NPC Issuance Wiki

NPC 16-004: CBP v. Orani Water District

Issued Resolution

Resolution Text

CBP,

Complainant,

-versus-

ORANI WATER DISTRICT

(formerly CDBJ and SRM ),

Respondents.

x-------------------------------------------x

AGUIRRE, D.P.C.;

This Commission resolves the sufficiency of Orani Water District’s (OWD) Privacy Manual and Notices, and proof of participation in a data privacy orientation of its employees, as directed in the Decision dated 15 December 2017.

Facts

On 15 December 2017, the Commission issued a Decision requiring OWD to submit its Privacy Manual and Notices, and proof of participation in any orientation on the Data Privacy Act of 2012 (DPA):

WHEREFORE, premises considered, CDBJ and SRM, [officers of Orani Water District] are STERNLY WARNED that repetition of the same or similar acts will be dealt with more severely.

Respondents are hereby further ordered:

  1. To coordinate with the head of agency of Orani Water District and submit to National Privacy Commission the organization’s privacy notice and existing privacy policies pertaining to their employees within fifteen (15) days from receipt of this Decision; and

Personal Information Controller is clearly defined as:

(h) Personal information controller refers to a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf. The term excludes:

(1) A person or organization who performs such functions as instructed by another person or organization; and

(2) An individual who collects, holds, processes or uses personal information in connection with the individual’s personal, family or household affairs.

From the foregoing, it should be noted that under these circumstances, OWD is the Personal Information Controller and not a specific individual or employee thereof.

Hence, we suggest that OWD’s Privacy Manual be amended to reflect the clear and correct designation of officers including their functions and responsibilities pursuant to the DPA and relevant issuances. In this regard, the Data Privacy Officer may be supported by different compliance officers for privacy (COP) or other team members as your organization may see fit.

Further, upon reviewing the OWD’s Data Privacy Manual, we found that the draft does not include the manner of verification and/or validation of the contents of the Personal Data Sheet of employees. To recall, this instant case arose because one of your employees verified the contents of the PDS of another employee by requesting documents from the Philippine Statistics Authority. In the NPC’s Decision, the Commission posed the question ‘[W]as the complainant informed that the verification and validation of contents in the PDS include requesting relevant documents from other government agencies or information repositories?’

While in OWD’s Privacy Manual, you indicated that the data subjects will be provided specific information regarding the purpose and extent of the processing of their data, the information regarding the extent of the processing of the employees’ PDS is not clearly specified defined in the employee consent forms. Without such provision, likely, similar incidents could not be avoided.

An agency should adhere to the principle of transparency or openness in the processing of personal data. Personal information controllers like OWD must demonstrate that there are existing policies and procedures to ensure that data subjects are fully informed of the intended processing of their personal information.1

It directed OWD to submit within thirty (30) days from receipt of the letter a revised Privacy Manual and Notices that indicate the manner of verification and validation of the contents of employees’ PDS, and a detailed and concrete Security Incident Management Policy according

to the DPA and Section 4 of NPC Circular No. 16-03 (Personal Data Breach Management).2

On 19 May 2021, OWD complied with the EnD’s directive and submitted its revised Privacy Manual and Notices, which includes its Security Incident Management Policy, for the Commission’s perusal.3

On 12 August 2021, the EnD informed OWD that it identified inconsistencies between the Privacy Manual and Notices and the DPA, its Implementing Rules and Regulations, and the Commission’s relevant issuances.4 It instructed OWD to revise the following:

  1. Functions of the Personal Information Controller (PIC), Data Protection Officer (DPO), and Compliance Officer for Privacy (COP)

The obligations, duties, and responsibilities of a PIC, which in your case, the OWD itself, must not be delegated to either DPO or COP, unless allowed by DPA or its rules. In the same vein, duties and obligations imposed explicitly by law upon DPO and COP must not be placed upon the OWD, especially when the OWD has already designated a DPO and COP within its organization.5

  1. OWD’s measures on storage, retentions, and disposal procedure found under its Manual

An observation of the ‘Retention Records Table’ vis-à-vis ‘Storage, Retention, and Destruction (means of storage, security measures, the form of information stored, retention period, disposal procedure, etc.)’ of the OWD Manual reveals that the former is blank at the latter appears to be leaving the discretion of the matter to its individual employees. The means of storage, period of retention, and manner of disposal should not be merely placed under the discretion of an individual employee; the discretion on the matter must be carefully determined by OWD, taking into consideration the specific purpose of each category of personal data. The said policy on retention should already be documented in the OWD Manual.6

  1. Collection of Data Table

The Manual on the Use and Purpose of Data Collection referred to a Collection of Data Table which is supposed to include further details of the types of data collected and its purposes, the same is supposed to also demonstrate any data sharing to which the particular data is involved. However, the said table is left blank and it is not made clear who is responsible to accomplish the table. It should be reiterated that Data Inventory must be made part of the preparation of your Records of Processing Activities as required under Section 26(c) of the IRR of DPA which forms part of the organization’s data privacy compliance documentation.7

