Text
6 March 2017
Re: DATA SHARING; DEFINITION OF “COMMERCIAL PURPOSES”; SCOPE; DATA PROTECTION OFFICER
Dear [Redacted],
This pertains to your queries received by the National Privacy Commission (NPC) on 9 January 2017, via email. Specifically, your questions pertain to the following:
a. Data Sharing between Private Entities. Whether or not a data sharing agreement (DSA) is necessary between affiliated companies that share data even if such sharing is not for commercial purposes; if not, whether the consent of the data subject to such sharing is sufficient for the purpose of complying with the provisions of Data Privacy Act (DPA). How is the term “commercial purpose” defined;
b. Scope of the Law. Whether or not the provision of the DPA excluding from its scope information necessary for public authorities to carry out their functions, includes information disclosed by private entities to government entities in relation to certain regulatory or reportorial requirements (e.g., information contained in the General Information Sheet [GIS], as submitted to the Securities and Exchange Commission [SEC]; tax returns filed with the Bureau of Internal Revenue (BIR); and Employee Data Forms submitted to the Social Security System [SSS]); thus, compliance with these regulatory or reportorial requirements do not require the execution of a data sharing agreement;
c. Designation of a Data Protection Officer (DPO). Whether or not, in the case of several affiliated or related companies, a different or separate DPO should be appointed for each company or affiliate, or is it possible that only one (1) DPO is appointed by such companies who will ensure their compliance with the DPA.
Data Sharing between Private Entities
Data sharing is allowed when it is expressly authorized by law and adequate safeguards are in place, including adherence by the parties thereto to the general principles of transparency, legitimate purpose, and proportionality.1
In the private sector, it is permitted if the consent of the data subject is obtained, and certain conditions provided in the Implementing Rules and Regulations (IRR) of the DPA are complied with.2 One such condition requires the execution of a DSA if sharing is carried out for commercial purposes.3 The term “commercial purpose” is read in its ordinary meaning and refers to any activity with the ultimate purpose of gain or profit.
Data sharing between private sector entities is generally presumed to be in pursuit of some commercial objective or purpose, as is the compliance by such entities with the DSA requirement prior to any data sharing arrangement. This view is consistent with Section 38 of the DPA, which calls for an interpretation of the law that is mindful of the rights and interests of data subjects. Accordingly, it is incumbent upon a private sector entity seeking to exempt itself from the DSA requirement to overcome the aforesaid presumptions.
Scope of the Law
Section 4(e) of the DPA provides for the non-applicability of the law on information necessary for public authorities to carry out their constitutionally- or statutorily-mandated functions. By implication, this would include personal data that are being submitted to government regulatory agencies in furtherance of the latter’s mandate.
The Commission stresses, however, that the exemptions provided in the law are not, in any way, absolute or without qualifications. The IRR clarifies this point by stating that the exemption is “only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned.”4
As regards data sharing agreements involving government agencies, NPC Circular No. 2016-02 shall govern, in relation to the provisions of the DPA and its IRR. The Circular also covers personal data under the control or custody of a private entity that is being shared with or transferred to a government agency.5 Regarding DSAs, it provides that, notwithstanding the DSA requirement, nothing in the issuance “shall be construed as prohibiting or limiting the sharing or transfer of any personal data that is already authorized or required by law”.6 Thus, if the transfer or sharing of personal data by a private sector entity to a government agency is required by a statute or is pursuant to one, there is no need for a DSA between the parties.
Data Protection Officer (DPO)
Data Protection Officer designation and appointment are governed by applicable DPA and IRR provisions. An entity must appoint a Data Protection Officer as required by law and ensure proper designation and oversight of duties and responsibilities in accordance with the regulatory framework.
For your reference.
Sincerely,
[Signature block not included in advisory opinion body]