When a person resigns from his or her previous employment or transfers companies, a significant matter on data privacy comes to mind — what is the duration for which the employer should legally retain the personal records of its previous employee?
Republic Act 10173 or the Data Privacy Act (DPA) lays out the general principles that must be taken into consideration in dealing with personal information. Section 11 of the DPA mandates that any processing of personal information, which includes the retention of personal data, must adhere to the principles of transparency, legitimacy, and proportionality. Section 19 of the DPA Implementing Rules and Regulations (IRR), which expounds on the principles required for the retention of personal data, provides that the retention shall only be for as long as necessary for the following purposes: a) for the fulfillment of the declared, specified and legitimate purpose, or when the processing relevant the purpose has been terminated; b) for the establishment, exercise or defense of legal claims; or c) for legitimate business purposes, which must be consistent with standards followed by the applicable industry or approved the appropriate government agency. Furthermore, the IRR provides that personal data cannot be retained in perpetuity in contemplation of a possible future, yet still undetermined, use.
Specifically, with regard to employee data, the National Privacy Commission (NPC), in Advisory Opinion 2017-24, supplied the key factors that may be considered in the proper determination of the retention period of employment records, which includes the following: 1) legal requirements to which the company may be subject; 2) applicable prescription periods in existing law; 3) Department of Labor and Employment (DoLE) rules; 4) Bureau of Internal Revenue (BIR) regulations; and 5) Industry standards and other laws and regulations applicable to the specific sector.
Under Rule X, Section 12 of the Omnibus Rules Implementing the Labor Code, issued by DoLE, an employer is mandated to retain the records of employees for a minimum of three years from the date of the last entry in the records. This period is in line with the prescriptive period of money claims arising from employer-employee relations, provided in Article 291 of the Labor Code, of three years from the time the cause of action accrued. Consequently, the previous employee may request and shall be given reasonable access to his or her personal data relevant to the employer even after resignation, subject to the same principles mandated by the DPA.
Hence, employers are generally required to retain the records of their resigned employees for a minimum of three years, subject to other industry-specific standards or other applicable laws and regulations of a particular sector.
