Welcome to my blog. Forgive me, I really don’t know how and where to start. This is my first time to write a blog and I’m still kinda lost. This is a new experience to me and I believe I will learn a lot particularly how to write an interesting one. The title is totally not relevant with the topic. It’s just that like what I said, my first time to blog and I feel so blabber-ish, if there’s such a word.
The first topic given to us by our professor is, “Is the act of a person, A, disclosing the mobile number of B, to a third person, without B’s consent, considered a violation of RA 10173?” Initially, after reading the topic assigned to us, I remember those times wherein a friend will text or call me to ask permission if they can give my number to a certain person. How thoughtful of them to consider getting my permission before giving anyone my mobile number. I really appreciate that because I don’t want a stranger texting or calling me. I really feel irritated when I receive a text like, “Can you be my textmate?” or silly stuff from fraudulent people who just want a free load like “Eto na ang bagong roaming ko, loadan mo muna ako para matext ko kayo, miss na miss ko na kayo”. Can you recall receiving the same text? Indeed that happened a lot of times to me which compelled me to change my mobile number. Then again, I remember, am I getting a person’s consent before I give them someone’s number. I think I’m kinda guilty. With that, have I violated some law? What is RA10173? Before going on the central issue of this paper, I would like to dwell on some important things first in relation to the question.
RA10173 is also known as the Data Privacy Act of 2012.1 Said law was approved by President Aquino on August 15, 2012 . It is an act protecting individual personal information. It aims to protect the fundamental human right to privacy.2
Privacy? Big word! It is defined by Wikipedia as the ability of an individual or group to seclude themselves or information about themselves and thereby reveal themselves selectively.3
My good professor Former Senator Atty. Rene Saguisag always say in our Constitutional Class that we have the right to be left alone because we have the right to privacy. I, personally, value my privacy very much because there are some things I don’t want to share to anyone. There are personal things I want to keep only to myself. Oftentimes, I want to be left alone. Not that I’m a loner. I’m far from that. We all need private moments to just be with ourselves to reflect and self-introspect.
Privacy is supported by Constitutional rights such as Section 2 and 3 of Article III of the 1987 Constitution.4 It is needless to say that the right to privacy embodied in the Bill of Rights serves as “a charter of liberties for the individual and a limitation upon the power of the State.”5 The right to privacy is “the most comprehensive of rights and the right most valued by civilized me.”6
Aside from the protection provided by the Constitution, The right to privacy is supported by many laws. One of course is RA10173. Another example is Article 26 of Republic Act 3867, or the Civil Code of the Philippines, as amended, which reiterated that dignity, personality, privacy and peace of mind of neighbors and other persons should be respected and provided for a cause of action of damages upon violation of said provision. Section 2 of Republic Act 9995 also emphasizes that “the State values the dignity and privacy of every human person and guarantees full respect for human rights. Toward this end, the State shall penalize acts that would destroy the honor, dignity and integrity of a person.”
Is the right of privacy absolute?
In the case of Valmonte vs Belmonte, Jr., “petitioners who are members of the media, seek to compel the GSIS by mandamus to furnish them with the list of names of Batasan members who were able to secure clean loans immediately before election and GSIS assers the confidentiality of its relationship to those who obtained the said loans. The petitioners are practitioners in media so they have the right to gather and the obligation to check the accuracy of the information. For them, the freedom of the press and speech is not only critical, but vital to the exercise of their professions. When the information requested from the government intrudes into the privacy of a citizen, a potential conflict between the rights to information and to privacy may arise. Apparent from the statement of the Court in Morfe is that the right to privacy belongs to the individual in his private capacity, and not to public and governmental agencies like the GSIS. Moreover, the right cannot be invoked by juridical entities like the GSIS. As held in the case of Vassar College v. Loose Wills Biscuit Co. [197 F. 982 (1912)], a corporation has no right of privacy in its name since the entire basis of the right to privacy is an injury to the feelings and sensibilities of the party and a corporation would have no such ground for relief.8”
In Evangelista vs Jarencio, Justice Fernando in his concurring opinion in resolving whether a corporation is entitled to the protection of privacy, stated that “Although the “right to be let alone — the most comprehensive of rights and the right most valued by civilized men,” … is not confined literally to searches and seizures as such, but extends as well to the orderly taking under compulsion of process, … neither incorporated nor unincorporated associations can plead an unqualified right to conduct their affairs in secret. … While they may and should have protection from unlawful demands made in the name of public investigation, corporations can claim no equality with individuals in the enjoyment of a right to privacy.”9
Article 17 of International Convent on Civil and Political Rights states that “No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honor and reputation.” Does this mean there is a chance that privacy cannot be validly invoked when interference in privacy is lawful? Clearly, the right to privacy is not absolute.
