Search for:
Cybersecurity, Data and Tech

Philippines: NPC issues new guidelines on the processing of sensitive personal information for legal claims

By , and 5 Mins Read

The National Privacy Commission recently issued Advisory No. 2024-02, which lays down guidelines on the processing of sensitive personal information on the basis of Section 13 (f) of the Data Privacy Act.

In brief

The National Privacy Commission (NPC) recently issued NPC Advisory No. 2024-02 (“Advisory“), which lays down guidelines on the processing of sensitive personal information for the protection of lawful rights and interests or the establishment, exercise or defense of legal claims, pursuant to Section 13(f) of the Data Privacy Act (DPA).

Entities who process sensitive personal information or privileged information must ensure that such processing is compliant with the guidelines provided in the Advisory. A legitimate interest assessment will be helpful in evaluating compliance with NPC Circular No. 2023-07.

In more detail

Section 13 (f) of the DPA provides that the processing of sensitive personal information and privileged information is lawful when it is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings; the establishment, exercise or defense of legal claims; or when provided to government or public authorities. However, the Advisory clarifies that this provision is intended not to grant a blanket exemption to public authorities but to strike a balance between the need for public authorities to process personal data, pursuant to their functions and mandates, and the need to safeguard the rights and interests of data subjects.1

Thus, the Advisory provides that the processing of sensitive personal information and privileged information under Section 13 (f) of the DPA is proper when any of the following requisites are met:2

  1. The processing is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings.
  2. The processing is necessary for the establishment, exercise or defense of legal claims.
  3. The processing entails providing government or public authorities with personal data for the protection of lawful rights and interests in court proceedings or the establishment, exercise or defense of legal claims in relation to their constitutional or statutory mandate. Such instances may include providing information that supports the investigation of a law enforcement or regulatory agency.

The Advisory applies to all natural or juridical persons relying on Section 13 (f) of the DPA as a lawful basis for processing personal data.3

Section 13 (f) and the legitimate interest exception

The Advisory recognizes that processing under Section 13 (f) is to a certain extent akin to processing pursuant to legitimate interest under Section 12 (f) of the DPA, such that a personal information controller that invokes the exception under Section 13 (f) must likewise fulfill the requisites for processing based on legitimate interest as stated in NPC Circular 2023-07 or the Guidelines on Legitimate Interest.4

Hence, similar to the standards for processing based on legitimate interest, the Advisory provides that processing of sensitive and privileged information under Section 13 (f) is necessary when it is “adequate, relevant, suitable, and not excessive in relation to such legitimate purpose”. The specific processing activity must also be within the limitations of the law.5

Processing for the defense of legal claims

The Advisory states that processing of personal data on the basis of Section 13 (f) of the DPA may be conducted even during stages preparatory to a case. It does not require that there be an existing proceeding before an administrative agency, court or other tribunal.6 Note that the establishment, exercise or defense of a legal claim under Section 13 (f) of the DPA as a lawful basis for processing personal data is also independent of the existence of a cause of action.7

The Advisory also clarifies that processing of personal data on the basis of Section 13 (f) need not result in the filing of an actual case.8 Moreover, legal claims that are established, exercised or defended may refer to legal claims of persons other than those who processed the personal data.

A data subject whose sensitive personal information or privileged information is processed pursuant to Section 13 (f) must be informed of such processing either prior to the processing or at the next practical opportunity.9 Where legal claims are concerned, the ‘next practical opportunity’ refers to service of pleadings to the parties of a case. A data subject’s right to be informed of the specific processing activity is satisfied when they are served with a copy of the pleading containing the personal data following the applicable rules of procedure on summons and service.10

Recommended actions

Clients who rely on the exception provided by Section 13 (f) for the processing of sensitive personal information or privileged information must ensure that such processing is compliant with the guidelines provided in the Advisory.

Since processing under Section 13 (f) is to a certain extent similar to processing pursuant to a legitimate interest, clients who rely on this exception are also advised to undertake a legitimate interest assessment to evaluate their compliance with NPC Circular No. 2023-07.

