NPC Issuance Wiki

NPC 24-006: HCN vs. DBO

Issued Decision

Source

Source Tags

  • Personal Information, Sensitive Personal Information, Legitimate Interest (Section12 (f), Protection of Lawful Rights and Interests in Court Proceedings Section 13(f), Scope of the DPA Section 4)

Decision Text

HCN, Complainant,

-versus-

DBO, Respondent.

NPC 24-006
For: Violation of the Data Privacy Act of 2012

DECISION

BELARMINO, D.P.C.;

Legitimate interest is not absolute, and it does not serve as a shield for unlawful processing of personal data. It may not be invoked as lawful basis for processing personal data when such processing is prohibited by law.

Before this Commission is a Complaint filed by HCN (Complainant for brevity) against DBO (Respondent for brevity) for an alleged violation of the Data Privacy Act of 2012 or Republic Act No. 10173 (“DPA”).

Facts

On 26 January 2024, the Commission, through its Complaints and Investigation Division (CID), received the Complaints-Assisted Form (CAF) of Complainant.1

Complainant alleged that the Respondent is a regulatory body primarily responsible for the enforcement of the National Building Code of the Philippines (NBCP) pursuant to Presidential Decree No. 1096, as well as its Internal Rules and Regulations (IRR) and is charged with the duty of issuing building permits.2

Complainant alleged that he owns the adjoining property of the rear portion of RKG (RKG for brevity) property.3 The Complainant averred that sometime in September 2022, RKG personally visited his residence to secure the ‘neighbor’s consent’ from his mother,4 which was allegedly required by the Barangay to secure the appropriate building permit for the proposed extension of their three-story residential house.5

Pending the issuance of a building permit, the Complainant claimed that several dialogue meetings with RKG were conducted by the Office of the Punong Barangay of BSP, Quezon City.6 During one of these meetings, Architect AXB (Arch. AXB for brevity), the contractor of RKG, was present.7 It was agreed that Arch. AXB shall provide an Affidavit of Undertaking in favor of the Complainant, along with a copy of the signed construction/building Plans8 (Plans for brevity). The Complainant further alleged that, unbeknownst to him and the Office of the Punong Barangay, Arch. AXB proceeded to secure the building permit from the Respondent without submitting the agreed documents and was issued Building Permit BP xxxx dated 29 June 2023.9

As a result, the Complainant was prompted to file a complaint against Arch. AXB on 01 September 202310 before the Lupon ng Tagapamayapa (Lupon for brevity) of BSP, Quezon City.11 The Complainant alleged that the Lupon directed Arch. AXB to submit the notarized undertaking and the approved plans issued by the Respondent as attachments to said affidavit.12 Arch. AXB complied by submitting the notarized Undertaking but only provided signed construction drawings, and not the Respondent-approved plans.13

Complainant alleged that he filed several letters requesting and complaining14 to the Respondent for the issuance of the Respondent approved plans15 or in the alternative, an issuance from the Respondent that the construction drawings previously submitted by Arch. AXB before the Lupon is in accordance with the approved plans when the Building Permit16 was issued.

Complainant maintained that the legal basis to secure and access the plans requested is pursuant to Sections 12 (f) and 13 (f) of the DPA.17

Complainant claimed that Respondent, in a letter dated 26 October 2023, informed him that his request cannot be granted in consideration of the provisions of the DPA, to wit:

Please be informed that we cannot grant your request. We need to comply with the provisions of R.A. 10173, otherwise known as the Data Privacy Act of 2012. Although technical documents, while submitted to this Office, are not public documents and still private in nature. Thus, the reproduction of the said documents requires the permission/ consent from the owner.18

On 29 February 2024, the CID issued an Order (To File Verified Comment and Appear Virtually for Preliminary Conference) requiring the Respondent to file its Verified Comment within fifteen (15) days from receipt of the Order.19 The CID likewise ordered the parties to appear virtually for a Preliminary Conference on 25 April 2024 and 23 May 2024.20 The Order was received by the Complainant via email on 01 March 2024.21

On 22 March 2024,22 Respondent, through Engr. IRVJR., filed its Verified Comment dated 19 March 2024.23 It was alleged that the Order was received by the Respondent on 11 March 2024, hence, the timeliness of the submission of the Comment.24

The Respondent argued that its Office was justified in not providing a copy of the plans as requested by the Complainant, and that the Complaint should be dismissed for being entirely without merit.25

As per Respondent’s Verified Comment, the Complainant’s request was denied pursuant to Republic Act No. 8293, otherwise known as the Intellectual Property Code of the Philippines (IPC), and in relation to Republic Act No. 10173, or the DPA of 2012, which prohibits the reproduction and/or copying of such documents without the consent of the owner and the architect.26

The Respondent argued that, even assuming the Complainant’s contention is tenable pursuant to Section 12 (f), the request for a copy of the approved plans cannot be given due course.27 This is because under Section 172 in relation to Section 178.4 of IPC, the said building plans are considered protected works, and disclosure requires the consent from the creator/ architect.28 Accordingly, any disclosure without such consent is prohibited by law.29

