NPC Issuance Wiki

Guidelines on the Processing of Personal Data for Election Campaign or Partisan Political Activity (Advisory No. 2021-03)

Issued Advisory

Issuance Text

NPC Advisory No. 2021–03

DATE: 05 November 2021

SUBJECT: GUIDELINES ON THE PROCESSING OF PERSONAL DATA FOR ELECTION CAMPAIGN OR PARTISAN POLITICAL ACTIVITY

SECTION 1. Scope. This Advisory shall apply to political parties, candidates, aspirants, party-list groups or organizations and their nominees, and information society service providers on the matter of processing personal and sensitive personal information (collectively, personal data) for election campaigns or partisan political activities.

SECTION 2. Definition of Terms. For the purpose of this Advisory, the following terms are defined, as follows:

  • A. “Act” or “DPA” refers to Republic Act No. 10173, also known as the Data Privacy Act of 2012;

  • B. “Aspirant” refers to any person who has filed a certificate of candidacy within the prescribed period but is not yet officially considered as a candidate;

  • C. “Candidate” refers to any person aspiring for or seeking an elective public office, who has filed a certificate of candidacy by himself or through an accredited political party, aggroupment, or coalition of parties.1 Such person shall be considered a candidate at the start of the campaign period for which he or she has filed his or her certificate of candidacy;2

  • D. “Commission” or “NPC” refers to the National Privacy Commission;

  • E. “Consent of the data subject” refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so;

  • F. “Data subject” refers to an individual whose personal, sensitive personal, or privileged information is processed;

  • G. “Election campaign” or “partisan political activity” refers to an act designed to promote the election or defeat of a particular candidate or candidates to a public office which shall include:3

    1. Forming organizations, associations, clubs, committees or other groups of persons for the purpose of soliciting votes and/or undertaking any campaign for or against a candidate;
    2. Holding political caucuses, conferences, meetings, rallies, parades, or other similar assemblies, for the purpose of soliciting votes and/or undertaking any campaign or propaganda for or against a candidate;
    3. Making speeches, announcements or commentaries, or holding interviews for or against the election of any candidate for public office;
    4. Publishing or distributing campaign literature or materials designed to support or oppose the election of any candidate; or
    5. Directly or indirectly soliciting votes, pledges or support for or against a candidate.

  • H. “Information society service” refers to any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services.4

  • I. “Information society service provider” refers to natural or juridical person providing information society service.5

  • J. “IRR” refers to the Implementing Rules and Regulations of Republic Act No. 10173;

  • K. “Nominee” refers to refers to individuals nominated by party-list groups or organizations as party-list representatives. No person shall be nominated as a party-list representative unless he is a natural born citizen of the Philippines, a registered voter, a resident of the Philippines for a period of not less than one (1) year immediately preceding the day of the election, able to read and write, bona fide member of the party or organization which he seeks to represent for at least ninety (90) days preceding the day of the election, and is at least twenty-five (25) years of age on the day of the election. In case of a nominee of the youth sector, he must at least be twenty-five (25) but not more than thirty (30) years of age on the day of the election. Any youth sectoral representative who attains the age of thirty during his term shall be allowed to continue until the expiration of his term;6

  • L. “Party-list groups or organizations” refers to organized groups who may participate in the party-list election:7

    1. Sectoral party an organized group of citizens whose principal advocacy pertains to the special interests and concerns of the following sectors: Labor; Peasant; Urban Poor; Indigenous Cultural Communities; Elderly; Handicapped; Women; Youth; Overseas Workers; Fisherfolk; Veterans; and Professionals;
    2. Sectoral organization a group of qualified voters bound together by similar physical attributes or characteristics, or by employment, interests or concerns;
    3. Political Party an organized group of qualified voters pursuing the same ideology, political ideas and principles for the general conduct of the government;
      It is a national party when its constituency is spread over the geographical territory of at least a majority of the regions. It is a regional party when its constituency is spread over the geographical territory of at least majority of the cities and provinces comprising the region; and
    4. Coalition an aggrupation of duly-registered national, regional. Sectoral parties or organizations for political and/or election purposes.