After I dwell on the right to privacy which is very substantial to the topic, I shall dwell on the main issue which is RA10173 .
RA 10173 applies to the processing of all types of personal information and it includes natural and juridical person involved in personal information processing including the controllers and processors who, although they are not found in the Philippines, they use equipment located here. It may also apply to those who maintain an office, branch or agency. However, this act does not apply to certain information enumerated in section 4 of this act.10
Protection is also afforded to journalists and their sources wherein the publishers, editors or duly accredited reporters of any newspaper, magazine or periodical of general circulation protection from being compelled to reveal the source of any news report or information appearing in said publication which was related in any confidence to such publisher, editor, or reporter.
In this act, the processing of personal information shall be allowed but is subjected to the requirements of this act and other laws allowing disclosure of information to people. It is also important to comply and adhere to the principles of transparency, legitimate purpose and proportionality. The personal information must be collected for specified and legitimate purposes, processed fairly and lawfully, and accurate, relevant, adequate and necessary for purposes intended and all items required by section 11 of this Act.
When does processing of an information considered lawful? Personal information processing shall be permitted only if not prohibited by the law. There are also conditions set forth and at least one condition should exist. Some of the conditions are: Consent of the data subject must be given, the processing of personal information is necessary and related to the fulfillment of contract, processing is necessary for compliance and with a legal obligation, processing is necessary to protect vitally important interests including life and health, or when processing is necessary to respond to national emergence, public order and safety and finally, the processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution. Such is stated at section 12 of this act.
Sensitive personal information and privileged information is also protected in this law. The processing of such shall be prohibited. However, the following cases will be the exceptions: Firstly, the data subject has given his or her consent, specific to the purpose prior to the processing. Secondly, the processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information; Third, that the processing is necessary to protect the life and health of the data subject and is not legally or physically able to express his or her consent prior to the processing; Fourth, the processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations. Fifth, the processing is necessary for purposes of medical treatment carried out by a medical practitioner or a medical treatment institution, and lastly, the processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.11 The personal information controllers may invoke the principle of privileged communication over privileged information however, this is subject to existing laws and regulations which states that any evidence gathered on such is inadmissible.
RA10173 ensures protection of the rights of the Data subject . With these, the data subject is entitled to be informed whether the personal information about him is already being processed. He shall also be furnished or provided with information before the entry of his information into the processing system. The subject, upon demand, have reasonable access to the contents, sources, manner , reasons for disclosure of personal information to recipient and even the name, identity and address of the personal information controller. The subject has also right to be indemnified for any damages caused or sustained due to inaccuracy of personal information.
The rights of the subject data is transmissible to the lawful hers and they may validly invoke the rights of the data subject, at any time after the death.
The personal information controller has to ensure the security of personal information. With this, the controller must implement reasonable and appropriate measures intended for the protection of personal information against natural dangers, fraudulent misuse, unlawful destruction, alteration and contamination. The determination of the appropriate level of security under this section must take into account the nature of the personal information to be protected, the risks represented by the processing, the size of the organization and complexity of its operations, current data privacy best practices and the cost of security implementation. The controller must ensure that the processing of information by third parties on its behalf shall implement the security measures required by this provision. In order to ensure the personal information, the provisions of section 20 must apply.
