Text
13 March 2017
Re: DATA SHARING AND DATA SHARING AGREEMENTS
Dear [Redacted],
This pertains to your inquiry received by the National Privacy Commission (NPC) on 3 November 2016, via email, relative to certain provisions of the Data Privacy Act of 2012 (DPA) and its Implementing Rules and Regulations (IRR) vis-à-vis data sharing agreements between private entities. Please find below your queries, with their corresponding answers:
1. Does data sharing, as defined in the IRR, also include the disclosure or transfer of personal information between 2 personal information controllers (PICs) such that the transferee PIC is considered a “third party” under the definition of “data sharing”?
Data sharing is the disclosure or transfer to a third party of personal data under the control and custody of a PIC or personal information processor (PIP). In the case of the latter, such disclosure must be upon the instructions of the PIC concerned.1 The term excludes outsourcing or subcontracting, which concerns the disclosure or transfer of personal data by a PIC to a PIP.2
By its very definition, a data sharing agreement can only be executed between or among PICs, as opposed to outsourcing, which is entered into by a PIC and a PIP.
2. In a situation where both PICs that share data have registered data processing systems (thereby ensuring that the data privacy principles are upheld on both ends of the information transfer chain), would a data sharing agreement contemplated by the DPA IRR still be required?
The obligation of a PIC to enter into a data sharing agreement, when required to do so by the IRR and any subsequent issuance by the NPC, is separate and distinct from the obligation of a PIC or PIP to register a data processing system.
Thus, even if both PICs engaged in a data sharing arrangement have registered their respective data processing systems with the Commission, they are still mandated to enter into a data sharing agreement, in accordance with the IRR and any other criteria set by the NPC.
3. Does the NPC foresee issuing a subsequent Memorandum Circular (MC) where the rules on data sharing will be clarified including provisions on when data sharing agreements should be in place?
The NPC is actively working towards developing new policies aimed at ensuring the effective implementation of the DPA and its IRR. They include a separate circular providing further guidance on data sharing arrangements between private parties. In the interim, such arrangements shall be governed by the provisions of the IRR.3
For reference purposes, there is also NPC Circular No. 16-02, dated 10 October 2016, which concerns data sharing that involving government agencies. That Circular also covers personal data under the control or custody of a private entity that is being shared with or transferred to a government agency.4
4. Are private entities engaged in data sharing now required to enter into data sharing agreements? Or should private entities wait for an MC on data sharing for private entities?
Private entities currently engaged in data sharing are required to enter into data sharing agreements in accordance with the provisions of the IRR, particularly Section 20 thereof, even sans an NPC Circular on the matter. Any relevant subsequent issuance by the NPC shall only serve to complement the requirements already established in the IRR.
The one-year period given in the second paragraph of Section 67 of the IRR, including the possible extension thereof, pertain to the requirement for registration of data processing systems, and of automated processing operations. Thus, PICs and PIPs are already mandated to comply with the other requirements of the DPA and its IRR as soon as both policies became effective.
For your reference.
Sincerely,
[Signature block not included in advisory opinion body]
Footnotes
-
Id. ↩
-
NPC Circular No. 16-02, §2. ↩