NPC Issuance Wiki

Guidelines on Personal Data Processing Based on Section 13 (f) of the Data Privacy Act of 2012 (Advisory No. 2024-02)

Issued Advisory

Issuance Text

NPC Advisory No. 2024 - 02

DATE: 12 August 2024

SUBJECT: GUIDELINES ON PERSONAL DATA PROCESSING BASED ON SECTION 13 (F) OF THE DATA PRIVACY ACT OF 2012

WHEREAS, Section 7 (g) of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA) empowers the National Privacy Commission (NPC) to publish, on a regular basis, a guide to all laws relating to data protection;

WHEREAS, Section 9 of the Implementing Rules and Regulations of the DPA (IRR) empowers the NPC to develop, promulgate, review, or amend rules and regulations for the effective implementation of the DPA;

WHEREAS, Section 13 (f) of the DPA provides that the processing of sensitive personal information and privileged information is lawful when it is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise, or defense of legal claims, or when provided to government or public authority;

WHEREAS, there is a need to clarify the application of Section 13 (f) of the DPA to enable personal information controllers (PICs) to properly rely on this provision as the basis for processing personal data;

WHEREAS, the intention of the DPA is not to grant blanket exemption to public authorities, but rather to strike a balance between the need for public authorities to process personal data pursuant to its functions and mandates and the need to safeguard the rights and interests of data subjects;

WHEREAS, the legislative intent in passing the DPA is to give full effect to all its provisions. The whole and every part of the statute must be considered in fixing the meaning of any parts and to produce a harmonious whole. A statute must be so construed as to harmonize and give effect to all its provisions whenever possible;1

WHEREAS, the DPA recognizes public authority’s need to process information in specific situations pursuant to its constitutional or statutory mandate or functions, as discussed in Section 4 (e), Section 12 (e), Section 13 (b), and Section 13 (f) of the DPA;

WHEREAS, information necessary to carry out the functions of public authority following Section 4 (e) of the DPA may be processed without a lawful basis under Section 12 or 13 of the DPA;

WHEREAS, the information referred to in Section 4 (e) of the DPA does not pertain to personal information. The doctrine of last antecedent states that a qualifying or relative word or clause, such as “which,” “said,” and “such,” is to be construed as applying to the words, phrase, or clause next preceding or, as is frequently stated, to the next preceding antecedent, and not as extending to or including others more remote, unless a contrary intention appears.2 Following the doctrine of last antecedent, the phrase “which includes the processing of personal data” relates to the immediately preceding phrase “functions of public authority” and not to the term “information”;

WHEREAS, processing of personal data for the performance by the independent central monetary authority or law enforcement and regulatory agencies, for its constitutionally and statutorily mandated functions under Section 4 (e) can find lawful basis under Sections 12 (e), 13 (b), or 13 (f) of the DPA, as applicable;

WHEREAS, processing of personal data by the government or public authority in relation to its constitutional or statutory mandate can find lawful basis in Section 12 (e) or Section 13 (b) of the DPA;

WHEREAS, Section 12 (e) of the DPA pertains to the processing of personal information when necessary to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority, which necessarily includes processing of personal information for the fulfillment of its mandate;

WHEREAS, Section 13 (b) of the DPA allows the processing of sensitive personal information and privileged information when provided for by existing laws and regulations: provided, that such regulatory enactments guarantee the protection of the sensitive personal information and privileged information: provided further, that the consent of the data subjects are not required by law or regulation permitting the processing of sensitive personal information and privileged information;

WHEREFORE, in consideration of these premises, the NPC hereby issues this Advisory on the Guidelines on Personal Data Processing based on Section 13 (f) of the DPA.

SECTION 1. Scope. This Advisory applies to all natural or juridical persons relying on Section 13 (f) of the DPA as a lawful basis for processing personal data.

SECTION 2. Processing under Section 13 (f) of the DPA. Processing on the basis of Section 13 (f) of the DPA requires that the processing is necessary, and the processing is for the protection of lawful rights and interests or the establishment, exercise, or defense of legal claims. Thus, processing under Section 13 (f) of the DPA is read as follows:

  • A. The processing is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings;

  • B. The processing is necessary for the establishment, exercise, or defense of legal claims; or

  • C. The processing entails providing to government or public authority personal data that is necessary for the protection of lawful rights and interests in court proceedings or the establishment, exercise, or defense of legal claims in relation to its constitutional or statutory mandate. Such instances may include providing information that supports the investigation of a law enforcement or regulatory agency.

SECTION 3. Processing under Section 13 (f) of the DPA as legitimate interest. Processing under Section 13 (f) of the DPA may be considered legitimate interest under Section 12 (f) of the DPA, which is a lawful basis for processing personal information.

  • A. Processing personal information that is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings or necessary for the establishment, exercise, or defense of legal claims3 may be considered as legitimate interest under Section 12 (f) of the DPA.4 As such, Section 13 (f) in relation to Section 12 (f) of the DPA may be a lawful basis for processing personal information for this purpose.

  • B. The PIC must fulfill the requisites for processing based on legitimate interest in NPC Circular 2023-07 or the Guidelines on Legitimate Interest.5

SECTION 4. Necessary. Determining the proper application of Section 2 of this Circular takes into consideration the necessity of the specific processing activity undertaken for the legitimate purpose of protecting lawful rights and interests of natural or legal persons in court proceedings, or establishing, exercising, or defending legal claims.6

The specific processing activity is necessary when it is adequate, relevant, suitable, and not excessive in relation to such legitimate purpose.7 The specific processing activity must be within the limitations of the law.8

SECTION 5. Protection of Lawful Rights and Interests; Establishment, Exercise, or Defense of Legal Claims.