In the case of Ople vs Torres, Petitioner Ople prays to invalidate Administrative order No. 308 entitled, “Adoption of a National Computerized Identification Reference System” on two important Constitutional grounds, viz: It is a usurpation of the power of Congress and it impermissibly intrudes on our citizenry’s protected zone of privacy. The issue in the case is whether or not the petitioner has the stand to assail the validity of A.O. No. 308. The Supreme Court held that “In no uncertain terms, we also underscore that the right to privacy does not bar all incursions into individual privacy. The right is not intended to stifle scientific and technological advancements that enhance public service and the common good. It merely requires that the law be narrowly focused and a compelling interest justify such intrusions. Intrusions into the right must be accompanied by proper safeguards and well-defined standards to prevent unconstitutional invasions. We reiterate that any law or order that invades individual privacy will be subjected by this Court to strict scrutiny. The reason for this stance was laid down in Morfe v. Mutuc, to wit:
The concept of limited government has always included the idea that governmental powers stop short of certain intrusions into the personal life of the citizen. This is indeed one of the basic disctinctions between absolute and limited government. Ultimate and pervasive control of the individual, in all aspects of his life, is the hallmark of the absolute state. In contrast, a system of limited government safeguards a private sector, which belongs to the individual, firmly distinguishing it from the public sector, which the state can control. Protection of this private sector — protection, in other words, of the dignity and integrity of the individual — has become increasingly important as modern society has developed. All the forces of a technological age — industrialization, urbanization, and organization — operate to narrow the area of privacy and facilitate intrusion into it. In modern terms, the capacity to maintain and support this enclave of private life marks the difference between a democratic and a totalitarian society.
Indeed, if we extend our judicial gaze we will find that the right of privacy is recognized and enshrined in several provisions of our Constitution. It is expressly recognized in section 3 (1) of the Bill of Rights:
Sec. 3. (1) The privacy of communication and correspondence shall be inviolable except upon lawful order of the court, or when public safety or order requires otherwise as prescribed by law.
Other facets of the right to privacy are protected in various provisions of the Bill of Rights, viz:
Sec. 1. No person shall be deprived of life, liberty, or property without due process of law, nor shall any person be denied the equal protection of the laws.
Sec. 2. The right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures of whatever nature and for any purpose shall be inviolable, and no search warrant or warrant of arrest shall issue except upon probable cause to be determined personally by the judge after examination under oath or affirmation of the complainant and the witnesses he may produce, and particularly describing the place to be searched and the persons or things to be seized.
x x x x x x x x x
Sec. 6. The liberty of abode and of changing the same within the limits prescribed by law shall not be impaired except upon lawful order of the court. Neither shall the right to travel be impaired except in the interest of national security, public safety, or public health as may be provided by law.
x x x x x x x x x
Sec. 8. The right of the people, including those employed in the public and private sectors, to form unions, associations, or societies for purposes not contrary to law shall not be abridged.
Sec. 17. No person shall be compelled to be a witness against himself.
The right to privacy is one of the most threatened rights of man living in a mass society. The threats emanate from various sources — governments, journalists, employers, social scientists, etc. In the case at bar, the threat comes from the executive branch of government which by issuing A.O. No. 308 pressures the people to surrender their privacy by giving information about themselves on the pretext that it will facilitate delivery of basic services. Given the record-keeping power of the computer, only the indifferent fail to perceive the danger that A.O. No. 308 gives the government the power to compile a devastating dossier against unsuspecting citizens. It is timely to take note of the well-worded warning of Kalvin, Jr., “the disturbing result could be that everyone will live burdened by an unerasable record of his past and his limitations. In a way, the threat is that because of its record-keeping, the society will have lost its benign capacity to forget.” Oblivious to this counsel, the dissents still say we should not be too quick in labelling the right to privacy as a fundamental right. We close with the statement that the right to privacy was not engraved in our Constitution for flattery.”12
In relation with the case above sited, the right to privacy which primarily is protected by RA10173 is not absolute. There are certain exceptions and this right cannot be properly invoked always. Accordingly, the right to privacy as mentioned in the above case was not engraved in our Constitution for flattery. It comes with it that the right to privacy must be accompanied by just and coherent reason and lawful acts. It cannot be used as a tool for fraud, injustice, commit wrongdoings and to defeat the spirit and purpose to which the law is intended.
“Is the act of a person, A, disclosing the mobile number of B, to a third person, without B’s consent, considered a violation of RA 10173?”
Based on the provisions cited on the preceding pages, I would have to answer the question with “It depends.”
If A is a data processor as defined by the special law, he is duty bound not to disclose personal information as disclosed by B especially if such information is a privileged one or a sensitive personal information. Consent of the owner of the personal information is necessary for such a disclosure. Absent of which amounts to violation of RA10173 particularly section 13. Otherwise, A will not be liable.
