Text
5 January 2017
Re: LOCATION OF PERSONAL INFORMATION CONTROLLER AND CROSS-BORDER TRANSFER OF PERSONAL DATA
Dear [Redacted],
This pertains to your queries received by the National Privacy Commission (NPC) on 21 November 2016 and 23 November 2016, via emails. Specifically, you raised the following questions:
a. May a personal information controller be located outside of the Philippines? b. How does an entity located in the Philippines and engaged in cross-border transfer of personal data comply with the Data Privacy Act?
Location of Personal Information Controller
A personal information controller (PIC) subject to the provisions of Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), may be located outside of the Philippines. Section 4 of the law reads:
“Scope. – This Act applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing including those personal information controllers and processors who, although not found or established in the Philippines, use equipment that are located in the Philippines, or those who maintain an office, branch or agency in the Philippines subject to the immediately succeeding paragraph: Provided, That the requirements of Section 5 (sic) are complied with.” (underscoring supplied)
For the extra-territorial application of the law to operate, the PIC must be engaged in the processing of the personal data of a Filipino citizen, or at least a resident of the Philippines, and it should have an established link to the country.1
Please note that the DPA defines a PIC as a “person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.”2
Your query seems to indicate that whoever is managing or running the internal branding campaign that requires the processing of personal data should be considered as the PIC. Unfortunately, we are unable to establish with certainty as to who must be considered as the PIC given the facts you have provided. Accordingly, there is a need for you to evaluate the relationship between the companies mentioned and the extent of their involvement in the aforesaid campaign. Since the law imposes a number of obligations upon the PIC, one should identify this person or organization as soon as possible in order for it to note its obligations under the law.
Cross-border Transfer of Personal Data and the DPA
In situations wherein the cross-border transfer of personal data is necessary for processing purposes, keep in mind Section 21 of the DPA, to wit:
“Principle of Accountability. – Each personal information controller is responsible for personal information under its control or custody, including information that have been transferred to a third party for processing, whether domestically or internationally, subject to cross-border arrangement and cooperation.” (underscoring supplied)
As can be gleaned from the foregoing provision, the PIC has the primary responsibility of securing the personal data under its control or custody, even when these are transferred across borders or jurisdictions. It shall ensure that said data are processed in accordance with the provisions of the DPA, its IRR, and other applicable issuances of the NPC. Any outsourcing, subcontracting, or data sharing agreement that facilitates such cross-border transfer shall also be subject to the requirements of the law.
In your particular case, whoever is determined to be the PIC shall shoulder these responsibilities. In the event, for instance, that the Singapore entity is identified as the PIC, it shall utilize all available and appropriate means to ensure that your company here in the Philippines (presumably acting as a mere personal information processor) abides by the DPA and other applicable policies.
For your reference.
Sincerely,
JAMAEL A. JACOB
Director, Privacy Policy Office
Approved:
IVY D. PATDU
Deputy Privacy Commissioner,
Policy and Planning