  • M. “Personal data” refers to all types of personal information and sensitive personal information;

  • N. “Personal information” refers to any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual;

  • O. “Personal information controller” or “PIC” refers to a natural or juridical person, or any other body, who controls the processing of personal data, or instructs another to process personal data on its behalf. The term excludes:

    1. A natural or juridical person, or any other body, who performs such functions as instructed by another person or organization; or
    2. A natural person who processes personal data in connection with his or her personal, family, or household affairs;

    There is control if the natural or juridical person or any other body decides on what information is processed, or the purpose or extent of its processing.

  • P. “Personal information processor” or “PIP” refers to any natural or juridical person or any other body to whom a personal information controller may outsource or instruct the processing of personal data;

  • Q. “Political party” refers to an organized group of persons pursuing the same ideology, political ideas or platforms of government and includes its branches and divisions.8

  • R. “Processing” refers to any operation or any set of operations performed upon personal data including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data. Processing may be performed through automated means, or manual processing, if the personal data are contained or are intended to be contained in a filing system;

  • S. “Sensitive personal information” refers to personal information:

    1. About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical, or political affiliations;
    2. About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such individual, the disposal of such proceedings, or the sentence of any court in such proceedings;
    3. Issued by government agencies peculiar to an individual which includes, but is not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and
    4. Specifically established by an executive order or an act of Congress to be kept classified.

SECTION 3. Accountability. As PICs, political parties, candidates, aspirants, party-list groups or organizations and their nominees, and information society service providers acting as PICs shall be accountable for complying with the requirements of the DPA, IRR, and issuances of the NPC.

SECTION 4. Guidelines. The processing of personal data for election campaign or partisan political activity shall be subject to the following general guidelines:

  • A. Legitimate purpose. The processing of personal data shall be limited to and compatible with the declared and specified purpose/s which must not be contrary to law, morals, or public policy.

    1. All political parties, candidates, aspirants, party-list groups or organizations and their nominees, and information society service providers acting as PICs processing personal data for election campaigns shall clearly identify and document the specific purpose/s of processing, e.g., advertising, direct marketing, fundraising, opinion research, profiling, targeted communications, polling, surveys. Personal data shall not be processed for indeterminate purposes. All identified and documented purpose/s shall be duly communicated to data subjects before the entry of personal data into any processing system, or at the next practical opportunity.
    2. Personal data originally collected for election campaign purposes may be processed further for historical, statistical, or scientific purposes, subject to the implementation of appropriate security measures to safeguard the rights and freedoms of data subjects,9 such as anonymization, pseudonymization, restriction on access.
    3. Any other further processing for purposes aside from those in the immediately preceding provisions shall still be compatible with the declared and specified purposes. In determining whether another purpose is compatible with the purpose for which the personal data is initially collected, the following shall be considered:10
      • a) any clear and reasonable link between those purposes and the purposes of the intended further processing;
      • b) the context in which the personal data has been collected, particularly the reasonable expectations of data subjects based on their relationship with the PIC as to any further use;
      • c) the nature of the personal data;
      • d) the likely impact of further processing to data subjects; and
      • e) the existence of reasonable and appropriate security measures in both the original and intended further processing operations.
    4. Further processing of personal data that is beyond the reasonable expectations of data subjects is prohibited. In this instance, reasonable expectations shall be considered to determine the legitimacy of the intended further processing by examining whether the same is compatible with the original purpose and not beyond what data subjects may reasonably expect as to the purpose, scope, manner, and extent of the processing of their personal data.11
    5. Purpose limitation protects against function creep or the gradual widening or blurring of purposes for which personal data is processed.12 Any unauthorized repurposing or unanticipated use of personal data resulting to real risk of serious harm to data subjects shall be taken into account by the Commission in case a complaint is filed and/or in the course of any investigation, as well as in the conduct of compliance checks.

  • B. Lawful basis for processing. Political parties, candidates, aspirants, party-list groups or organizations and their nominees, and information society service providers acting as PICs shall determine the most appropriate lawful basis for processing under Sections 12 or 13 of the DPA in processing personal data for election campaign or partisan political activity.