The pertinent provisions of the IPC were quoted as follows:30

SECTION 172. Literary and Artistic Works. -

172.1. Literary and artistic works, hereinafter referred to as “works”, are original intellectual creations in the literary and artistic domain protected from the moment of their creation and shall include in particular:

x x x

  • j. Illustrations, maps, plans, sketches, charts and three-dimensional works relative to geography, topography, architecture or science;

x x x

SECTION 178. Rules on Copyright Ownership. - Copyright ownership shall be governed by the following rules:

x x x

178.4. In the case of a work commissioned by a person other than an employer of the author and who pays for it and the work is made in pursuance of the commission, the person who so commissioned the work shall have ownership of the work, but the copyright thereto shall remain with the creator, unless there is a written stipulation to the contrary;

x x x31

Respondent alleged that the Complainant’s request for a confirmation that the plans given to him by Arch. AXB were the same as the approved plans was likewise refused because the plans did not bear the sign and seal of their Office.32 It was also alleged that doing so would be an indirect contravention of the IPC.33

It was further emphasized that while it is true that the Respondent, DBO is a public office, it is still guided by the state policy to protect the fundamental human right to privacy.34 Respondent reiterated that granting the request of the Complainant will be granting access to the information as to the footprint of RKG’s abode which is a violation of his right to privacy.35

Lastly, Respondent averred that if the Complainant is worried that the approved plans will not be strictly followed in the construction of RKG’s structure, Respondent has the authority to conduct an investigation pursuant to the NBCP.36 Respondent claimed that it is within their vested authority to revoke a validly issued building permit pursuant to Section 306 in relation to Section 304 of said Code.37

On 26 March 2024, the CID issued an Order (On Respondent’s Comment).38 The Order noted the Respondent’s working email address and reminded both parties to appear virtually for the Preliminary Conference on 25 April 2024 and 23 May 2024.39

On 25 April 2024, the CID issued an Order (After the 1st Preliminary Conference held on 25 April 2024).40 The Order stated that both parties were not willing to explore the possibility of a settlement and undergo the mediation proceedings.41 Both parties likewise moved for an additional fifteen (15) calendar days for the submission of their respective memoranda.42 Hence, the CID, cancelled the scheduled second preliminary conference on 23 May 2024 and ordered the parties to file their respective memoranda thirty (30) calendar days from the receipt of the Order.43 The Order was sent via email to both parties on the same date.44

On 23 May 2024, the Respondent filed its Memorandum dated 21 May 2024.45 In the said Memorandum, the Respondent reiterated its previous defenses mentioned in its Verified Comment.46

Respondent likewise argued that the requested approved plans are not considered public documents which will entitle the access of the Complainant pursuant to the DPA.47 Respondent cited the Supreme Court in the case of Atty. Bernardo T. Constantino, Petitioner v. People of the Philippines, (G.R. No. 225696, 08 April 2019),48 to wit:

x x x Public documents are defined in Cacnio v. Baens as “those instruments authorized by a notary public or by a competent public official with all the solemnities required by law[.]” By this definition, any notarized document is considered public document.

Rule 132, Section 19 of the Rules of Court, however, provides:

SECTION 19. Classes of documents. - For the purpose of their presentation in evidence, documents are either public or private.

Public documents are:

  • a. The written official acts, or records of the official acts of the sovereign authority, official bodies and tribunals, and public officers, whether of the Philippines, or of a foreign country;

  • b. Documents acknowledged before a notary public except last wills and testaments; and

  • c. Public records, kept in the Philippines, of private documents required by law to be entered therein.

All other writings are private. (Emphasis supplied) x x x49

Respondent maintained that the plans submitted to its Office are not considered public documents, as they are prepared by professionals and submitted solely for evaluation to ensure compliance with minimum requirements of the NBCP.50 The Respondent further explained that these plans are not prepared by its Office or any of its employees, and therefore cannot be regarded as an official act.51

Additionally, the Respondent argued that, upon issuance of the building permit, the plans are stored for filing purposes and for the reference of the owner in cases of renovation and/or structural additions.52 They are also used whenever inspection or investigation is necessary to verify whether the existing structure conforms to the approved plans.53

Finally, the Respondent asserted that granting the Complainant’s request would set a precedent that could expose its Office vulnerable to potential lawsuits for non-compliance with the IPC and the DPA.54

On 29 May 2024,55 the CID issued an Order (On the Memorandum for the Public Respondent) dated 28 May 2024, acknowledging the submission of the Respondent’s Memorandum and reminding the Complainant to submit his Memorandum.56

On the same day,57 the Complainant filed his Memorandum dated 02 May 2024.58 In the Memorandum, the Complainant alleged that more than twenty (20) years ago, RKG, engaged the services of the then newly licensed architect, Arch. AXB, to design and build a two-story residential house adjacent to the Complainant’s property.59

During the construction of RKG’s house, the Complainant claimed to have personally witnessed the mental anguish and anxiety experienced by his mother as a result of the horrendous and unfortunate incidents that occurred during the construction phase.60