  1. Keeping Records of Processing Activities

OWD must attach to its Privacy Manual its Records of Processing Activities for each of its data processing systems, program, project, or activity.8

  1. Contact Details of the Data Protection Officer

Section I of the OWD Manual on Inquiries and Complaints discussed the data subject’s rights and the means to exercise them, however, the contact details of the Data Protection Officer to whom any data privacy concern, dispute, issues, or complaints should be escalated is left blank. It is necessary to complete these details since this manual will serve as the organization’s guide in addressing any data privacy concerns, disputes and grievances and it will be advantageous to have this information on hand.9

  1. Conduct of Training or Seminars for the DPO and OWD Personnel

The authority phrase found under paragraph 4 of the Consent Letter, which reads: “to share my information to affiliates and necessary third parties for any legitimate business purpose.” is ambiguous and fails to meet the requirements of transparency. At this point, OWD must have already identified its affiliates and third parties with whom it shares data. Therefore, the phrase in question must be revised to convey to the data subject the recipients or classes of recipients to whom their data will be disclosed and the purpose/s for its disclosure.10

The EnD directed OWD to correct the deficiencies and submit a revised Privacy Manual and Notices within fifteen (15) days from receipt of the letter.11

On 28 August 2021, OWD submitted its revised Privacy Manual and Notices.12

On 15 September 2021, the EnD again directed OWD to correct the following deficiencies:

  1. The Manual still refers to the Personal Information Controller (PIC) as if it is another entity or person

On pages 17 and 38, it is written:

‘1. Organization Security Measures Every personal information controller or personal information processor must also consider the human aspect of data protection.

…

➢General Obligations and Functions of the PIC, DPO, COP and/or any other responsible personnel with similar functions.

…

  1. Functions of DPO

a. The Data Protection Officer shall monitor the PIC’s or PIP’s compliance with the DPA, its IRR, issuances by the NPC and other applicable laws and policies. For this purpose, he or she may:’

…

The Manual’s Definition of Terms even defined the PIC as it is defined in the law: “refers to a natural or juridical person, or any other body who controls the processing of personal data, or instructs another to process personal data on its behalf” and not how you use the term in the Manual which in this case should be used as referring to Orani Water District as the PIC. OWD must make it clear that when it refers to a PIC in its Manual, it is referring to itself and not to a separate entity or a person.13

  1. The Data Protection Office has no specific e-mail address intended only for privacy-related complaints and inquiries in its Privacy Notice

OWD must provide a dedicated e-mail address for proper escalation and reporting of privacy-specific inquiries, issues, and concerns instead of giving a general customer service email address where the privacy-related concerns will be comingled with customer service-related concerns (e.g., billing, account, change request).14

  1. Consent Letter for Concessionaires does not provide specific information as to the purpose for data sharing

On Annex A, Consent Letter (Concessionaires), number 4, it is stated:

‘4. Share my information to Primewater Infrastructure Corp. for any legitimate business purpose.’

For transparency and in line with the general principles of data sharing, please revise the underlined text to be more specific to discuss the type of data being shared, the purpose of sharing, the extent of data sharing, and how Primewater Infrastructure shall process these data.15

  1. Conduct of Training or Seminars for the DPO and OWD personnel did not occur

Once again, OWD is ordered to conduct DPA training for its employees by submitting a training request once again to NPC’s PIAD or find alternative means to comply with this directive.16

On 24 September 2021, OWD submitted its revised Privacy Manual and Notices.17

On 10 November 2021, OWD submitted the Certificates of Participation of its employees to the DPO Ace Level 1 Training Program organized by the National Privacy Commission.18

Discussion

The Commission finds that OWD has sufficiently complied with the Commission’s directives. As reflected in the revised Privacy Manual and Notices, OWD has fully addressed and corrected the deficiencies to the satisfaction of the Commission. It has also caused the participation of its employees in a data privacy orientation, as shown by the submission of Certificates of Participation to the NPC’s DPO Ace Level 1 Training Program.19

Section 7 of the DPA authorizes the Commission to ensure that personal information controllers (PICs) comply with the DPA, its IRR, and other issuances of the Commission:

Section 7. Functions of the National Privacy Commission. – To administer and implement the provisions of this Act, and to monitor and ensure compliance of the country with international standards set for data protection, there is hereby created an independent body to be known as the National Privacy Commission, which shall have the following functions:

(a) Ensure compliance of personal information controllers with the provisions of this Act;

…

(d) Compel or petition any entity, government agency or instrumentality to abide by its orders or take action on a matter affecting data privacy;

…

(f) Coordinate with other government agencies and the private sector on efforts to formulate and implement plans and policies to strengthen the protection of personal information in the country;20

Based on the EnD’s assessment, it determined that OWD has sufficiently complied with its directives. It identified that the OWD has revised its Privacy Manual and Notices to reflect the following:

