NPC gives Advisory Opinion on Data Sharing Agreement
The National Privacy Commission (NPC) rendered Advisory Opinion No. 2023-009 regarding the proposed data sharing agreement (DSA) between the Department of Agriculture (DA) and the Food and Agriculture Organization (FAO), a Specialized Agency of the United Nations.
The DA is working with the FAO for the establishment of the Rice Competitiveness Enhancement Fund-Impact Monitoring System. This collaboration includes the integration of databases and reporting platforms to ensure seamless sharing. The collaboration thus necessitates the disclosure of confidential information to the FAO regarding confidential information on the Registry System for Basic Sectors in Agriculture under the DA.
The DA proposed to execute a Data Sharing Agreement (DSA) but the FAO refused, invoking its status as a Specialized Agency of the UN System with privileges and immunities under public international law and relevant treaties. Thus, citing Section 6 of the Data Privacy Act (DPA), the DA proposed to execute an Undertaking requiring the FAO to pledge to investigate and impose disciplinary action in case of confidentiality violations and to report incidents of data breach to the DA, should Philippine data privacy laws be violated. The FAO denied the proposal but committed to investigate and even impose disciplinary action on the basis of their internal rules, as they maintained their legal status under international law.
In response to the request, the NPC held that the DPA has extraterritorial application since the personal data involved in the sharing is that of beneficiaries who are Philippine citizens. While the FAO enjoys certain privileges and immunities, such does not give them blanket exemption from compliance with Philippine law. Citing the case of Khorsow Minucher v. Court of Appeals, the NPC explained that the immunity is limited to the exercise of territorial jurisdiction—it is not immunity from the observance from the law.
The NPC furthered that the DA can ensure DPA compliance by policy or any like written document. The policy may include documentation as to the legitimate purpose of the data sharing, as well as other terms and conditions. Thus, they are not constrained to executing a DSA. However, the NPC refrained from giving advice as to the question of whether the execution of the DSA by the FAO amounts to a waiver of its immunity and privileges.
The NPC assured that should there be violations of the DPA, the NPC shall determine who is liable after investigation and hearing. In the event that the FAO is found liable and it invokes its immunity, the DA is not automatically liable. In any event, recourse may still be made against the FAO following the ruling in Lasco v. United Nations Revolving Fund for Natural Resources Exploration where the Court explained that each Specialized Agency is mandated to make a provision for appropriate modes of settlement for disputes from contracts or other disputes of private character involving the Specialized Agency.
The full text of the Advisory Opinion may be read here.