Privacy Policy

1. Overview & Policy Statement

The Municipal Government of Santa Ana, Pampanga is committed to protecting the privacy rights of all citizens, residents, taxpayers, business owners, employees, and visitors in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR).

This Privacy Policy explains how the Municipal Government collects, uses, stores, categorizes, shares, and disposes of personal and sensitive personal information collected through our official portals, digital applications, physical forms, and municipal office transactions.

2. Core Principles

All data processing activities carried out by the Municipality of Santa Ana adhere to the three core principles of the DPA:

• Transparency: Data subjects are informed of the nature, purpose, and extent of data processing.
• Legitimate Purpose: Personal data is processed solely for specified, non-contrary-to-law administrative and public service operations.
• Proportionality: Data collection is adequate, relevant, and strictly limited to what is necessary for public administration.

3. Detailed Data Classification & Collected Information Framework

To satisfy statutory requirements under R.A. 10173, all data collected by the Municipal Government is categorized according to legal data classification standards: Personal Information (PI), Sensitive Personal Information (SPI), Privileged Information (PIV), and Technical Data / Personal Information Assets (PIA).

A. Personal Information (PI)

Information from which the identity of an individual is apparent or can be reasonably and directly ascertained:

• Demographic Identifiers: Full name, complete residential address, temporary address, personal email address, landline number, and mobile phone number.
• Business & Property Records: Registered business trade names, property index numbers (PIN), Real Property Tax (RPT) declaration records, and Barangay clearance application records.
• Employment Details: Occupational title, employer/company name, and employment history submitted for local permits or employment assistance.

B. Sensitive Personal Information (SPI)

Information subject to enhanced legal protection under Section 13 of R.A. 10173:

• Personal Attributes & Status: Age, date of birth, place of birth, marital/civil status, gender, nationality, race, ethnic origin, religious affiliations, political opinions, or trade union memberships.
• Health & Medical Data: Medical history, health conditions, disability status (PWD records), physical/mental health evaluations, and social welfare assessment reports (MSWDO files).
• Government-Issued Identification & Financial Credentials: Philippine Identification System (PhilSys) number, Taxpayer Identification Number (TIN), Passport number, Driver’s License number, SSS/GSIS numbers, Voter's ID, official handwritten/digital signatures, gross revenue declarations, bank details, and social assistance payout receipts.
• Vulnerable Group & Civil Registry Records: Birth certificates, marriage certificates, death certificates, adoption papers, and case files involving minors or victims of abuse.

C. Privileged Information (PIV)

Data that constitutes privileged communication under the Rules of Court and Philippine law:

• Legal & Executive Communications: Communications between citizens and municipal legal officers, confidential legal advice, executive administrative proceedings, and ongoing municipal legal disputes.

D. Technical Data & Personal Information Assets (PIA)

Technical, spatial, and system assets collected via digital municipal applications, web portals, or geospatial surveys:

• Digital Access & Metadata: IP addresses, browser specifications, mobile device operating system versions, portal login timestamps, session logs, and online transaction reference numbers.
• Spatial & Geospatial Datasets: Micro-level GPS latitude/longitude coordinates linking specific households or property structures to municipal flood risk maps, hazard vulnerability surveys, or Community-Based Monitoring System (CBMS) spatial layers.

4. Categorized Data Disclosure & Non-Disclosure Framework

Collected data is governed by the following disclosure classification to balance privacy rights with Freedom of Information (FOI) and transparency mandates:

A. Disclosable Data Categories

Data that may be disclosed to designated third parties, oversight agencies, or published publicly pursuant to statutory obligations:

• Public Licensing & Business Data [PI]: Business trade names, registered business addresses, nature of business, and ownership status appearing on active Business/Mayor’s Permits.
• Public Procurement Records [PI]: Names of winning bidders, corporate details, and contract values under R.A. 9184 (Government Procurement Reform Act).
• Anonymized / Aggregated Datasets [PIA]: Statistical summaries, demographic counts, municipal flood risk maps, and CBMS spatial distributions where all individual PI and SPI identifiers have been stripped.
• Mandatory Statutory Disclosures [PI / SPI]: Shared with national oversight bodies (e.g., BIR, DILG, DSWD, PNP, PhilHealth, Commission on Audit) under direct legal mandates.
• Court Orders & Subpoenas [PI / SPI / PIV]: Released pursuant to lawful court orders, search warrants, or formal law enforcement subpoenas.

B. Non-Disclosable / Confidential Data Categories

Data strictly prohibited from disclosure, publication, or unauthorized access without explicit written consent or statutory exemption:

• Sensitive Personal Information [SPI]: All SPI data (health records, PhilSys/TIN numbers, civil registry files, minor/vulnerable group files).
• Household Geospatial Coordinates [PIA]: Individual household geospatial coordinates linking specific families to vulnerability or flood surveys.
• Privileged Information [PIV]: All internal legal advice, attorney-client communications, and executive administrative cases.
• Financial & Tax Assessment Records [PI / SPI]: Detailed financial and tax records (individual gross sales, specific income tax declarations, and bank details).

5. Purpose of Collection and Legal Basis

We collect and process your personal data under Sections 12 and 13 of R.A. 10173 to perform municipal duties and deliver public services, including:

• Processing and issuance of business permits, mayor’s permits, and local licenses.
• Assessment and collection of local taxes, fees, and charges.
• Issuance of civil registry documents and community tax certificates (Cedula).
• Delivery of social welfare assistance, health programs, and disaster risk reduction services.
• Evaluation and response to public feedback, complaints, and service requests.
• Compliance with statutory reporting and legal obligations under the Local Government Code of 1991 (R.A. 7160).

6. Data Security and Access Control

The Municipal Government of Santa Ana implements robust administrative, organizational, physical, and technical safeguards:

• Restricted Access: Access to SPI, PIV, and confidential PI is strictly role-based and limited to authorized LGU personnel.
• Technical Safeguards: Encrypted data transmission (SSL/TLS), network firewalls, regular vulnerability assessments, and secure database configurations.
• Confidentiality Agreements: All LGU employees, contractual staff, and third-party system providers sign binding non-disclosure agreements (NDAs).

7. Storage, Retention, and Disposal

• Storage: Digital records are stored on secure LGU servers and encrypted municipal cloud platforms; physical records are maintained in locked archival repositories.
• Retention: Data is retained only for as long as necessary to fulfill the intended municipal service, resolve disputes, or satisfy statutory retention periods mandated by the National Archives of the Philippines (NAP) and the NPC.
• Disposal: Upon expiration of retention periods, physical records are securely cross-shredded, and digital files are permanently deleted or anonymized beyond recovery.

8. Rights of the Data Subject

Under Section 16 of the Data Privacy Act of 2012, citizens and users have the right to:

• 1. Right to be Informed: Know whether personal data is being processed.
• 2. Right to Access: Request copies of your personal data held by the Municipality.
• 3. Right to Object: Object to processing based on consent or automated processing.
• 4. Right to Rectification: Dispute and request correction of inaccurate or outdated data.
• 5. Right to Erasure or Blocking: Request suspension, withdrawal, or deletion of data under statutory conditions.
• 6. Right to Damages: Be indemnified for damages due to inaccurate, incomplete, or unlawful processing.

9. Contact Information & Data Protection Officer (DPO)

For inquiries, requests, or to exercise your data privacy rights, please contact the Municipal Data Protection Officer (DPO):

10. Updates to This Policy

The Municipal Government of Santa Ana reserves the right to update this policy to reflect changes in Philippine laws, technology, or LGU operating procedures. Any updates will be posted on the official municipal portal and notice boards.