The Complainant further alleged that the required two (2) meter set back was not observed, as the structure was built directly along the boundary wall.61 Additionally, their roof suffered significant damage due to falling debris, unauthorized stepping, and repeated crossing of their roof by construction personnel.62

The Complainant maintained that his legitimate interest in requesting the Respondent-approved plans is to uphold his property rights and to protect his property from factors that have caused or likely to cause a repetition of the damage or injury allegedly done on his property in the past.63

He emphasized that his request should be interpreted by the Commission as one made in pursuit of a legitimate interest, and for the establishment, exercise, or defense of a legal claim,64 in accordance with Sections 12 (f) and 13 (f) of the DPA.65

Furthermore, the Complainant asserted that, as an adjacent property owner, his request for a copy of the plans is rooted in his desire to safeguard his property rights and to prevent a repetition of the tragic events that occurred more than twenty (20) years ago.66

The Complainant contended that, the Respondent’s argument that any reproduction and/or copying of the approved plans without the consent of the owner and the architect is prohibited under the IPC, lacks both legal and factual basis.67 He further argued that the Respondent’s interpretation of the law is misplaced and asserted that the more appropriate and applicable law in this case is Section 33 of Republic Act No. 9266, otherwise known as the Architecture Act of 2004, which provides:68

SECTION 33. Ownership of Plans, Specifications and other Contract Documents. - Drawings and specifications and other contract documents duly signed, stamped or sealed, as instruments of service, are the intellectual property and documents of the architect, whether the object for which they are made is executed or not. It shall be unlawful for any person to make copies of said documents for use in the repetition of or for other projects or buildings, whether executed partly or in whole, without the written consent of architect or author of said documents.

All architects shall incorporate this provision in all contract documents and other instruments of service.69

The Complainant insisted that the notarized Undertaking executed by Arch. AXB is a legally binding public document that binds not only the parties thereto but also third persons, including the Respondent.70 He argued that the Respondent failed to acknowledge that the Notarized Undertaking constitutes a valid agreement and expresses the freely given consent of Arch. Arch. AXB.71

Issue

Whether Respondent violated the Complainant’s data privacy rights in refusing to release the requested approved construction/ building plans.

Discussion

The Commission dismisses the case for lack of merit.

At the onset, the Commission points out that the Complainant failed to allege that a privacy violation was committed against him or a data subject. The important consideration in determining whether this Commission validly acquired jurisdiction over a case is whether the allegations, assuming they were true, show that a privacy violation was committed against a data subject.72

A privacy violation is defined as follows:

A privacy violation pertains to the processing of personal information in violation of a person’s reasonable expectation of confidentiality or privacy or in violation of any law, rules, or regulation relating to the protection of personal data, such as the DPA. It includes but is not limited to a violation of the general principles of privacy, a violation of the rights of the data subjects, unauthorized processing, improper disposal of personal data, processing for an unauthorized purpose, concealment of security breaches, and unauthorized or malicious disclosure.73

Section 3 of the DPA defines processing as follows:

Section 3. Definition of Terms. Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

x x x

  • (j) Processing refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.

x x x74

In the present case, the Complainant’s allegation, specifically the Respondent’s purported denial of access to the approved plans did not constitute a privacy violation under the DPA. The Complainant did not clearly identify or allege any act that would amount to a violation of the DPA.

Nevertheless, Section 4 of the DPA provides that the law applies to the processing of all types of personal information and to any natural and juridical persons. In this regard, the Commission deems it pertinent to determine whether the Complainant may be entitled to access the requested plans, which necessarily entail the inclusion of personal data, from the Respondent, in accordance with the provisions of the DPA.

The requested plans contain Personal Information and Sensitive Personal Information

The Commission finds it necessary to clarify that the Complainant specifically requested the Respondent-approved building plan covering only the rear portion of the extension project adjacent to Complainant’s property.

While these plans may indeed contain personal information - such as the architect’s name, signature, the property owner’s name and address, and sensitive personal information - such as the architect’s and engineers’ license number and their Taxpayer Identification Number (TIN) issued by the government agencies peculiar to an individual, it is important to highlight that, as explicitly stated in both the Complainant’s CAF75 and filed Memorandum,76 the request was particularly for the ‘building/ construction plans (rear portion)’ itself. No request was made for any personal information or sensitive personal information beyond what is necessary to identify and review the ‘two meter set back requirement’77 relevant to the building permit application.

In the DPA, personal information and sensitive personal information are defined as follows:

x x x x

  • (g) Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.

x x x x

  • (l) Sensitive personal information refers to personal information:

  1. About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;

  2. About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;

  3. Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and

  4. Specifically established by an executive order or an act of Congress to be kept classified.78

In this regard, while the Complainant’s request for the plans did not extend to personal information or sensitive personal information, it is important to note that such information is inherently included with the requested plans. The Complainant’s focus was solely on the construction details needed to assess the compliance of the building project with the minimum requirements set by the NBCP. However, the inclusion of personal information and sensitive personal information is incidental to the Complainant’s request. It is also worth emphasizing that due to the nature of the plans, it would be exceedingly difficult to disassociate the personal data from the requested plans.

