NPC Issuance Wiki

Guidelines on Identification Cards (Circular No. 2023-03)

Issued Circular

Issuance Text

NPC Circular No. 2023 – 03

DATE: 07 November 2023

SUBJECT: GUIDELINES ON IDENTIFICATION CARDS

WHEREAS, personal information controllers (PICs) issue physical or digital identification cards (ID cards) to their respective data subjects for identity verification in relation to the provision of goods and services as well as the implementation of safeguards for electronic systems and physical premises, among others;

WHEREAS, the National Privacy Commission (NPC) recognizes that such processing activity may have a legitimate purpose and a lawful basis for processing under Sections 12 and 13 of the Data Privacy Act of 2012 (DPA);

WHEREAS, Section 11 of the DPA allows the processing of personal and sensitive personal information (collectively, personal data) subject to compliance with the requirements of the DPA and other laws allowing disclosure of information to the public, and adherence to the general principles of privacy;

WHEREAS, the principle of proportionality requires that the processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose, and that personal data shall be processed only if the purpose of the processing could not be reasonably fulfilled by other means;

WHEREAS, pursuant to Section 7 of the DPA, the NPC is charged with the administration and implementation of the provisions of the law, which includes ensuring the compliance by PICs with the provisions of the DPA, and carrying out efforts to formulate and implement plans and policies that strengthen the protection of personal data in the country, in coordination with other government agencies and the private sector;

WHEREAS, Section 9 of the Implementing Rules and Regulations of the DPA (IRR) provides that the Commission shall, among its other functions, develop, promulgate, review or amend rules and regulations for the effective implementation of the law;

WHEREFORE, in consideration of the foregoing premises, the NPC hereby issues this Circular that prescribes the guidelines for PICs on the issuance of ID cards.

SECTION 1. Scope. This Circular shall apply to all PICs that issue ID cards to their respective data subjects: provided, that ID cards issued by government agencies pursuant to their respective regulatory mandate, such as but not limited to, driver’s license, passport, Professional ID card of a Registered Professional, including for this purpose the Integrated Bar of the Philippines (IBP) Lawyers ID, Tax Identification Number (TIN) card, shall be excluded from the scope of this Circular.

For purposes of this Circular, ID cards are understood to be any physical or digital ID1 card that identifies a data subject. ID cards include, but are not limited to, company IDs, school IDs, insurance cards, membership cards, and rewards or loyalty cards.

SECTION 2. Definition of Terms. Terms used herein shall have the respective meanings provided in the DPA, its IRR, as amended, and other issuances of the NPC.

SECTION 3. Contents of ID cards; proportionality. All PICs issuing ID cards shall ensure that only the necessary personal data are indicated therein in relation to the primary purpose of identifying the data subject.

  • A. In the case of ID cards with additional functionalities, PICs shall ensure that all other personal data that will be included are reasonable and necessary for the specified and declared purposes of that specific ID card.

  • B. Nothing in this Circular shall be construed as prohibiting the inclusion of any personal data that is explicitly required by law or regulation to be indicated in an ID card issued by PICs.

  • C. PICs shall implement reasonable and appropriate safeguards to protect personal data on ID cards and shall ensure that such security features are at par with technological advances, best practices, and industry standards. PICs shall also educate data subjects on the appropriate physical security measures for ID cards already issued and in the possession of such data subjects.

  • D. In all cases, ID cards shall not contain information that is excessive. PICs shall bear the burden of demonstrating that the inclusion of a particular category of personal data is proportionate to the legitimate purpose.

SECTION 4. Penalties. Subject to the provisions of Section 3 (A) above, the processing of personal data in violation of this Circular shall carry criminal, civil, and administrative liability pursuant to the provisions of the DPA and related issuances of the Commission.

SECTION 5. Interpretation. Any doubt in the interpretation of any provision of this Circular shall be liberally interpreted in a manner mindful of the rights and interests of the data subjects.

SECTION 6. Transitory Provision. PICs shall be given a period of one hundred twenty (120) calendar days from the effectivity of this Circular to comply with the requirements provided herein.

SECTION 7. Separability Clause. If any portion or provision of this Circular is declared null and void, or unconstitutional, the other provisions not affected thereby shall continue to be in force and effect.

SECTION 8. Repealing Clause. All other rules, regulations, and issuances contrary to or inconsistent with the provisions of this Circular are deemed repealed or modified accordingly.

SECTION 9. Effectivity. This Circular shall take effect fifteen (15) calendar days after its publication in the Official Gazette or a newspaper of general circulation.

Approved:

SGD.
JOHN HENRY D. NAGA
Privacy Commissioner

SGD.
LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner

SGD.
NERISSA N. DE JESUS
Deputy Privacy Commissioner

Footnotes

  1. See: International Telecommunication Union, Recommendation ITU-T X.1251, A framework for user control of digital identity, “3.2.3 digital identity: The digital representation of the information known about a specific individual, group or organization”, available at https://www.itu.int/itu-t/recommendations/rec.aspx?rec=9619 (last accessed 5 July 2023) and United Nations Conference on Trade and Development, Policy Brief No. 96, March 2022, Digital identity refers to the set of electronically captured and stored attributes and credentials used to uniquely identify a person, which can include biographic data (e.g. name and date of birth), biometric data (e.g. fingerprints and facial features) and/or government-issued identification, available at: https://unctad.org/system/files/official-document/presspb2022d4_en.pdf (last accessed 5 July 2023). ↩

Backlinks