Dear Atty. Kathy,
We are thinking of having published in the newspaper and also announcing on our company’s social media account, that certain individuals are no longer connected with our company as employees because they were dismissed on the ground of theft by executing falsified documents. The announcement would include photos of the former employees and their names. The purpose for this publication or announcement is the protection of the company against fraud, theft and unauthorized transactions. We just need to confirm, please, if our planned publication or announcement will not violate data privacy laws.
Joyce
□□□□□
Dear Joyce,
According to the National Privacy Commission Privacy Policy Office Advisory Opinion No. 2022-009 Re: Publication of Former Employees’ Names and Severance from Employment (Advisory Opinion), under the Data Privacy Act (DPA), the names of the employee and the fact that they are no longer employed are classified as personal information, the processing of which may be based on any of the lawful bases under Section 12 of the DPA, particularly, that the processing of personal information is allowed if the same is necessary for the purpose of the legitimate interests pursued by the personal information controller (PIC) or by a third party.
The DPA does not particularly identify matters to be considered in the PIC’s determination of its legitimate interests. In this regard, the EU General Data Protection Regulation (GDPR) provides guidance, in accordance with which the processing of personal information strictly necessary for fraud prevention purposes constitutes a legitimate interest.
Based solely on your narration, the purpose for your planned announcement is to protect the Company against fraud, theft and unauthorized transactions. Thus, as advised by the National Privacy Commission, this constitutes a legitimate interest.
However, while the Company has a legitimate interest to publish the announcement, the DPA mandates that the principle of proportionality should still be followed. Accordingly, disclosing the name and the fact that the employee is no longer employed with the Company is sufficient to meet the stated purpose, and that any other additional information may be considered disproportional.
Thus, if there are no other means by which the company’s legitimate interest may be pursued, the company’s announcement should only include the names and the fact that the employees are no longer employed with the company, and should exclude information on their dismissal, the ground for their dismissal, and their photos. Otherwise, the additional information may be considered disproportional to your legitimate interest, for which you may be held liable for data privacy violations.
Atty. Kathy Larios