    1. PICs shall establish and document their lawful basis for processing considering the purpose for processing, the nature of the personal data, and relationship with the data subject. The same evaluation shall be made on the determination of the most appropriate basis for any authorized further processing.
    2. Any PIC relying on consent under Sections 12 (a) or 13 (a) of the DPA must be able to demonstrate that they have obtained valid consent as defined under the DPA – freely given, specific, informed indication of will – by keeping records of the identity of the data subject, the specific period when consent was given, the manner how consent was given, and the specific information provided to the data subject at the time consent was obtained. Consent shall be evidenced by written, electronic, or recorded means.
    3. To use legitimate interest under Section 12 (f) of the DPA to process personal information, a legitimate interest assessment shall be conducted by PICs, considering the following:13
      • a) Purpose test. The existence of a legitimate interest must be clearly established, including a determination of what the particular processing activity seeks to achieve;
      • b) Necessity test. The processing of personal information must be necessary for the purpose of the legitimate interest pursued by PICs or third parties to whom personal data is disclosed, where such purpose could not be reasonably fulfilled by other means; and
      • c) Balancing test. The fundamental rights and freedoms of data subjects should not be overridden by the legitimate interests of the political parties, candidates, aspirants, party-list groups or organizations and their nominees, and information society service providers acting as PICs considering the likely impact of the processing on the data subjects.
    4. The Commission may evaluate whether PICs correctly relied on consent, legitimate interest, or any other lawful basis for the specific processing, taking in consideration Section 38 of the DPA and whether the rights of the data subject could be better protected by using another lawful criterion for processing.

  • C. Transparency. Political parties, candidates, aspirants, party-list groups or organizations and their nominees, and information society service providers acting as PICs shall adhere to the general data privacy principle of transparency in all personal data processing activities they are engaged in, including those that have been outsourced to personal information processors (PIPs).

    1. Political parties, candidates, aspirants, party-list groups or organizations and their nominees shall inform the data subjects of the following through an appropriate privacy notice in clear and plain language and easily accessible to data subjects:
      • a) The specific mechanisms used to engage and communicate with data subjects, e.g., websites, social media platforms, messaging applications, and other online applications;
      • b) Details of personal data collected and processed using the identified mechanisms;
      • c) The purpose and lawful basis of processing and further processing, where applicable;
      • d) The method of processing, including the use of any profiling and data-driven targeting techniques, as well as the targeting criteria used;
      • e) The identity and contact details of the political parties and candidates and their representative/s;
      • f) The period and purpose for which the personal data will be retained; and
      • g) The existence of data subject rights and how they may exercise them.
    2. Information society service providers acting as PICs shall likewise be transparent to data subjects by providing adequate information on its personal data processing activities for elections campaigns through its own privacy notice, accessible and written in clear and plain language, which should include the following:
      • a) Details of personal data that has been collected;
      • b) The method of processing, including the use of any profiling and data-driven targeting techniques, as well as the targeting criteria used;
      • c) Reason for the data subjects’ receipt of any particular election campaign material, targeted messaging, or any political message and communication; and
      • d) The identity of the political party and/or candidate responsible for such materials and communications.
    3. All election campaign materials and political messages and communications sent to data subjects must be easily recognizable, i.e., clearly labeled or marked, as such. The identity of the political parties, candidates, aspirants, party-list groups or organizations and their nominees sending such materials and communications shall be clearly identifiable in the content of the same by any person viewing such materials and communications.

  • D. Proportionality. In all personal data processing activities, PICs shall ensure that personal data collected therein should be adequate, relevant, suitable, necessary, and not excessive in relation to the specified purpose for which they are collected and processed. PICs shall process personal data only if the purpose of the processing cannot reasonably be fulfilled by other less intrusive means.

    1. An assessment shall be made on whether processing sensitive personal information, such as political affiliation, is proportional to the purpose of processing, considering the risks of voter discrimination, suppression, and intimidation.
    2. Processing of sensitive personal information shall have adequate safeguards against any undue intrusion into data subjects’ fundamental rights and freedoms.

  • E. Personal data collected from sources other than the data subject. The processing of personal data obtained from sources other than directly from a data subject or from publicly available sources is still within the scope of the DPA. Political parties, candidates, aspirants, party-list groups or organizations and their nominees, and information society service providers acting as PICs are required to comply with the provisions of the DPA, its IRR, and relevant issuances of the NPC.

