In more detail

Section 13 (f) of the DPA provides that the processing of sensitive personal information and privileged information is lawful when it is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings; the establishment, exercise or defense of legal claims; or when provided to government or public authorities. However, the Advisory clarifies that this provision is intended not to grant a blanket exemption to public authorities but to strike a balance between the need for public authorities to process personal data, pursuant to their functions and mandates, and the need to safeguard the rights and interests of data subjects.¹

Thus, the Advisory provides that the processing of sensitive personal information and privileged information under Section 13 (f) of the DPA is proper when any of the following requisites are met:²

1. The processing is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings.
2. The processing is necessary for the establishment, exercise or defense of legal claims.
3. The processing entails providing government or public authorities with personal data for the protection of lawful rights and interests in court proceedings or the establishment, exercise or defense of legal claims in relation to their constitutional or statutory mandate. Such instances may include providing information that supports the investigation of a law enforcement or regulatory agency.

The Advisory applies to all natural or juridical persons relying on Section 13 (f) of the DPA as a lawful basis for processing personal data.³

Section 13 (f) and the legitimate interest exception

The Advisory recognizes that processing under Section 13 (f) is to a certain extent akin to processing pursuant to legitimate interest under Section 12 (f) of the DPA, such that a personal information controller that invokes the exception under Section 13 (f) must likewise fulfill the requisites for processing based on legitimate interest as stated in NPC Circular 2023-07 or the Guidelines on Legitimate Interest.⁴

Hence, similar to the standards for processing based on legitimate interest, the Advisory provides that processing of sensitive and privileged information under Section 13 (f) is necessary when it is "adequate, relevant, suitable, and not excessive in relation to such legitimate purpose". The specific processing activity must also be within the limitations of the law.⁵

Processing for the defense of legal claims

The Advisory states that processing of personal data on the basis of Section 13 (f) of the DPA may be conducted even during stages preparatory to a case. It does not require that there be an existing proceeding before an administrative agency, court or other tribunal.⁶ Note that the establishment, exercise or defense of a legal claim under Section 13 (f) of the DPA as a lawful basis for processing personal data is also independent of the existence of a cause of action.⁷

The Advisory also clarifies that processing of personal data on the basis of Section 13 (f) need not result in the filing of an actual case.⁸ Moreover, legal claims that are established, exercised or defended may refer to legal claims of persons other than those who processed the personal data.

A data subject whose sensitive personal information or privileged information is processed pursuant to Section 13 (f) must be informed of such processing either prior to the processing or at the next practical opportunity.⁹ Where legal claims are concerned, the 'next practical opportunity' refers to service of pleadings to the parties of a case. A data subject's right to be informed of the specific processing activity is satisfied when they are served with a copy of the pleading containing the personal data following the applicable rules of procedure on summons and service.¹⁰

Recommended actions

Clients who rely on the exception provided by Section 13 (f) for the processing of sensitive personal information or privileged information must ensure that such processing is compliant with the guidelines provided in the Advisory.

Since processing under Section 13 (f) is to a certain extent similar to processing pursuant to a legitimate interest, clients who rely on this exception are also advised to undertake a legitimate interest assessment to evaluate their compliance with NPC Circular No. 2023-07.

1 Advisory, fifth Whereas clause.

2 Advisory, Section 2.

3 Advisory, Section 1.

4 Advisory, Section 3.

5 Advisory, Section 4.

6 Advisory, Section 5(A).

7 Advisory, Section 7.

8 Advisory, Section 5(B).

9 Advisory, Section 6, in relation to NPC Circular No. 2023-07.

10 Advisory, Section 6.

* * * * *

Please contact QTInfoDesk@quisumbingtorres.com for inquiries.

VISIT QUISUMBING TORRES SITE