In the Complainant’s submitted CAF79 and Memorandum,80 he alleged that he is entitled to access the plans from the Respondent pursuant to Sections 12 (f) and 13 (f) of the DPA.

As established in the previous rulings of this Commission, consent is not the only basis for processing personal information and sensitive personal information.81 In accordance with Sections 12 and 13 of the DPA, there are other lawful criteria in processing of personal information and sensitive personal information.82 Specifically, Sections 12 (f) and 13 (f), provide the following:

SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

x x x

  • (f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution. (Emphasis supplied)83

xxx

SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

xxx

  • (f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.84
1. Invoking Section 13 (f) of the DPA for the processing of the requested plans from the Respondent lacks merit

In the requested plans of the Complainant, it is essential to determine whether it contains personal information and/or sensitive personal information in order to determine the applicability of Section 12 (f) and/or Section 13 (f) of the DPA.

It should be emphasized that licenses issued by the government agencies peculiar to an individual – such as architects’ and engineers’ license numbers and their TINs which may appear in the requested plans - qualify as sensitive personal information under the DPA. Therefore, since the requested plans contain sensitive personal information, the processing of the requested plan must comply with Section 13 (f) of the DPA.

In this case, there was no evidence to support that the processing of the requested plans is necessary for the protection of lawful rights and interests or the establishment, exercise, or defense of legal claims.

Although the initiation of a court proceeding is not required, the processing of the requested plans must however demonstrate that the Complainant has a legal claim that he seeks to establish, exercise or defend. The Complainant alleged in his memorandum, to wit:

x x x

Actions taken by a landowner that appropriate adjacent land or substantially deprive adjacent owner of the reasonable enjoyment of his or her property is an unlawful use of one’s property x x x85

In this case, however, the Complainant failed to allege nor present proof that appropriation or deprivation has actually occurred. The Complainant’s concern was based solely on the possibility that RKG’s construction project could negatively impact his enjoyment of his property. While it is understandable that the Complainant may have had prior inconveniences with RKG’s construction, the fact remains that with the present construction, no tangible damage or legal violation has been alleged or proven.

Therefore, there is no substantiated legal claim that would justify the release of the requested plans. Mere anxiety or potential for inconvenience does not meet the threshold required to justify the processing of personal data, especially sensitive personal information under the DPA.

2. Even without the Sensitive Personal Information, invoking Section 12 (f) of the DPA for the processing of the requested plans from the Respondent lacks merit

The architect’s license number, which is considered sensitive personal information under the DPA, was not specifically requested by the Complainant. As such, this information can be easily redacted by the Respondent. Therefore, while the requested plans may contain personal information, they may not necessarily include sensitive personal information, provided that any extraneous data, such as the architect’s license number, is appropriately redacted.

To constitute lawful processing of personal information based on legitimate interest under Section 12 (f) of the DPA, the following requisites must be satisfied:

  1. The legitimate interest is established;

  2. The means to fulfill the legitimate interest is both necessary and lawful; and

  3. The interest is legitimate and lawful, and it does not override fundamental rights and freedoms of data subjects.86

Applying the first requisite to the present case, the Complainant has failed to establish a legitimate interest in requesting access to the plans approved by the Respondent.

The Complainant contended that, as an adjacent landowner to the property of RKG, he has a legitimate interest in ensuring that the development on his neighboring property does not adversely affect his own. He contended that property owners must exercise their rights without unduly interfering with the rights of adjacent contiguous landowners.87

In support of this claim, the Complainant stated that his interest lies in protecting his property rights against potential risks or damages that may result from construction activities on the neighboring lot.88

He emphasized that his request is aimed at preventing a recurrence of a tragic incident that occurred approximately twenty (20) years ago, allegedly due to similar construction-related issues.89 Thus, he seeks to ensure that his property is protected from “factors that will cause or likely to cause a repetition of the damage or injury previously done to his property.”90

However, the Commission finds that the Complainant’s assertion of a legitimate interest is not aligned with Section 5 (A) of NPC Circular No. 2023-07, which outlines the purpose test for establishing legitimate interest. Specifically:

SECTION 5. The Legitimate Interest is Established (Purpose Test). — A PIC shall determine the existence of a clearly established legitimate interest, including a determination of the objective of the specific processing activity.

A. The purpose of the specific processing activity must be specific, such that it is clearly defined and not vague or overbroad;91 x x x (Emphasis Supplied)

While the Complainant has raised concerns regarding potential harm to his property, there has been no actual damage or proven inconvenience caused by RKG’s construction project. The Complainant’s concern, therefore, remains speculative and without basis. The claim of legitimate interest is further undermined by the fact that the purpose for processing is both vague and overbroad. The Complainant’s request is based on hypothetical or future damage, rather than on a specific, identified injury to his property. The purpose of the processing is therefore not sufficiently defined, and as such, does not meet the threshold of specificity required by law.

In this regard, the Complainant’s purported legitimate interest is not substantiated by any actual or immediate threat to his property rights, and as such, the request for the Respondent approved plans is based on an overly general and unfounded concern, which is insufficient under the provisions of the DPA.