  • A. Processing of personal data on the basis of Section 13 (f) of the DPA may be conducted during stages preparatory to a case. It does not require that there be an existing proceeding before an administrative agency, court, or other tribunal.
  • B. Processing of personal data on the basis of Section 13 (f) of the DPA need not result in the filing of an actual case.
  • C. “Natural or legal persons” under Section 13 (f) of the DPA refers to persons whose lawful rights and interests are protected in court proceedings, including the parties and their witnesses.9
  • D. Legal claims that are established, exercised, or defended may refer to legal claims of persons other than those who processed the personal data.10

SECTION 6. Transparency; Right to be Informed. Service of pleadings to the parties of a case is understood as the next practical opportunity to inform data subjects, in relation to Section 16 (a) and (b) of the DPA, of the nature, purpose, and extent of the processing of their personal data for the protection of lawful rights and interests or the establishment, exercise, or defense of legal claims.

Data subjects whose personal data is processed on the basis of Section 13 (f) of the DPA is informed of the specific processing activity when they are served with a copy of the pleading containing the personal data following the applicable rules of procedure on summons and service.

SECTION 7. Determination of merit of lawful rights and interests and legal claims; admissibility of evidence. The Commission only determines whether the processing of personal data is necessary in relation to the lawful rights and interests sought to be protected or the legal claims that are sought to be established, exercised, or defended. The Commission does not rule on the admissibility of evidence, its materiality, relevance, or probative value to a particular case outside its jurisdiction,11 or the propriety of the legal strategy employed by parties in legal proceedings.12 The establishment, exercise, or defense of a legal claim under Section 13 (f) of the DPA as a lawful basis for processing personal data is independent of the existence of a cause of action.13

SECTION 8. Interpretation. Any doubt in the interpretation of any provision of this Advisory shall be liberally interpreted in a manner mindful of the rights and interests of the data subjects.

Approved:

SGD.
JOHN HENRY D. NAGA
Privacy Commissioner

SGD.
LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner

SGD.
NERISSA N. DE JESUS
Deputy Privacy Commissioner

Footnotes

  1. Francisco I. Chavez v. Judicial Bar and Council, G.R. No. 202242 (2012). ↩

  2. Marvin L. San Juan v. People of the Philippines, G.R. No. 236628 (2023). ↩

  3. EA and TA v. EJ, EE and HC, NPC 17-018, 15 July 2019, at 8, available at https://privacy.gov.ph/wp-content/uploads/2024/06/NPC-17-018-2019.07.15-EA-and-TA-v-EJ-Decision-FinalP.pdf. ↩

  4. KRL v. Trinity University of Asia, AA, MC, NCB, RG GV, GCT, RR, MR, PB, CID Case No. 17-K-003, 19 November 2019, at 6, available at https://www.privacy.gov.ph/wp-content/uploads/2020/10/CID-17-K-003-KRL-v-Trinity-Decision-PSD-10Aug2020.pdf. ↩

  5. See National Privacy Commission, Guidelines on Legitimate Interest, NPC Circular No. 2023-07 [NPC Circ. No. 2023-07] (13 December 2023). ↩

  6. EA and TA v. EJ, EE and HC, NPC 17-018, 15 July 2019, at 8, available at https://privacy.gov.ph/wp-content/uploads/2024/06/NPC-17-018-2019.07.15-EA-and-TA-v-EJ-Decision-FinalP.pdf. ↩

  7. National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, rule IV, § 18 (c) (2016); See Spouses MCD and JJD v. Victoria Milling Company, et al., NPC 19-758 & 19-1846, 30 June 2023, at 23, available at https://privacy.gov.ph/wp-content/uploads/2024/05/NPC-19-758-to-NPC-19-1846-2023.06.30-MCD-_-JJD-v-Victorias-Milling-Company-et-al-Decision-FinalP.pdf. ↩

  8. Spouses MCD and JJD v. Victoria Milling Company, et al., NPC 19-758 & 19-1846, 30 June 2023, at 21, available at https://privacy.gov.ph/wp-content/uploads/2024/05/NPC-19-758-to-NPC-19-1846-2023.06.30-MCD-_-JJD-v-Victorias-Milling-Company-et-al-Decision-FinalP.pdf. ↩

  9. JCB v. FRL, NPC 21-031, 03 March 2022, at 11, available at https://privacy.gov.ph/wp-content/uploads/2024/05/NPC-21-031-2022.03.03-JCB-v.-FRL-Decision-FinalP.pdf. ↩

  10. JCB v. FRL, NPC 21-031, 03 March 2022, at 11, available at https://privacy.gov.ph/wp-content/uploads/2024/05/NPC-21-031-2022.03.03-JCB-v.-FRL-Decision-FinalP.pdf. ↩

  11. RJC v. DL, NPC 22-012, 10 November 2022, at 8, available at https://privacy.gov.ph/wp-content/uploads/2023/08/NPC-22-012-2022.11.10-RJC-v.-DL-Decision.pdf. ↩

  12. RJC v. DL, NPC 22-012, 26 January 2023, at 11, available at https://privacy.gov.ph/wp-content/uploads/2023/07/NPC-22-012-2023.01.26-RJC-v.-DL-Resolution-w-Sgd-Final.pdf. ↩

  13. EA and TA v. EJ, EE and HC, NPC 17-018, 05 November 2020, at 3, available at https://privacy.gov.ph/wp-content/uploads/2024/08/NPC-17-018-2020.11.05-EA-_-TA-v.-EJ-EE-_-HC-Resolution.pdf. ↩

Backlinks