Based on section 4 of RA10173, If B is or was a government official, and the telephone number disclosed by A to a third person is the same number he uses for official acts or functions, no violation is committed. Under the Data Privacy Act, government officials are not covered by said protection. If he is not a government official, then consent must necessarily be obtained.
Further, if the giving of A’s number to a third person is no more than an act purporting to data processing as defined under the law, consent is not required and no violation is incurred. If it happens that the third person is a data processor himself, he will then be duty bound as well to observe faithfulness in the spirit of RA10173. Otherwise, he could be charged with a violation thereby,
So long as the telephone number of B is not connected to the provisions covered by the Act, no violation would be committed. It depends on which person discloses the information and for what purpose. Purpose and reason should be legitimate and necessary.
1 – Section 1 of RA10173
2- Section 2 of RA10173 – It is the policy of the State to protect the fundamental human right of privacy, of communication while ensuring free flow of information to promote innovation and growth. The State recognizes the vital role of information and communications technology in nation-building and its inherent obligation to ensure that personal information in information and communications systems in the government and in the private sector are secured and protected.
4- Section 2. The right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures of whatever nature and for any purpose shall be inviolable, and no search warrant or warrant of arrest shall issue except upon probable cause to be determined personally by the judge after examination under oath or affirmation of the complainant and the witnesses he may produce, and particularly describing the place to be searched and the persons or things to be seized.
Section 3. (1) The privacy of communication and correspondence shall be inviolable except upon lawful order of the court, or when public safety or order requires otherwise, as prescribed by law.cralaw
(2) Any evidence obtained in violation of this or the preceding section shall be inadmissible for any purpose in any proceeding.
6- Ople vs Torres. GR 127685, July 23, 1998
7- Article 26. Every person shall respect the dignity, personality, privacy and peace of mind of his neighbors and other persons. The following and similar acts, though they may not constitute a criminal offense, shall produce a cause of action for damages, prevention and other relief:
(1) Prying into the privacy of another’s residence;
(2) Meddling with or disturbing the private life or family relations of another;
(3) Intriguing to cause another to be alienated from his friends;
(4) Vexing or humiliating another on account of his religious beliefs, lowly station in life, place of birth, physical defect, or other personal condition.
8- G.R. No. 74930 February 13, 1989
9- G.R. No. L-29274 November 27, 1975
10- This Act does not apply to the following:
(a) Information about any individual who is or was an officer or employee of a government institution that relates to the position or functions of the individual, including:
(1) The fact that the individual is or was an officer or employee of the government institution;
(2) The title, business address and office telephone number of the individual;
(3) The classification, salary range and responsibilities of the position held by the individual; and
(4) The name of the individual on a document prepared by the individual in the course of employment with the government;
(b) Information about an individual who is or was performing service under contract for a government institution that relates to the services performed, including the terms of the contract, and the name of the individual given in the course of the performance of those services;
(c) Information relating to any discretionary benefit of a financial nature such as the granting of a license or permit given by the government to an individual, including the name of the individual and the exact nature of the benefit;
(d) Personal information processed for journalistic, artistic, literary or research purposes;
(e) Information necessary in order to carry out the functions of public authority which includes the processing of personal data for the performance by the independent, central monetary authority and law enforcement and regulatory agencies of their constitutionally and statutorily mandated functions. Nothing in this Act shall be construed as to have amended or repealed Republic Act No. 1405, otherwise known as the Secrecy of Bank Deposits Act; Republic Act No. 6426, otherwise known as the Foreign Currency Deposit Act; and Republic Act No. 9510, otherwise known as the Credit Information System Act (CISA);
(f) Information necessary for banks and other financial institutions under the jurisdiction of the independent, central monetary authority or Bangko Sentral ng Pilipinas to comply with Republic Act No. 9510, and Republic Act No. 9160, as amended, otherwise known as the Anti-Money Laundering Act and other applicable laws; and
(g) Personal information originally collected from residents of foreign jurisdictions in accordance with the laws of those foreign jurisdictions, including any applicable data privacy laws, which is being processed in the Philippines.
11- Section 13, RA 10173
12- Ople vs Torres. GR 127685, July 23, 1998