Are DMW Agencies Required to Have a Data Sharing Agreement?
Yes. A Data Sharing Agreement (DSA) is needed because the DMW-licensed Philippine recruitment agency and the DMW-accredited foreign placement agency are likely separately handling and transferring candidates’ personal data for overseas recruitment and deployment. The data may include identification details, passports, employment records, medical information, contact information, and other sensitive personal information.
Under Rule XIII, Section 45 of the IRR of Republic Act No. 11641 (2022), also known as The Implementing Rules and Regulations of the Department of Migrant Workers Act, data sharing with external government agencies, private organizations or corporations, and other third parties requires a DSA. The same provision permits internal sharing within the DMW ICT ecosystem only under specified conditions; it does not dispense with a DSA when data is shared externally.
The provision states:
“Section 45. Data and Resource Sharing. Provided that the same is not classified, confidential data and any informational resource sharing amongst participants/stakeholders within the Department’s ICT ecosystem shall be allowed. This sharing arrangement shall be the primary means to achieve improved efficiencies and effectiveness. However, in compliance with the provisions of the Data Privacy Act of 2012 and issuances from the Department of Information and Communications Technology (DICT), individual personal information processors (PIP) shall sing a non-disclosure agreement (NDA) before being allowed to use any system/application of the Department where OFW personal information is accessed/viewed/processed. Data sharing with external government agencies, private organizations/corporations, and any other third parties shall require a Data Sharing Agreement.”
The DSA is needed for the following reasons:
- To establish the lawful purpose and basis for the transfer.
It should state why the agencies need the candidate employees’ data—for example, accreditation, recruitment, evaluation, submission to a foreign employer, visa processing, deployment, or worker assistance—and identify the applicable lawful basis. Section 9 of the National Privacy Commission’s NPC Circular No. 2020-03 (2020) requires these matters to be specified. - To allocate responsibility between the agencies.
The DSA should identify the data each party will share, the processing each party may perform, the permitted recipients, and each party’s Data Protection Officer. It should also clarify who may access, retain, amend, disclose, or delete the information. - To protect candidates from unauthorized or excessive disclosure.
The agreement can limit the data to what is necessary, prohibit unrelated use, regulate onward disclosure to foreign employers or other service providers, and require appropriate security safeguards. NPC Circular No. 2020-03 requires secure handling of shared personal data and accountability for data under each party’s control or custody. (NPC Circular No. 2020-03 (2020)) - To comply with DMW licensing requirements.
The DMW IRR requires data-protection compliance to be incorporated into the licensing provisions of recruitment and manning agencies. Violations may lead to administrative charges and possible cancellation of the agency’s license, without prejudice to charges under the Data Privacy Act of 2012. (IRR of Republic Act No. 11641 (2022)) - To document accountability for cross-border processing.
Because the foreign placement agency is located outside the Philippines, the DSA should address the transfer and processing of candidate data abroad, including security, retention, access, breach response, and restrictions on further transfers. NPC Circular No. 2020-03 expressly extends accountability to personal data transferred to a third party outside the Philippines, subject to the applicable cross-border arrangements and cooperation. (NPC Circular No. 2020-03 (2020))
The DSA should not be treated as a mere confidentiality document. A confidentiality or non-disclosure agreement may be useful, but the DMW IRR separately requires personnel who access or process OFW information to sign NDAs. The DSA, by contrast, governs the inter-agency data transfer itself—its purpose, lawful basis, scope, operational procedures, duration, safeguards, and accountability.
One important qualification: under NPC Circular No. 2020-03, a DSA is generally an agreement between or among personal information controllers (PICs). A personal information processor (PIP) should not ordinarily be made a party to the DSA; processing by a PIP should instead be covered by the appropriate controller–processor or subcontracting arrangement. (NPC Circular No. 2020-03 (2020)) Thus, the agencies should first determine whether each acts as a PIC, a PIP, or in both capacities for particular processing activities.
The DSA should also have a defined term and periodic review. Perpetual or indeterminate DSAs are invalid under Section 9 of NPC Circular No. 2020-03. (NPC Circular No. 2020-03 (2020))
About Nicolas and De Vega Law Offices
Nicolas and de Vega Law Offices is a full-service law firm in the Philippines. You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines. You may also call us at +632 84706126, +632 84706130, +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com.
