REP. 615, 647 (July 5, 2022). ↩

  9. National Privacy Commission, Guidelines on Requests for Personal Data of Public Officers, NPC Advisory No. 2022-01, § 3(C) (Feb. 4, 2022). ↩

  10. National Privacy Commission, Re: Disclosure of Personal Information to the Bangko Sentral ng Pilipinas, NPC Advisory Opinion No. 2018-060 (Aug. 30, 2018). ↩

  11. Office of the President, Amending Executive Order No. 125, Entitled “Reorganizing the Ministry of Transportation and Communications, Defining Its Powers and Functions, and for Other Purposes,” Executive Order No. 125-A, § 5(b) (Apr. 13, 1987). ↩

  12. National Privacy Commission, Re: Verification of Credentials Submitted for Visa Application, NPC Advisory Opinion No. 2025-014 (Oct. 9, 2025). ↩

  13. National Privacy Commission, Guidelines on Consent, NPC Circular No. 2023-04, § 7(B) (Nov. 7, 2023). ↩

  14. National Privacy Commission, Guidelines on Legitimate Interest, NPC Circular No. 2023-07, § 12 (Dec. 13, 2023). ↩

  15. Id. §§ 4 and 8. ↩

  16. National Privacy Commission, Re: Personal Information Controller in the Processing of Concessionary beep™ Cards, NPC Advisory Opinion No. 2018-038 (July 30, 2018). ↩

  17. Rules and Regulations Implementing the Data Privacy Act of 2012, § 34(a)(2). ↩

  18. National Privacy Commission, Security of Personal Data in the Government and the Private Sector, NPC Circular No. 2023-06, §§ 4(D) and 5 (Dec. 1, 2023). ↩

Backlinks

  • No backlinks found