Moreover, it must be emphasized that, while the Complainant asserts an interest in protecting his property, his neighbor, RKG, likewise has a legitimate interest in safeguarding the confidentiality of his property, which extends to his residential house. The interests of one party cannot override those of another, particularly in the absence of any concrete, demonstrated harm or legal violation.

For the second requisite, under Section 6 of the NPC Circular No. 2023-0792 (Necessity Test), the means or method chosen for the specific processing activity undertaken to accomplish the legitimate interest of the PIC or the third party should be necessary and lawful.

In this case, the Complainant asserted that access to the plans is necessary to verify compliance with the ‘two-meter setback requirement’93 under the NBCP. However, the Commission finds that the asserted purpose can be achieved through other lawful and appropriate means. In its letter dated 11 December 2023, the Respondent assured the Complainant that the ongoing construction will be strictly monitored for compliance with the approved plans and applicable laws:

Nonetheless, rest assured that the subject construction shall be strictly monitored by this Office to assure that the approved plans are strictly complied by RKG. Otherwise, non-compliance with the approved building plans of this Office shall be subject to necessary actions pursuant to the provisions of P.D. 1096.94

This assurance demonstrates that the Complainant’s purpose can be fulfilled through regulatory supervision of the Respondent, without the need for direct access to the requested plans. Therefore, the means chosen by the Complainant is not necessary.

For the third requisite, under Section 7 of the NPC Circular No. 2023-07 (Balancing Test), the availability of other means or methods to fulfill the legitimate purpose95 weighs against the necessity for the processing of personal data. As discussed above, the Complainant has not shown that the access to the requested plans is the least intrusive or only method to achieve his declared purpose of processing the requested plans. Furthermore, granting access to the requested plans, without sufficient established purpose would unduly compromise RKG’s, fundamental right to privacy and right over his property of the requested plans.

In view of the foregoing, all three requisites for lawful processing of personal information under Section 12 (f) of the DPA was not met.

The Intellectual Property Code proscribes the Respondent from processing the requested construction/ building plan.

The Complainant is not entitled to access the requested plans from the Respondent due to the express requirement under the first sentence of Section 12 of the DPA, which provides that:

SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:96 (Emphasis Supplied)

In its Verified Comment97 and Memorandum98 submitted to the CID, the Respondent asserted that such disclosure is prohibited under Republic Act No. 8293, otherwise known as the Intellectual Property Code of the Philippines. According to the Respondent, the plans requested by the Complainant are protected works under the said law and cannot be disclosed without the consent of the owner or the author.

Specifically, Section 172 of the Intellectual Property Code, provides that “[illustrations], maps, plans, sketches, charts and three-dimensional works relative to geography, topography, architecture or science” are considered as literary and artistic works that are protected from the moment of their creation.99 Furthermore, Section 178 states that the copyright in a commissioned work belongs to the person who commissioned the work, unless otherwise agreed in writing.100

On this basis, the Respondent maintained that it cannot disclose the requested plans without the consent of the copyright owner, who in this case is either the property owner or the architect, depending on the agreement of the parties.

In response, the Complainant argued that the Respondent’s interpretation of the Intellectual Property Code is misplaced, and contended that Republic Act No. 9266, or the Architecture Act of 2004, should apply instead.101 However, such argument cannot be entertained by the Commission, as it falls outside the scope of its jurisdiction.

It must be emphasized that the Commission’s function is limited to administering and implementing the provisions of the DPA.102 The interpretation of the Intellectual Property Code or the Architecture Act is a matter beyond the Commission’s authority.

What the Commission may consider is whether the processing of personal information, as requested by the Complainant, is prohibited by another law. In this case, the Respondent has cited a specific legal provision under the Intellectual Property Code that may restrict the disclosure of the requested document. Given this assertion and absent any clear authority on the Commission’s part to interpret or resolve conflicts between these laws, the Commission cannot compel the Respondent to disclose the requested plans.

Accordingly, as the Intellectual Property Code regards plans relative to topography103 as works which are protected from the moment of their creation and as discussed above, the three (3) requirements for lawful processing of personal information were not met, Section 12 (f) of the DPA cannot be applied in the instant case.

The Respondent has already furnished the Complainant with several written affirmations in relation to his requests.

The Commission also emphasizes that, in response to the alleged letters, requests and complaints of the Complainant104 to the Respondent, the Respondent has already provided several written affirmations addressing the purpose and subject of the Complainant’s inquiries.

In the Respondent’s emailed letter105 to Complainant dated 14 August 2023, attached as “Annex B” to the CAF, the Respondent informed the Complainant that its Office had conducted an ocular inspection and validation of the concerns raised regarding the construction of RKG’s property. The following findings were reported:

x x x x

  1. Safety measures using corrugated G.I. sheets at a height of approximately 3.0m at the rear side (which is adjacent to the complainant’s house) were provided/ installed by the respondent [herein RKG].