  1. On the functions of the Personal Information Controller (PIC), Data Protection Officer (DPO), and Compliance Officer for Privacy (COP):

The revised OWD Privacy Manual was already updated, the provisions as to the PIC, DPO, and COP functions are now addressed in accordance and in compliance with NPC Advisory No. 2017-01. Further, the Manual now refers to OWD as the PIC, and its functions as the PIC are now clear and adequately discussed.21

  1. On OWD’s Measures on Storage, Retentions, and Disposal Procedure found under its Manual:

As discussed in the previous report, the Retention Records Table shows that the same is filled out with the relevant data existing in and being processed in OWD. The said table also illustrates who are the ‘data subjects,’ the means of storage of such data, location, security measures employed upon for protection, period of retention, and the manner of disposal. The means of storage, retention period, and disposal manner is no longer left to individual employees but already determined and documented as an attachment to the revised Manual.22

  1. On the Collection of Data Table and Data Inventory:

The Collection Data Table is filled out with relevant information such as the process owners (department involved in the collection and responsible persons), categories of the data subject, categories of personal data, the purpose for which data is collected, the mode of data collection, forms employed to collect, and the responsible person.23

  1. On Contact Details of the Data Protection Officer:

The OWD’s Revised manual now designated a contact e-mail address (oraniwaterdistrictdataprivacy@gmail.com) specific to privacy concerns and questions.24

  1. On Consent Letter (Concessionaires):

Likewise, it is now clearly specified under the ‘Consent Letter (Concessionaires)’ portion the kinds of processing

(applications for water service connections, reconnection, termination, billing, and payment) that Primewater Infrastructure Corporation conducts upon the shared data from OWD in place of the previous general phrase ‘for any legitimate business purpose.’25

  1. On the Conduct of Training or Seminars for the DPO and OWD Personnel:

Lastly, the submission of the Certificate of Participation DPO Ace Level 1 Training Program for Mixed Sector issued to the key employees within its organization as proof of conduct of training fully satisfies the Order of the Commission.26

Considering the foregoing, the Commission finds that OWD has, to the satisfaction of the Commission, rectified its Privacy Manual and Notices and has caused the attendance of its employees to a data privacy orientation.

WHEREFORE, premises considered, the Commission hereby finds that Orani Water District has sufficiently notified its affected data subjects and complied with the Decision dated 15 December 2017. This Commission hereby considers the matter CLOSED.

SO ORDERED.

City of Pasay, Philippines.

27 January 2022.

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

I CONCUR:

JOHN HENRY D. NAGA

Privacy Commissioner

Copy furnished:

CBP

Complainant

CDBJ

SRM

EFS

General Manager

Orani Water District

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Compliance with Decision dated 15 December 2017 “CBP v. CDBJ, et al.”, 20 April 2021, at 1-3, in CBP v. Orani Water District, NPC 16-004 (NPC 2021). ↩

  2. Id. at 3. ↩

  3. Submission of Revised Draft of OWD Privacy Manual, 19 May 2021, in CBP v. Orani Water District, NPC 16-004 (NPC 2021). ↩

  4. Compliance with Decision dated 15 December 2017 “CBP v. CDBJ, et al.”, 12 August 2021, in CBP v. Orani Water District, NPC 16-004 (NPC 2021). ↩

  5. Id. at 2. ↩

  6. Id. at 3. ↩

  7. Id. at 3-4. ↩

  8. Id. at 4. ↩

  9. Id. ↩

  10. Compliance with Decision dated 15 December 2017 “CBP v. CDBJ, et al.”, 12 August 2021, at 4, in CBP v. Orani Water District, NPC 16-004 (NPC 2021). ↩

  11. Id. ↩

  12. Letter from EFS, Orani Water District, to Enforcement Division, National Privacy Commission, in CBP v. Orani Water District, NPC 16-004 (28 August 2021). ↩

  13. Compliance with Decision dated 15 December 2017 “CBP v. CDBJ, et al.”, 15 September 2021, at 1-2, in CBP v. Orani Water District, NPC 16-004 (NPC 2021). ↩

  14. Id. at 2. ↩

  15. Id. ↩

  16. Id. at 3. ↩

  17. Letter from EFS, Orani Water District, to Enforcement Division, National Privacy Commission, 24 September 2021, in CBP v. Orani Water District, NPC 16-004 (NPC 2021). ↩

  18. Letter from EFS, Orani Water District, to Enforcement Division, National Privacy Commission, 10 November 2021, in CBP v. Orani Water District, NPC 16-004 (NPC 2021). ↩

  19. Id. ↩

  20. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 § 7(a), (d), (f) (2012). Emphasis supplied. ↩

  21. Final Enforcement Assessment Report, 26 November 2021, at 5, in CBP v. Orani Water District, NPC 16-004 (NPC 2021). ↩

  22. Id. ↩

  23. Id. ↩

  24. Id. at 6. ↩

  25. Id. ↩

  26. Id. ↩

Backlinks

  • No backlinks found