De-Identification of Requesters' Personal Information in the Electronic Freedom of Information Portal Otherwise Known as the "Policy on Anonymization"

July 14, 2021

PCOO FOI MEMORANDUM CIRCULAR NO. 21-04

 

WHEREAS, Section 7 of Article III of the 1987 Constitution provides that the right of the people to information on matters of public concern shall be recognized. Access to official records, and to documents and papers pertaining to official acts, transactions, or decisions, as well as to government research data used as basis for policy development, shall be afforded the citizen, subject to such limitations as may be provided by law;

WHEREAS, Section 28 of Article II of the 1987 Constitution provides that, subject to reasonable conditions prescribed by law, the State adopts and implements a policy of full public disclosure of all its transactions involving public interest;

WHEREAS, on 23 July 2016, Executive Order (EO) No. 02, series of 2016, was issued by President Rodrigo R. Duterte to operationalize in the Executive Branch the Constitutional mandate of the people's right of access to information;

WHEREAS, Memorandum Order (MO) No. 10, series of 2016, designated the Presidential Communications Operations Office (PCOO) as the lead agency in the implementation of EO No. 2, s. 2016;

WHEREAS, Section 9 of EO No. 02, series of 2016, provides that any person who requests access to information shall submit a written request to the government office concerned and said request shall state the name and contact information of the requesting party, provide valid proof of his/her identification or authorization, reasonably describe the information requested, and the reason for, or purpose of the request for information;

WHEREAS, Republic Act (RA) No. 10173 or the "Data Privacy Act of 2012" was issued to protect the fundamental human right of privacy, of communication while ensuring free flow of information to promote innovation and growth, and also to recognize the State's inherent obligation to ensure that personal information in information and communications systems in both government and private sector are secured and protected;

WHEREAS, under RA 10173, personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual. Names of an individual is considered a personal information;

WHEREAS, the International Organization for Standardization defines anonymization 1 as a process by which the personal data is irreversibly altered in such a way that a data subject can no longer be identified both directly or indirectly. Conversely, de-identification 2 was defined as a process of removing the association between a set of dataset or collection of data and the data subject;

WHEREAS, in order to prevent exposure and possible disclosure of the identity of requesting parties, it is imperative that there should be a guiding rule on anonymization and de-identification;

NOW, THEREFORE, in consideration of the foregoing and pursuant to the functions of the Freedom of Information-Project Management Office (FOI-PMO) to develop policies, rules, procedures and regulations necessary to provide the strategic direction in implementing the FOI Program, strict adherence to the following is hereby ordered:

SECTION 1. Anonymization or De-identification in the Electronic FOI (eFOI) Platform. — Any personal information, particularly the names of requesting parties, that the FOI-PMO collects through its electronic FOI portal or www.foi.gov.ph shall be anonymized or de-identified in compliance with RA No. 10173. Accordingly, the names of the requesting parties posted in the electronic FOI portal prior to the effectivity of this Circular shall be anonymized by the said Office.

For requests made in the standard form, the FOI Receiving Officers (FROs) and FOI Decision Makers (FDMs) shall exercise reasonable diligence in protecting the personal information disclosed in the application form.

SECTION 2. Access to Valid Proof of Identification (IDs). — FROs, FDMs, and FOI-PMO are allowed access to the IDs uploaded by the requesting parties during the process of signing up in the eFOI portal (Annex A).

They shall advise the requesting parties to refrain from uploading or posting any ID, personal information, or sensitive personal information in the individual request page (Annex B), a portion in the eFOI portal which is accessible to the general public that contains the request for information, the agency to which the request is made, and the status of the request.

Those who have access to personal information in the eFOI portal must not disclose the information except when permitted or officially recognized under existing laws, rules or regulations. They shall also exercise reasonable diligence in protecting said personal information against leaks, exposure or unwarranted disclosure which would unduly expose the requesting party to vilification, harassment, or any other wrongful act.

SECTION 3. Non-compliance. — In case of non-compliance, RA No. 10173, EO No. 02, series of 2016, and other existing laws, rules and regulations shall govern without prejudice to the filing of appropriate action.

SECTION 4. Separability Clause. — If, for any reason, any part or provision of this Circular is declared invalid or unconstitutional, those parts or provisions not affected shall remain in full force and effect.

SECTION 5. Repealing Clause. — All previous orders, rules and regulations, memoranda, circulars, and issuances or any part thereof inconsistent with the provisions of this Circular are hereby repealed, amended or modified accordingly.

SECTION 6. Effectivity. — This Memorandum Circular shall take effect immediately.

For guidance and strict compliance.

Manila, Philippines, 14th day of July 2021.

(SGD.) JOSE RUPERTO MARTIN M. ANDANARSecretary and FOI Champion

ANNEX A

Sign up Page of eFOI Portal (www.foi.gov.ph/signup)

ANNEX B

Requesting Party's Individual Request Page

 

Footnotes

1. Section 2.2 of ISO/IEC 29100:2011.

2. Section 3.7 of ISO/IEC.