NPC guidelines on personal data processing in court

On 13 November, we commemorated the 40th-day memorial of my beloved son, Jomar. During this deeply personal and challenging time, I have been fortunate to receive the understanding and support of Willie, Chingbee, Chito, and the writers and staff of my DAILY TRIBUNE family. Willie and Chingbee graciously allowed me to take a leave to process my grief.

Now, I am back.

Speaking of processing, I thought it fitting to resume my column by delving into a topic centered on “processing” — but in the context of the legal matters I regularly explore. Therefore, I have decided to focus on the recent National Privacy Commission (NPC) guidelines on personal data processing in court proceedings. This timely topic holds significant implications for the practice of law and the balance between transparency and privacy.

Under Section 13(f) of the Data Privacy Act (DPA), one of the exceptions to the prohibition on processing sensitive personal information and privileged information of data subjects is when it concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise, or defense of legal claims, or when provided to a government or public authority.

As defined under the DPA, privileged information refers to any and all forms of data which, under the Rules of Court and other pertinent laws, constitute privileged communication, such as those covered by the lawyer-client relationship and physician-patient relationship. Sensitive personal information, on the other hand, refers to personal information (a) about an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical, or political affiliations; (b) about an individual’s health, education, genetic or sexual life, or to any proceeding for any offense committed or alleged to have been committed by such a person, the disposal of such proceedings, or the sentence of any court in such proceedings; (c) issued by government agencies peculiar to an individual, which includes, but is not limited to, social security numbers, previous or current health records, licenses or their denials, suspension, or revocation, and tax returns; and (d) specifically established by an executive order or an act of Congress to be kept classified.

On 12 August 2024, the National Privacy Commission (NPC) issued NPC Advisory 2024-02, laying down the guidelines on personal data processing, which must be observed by all natural and juridical persons relying on Section 13(f) of the DPA as a lawful basis for processing personal data.

The NPC advisory considers processing specific personal information as “necessary” when it is adequate, relevant, suitable, and not excessive in relation to such legitimate purpose and done within the limitations of the law. It also clarifies that processing of personal data on the basis of Section 13(f) of the DPA: (a) may be conducted during stages preparatory to a case; (b) does not require that there be an existing proceeding before an administrative agency, court, or other tribunal; (c) the processing of personal data under the same provision need not result in the filing of an actual case; and (d) the data subject covered by the said provision includes the parties and their witnesses.

Further, to enforce the rights of the data subject to be informed whether personal information pertaining to him/her is being or has been processed and to be furnished with said information, the NPC Advisory provides that this is complied with when the data subjects are served with a copy of the pleading containing the personal data, following the applicable rules of procedure on summons and service.

In issuing the advisory, the NPC is quick to note that it is not meant to change the rule on the admissibility of evidence, its relevance, or probative value to a particular case outside its jurisdiction. The establishment, exercise, or defense of a legal claim under Section 13(f) of the DPA as a lawful basis for processing personal data is likewise independent of the existence of a cause of action.

For more of Dean Nilo Divina’s legal tidbits, please visit www.divinalaw.com. For comments and questions, please send an email to cad@divinalaw.com.