  2. The [R]espondent [herein RKG] was reminded to properly secure their safety measures especially at the rear side and to observe normal working hours to avoid disturbance to the adjacent properties.106

x x x x

The Respondent further assured the Complainant that its Office would continue to ‘monitor the subject construction activity’107 and that, should any violations of the New Building Code be observed, appropriate enforcement actions would be taken.108

In light of the foregoing actions and assurances by the Respondent, the Complainant’s asserted legitimate interest, which serves as the legal basis for requesting the copies of the plans, has already been adequately addressed and satisfied.

The Complainant, in his Memorandum,109 asserted that the notarized Undertaking executed by Arch. AXB is a legally binding document that not only binds the parties therein but also extends its effect to third persons, including the Respondent.110 The Complainant further argued that the Respondent had no basis to claim that it is not privy to the said agreement and failed to acknowledge that, by signing the Undertaking, Arch. AXB freely and validly gave consent to the processing of the requested construction/building plan.111

However, the Commission finds no merit in the Complainant’s assertion that the Undertaking executed by Arch. AXB constitutes valid consent for the Respondent to process the requested construction/building plans.

Under NPC Circular No. 2023-04,112 Guidelines on Consent, the Commission laid down the requirements for what constitutes valid consent under the Data Privacy Act (DPA) and its Implementing Rules and Regulations (IRR).

As defined in Section 3 of the DPA, the consent of a data subject refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the processing of personal data about or relating to him or her, and such consent must be evidenced by written, electronic, or recorded means.113 Section 10 of the same Circular emphasizes that consent must be expressly given through a clear, affirmative action that signifies agreement to the specific purpose of the processing.114 Moreover, consent can neither be assumed nor implied.115

In this case, even assuming, for the sake of argument, that the executed Undertaking binds the Respondent, it does not indicate that such document constitutes valid consent to process the plans requested by the Complainant. Upon closer examination of the contents of the Undertaking, it is clear that it does not contain any express, specific, or informed indication that Arch. AXB consented to the disclosure or processing of the requested plans in favor of the Complainant. The document makes no reference whatsoever to the said plans, nor does it include any statement authorizing their release to the Complainant.

Thus, the Undertaking falls short of the requirements for valid consent as prescribed by the DPA. It does not reflect any clear, specific, and informed expression of will from the data subject to authorize the processing of the requested plans. Accordingly, the Commission cannot consider such document as a valid basis for the processing of the requested plans from the Respondent.

The Complainant’s assertion that the Respondent-approved construction/ building plan is a public document that entitles him to its access is without merit.

The Complainant argued that the seal of the Respondent’s Office appearing on the approved plans is considered, for all intents and purposes, a public official document partaking the nature of a public or official record.116 The Complainant further argued that although the requested plans may have been initially a private document, it has effectively become a public document by virtue of the Respondent now being its custodian.117 This argument, however, is misplaced.

Section 4 of the Data Privacy Act of 2012 (DPA) provides that the law applies to the processing of all types of personal information and to any natural or juridical person involved in such processing.118 While it is accepted that Executive Order No. 02119 recognizes the right of the people to have access to information, official records, and to documents and papers pertaining to official acts, transactions, or decisions, which are in the possession or under the custody of the government and relating to matters of public concern; the same also clarified that it is not without limitation as it recognizes certain exceptions in its application as enshrined in the Constitution, existing laws, or jurisprudence.120 It does not grant blanket access to all documents merely because they are classified as “public”.

It is a common misinterpretation that once a document is deemed public, the personal information it contains becomes freely accessible to anyone. The DPA makes no distinction between personal information found in private or public documents. What matters is the presence of personal information. If a document, regardless of whether it is public, private, notarized, or otherwise, contains personal information, its processing must still comply with the provisions of the DPA.

In this case, whether the requested plans qualify as a public document is not determinative of the application of the DPA. What is controlling is the fact that the plan may contain personal data, such as names, addresses, signatures, or other identifying data, that are subject to the DPA. Accordingly, accessing and processing of the document must still meet the minimum requirements under the DPA.

Thus, even if the plans are considered public document or are in the custody of a public office, it does not become freely accessible to anyone. It remains subject to the provisions of the DPA and must be handled in accordance with the general data privacy principles enshrined in the law.

WHEREFORE, premises considered, this Commission resolves that the instant Complaint filed by HCN against DBO is hereby DISMISSED for lack of merit.

This is without prejudice to the filing of appropriate civil, criminal or administrative cases against the Respondent DBO before any other forum or tribunal, if any.

SO ORDERED.

Quezon City, Philippines.