    1. Access to list of registered voters. The right of registered political parties and bona fide candidates under Republic Act No. 818914 or The Voter’s Registration Act of 1996 to inspect or copy the list of registered voters in the precincts constituting the constituency of the bona fide candidate or at which the political party is fielding candidates is recognized. While this right is necessary for promoting political participation, the processing of such lists should still be compliant with the DPA.

      • a) Political parties or candidates obtaining such lists are deemed to be PICs having duties and responsibilities under the DPA;
      • b) The use of the lists of registered voters must be in ways compatible with election laws, rules, and regulations;
      • c) Information as to how political parties or candidates use these lists should be readily available in their websites and social media platforms, and/or physical notices in offices or headquarters;
      • d) These lists should not be shared or posted on any social media platform; and
      • e) Should political parties or candidates or their authorized representatives use the lists to communicate directly with the data subjects, they must be able to provide adequate information to the data subjects when requested.

    2. Publicly available sources; social media. Political parties, candidates, aspirants, party-list groups or organizations and their nominees, and information society service providers acting as PICs collecting and processing personal data from the public domain must still observe the requirements under the law, such as but not limited to, adhering to the general data privacy principles, and having a lawful basis for processing personal data.

      • a) Collecting and processing personal data which are publicly available such as social media profiles or personal data that are collected from the social media pages of political parties, candidates, aspirants, party-list groups or organizations and their nominees such as details on followers or other users that have been observed or inferred, should still have a lawful basis for processing;
      • b) Providing personal data in a publicly accessible platform does not mean that data subjects have given consent to the use of their personal data for election campaign purposes; and
      • c) PICs shall uphold data subjects’ right to be informed and provide adequate information to them within a reasonable time after collecting the personal data or at the next practical opportunity, e.g., if personal data is used to communicate with the data subject, information shall be provided at the same instance when the first communication occurs.

SECTION 5. Rights of the Data Subjects. Political parties, candidates, aspirants, party-list groups or organizations and their nominees, and information society service providers acting as PICs shall uphold the rights of the data subjects and have mechanisms in place that will allow them to exercise such rights.

  • A. Personal data shall be processed fairly, lawfully, and in a transparent manner. Data subjects have the right to be informed about the collection and use of their personal data, the purposes for processing, retention periods for that personal data, who it will be shared with and the purpose for sharing, among others.

  • B. If processing is based on consent, data subjects have the right to withdraw their consent at any time. PICs are required to implement convenient means for data subjects to withdraw consent. Similarly, if such processing is based on legitimate interest, data subjects may exercise their right to object to the processing of his or her personal data at any time.

  • C. Data subjects should be able to exercise the right to access their personal data through procedures that are simple and convenient, as well as the right to erasure in certain circumstances as provided for under the DPA.

  • D. For further guidance on the data subject rights, refer to NPC Advisory No. 2021 – 01.15

SECTION 6. Security of Personal Data. PICs are expected to implement reasonable and appropriate organizational, physical, and technical security measures intended for the protection of personal data.

  • A. At the minimum, the following should be complied with:

    1. Appointment of a data protection officer and registration of data processing systems with the NPC;
    2. Conduct of privacy impact assessments;
    3. Development of a privacy management program and privacy manual;
    4. Implementation of privacy and data protection measures; and
    5. Preparation for a personal data breach, including compliance with mandatory personal data breach notifications.

  • B. A privacy impact assessment should be conducted prior to adoption, use, or implementation of any personal data processing system to aid in identifying, assessing, evaluating, and managing the risks represented by the processing of personal data for election campaigns or partisan political activities, considering the risks of voter discrimination, suppression, and intimidation.

  • C. As part of technical measures, PICs should conduct regular monitoring for security incidents and personal data breaches on databases containing voters’ personal data. A process for identifying reasonably foreseeable vulnerabilities in personal data processing systems and for taking preventive, corrective, and mitigating action against security incidents that can lead to a personal data breach shall be implemented.16

  • D. If the processing of personal data is outsourced, PICs shall use contractual or other reasonable means to provide a comparable level of protection while the personal data is being processed by a PIP. For this purpose, an outsourcing agreement containing the required provisions under the IRR should be executed to ensure reasonable protection of the personal data processed.

