Dear Attorney,

I lost the transaction slip for claiming my ID. Can I ask for the tracking number of someone else, who lives in Taguig City, so I can retrieve it?

Sincerely,
A Concerned Resident

Insights

In the Philippines, the query about obtaining a tracking number tied to a third party (another individual) involves critical considerations of data privacy and confidentiality laws. Specifically, the request to access someone else's information, such as a tracking number linked to an individual's identity document, is governed by the Data Privacy Act of 2012 (Republic Act No. 10173). This law ensures the protection of personal data and regulates how personal information is collected, used, stored, and shared.

Data Privacy Act of 2012: Protection of Personal Information

The Data Privacy Act (DPA) defines personal information as any data that can be used to identify an individual. In this case, requesting the tracking number associated with an individual's ID would constitute personal information. The law prohibits any person or entity from accessing personal data without the individual's consent. Here are the main principles that guide the application of the DPA:

Legitimate Purpose – Personal data can only be processed if there is a legitimate purpose declared and agreed upon by the data subject. Requesting personal information like a tracking number falls under this provision and requires express consent from the individual involved.
Transparency – The law mandates that data subjects be fully informed about how their data will be collected and used. In this case, sharing the tracking number without the knowledge and consent of the person it pertains to would violate this principle.
Proportionality – The use of personal data must be necessary and directly relevant to the declared purpose. Providing sensitive information, such as a tracking number, to an unrelated party would be deemed unnecessary and excessive in this context.
Consent Requirement – One of the most critical aspects of the DPA is the requirement of consent from the data subject. In this case, before any information about the tracking number can be disclosed, the person whose ID or transaction slip is involved must give explicit permission.

Legal Implications of Unauthorized Disclosure

If an organization, such as a government agency or a private entity, were to release the tracking number without the consent of the individual, they would be in violation of the Data Privacy Act. Such violations can result in both civil and criminal liabilities. Penalties include:

Imprisonment ranging from one year to six years, depending on the nature of the violation.
Fines from PHP 500,000 to PHP 5,000,000, depending on the gravity of the offense.

Violations could also lead to administrative actions from the National Privacy Commission (NPC), which oversees compliance with the DPA.

How to Resolve the Issue

For someone who has lost a transaction slip and is unable to claim an ID, the appropriate course of action is to:

Contact the Issuing Office – The concerned individual should get in touch with the office where the transaction occurred and explain the situation.
Provide Proof of Identity – Instead of requesting the tracking number of someone else, the individual should provide proof of identity to verify their claim.
Request a Reissuance or Verification – The issuing authority may be able to issue a new transaction slip or allow an alternative means to verify the individual's claim to the ID.

Role of the National Privacy Commission (NPC)

The National Privacy Commission is the primary regulatory body that ensures compliance with the Data Privacy Act. In instances where personal data is improperly disclosed, affected individuals can file complaints with the NPC. The NPC has the authority to investigate potential violations and impose administrative sanctions.

The NPC also encourages individuals and organizations to take proactive steps in protecting personal data by adhering to strict data protection measures. Organizations handling sensitive personal data, like government agencies processing IDs, are expected to implement high standards of data security and establish processes that prevent unauthorized access to personal information.

Exceptions to Data Sharing

There are very limited instances where personal information can be disclosed without the consent of the data subject, such as:

Compliance with a Legal Obligation – If a court order or legal obligation mandates the disclosure of certain information, it can be shared.
Public Interest – In some cases, personal data may be shared for reasons of public interest or national security. However, these exceptions must still be handled with caution, and proper legal protocols must be followed.

Conclusion

In summary, requesting the tracking number of someone else's ID without their consent would violate the Data Privacy Act of 2012. The appropriate legal route would involve contacting the proper issuing authority, verifying the identity of the person concerned, and following established procedures for reissuing or confirming the lost transaction slip. Understanding the importance of personal data privacy is crucial, not only for compliance with the law but also for maintaining the trust and security of individuals' information.