On SPI Legal Bases as Legitimate Interest
Take note that establishment of legal claims, though normally a legal basis for processing sensitive personal information, may be used as a legal basis for processing non-sensitive personal information under legitimate interest.
BGM v. IPP: Processing of personal information for the protection of lawful rights and interests of natural or legal persons in court proceedings or the establishment, exercise or defense of legal claims are considered as legitimate interests under Section 12 (f):
Although Section 13(f) applies to sensitive personal information while the information involved in this case is just personal information, the protection of lawful rights and interests under Section 13(f) by the Respondent is considered as legitimate interest pursuant to Section 12(f) of the DPA. This section provides that it is lawful to process personal information if it is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.