NPC Releases Advisory Opinion on the Posting of Passport Applicants Information on the DFA’s Website

The National Privacy Commission (NPC) released Advisory Opinion No. 2021-041 on the posting of the names of Philippine passport applicants whose passports were unsuccessfully delivered despite repeated attempts on the website of the DFA – Office for Consular Affairs (DFA-OCA).

 

The Commission noted that the names of applicants are personal information and their posting on the website constitutes processing under the Data Privacy Act (DPA). As a result, the processing of personal information must comply with Section 12 of the DPA on the lawful processing of personal information.

 

The NPC stated that Section 12(e) would be the most appropriate lawful basis for processing as the DFA has the legal mandate to enforce the Philippine Passport Act of 1996. Likewise, the processing of personal information may be valid under Section 12(b) of the DPA as necessary processing for the fulfillment of a contract with the data subject in relation to the delivery of the passport.

 

The NPC also clarified that government agencies like the DFA cannot rely on Section 12(f) of the DPA which contemplates “legitimate interest” as a lawful basis for processing data. Relying on Article 6 of the European Union General Data Protection Regulation (GDPR), processing on the basis of legitimate interests does “not apply to processing carried out by public authorities in the performance of their tasks.”

 

While the posting of applicant information may be based on Sections 12(e) and (f) of the DPA, the NPC reiterated that the DFA must nonetheless adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality. Moreover, the DFA must ensure that the data subjects are informed about the posting of their personal information on the website through privacy notices.

 

The NPC also provided the suggestion that the DFA should include a privacy notice in passport applications moving forward to apprise applicants of the possible posting of their names in case of unsuccessful delivery attempts.

 

The full advisory opinion can be accessed here.