Retention Period of Personal Information and Sensitive Personal Information Gathered Through the Standard FOI Request Form and Electronic Freedom of Information (e-FOI) Portal

July 14, 2021

PCOO FOI MEMORANDUM CIRCULAR NO. 21-03

 

WHEREAS, pursuant to Section 28, Article II of the 1987 Constitution, the State adopts and implements a policy of full public disclosure of all its transactions involving public interest, subject to reasonable conditions prescribed by law;

WHEREAS, Section 7, Article III of the Constitution guarantees the right of the people to information on matters of public concern;

WHEREAS, Executive Order (EO) No. 02, s. 2016, was issued by President Rodrigo R. Duterte on 23 July 2016 to operationalize the People's Constitutional Right to Information and the State Policies to full public disclosure and transparency in the public service;

WHEREAS, Memorandum Order (MO) No. 10, s. 2016, designated the Presidential Communications Operations Office (PCOO) as the lead agency in the implementation of EO No. 2, s. 2016, and all other Freedom of Information (FOI)programs and initiatives in the Executive Branch, including the electronic FOI (eFOI) platform;

WHEREAS, there are two (2) ways of accessing public information through the FOI Program — the standard FOI (paper-based) request form, and through the eFOI portal (www.foi.gov.ph);

WHEREAS, the standard FOI request form and the eFOI portal, which require the requesting party to divulge his/her sensitive personal information, shall be subjected to the existing rules and regulations of Republic Act No. 10173 or the Data Privacy Act of 2012, 1 which prohibits unlawful disclosure of personal information and/or sensitive information. Further, any natural or juridical persons who are storing and processing such information are bound to observe and respect data privacy rights;

WHEREAS, the FOI-Project Management Office (FOI-PMO) abides by the provisions of the Data Privacy Act of 2012, to ensure that personal information and sensitive personal information of the requesting public will be protected.

NOW, THEREFORE, in view of the foregoing and pursuant to the function of the FOI-PMO to develop policies, rules, procedures, and regulations necessary to provide strategic direction in implementing the FOI Program, strict adherence to the following is hereby ordered:

SECTION 1. Scope. — This Memorandum Circular shall apply to all personal 1 and sensitive 2 personal information of the requesting parties obtained by any agency, through the FOI Receiving Officers (FRO) and FOI Decision Maker (FDM), as a requirement to submit a request under the Standard Mode and through the eFOI Portal.

SECTION 2. Retention. — Pursuant to Section 11 of RA 10173, 3 designated FOI Receiving Officers of all agencies, departments, bureaus, offices and instrumentalities of the Executive Branch, including government-owned and/or controlled corporations (GOCCs), state universities and colleges (SUCs), and local water districts (LWDs), are hereby directed to retain personal and sensitive personal information only for the fulfillment of the purpose for which these information were obtained in order to secure the privacy of personal information and sensitive personal information of the requesting parties.

SECTION 3. Period to Retain Personal Information. 4 — Personal and sensitive personal information processed by government agencies for the purpose of making an FOI request shall be retained for two (2) years. Said information may include but are not limited to:

i. FOI request forms containing personal and sensitive personal information;

ii. Valid proof of identification (i.e., Government-issued IDs, school-ID, etc.);

iii. Personal address; and

iv. Personal contact numbers.

The FOI-PMO which is the manager and controller of the eFOI portal shall be responsible in handling and retention of personal and sensitive personal information uploaded and processed therein.

SECTION 4. Reckoning Period. — For the standard mode, the 2-year retention period shall be counted after the transaction has been closed, whether successful or denied.

For the eFOI portal, the 2-year retention period shall be counted from the last login of the requesting party.

Once the 2-year period lapsed, the eFOI system will send a notification to the requesting party via their registered email. The requesting party has the option whether to retain or delete their account permanently. They may retain their credentials by logging in within thirty (30) calendar days, however, failure to do so will prompt the system to delete their personal information with their IDs permanently.

SECTION 5. Disposal of Personal Information. — Agencies and FOI-PMO shall discard and dispose all personal and sensitive information in a secure manner that shall prevent further processing, unauthorized access or disclosure to any other party or the public, or prejudice the interests of the requesting party.

For paper-based documents, agencies and FOI-PMO may discard the personal information by mode of redaction and shredding. The FOI-PMO may also redact the personal and sensitive information gathered through the portal by using the initials of the requesting party instead of his/her complete name.

SECTION 6. Separability Clause. — If, for any reason, any part or provision of this Memorandum Circular is declared invalid or unconstitutional, any part or provision not affected thereby shall remain in full force and effect.

SECTION 7. Repealing Clause. — All previous FOI-PMO and PCOO circulars, orders, memoranda, and other issuances or parts thereof that are inconsistent with the provisions of this Circular are hereby repealed or modified accordingly.

SECTION 8. Effectivity. — This Memorandum Circular shall take effect immediately.

Manila, Philippines, 14th day of July 2021.

(SGD.) JOSE RUPERTO MARTIN M. ANDANARSecretary/FOI Champion

 

Footnotes

1. Section 3 (g) of Republic Act (RA) No. 10173 defines Personal Information as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.

2. Section 3 (l) of RA No. 10173 refers Sensitive Personal Information as personal information: (1) About an individual's race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; (2) About an individual's health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and (4) Specifically established by an executive order or an act of Congress to be kept classified.

3. RA No. 10173 states that personal information must be, among others, retained only for as long as necessary for the fulfilment of the purpose for which the data was obtained or for legitimate purposes, or as provided by law.

4. Pursuant to National Privacy Commission Advisory Opinion No. 2017-24 on Retention Period of Personal Information, an organization may develop and maintain its own records management policy which provide for retention periods and procedures for disposal of records containing personal data.