  • E. Employees, volunteers, and other authorized representatives involved in election campaigns shall undergo basic training on data privacy. Confidentiality agreements shall be executed by the abovementioned individuals, where appropriate.

  • F. Retention of personal data shall only be for as long as necessary for the fulfillment of the declared, specified, and legitimate purpose related to election campaigns and partisan political activities. PICs shall dispose personal data in a secure manner that will prevent unauthorized further processing by, access of, or disclosure to, any other party or the public, that would prejudice the rights and freedoms of the data subjects.17

SECTION 7. Interpretation. Any doubt in the interpretation of any provision of this Advisory shall be liberally interpreted in a manner mindful of the rights and interests of the individual about whom personal information is processed.

Approved:

SGD.
RAYMUND ENRIQUEZ LIBORO
Privacy Commissioner

SGD.
LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner

SGD.
JOHN HENRY D. NAGA
Deputy Privacy Commissioner

Footnotes

  1. Omnibus Election Code of the Philippines, Batas Pambansa Blg. 881, § 79 (a) (1985). ↩

  2. An Act Amending Republic Act No. 8436, Entitled “An Act Authorizing The Commission On Elections To Use An Automated Election System In The May 11, 1998 National Or Local Elections And In Subsequent National And Local Electoral Exercises, To Encourage Transparency, Credibility, Fairness And Accuracy Of Elections, Amending For The Purpose Batas Pambansa Blg. 881, As Amended, Republic Act No. 7166 And Other Related Election Laws, Providing Funds Therefor And For Other Purposes, Republic Act No. 9369, § 13 (2007). ↩

  3. Omnibus Election Code of the Philippines, Batas Pambansa Blg. 881, § 79 (b) (1985). ↩

  4. Directive (EU) 2015/1535 of the European Parliament and of the Council of 9 September 2015 laying down a procedure for the provision of information in the field of technical regulations and of rules on Information Society services (codification), Art. 1 (1) (b); ↩

  5. This includes, but is not limited to, social media, networking and discussion forums, online media sharing providers, messaging platforms, e-commerce platforms, file storage and sharing providers, online polling or survey providers, online advertising platforms. ↩

  6. An Act Providing For The Election Of Party-List Representatives Through The Party-List System, And Appropriating Funds Therefor [Party-List System Act], Republic Act No. 7941, § 8 and 9 (1995). ↩

  7. Commission on Elections, Rules and Regulations Governing The: 1) Filing Of Petitions For Registration; 2) Filing Of Manifestation Of Intent To Participate; 3) Submission Of Names Of Nominees; And 4) Filing Of Disqualification Cases Against Nominees Of Party-List Groups Or Organizations Participating Under The Party-List System Of Representation In Connection With The May 13, 2013 National And Local Elections, And Subsequent Elections Thereafter, Resolution No. 9366, § 3 (2012). ↩

  8. Omnibus Election Code of the Philippines, Batas Pambansa Bilang 881, § 60 (1985). ↩

  9. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 19 (e) (1) (2016). ↩

  10. See: Council of Europe, Explanatory Report to the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, available at https://rm.coe.int/cets-223-explanatory-report-to-the-protocol-amending-the-convention-fo/16808ac91a (last accessed 29 September 2021). ↩

  11. See: National Privacy Commission, JV v. JR, NPC Case No. 17-047 (2019). ↩

  12. European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, Version 1.1 Adopted on 4 May 2020, available at https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf (last accessed 29 September 2021). ↩

  13. See generally, Data Privacy Act of 2012, § 12 (f); United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ (last accessed September 22, 2021). ↩

  14. An Act Providing For A General Registration Of Voters, Adopting A System Of Continuing Registration, Prescribing The Procedures Thereof And Authorizing The Appropriation Of Funds Therefor [The Voter’s Registration Act of 1996], Republic Act No. 8189, § 42 (1996). ↩

  15. National Privacy Commission, Data Subject Rights [NPC Advisory No. 2021-01] (January 29, 2021). ↩

  16. See: Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 28 (d) (2016). ↩

  17. Id. § 19 (d) (2016). ↩

Backlinks