04 August 2025.

JOSE AMELITO SUTTON BELARMINO II

Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA

Privacy Commissioner

NERISSA N. DE JESUS

Deputy Privacy Commissioner

Copy furnished:

HCN

Complainant

DBO

Respondent

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

Footnotes

  1. Complaints-Assisted Form, 24 January 2024, in HCN v. DBO, NPC 24-006. ↩

  2. Id. at 4. ↩

  3. Id. ↩

  4. Complaints-Assisted Form, 24 January 2024, at Annex “A”, in HCN v. DBO, NPC 24-006. ↩

  5. Id. ↩

  6. Id. at 4. ↩

  7. Id. ↩

  8. Id. ↩

  9. Id. ↩

  10. Complaints-Assisted Form, 24 January 2024, at Annex “H”, in HCN v. DBO, NPC 24-006. ↩

  11. Id. at 4. ↩

  12. Id. ↩

  13. Id. ↩

  14. Id. ↩

  15. Id. ↩

  16. Complaints-Assisted Form, 24 January 2024, at 4, in HCN v. DBO, NPC 24-006. ↩

  17. Id. at 5. ↩

  18. Complaints-Assisted Form, 24 January 2024, at Annex “E”, in HCN v. DBO, NPC 24-006. ↩

  19. Order (To File Verified Comment and Appear Virtually for Preliminary Conference), 29 February 2024, in HCN v. DBO, NPC 24-006. ↩

  20. Id. at 3. ↩

  21. Delivery Receipt, dated 01 March 2024, 7:49 am. ↩

  22. Delivery Receipt dated 22 March 2024, 2:59 pm. ↩

  23. Verified Comment for the Respondent, 19 March 2024, in HCN v. DBO, NPC 24-006. ↩

  24. Id. at 1. ↩

  25. Id. at 7. ↩

  26. Id. at 2. ↩

  27. Id. at 4. ↩

  28. Id. ↩

  29. Verified Comment for the Respondent, 19 March 2024, at p. 4, in HCN v. DBO, NPC 24-006. ↩

  30. Id. ↩

  31. An Act Prescribing the Intellectual Property Code and Establishing the Intellectual Property.Office, Providing for Its Powers and Functions, and For Other Purposes [Intellectual Property Code of the Philippines], Republic Act No. 8293, Sections 172.1 (j) Chapter II and 178.4 Chapter VI (1997). ↩

  32. Verified Comment for the Respondent, 19 March 2024, at p. 2, in HCN v. DBO, NPC 24-006. ↩

  33. Id. ↩

  34. Id. at 4. ↩

  35. Id. at 6. ↩

  36. Id. ↩

  37. Id. ↩

  38. Order (On Respondent’s Comment), 26 March 2024, in HCN v. DBO, NPC 24-006. ↩

  39. Id. ↩

  40. Order (After the 1st Preliminary Conference held on 25 April 2024), 25 April 2024, in HCN v. DBO, NPC 24-006. ↩

  41. Id. ↩

  42. Id. ↩

  43. Id. ↩

  44. Delivery Receipt dated 25 April 2024, 6:25 pm. ↩

  45. Memorandum for the Respondent dated 21 May 2024, in HCN v. DBO, NPC 24-006. ↩

  46. Id. ↩

  47. Id. at 11. ↩

  48. Id. at 12. ↩

  49. Id. ↩

  50. Id. ↩

  51. Id. ↩

  52. Memorandum for the Respondent dated 21 May 2024, at p.13, in HCN v. DBO, NPC 24-006. ↩

  53. Id. ↩

  54. Id. ↩

  55. Delivery Receipt dated 29 May 2024, 3:35 pm. ↩

  56. Order (On the Memorandum for the Public Respondent), dated 28 May 2024, in HCN v. DBO, NPC 24-006. ↩

  57. Delivery Receipt dated 29 May 2024, 3:42 pm. ↩

  58. Memorandum for the Complainant dated 02 May 2024, in HCN v. DBO, NPC 24-006. ↩

  59. Id. at 2. ↩

  60. Id. at 3. ↩

  61. Id. ↩

  62. Id. ↩

  63. Id. at 25. ↩

  64. Memorandum for the Complainant dated 02 May 2024, at p. 25, in HCN v. DBO, NPC 24-006. ↩

  65. Id. ↩

  66. Id. at 27. ↩

  67. Id. at 24. ↩

  68. Id. ↩

  69. An Act Providing for a more Responsive and Comprehensive Regulation for the Registration, Licensing and Practice of Architecture, Repealing for the Purpose Republic Act No. 545, as Amended, Otherwise Known as “An Act to Regulate The Practice Of Architecture In The Philippines,” and for Other Purposes [The Architecture Act of 2004}, Republic Act No. 9266, Section 33, Article IV (2004). ↩

  70. Memorandum for the Complainant dated 02 May 2024, at p.28, in HCN v. DBO, NPC 24-006 ↩

  71. Id. ↩

  72. MNLC Inc. represented by IKP v. PXXX Corporation, RCM and AD, NPC 19-528, Decision dated 29 October 2020, at p. 10, available at https://privacy.gov.ph/wp-content/uploads/2023/05/Decision_NPC-19-528-MNLC-v.-PXXX-Corporation.pdf (last accessed 25 August 2025). ↩

  73. GSS v. Global Dominion Financing Inc., NPC 21-064, Decision dated 16 June 2022, at p. 7, available at https://privacy.gov.ph/wp-content/uploads/2024/05/NPC-21-064-2022.06.16-GSS-v.-Global-Dominion-Financing-Inc-Decision-FinalP.pdf (last accessed 25 August 2025). ↩

