29 October 2024
MR. FRESCIAN O. CANLAS, RSW
Head, City Social Welfare and Development Office
Dear Mr. Canlas,
This has reference to your Document Tracking Form dated 17 October 2024
requesting for a comment and/or recommendation relative to the request of
Mr. Crisanto R. Madrigalejos for a certified true copy of any information
recorded in your office on the alleged physical injuries committed against Ms.
Daisy D. Lacy on 22 November 2022.
In this regard, please be informed that Section 13(f) of the Data Privacy Act of
2012 applies in this case. -
“SEC. 13. Sensitive Personal Information and Privileged Information.
– The processing of sensitive personal information and privileged
information shall be prohibited, except in the following cases:
xxx
(f) The processing concerns such personal information as is
necessary for the protection of lawful rights and interest of natural or
legal persons in court proceedings or the establishment, exercise, or
defense of legal claims, or when provided to government or public
authority.”
In the said letter, your client requested for certified true copy of any
information recorded in your office on the alleged physical injuries committed
against Ms. Daisy D. Lacy on 22 November 2022 for purposes of submission in
court for Criminal Case No. 23-82829 entitled “People of the Philippines vs.
Crisanto R. Madrigalejos” for violation of Section 5 (a) in relation to Section 6
(a) of Republic Act No. 9262, in further relation to Section 5 (k) of Republic Act
No. 8369. The requested documents/information appear to be necessary for
the protection of lawful rights and interests of natural or legal persons in court
proceedings, or the establishment, exercise or defense of legal claims.
Despite the existence of a legal basis for processing, the DPA does not permit
unbridled processing of personal data. Personal Information Controllers (PICs)
are still required to adhere to the general data privacy principles set forth
under the law. Thus, the City Social Welfare and Development Office (CSWDO)
should disclose personal data to requesting individuals limited to its declared,
specified, and legitimate purpose. In addition, only those personal data
needed in relation to the declared and stated purpose should be disclosed to
the requesting parties.
Very truly yours,
ATTY. CEDRICK JUSTICE U. CAPIRAL
City Legal Officer
