Republic of the Philippines

NATIONAL PRIVACY COMMISSION

PRIVACY POLICY OFFICE

ADVISORY OPINION NO. 2018-042

7 August 2018

'''''''''''''''''' ''''' '''''''''''''''''

'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''

RE: EMPLOYEE’S RIGHT TO ACCESS EMPLOYMENT RECORDS

Dear ''''''''' '''''''''''''''''',

This is in response to your inquiry received by the National Privacy Commission (NPC) regarding
the employee’s right to access his employment records, pursuant to Section 16 of Republic Act No.
10173,1 also known as the Data Privacy Act of 2012 (DPA). Specifically, you are seeking
clarification on the following:

1. Whether an employee can request for a copy of the results (laboratory exam results, ECG
paper or x-ray film) of his annual physical exam conducted by the company for personal
use;
2. Whether an employee may request for a copy of his 201 file, including the trainings
attended or results of performance evaluation; and
3. Whether the resigned employee may request for a copy his personal data and other records
retained by the company.

Processing of personal data of employees

It is a fact that processing of personal data at work is inevitable and indispensable. The collection,
use and retention of personal data of employees is necessary for the performance of a contract,
compliance with a legal obligation, in furtherance of the employer’s legitimate interests or when
the employee expressly gives his or her consent to the personal information controller for
processing.2

Nevertheless, the employers, as personal information controllers (PICs), are directed to adhere to
the principles of transparency, legitimate purpose and proportionality in the collection,
processing, retention, storage and disclosure of personal information in their custody.3

1 An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the
Private Sector, Creating for this purpose a National Privacy Commission and for other Purposes [DATA PRIVACY ACT OF
2012], Republic Act No. 10173 (2012).
2 Id, §12 and 13.
3 Id, §11.

5th Floor, Delegation Building, PICC Complex, Vicente Sotto St., Pasay City
URL: https://privacy.gov.ph Email Add: [email protected]
Right to reasonable access of personal information

The employee as a data subject may exercise his or her right to reasonable access to the following:

1. Contents of his or her personal information that were processed;

2. Sources from which personal information were obtained;
3. Names and addresses of recipients of the personal information;
4. Manner by which such data were processed;
5. Reasons for the disclosure of the personal information to recipients;
6. Information on automated processes where the data will or likely to be made as the sole
basis of any decision significantly affecting or will affect the data subject;
7. Date when his or her personal information concerning the data subject were last accessed
and modified; and
8. The designation or name or identity and address of the personal information controller.

In some instances, copies of personal data retained by the employer may be requested by the
employee, particularly those records that are provided by the employee upon application and
those related to his or her official duties and responsibilities.4 However, some personnel files that
are obtained in confidence shall be kept confidential and the employer may withhold disclosure,
reproduction or viewing of the particular file.5

As an alternative, perhaps it is possible for the employer to provide a summary of the confidential
information without causing prejudice to its interests or other parties involved.6

Access to results of the annual physical exam

Medical records are classified as sensitive personal information and are then treated with utmost
care and strict confidentiality.

In the given scenario, we assume that the company sponsored and shouldered the cost for the
annual physical exam and the attendant laboratory procedures. Nonetheless, the employee has
the right to access and ask for a copy of the results and related documentation, subject to existing
company protocol on accessing employee files.

Access to personnel file

Employees are generally allowed reasonable access to their files, specially those they have
personally provided the employer during the recruitment and application process.

The trainings attended by the employee may be disclosed since they are part of the duties,
responsibilities and privileges attached to the position and function and part of the professional
development and capacity building program of the employer.

As to access to employee performance evaluation, it may be viewed in two perspectives. If the

evaluative material is solely complied to determine the qualification of the employee for
employment, appointment, promotion, recognition or termination, and such is given by the

4 Repa, Barbara Kate. State Laws on Access to Your Personnel File, available at https://www.nolo.com/legal-
encyclopedia/free-books/employee-rights-book/chapter5-2.html, last accessed on 26 July 2018.
5 Privacy at Work: A Guide to the Privacy Act for employers and employees, Office of the Privacy Commissioner of New

Zealand, available at https://www.privacy.org.nz/assets/Files/Brochures-and-pamphlets-and-pubs/Privacy-at-Work-2008.pdf,

last accessed on 26 July 2018.
6 Id.
immediate supervisor due to the normal course of personnel evaluation, the employee is entitled
to know the rating.7

On the other hand, if the evaluative material is given in confidence, in such a way that the rating
and observation will not be given except for an understanding of confidentiality and anonymity,
the employee shall not be permitted to access the file.8

Nonetheless, the employer may likewise provide a summary of all the ratings given to the
employee without identifying the source in order to uphold the duty of confidentiality.

Access to personal data after resignation

Upon cessation of employment, the employer may retain the records and files of the employee in
accordance with the retention period as may be provided for by existing laws on the matter and/or
as stated in its policies.

If the request falls within the retention period of employment records, the employer shall provide
reasonable access to the requested information, subject to the same limitations discussed above
and its own company policies.

Please note that as part of the organizational security measures, PICs are required to develop,
implement and review policies and procedures for data subjects to exercise their rights under the
DPA.9

This opinion is being rendered based on the limited information you have provided. Additional
information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO

OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO

Privacy Commissioner and Chairman

7 Supra note 5.
8 Id.
9 Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 (2016), §26(e)(4)