NPC Issuance Wiki

NPC Advisory Opinion No. 2017-003 — Applicability of the Data Privacy Act and NPC Circulars to the Landbank of the Philippines

Issued Advisory Opinion

Text

5 January 2017

Re: APPLICABILITY OF THE DATA PRIVACY ACT OF 2012 AND CIRCULARS OF THE NATIONAL PRIVACY COMMISSION TO THE LANDBANK OF THE PHILIPPINES

Dear [Redacted],

This pertains to your query received by the National Privacy Commission (NPC) on 2 November 2016, via email, regarding the applicability of Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and administrative circulars issued by the NPC, to the Landbank of the Philippines (LBP), in light of Section 5(e) of the IRR of the DPA, which states:

“Section 5. Special Cases. The Act and these Rules shall not apply to the following specified information, only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned:

xxx

e. Information necessary for banks, other financial institutions under the jurisdiction of the independent, central monetary authority or Bangko Sentral ng Pilipinas, and other bodies authorized by law, to the extent necessary to comply with Republic Act No. 9510 (CISA), Republic Act No. 9160, as amended, otherwise known as the Anti-Money Laundering Act, and other applicable laws;” (underscoring supplied)

We confirm that banks and other financial institutions are covered by the DPA, its IRR, and all issuances by the NPC. Section 4 of the DPA provides that the law applies to the processing of all types of personal data and to any natural and juridical person involved in personal data processing. No distinction is made between those who form part of the government sector or the private sector. This policy is further reiterated in the law’s IRR.1

Regarding Section 5(e) of the IRR, it is important to note that the exemptions and/or special cases provided in the DPA and its IRR all pertain to specific types of information, and not those persons engaged in the processing thereof. Moreover, the exemption is not absolute. Even in those instances wherein the information being processed may be considered outside the scope of the law, the IRR clarifies that the processing shall be exempt from the requirements of the law “only to the minimum extent necessary to achieve the specific purpose, function, or activity.”2

Established in 1963, LBP is considered a specialized government bank that has a universal banking license.3 Its major roles include: (1) implementing the Comprehensive Agrarian Reform Program of the government; (2) providing assistance to small farmers and fisher folk; (3) serving as an official depository of government funds; and (4) encouraging countryside development.4 As such, it is obliged to comply with the data privacy law, similar to any other bank or financial institution engaged in the processing of personal data. It must also abide by all applicable issuances of the NPC, such as NPC Circular Nos. 16-01 (Security of Personal Data in Government Agencies) and 16-02 (Data Sharing Agreements involving Government Agencies).

For your reference.

Sincerely,

JAMAEL A. JACOB
Director, Privacy Policy Office

Approved:

IVY D. PATDU
Deputy Privacy Commissioner,
Policy and Planning

Footnotes

  1. IRR of RA 10173, § 4. ↩

  2. Id., § 5. ↩

  3. Corporate Profile, Landbank of the Philippines, accessed on 19 December 2016, available at https://www.landbank.com/corporate-profile. ↩

  4. Major Roles of Landbank, accessed on 19 December 2016, available at https://www.landbank.com/major-roles-of-landbank. ↩

Backlinks