Resolution Text
EA and TA,
Complainant,
-versus-
EJ, EE and HC,
Respondents.
x----------------------------------------x
AGUIRRE, D.P.C.
For consideration of the Commission is the Motion for Reconsideration filed by Complainants EA and TA (Complainants) of the Decision dated 15 July 2019 which dismissed the Complaint against the Respondents EJ, EE and HC (Respondents) on the ground that the elements for a violation of Section 25 (b) of the Data Privacy Act of 2012 (DPA) were not sufficiently established.
In Complainants’ Motion for Reconsideration, they argued that the Commission’s reliance on Section 13(f) of the Act is “misplaced and runs contrary to established law.”1 They state thus:
- Moreover, the Decision states that the “establishment…of legal claims” as an exemption from the prohibition on processing sensitive personal information will set a dangerous precedent in allowing unauthorized persons from processing such personal sensitive information to their own nefarious ends.2
In Respondents’ Comment / Opposition, they stressed that the Motion for Reconsideration, being just a rehash of the Complaint, did not raise new matters that could serve as basis for this Commission to reconsider its Decision.3
Discussion
The Commission denies the Complainants’ Motion for Reconsideration.
Complainants’ arguments relating to the exemption provided under Section 13(f) regarding the “establishment of legal claims” proceed from the erroneous assumption that a pending case is required. As this Commission has held in its Decision:
“To require a[n existing] court proceeding for the application of Section 13(f)… would not only be to disregard the distinction provided in the law but the clear letter of the law as well. After all, the very idea of ‘establishment … of legal claims’ presupposes that there is still no pending case since a case will only be filed once the required legal claims have already been established.”4
Considering that an existing court proceeding is not required, Complainants’ claim that a subpoena duces tecum is always required for the production of documents under Section 13(f) has no basis. The Commission emphasizes that, contrary to the claim of Complainants, there is no violation of Section 26, Rule 132 of the Rules of Court5 since what was released to the respondents were just certified copies while the original records remained with the Philippine Statistics Authority.
Further, the Commission takes this opportunity to emphasize that it is not for this Commission to determine the merits of the legal claims that may be established pursuant to Section 13(f). As such, contrary to the
claim of the Complainants, the supposed dismissal of the Falsification case that was filed against the herein Complainants, where the documents from the Philippine Statistics Authority were used, does not negate the respondents’ reliance on Section 13(f).
Finally, regarding their argument that allowing the exemption for the “establishment of legal claims” sets a dangerous precedent, the Complainants should note that this exemption is provided in the DPA itself. In any case, in its determination of the lawfulness of processing, the Commission does not rely on the bare assertions that a controller relied on Section 13(f) as its basis.
The determination of a valid reliance on the second part of Section 13(f), i.e. “the processing is necessary for the establishment, exercise or defense of legal claims,” requires a consideration of the relationship of the parties at the time of the processing, taking into consideration the juridical ties between them. Whether the legal claim that is established, exercised, or defended, resulted in the filing of an actual case is immaterial since the exercise of these remedies is a decision independent from the existence of a cause of action.
Aside from this, Section 13(f) also requires compliance with the general principles particularly, transparency, legitimate purpose, and proportionality, as well as compliance with the limitations provided by law. This involves, among others, compliance with the procedures set out by law, including those established by government agencies such as the Philippine Statistics Authority in this case for the release of documents in their possession.
The Decision has discussed the principles of legitimate purpose and proportionality. It stated thus:
As regards legitimate purpose, the Implementing Rules and Regulations (IRR) of the Data Privacy Act provides that the processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy.6 This means that the processing done for the establishment of a legal claim
should not in any manner be outside the limitations provided by law. The DPA is neither a tool to prevent the discovery of a crime nor a means to hinder legitimate proceedings.
In this case, the collection of the subject documents was in view of the falsification case that was eventually filed with the Regional Trial Court of Roxas City, Iloilo. The processing of the documents for this cannot be considered as wrongful or illegal.
xxx
Aside from legitimate purpose, the qualifier “necessary” also pertains to the general privacy principle of proportionality. Under the IRR, the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.
The proportionality principle, as manifested in the qualifier “necessary” serves as a sufficient test in determining whether the processing is justified in relation to the declared purpose.
In this case, considering that the documents were used in the falsification case and absent any showing that its use was unjustified, it cannot therefore be said that the processing done by Respondents was not necessary.7
The principle of transparency normally relates to the information provided by controllers through their privacy policies, notices, or terms and conditions regarding how personal information of data subjects may be used to establish, exercise, or defend legal claims. In discussing when information about the processing of personal information should be disclosed to the data subject, Section 11 of the DPA provides:
“Personal information must, be:,
(a) Collected for specified and legitimate purposes determined and declared before, or as soon as reasonably practicable after collection, and later processed in a way compatible with such declared, specified and legitimate purposes only xxx”8
This Commission acknowledges, however, that situations may arise where strict compliance with the principle of transparency may “render impossible or seriously impair the achievement of the objectives of [the] processing.”9 In these cases, the controller may continue their processing to establish their legal claims while taking appropriate measures to protect the data subject’s rights and freedoms.
If the controller decides to pursue and exercise their legal claim/s by availing of the appropriate remedy provided by law, such as filing a case in court or a quasi-judicial body, the existing requirements of due process during the course of the proceedings should cause the controller to comply with the declaration required under Section 11 of the DPA.
If, after going through the initial processing to establish their claim, the controller decides not to pursue their legal remedy for whatever reason, the controller is bound to comply with their obligations under the Data Privacy Act, including the disposal of the personal information processed.
WHEREFORE, the foregoing considered, this Commission resolves to DENY the Motion for Resolution filed by Complainants EA and TA.
SO ORDERED.
Pasay City, 5 November 2020.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Copy furnished:
EA
TA
EJ
EE
HC
ENFORCEMENT DIVISION
GENERAL RECORDS UNIT
Footnotes
-
Motion for Reconsideration dated 09 August 2019, p. 1. ↩
-
Ibid., at 2. ↩
-
Comment and/or Opposition to the Motion for Reconsideration dated 20 August 2019. ↩
-
Decision dated 15 July 2019, p. 9. ↩
-
Section 26. Irremovability of public record. — Any public record, an official copy of which is admissible in evidence, must not be removed from the office in which it is kept, except upon order of a court where the inspection of the record is essential to the just determination of a pending case. ↩
-
Implementing Rules and Regulations of the Data Privacy Act of 2012 (hereinafter, “IRR”), § 18(b). ↩
-
Supra, Note 4. ↩
-
Emphasis supplied. ↩
-
General Data Protection Regulation, Article 14, par. 5(b). ↩