Last of 2 parts
LIKE in the European Union, the Data Privacy Act (DPA) of the Philippines is intended to protect the fundamental human right of privacy—“No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks.”
The Data Privacy Act of 2012
The DPA regulates the processing of personal information of an individual by an organization and even by the government. These organizations are called the personal information controller and/or personal information processor. For instance, it could be an employer who collects personal information about his/her employees. The concept of processing is extremely broad; it covers from initial collection of personal information through its final deletion or destruction. In between the collection and deletion, personal information goes through a lot of processing, which includes alteration of data, retrieval, consultation or use of data, disclosure of data by transmission and blocking.
Personal information refers to information from which the identity of an individual (known as the data subject) is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.
The DPA allows the processing of personal information provided that organizations comply with the law and adhere to the principles of transparency, legitimate purpose, and proportionality. In effect, organizations must inform the data subject the purpose and extent of processing of personal information; the processing should be lawful, compatible, adequate and not excessive in relation to its purpose. Apart from these principles, the DPA requires organizations to safeguard the personal information they hold in order to prevent identity theft or unauthorized use of the data. And in case of data breach, organizations are required to notify the data subject of the breach and measures taken to reduce harm.
Rights of data subject
Under the DPA, could an individual demand the removal of information that is prejudicial and harmful to his reputation?
The DPA provides several rights to the data subject, which enable the person to effectively control information about himself/herself, as follows: 1) the right to be informed, 2) right to access, 3) right to rectify, 4) right to object, 5) right to erasure or blocking, 6) right to data portability, 7) right to damages and 8) right to file a complaint. From these rights, the right to erasure or blocking resembles the right to be forgotten.
The right to be forgotten is a legal mechanism to compel the permanent removal of one’s personal information from online database when such information is no longer needed for legitimate purposes. This similar right can also be found in the DPA. Under the law, a data subject can ask for removal, blocking or destruction of his personal information not only when it is unlawfully obtained or processed but also when it is no longer necessary for the purpose for which the personal information was collected or the information is prejudicial to the data subject, unless justified by freedom of speech, of expression, or of the press; or otherwise authorized (by court of law). The right to be forgotten does not only contemplate the removal of unlawfully obtained information or inaccurate information but it likewise contemplates the removal of past events from other people’s memory.
Free speech and expression in PH
In order for Anna to exercise this right to be forgotten, she needs to prove by substantial evidence the prejudice caused by her unflattering photo. There is no dispute that in the balancing of constitutional rights, greater weight is given to free speech and expression in our jurisdiction. This freedom of expression has also been extended to film and motion pictures in theaters and television. Entertainment magazines, newspapers, and other publications are among the vehicles of communication utilized by the people for information, education and entertainment.
Both the freedom of expression and the right to privacy limit the exercise of these rights. It is the task of the courts to determine the precise scope and content of these rights in different types of situations where they clash. In one case, the Supreme Court held that limited intrusion into a person’s privacy has long been regarded as permissible where the person is a public figure and the information that is published about him constitutes a public character. The right of privacy cannot be invoked against publication and dissemination of matters of public interest. However, this is not to say that privacy is divested just because one has attained the status of a public figure. The right to privacy also protects public figures, like all other individuals from unwarranted publicity and from wrongful publicizing of private affairs and activities, which are outside the realm of legitimate concern. It is clear that if the subject relates to a highly critical stage in history or current events, it is considered as having passed into the public domain and an appropriate subject matter of free speech and expression.
Right to be forgotten in PH context
Commercial speech in our jurisdiction has not been accorded with the same protection given to core speech, i.e., political and religious speech. A law or regulation directly affecting commercial speech is valid and does not offend the freedom of expression if: 1) the speech concerns illegal activity; 2) the government’s interest in restricting the speech is substantial; 3) it directly advances governmental interest; and 4) it is narrowly tailored.
Under this premise, can the government validly regulate commercial speech for the protection of an individual’s privacy? While Anna’s photo was sensual and revealing, it was nonetheless not illegal or unlawful. Under the DPA, the government’s interest is that it ought to protect the privacy of individuals, thus allowing them to control information about themselves. The right to be forgotten can be invoked if the personal information is no longer necessary for the purpose for which it was collected or the information is prejudicial to the data subject. Anna’s photo was collected for commercial and entertainment purposes five years before. In Google, the news story was said to be no longer relevant as the matter had long been over; in this case, the purpose of Anna’s photo was for entertainment. The issue of the magazine bearing Anna’s photo had already been archived but a simple Google search would direct users to this old issue of the magazine.
Anna is 25 years old now; she no longer presents the young, sensual and daring woman of the photo. And Anna’s body may have changed, too. The “Anna” now is not the Anna of five years ago. She has changed. But despite this change, her image on the Internet remains same, thanks to Google. It is clear that Anna’s photo continues to cause prejudice against her. She cannot find a job because her reputation was judged by her conduct five years ago. While the posting is covered by freedom of expression, the same is afforded protection, albeit to a lesser degree. There is no dispute that Anna’s photo does not fall under political or religious speech. Likewise, the subject matter is not something that should be of interest to the public. Applying Google v. AEPD, the search engine may be compelled to delink Anna’s photo from its search index, so that people will have to use more difficult means of finding her photo. Without Google’s web indexing, searching for Anna’s photo would be like finding a needle in a haystack, making it almost impossible for prospective employers to find Anna’s revealing photo.
As to the Men’s sexy magazine, while the content is purely for entertainment, it is possible that Anna’s photo would still be afforded protection. Anna’s photo was published lawfully; she knowingly gave her consent. While commercial speech is not given the same protection as political and religious, the lawful publication of it may only be regulated when the government has substantial interest and/or when the regulation is narrowly tailored. To order the deletion of content is tantamount to censorship of commercial speech; it places commercial speech in the category of unprotected speech. The erasure of Anna’s photo suppresses a legitimate and lawful information that has already become part of the public domain. In other words, an outright deletion of the content is not the least restrictive means. It must be considered that Anna had no expectation of privacy on this matter as she freely gave her consent. The posting of such photo was neither illegal nor unlawful. If the purpose of the law is to allow individuals to control their information, it is enough that the availability of their information online is not determined by the algorithms set by search engines. Being the least restrictive means, it is enough that Anna’s photo cannot be brought back by a simple search.
After all, the right to be forgotten is not really to effect an obliteration of truth as an information once known cannot be physically deleted from human memory. It is not an attempt to falsify or re-write the history. The right to be forgotten merely interferes with the free flow of information; it destroys one’s bad memory through the passage of time.