  74. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, Section 3 (j), Chapter I (2012). ↩

  75. Complaints-Assisted Form, 24 January 2024, at p. 6, in HCN v. DBO, NPC 24-006. ↩

  76. Memorandum for the Complainant dated 02 May 2024, at p. 6, in HCN v. DBO, NPC 24-006. ↩

  77. Complaints-Assisted Form, 24 January 2024, at p. 4, in HCN v. DBO, NPC 24-006. ↩

  78. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, Section 3 (g)(l), Chapter I (2012). ↩

  79. Complaints-Assisted Form, 24 January 2014, at p. 4-5, in HCN v. DBO, NPC 24-006. ↩

  80. Memorandum for the Complainant dated 02 May 2024, at p. 25, in HCN v. DBO, NPC 24-006. ↩

  81. ACN v. DT, NPC 18-109, Decision dated 01 June 2021, at p. 10, available at https://privacy.gov.ph/wp-content/uploads/2022/01/Decision-NPC-18-109-ACN-v.-DT.pdf (last accessed 28 August 2025). ↩

  82. Id. ↩

  83. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, Section 12 (f), Chapter III (2012). ↩

  84. Id. at Section 13 (f). ↩

  85. Memorandum for the Complainant dated 02 May 2024, at p. 2, in HCN v. DBO, NPC 24-006. ↩

  86. NPC Circular 2023-07, Guidelines on Legitimate Interest dated 13 December 2023, Section 4. ↩

  87. Memorandum for the Complainant dated 02 May 2024, at p. 2, in HCN v. DBO, NPC 24-006. ↩

  88. Id. at p. 27. ↩

  89. Id. ↩

  90. Id. at p. 25. ↩

  91. NPC Circular 2023-07, Guidelines on Legitimate Interest dated 13 December 2023, Section 5 (A). ↩

  92. Id. at Section 6. ↩

  93. Complaints-Assisted Form, 24 January 2024, at p. 4, in HCN v. DBO, NPC 24-006. ↩

  94. Id. at Annex “E -1”. ↩

  95. NPC Circular 2023-07, Guidelines on Legitimate Interest dated 13 December 2023, Section 7 (C). ↩

  96. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, Section 12, Chapter III (2012). ↩

  97. Verified Comment for the Respondent, 19 March 2024, at p. 2, in HCN v. DBO, NPC 24-006. ↩

  98. Memorandum for the Respondent dated 21 May 2024, at p.6, in HCN v. DBO, NPC 24-006. ↩

  99. An Act Prescribing the Intellectual Property Code and Establishing the Intellectual Property Office, Providing for Its Powers and Functions, and For Other Purposes [Intellectual Property Code of the Philippines], Republic Act No. 8293, Sections 172.1 (i), Part IV Chapter II (1997). ↩

  100. Id. at 178.4 Part IV Chapter VI. ↩

  101. Memorandum for the Complainant dated 02 May 2024, at p.24, in HCN v. DBO, NPC 24-006. ↩

  102. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, Section 7, Chapter II (2012). ↩

  103. An Act Prescribing the Intellectual Property Code and Establishing the Intellectual Property Office, Providing for Its Powers and Functions, and For Other Purposes [Intellectual Property Code of the Philippines], Republic Act No. 8293, Sections 172.1 (i), Part IV Chapter II (1997). ↩

  104. Complaints-Assisted Form, 24 January 2024, at p. 4, in HCN v. DBO, NPC 24-006. ↩

  105. Id. at Annex “B”. ↩

  106. Id. ↩

  107. Id. ↩

  108. Id. ↩

  109. Memorandum for the Complainant dated 02 May 2024, at p.27-28, in HCN v. DBO, NPC 24-006. ↩

  110. Id. ↩

  111. Id. at p. 28. ↩

  112. NPC Circular 2023-04, Guidelines on Consent dated 07 November 2023. ↩

  113. An Act Prescribing the Intellectual Property Code and Establishing the Intellectual Property Office, Providing for Its Powers and Functions, and For Other Purposes [Intellectual Property Code of the Philippines], Republic Act No. 8293, Section 3 Chapter I (1997). ↩

  114. NPC Circular 2023-04, Guidelines on Consent dated 07 November 2023, Section 10. ↩

  115. Id. ↩

  116. Memorandum for the Complainant dated 02 May 2024, at p. 21, in HCN v. DBO, NPC 24-006. ↩

  117. Id. at Annex “F”. ↩

  118. An Act Prescribing the Intellectual Property Code and Establishing the Intellectual Property Office, Providing for Its Powers and Functions, and For Other Purposes [Intellectual Property Code of the Philippines], Republic Act No. 8293, Section 4 Chapter I (1997). ↩

  119. Office of the President, Operationalizing in the Executive Branch the Constitutional Right to Information and the State Policies of Full Public Disclosure and Transparency in the Public Service and Providing Guidelines Therefor, Executive Order No. 2 [E.O. No. 2] (July 23, 2016). ↩

  120. Id. at Section 4. ↩

Backlinks

  • No backlinks found