1 Advisory, fifth Whereas clause.

2 Advisory, Section 2.

3 Advisory, Section 1.

4 Advisory, Section 3.

5 Advisory, Section 4.

6 Advisory, Section 5(A).

7 Advisory, Section 7.

8 Advisory, Section 5(B).

9 Advisory, Section 6, in relation to NPC Circular No. 2023-07.

10 Advisory, Section 6.

* * * * *

LOGO Philippines_QuisumbingTorres_Manila

Please contact QTInfoDesk@quisumbingtorres.com for inquiries.

VISIT QUISUMBING TORRES SITE

Categories:
Tags:
Author

Bienvenido Marquez III is a partner in Quisumbing Torres' Intellectual Property, Data and Technology Practice Group. He also co-heads the Consumer Goods & Retail Industry Group and is a member of the Technology, Media & Telecommunications Group. He participates in initiatives of Baker & McKenzie International of which Quisumbing Torres is a member firm. He is a member of Baker McKenzie's Asia Pacific Intellectual Property Business Unit for Brand Enforcement. He is immediate Past President of the Philippine Chapter of the Licensing Executives Society International (2019-2021), and is currently co-chair of the LESI Asia Pacific. He is also a member of the Anti-Counterfeiting Committee of the International Trademarks Association (INTA). He has been appointed as member of the INTA Asia Global Advisory Council (GAC) for 2022 to 2023, making him the only Philippine representative on the council.

Bien has vast experience in handling IP enforcement litigation, trademark and patent prosecution and maintenance, copyright, data privacy, information security, IT, telecommunications, e-commerce, electronic transactions, cyber security and cybercrime. He has been consistently ranked as a leading individual for Intellectual Property and TMT in Legal 500 Asia Pacific, Chambers Asia Pacific, asialaw Leading Lawyers, Managing IP Stars, Asia IP, and World Trademark Review. He was also recognized as a Volunteer Service Awardee by INTA in 2018.

Author

Divina Ilas-Panganiban, CIPM is a partner and the head of Quisumbing Torres’ Intellectual Property, Data and Technology Practice Group and co-heads the Technology, Media & Telecommunications (TMT) Industry Group. She participates in initiatives of Baker & McKenzie International of which Quisumbing Torres is a member firm. She is a member of Baker & McKenzie International's Asia Pacific TMT, and the Asia Pacific Intellectual Property Steering Committees.
Divina is a Certified Information Privacy Manager by the International Association of Privacy Professionals (IAPP). She currently serves as the Vice-President and Director of the Philippine Chapter of the Licensing Executives Society International, the Regional Vice-chair of the LESI's Education Committee, the Co-chairperson of the Committee on Intellectual Property Rights of The American Chamber of Commerce of the Philippines, and the Chairperson of the IAPP KnowledgeNet Chapter for the Philippines.
Divina was recently appointed to be a member of the Advisory Council for Intellectual Property (ACIP) of the Intellectual Property Office of the Philippines (IPOPHL). The ACIP is an advisory board composed of a select group of people from different sector to which IP is of great value. She was recently recognized in the Hall of Fame for Best External Lecturers by the IP Academy of the IPOPHL.
Divina just finished her stint as the chair the Unreal Campaign of the International Trademarks Association (INTA) for East Asia and the Pacific and continues to organize anti-counterfeiting activities in schools and universities around the country, educating the youth about the importance of intellectual property protection.
Divina is a multi-awarded lawyer with a stellar track record in the IP, data and technology fields. She has garnered numerous awards and accolades, including the Woman Lawyer of the Year by the ALB Philippine Law Awards 2023. She has been cited as leading lawyer for intellectual Property and TMT by The Legal 500 Asia Pacific, Chambers Asia Pacific, Managing IP, World Trademark, Asialaw and IAM Patent 1000, among others. Known for her exceptional legal expertise and unwavering commitment to her clients, Divina has established herself as a leader in her profession.

Author

Marianne Angeli B. Estioco is an associate in Quisumbing Torres’ Intellectual Property, Data & Technology Practice Group. She obtained her Juris Doctor degree from the University of the Philippines College of Law in 2020 and was admitted to the Philippine bar in 2022.

Related Posts