Philippine Statistics Authority's Position that Firm-level Trade Statistics Can No Longer Be Provided to the Export Marketing Bureau of the Department of Trade and Industry

DOJ OPINION NO. 36, s. 2023 August 31, 2023 Director Bianca Pearl R. Sykimte Export Marketing Bureau Department of Trade and Industry 1F and 2F DTI International Bldg. 375 Sen. Gil J. Puyat Ave. 1200 Makati City Dear Director Sykimte : This has reference to your request for our opinion on the Philippine Statistics Authority's (PSA) position that firm-level trade statistics can no longer be provided to the Export Marketing Bureau of the Department of Trade and Industry (DTI-EMB). CAIHTE You stated that the PSA can now only provide, through a Data Sharing Agreement (DSA) with the DTI-EMB, information on names, addresses, contact numbers, and products engaged in on the list of exporters and importers to assure the public that the information provided to PSA's census enumerator will not be used for other purposes, citing Section 26 of Republic Act (R.A.) No. 10625, 1 which states that: SEC. 26. Confidentiality of Information . Individual data furnished by a respondent to statistical inquiries, surveys and censuses of the PSA shall be considered privileged communication and as such shall be inadmissible as evidence in any proceeding. The PSA may release aggregated information from statistical inquiries, surveys and censuses in the form of summaries or statistical tables in which no reference to an individual, corporation, association, partnership, institution or business enterprise shall appear. The National Statistician and all staff of the PSA shall take a solemn oath regarding confidentiality of information. However, confidentiality of information does not apply to: (a) Information in the form of a list or index of individual business firms, establishments or organizations that contain any or all of the following information: (1) The name, address and telephone numbers; (2) The business and products that they are engaged in; and (3) The specific ranges of number of employees. (b) Microdata from statistical inquiries or survey form/questionnaire/schedule prepared by the PSA for purposes of research, with care to ensure that identities of a particular person, business or organization will not be disclosed in whatever form; and x x x However, you stated that the PSA has been regularly providing detailed export and import statistics to the DTI-EMB through a Memorandum of Agreement. You also stated that the DTI-EMB uses the monthly disaggregated data in the formulation of policies and programs relative to the provision of stratified interventions to exporters and aspiring exporters, and that the firm-level data analytics is crucial in order to achieve the annual targets as reflected in the Philippine Development Plan (PDP), Philippine Export Development Plan (PEDP), and the DTI Enterprise Scorecard. Hence, this request for opinion. By established precedents, the Secretary of Justice has consistently refrained from passing upon or expressing his views on matters which fall within the primary jurisdiction of another government agency or office, 2 in this case, the National Privacy Commission (NPC), which was created under R.A. No. 10173 3 to, among others, issue advisory opinions and interpret the provisions of the Data Privacy Act and other data privacy laws. 4 Moreover, the issues raised involve the substantive rights of private parties, in this case, the exporters and importers. Since the opinion of the Secretary of Justice is merely advisory in nature, such opinion would not be binding upon private parties who may be adversely affected thereby and who may, in all probability, take issue therewith and contest the same before the courts. 5 Nonetheless, for your information and guidance only, the relevant provisions of R.A. No. 10173 and its Implementing Rules and Regulations (IRR) are provided below. R.A. No.10173 SEC. 13. Sensitive Personal Information and Privileged Information . The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases : (f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority . (Emphasis supplied) Section 5(d), Rule II (Scope of Application), IRR of R.A. No.10173 Rule II. Scope of Application xxx xxx xxx Section 5. Special Cases . The Act and these Rules shall not apply to the following specified information, only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned: xxx xxx xxx d. Information necessary in order to carry out the functions of public authority, in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function , x x x. (Emphasis supplied) Based on the above-mentioned provisions, sensitive personal information and privileged information such as individual data furnished by a respondent to statistical inquiries, surveys and censuses of the PSA may be disclosed even without the consent of the owner or the data subject if the sensitive personal information is to be provided to a government or public authority, such as the DTI-EMB, to carry out its mandated functions on law enforcement or regulatory function, which is to oversee the development, promotion, and monitoring of Philippine exports and provides the exporters the enabling environment to make them globally competitive. It may also not be amiss to state that the NPC has previously issued NPC Circular No. 2016-02, which mandates government agencies to execute a Data Sharing Agreement when sharing personal data with a third party. This was, however, superseded by NPC Circular No. 2020-03, 6 which provides: SECTION 8. Data sharing agreement; key considerations. Data sharing may be covered by a data sharing agreement (DSA) or a similar document containing the terms and conditions of the sharing arrangement , including obligations to protect the personal data shared, the responsibilities of the parties, mechanisms through which data subjects may exercise their rights, among others. The execution of a DSA is a sound recourse and demonstrates accountable personal data processing, as well as good faith in complying with the requirements of the DPA, itsIRR, and issuances of the NPC. The NPC shall take this into account in case a complaint is filed pertaining to such data sharing and/or in the course of any investigation relating thereto, as well as in the conduct of compliance checks. (Underscoring supplied) . Thus, under NPC Circular No. 2020-03, the execution of a DSA is no longer mandatory but is considered a best practice and a demonstration of accountability by the personal information controller with data sharing. Please be guided accordingly. Very truly yours, (SGD.) JESUS CRISPIN C. REMULLA Secretary Footnotes 1. Philippine Statistical Act of 2013. 2. DOJ Opinion No. 8, s. 2021. 3. Data Privacy Act of 2012. 4. See paragraph (l), Section 7 (Functions of the National Privacy Commission) of R.A. No. 10173. 5. DOJ Opinion 14, s. 2020, citing DOJ Opinions No. 53, s. 2016, Nos. 50, 51, and 55, s. 2010 and DOJ Opinion No. 3, s. 2012. 6. National Privacy Commission, NPC Circular No. 2020-03 on Data Sharing Agreements [NPC Circular No. 2020-03] (23 December 2020).