Text
16 March 2017
Re: SUBCONTRACTING OR OUTSOURCING OF THE PROCESSING OF PERSONAL DATA
Dear [Redacted],
This pertains to your query received by the National Privacy Commission (NPC) on 10 February 2017. Specifically, you inquired whether the disclosure by the Social Security System (SSS) of sensitive personal information of some of its members to certain banks would violate Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA). The members consist of those that have obtained loans from the SSS, while the banks are accredited collection agents of the SSS. You also mentioned that the members would be informed of such transfer, thereby directing them to the bank they shall make their loan payments.
Based on the facts, the SSS is proposing to outsource or subcontract the specific personal data processing operation of loan or debt collection. Such a step is allowed under the DPA and its Implementing Rules and Regulations (IRR), provided that is carried out in accordance with their provisions.
It is worth stressing here that the concept of outsourcing or subcontracting is recognized under the law, and is deemed integral to any given data privacy or data protection framework. This much is evident from the use and distinction made in the DPA between the concepts of “personal information controller”1 or “PIC” on the one hand, and “personal information processor”2 or “PIP” on the other. By their respective definitions, it is easy to discern that the law considers the PIC as an outsourcing entity or principal, the PIP as the “outsourcee” or subcontractor, and their relationship or those transactions between them as regular occurrences or part of the norm, in today’s globalized context.
In the case presented by the query, SSS is the PIC while the accredited banks function as PIPs.
In the DPA, the primary reference for the subcontracting or outsourcing of the processing of personal data is Section 14:
Subcontract of Personal Information. – A personal information controller may subcontract the processing of personal information: Provided, That the personal information controller shall be responsible for ensuring that proper safeguards are in place to ensure the confidentiality of the personal information processed, prevent its use for unauthorized purposes, and generally, comply with the requirements of this Act and other laws for processing of personal information. The personal information processor shall comply with all the requirements of this Act and other applicable laws.
This provision is essentially echoed by Section 43 of the IRR,3 although the latter elaborates on the subject by outlining the particulars of a typical subcontracting or outsourcing agreement in the next following provision:
Section 44. Agreements for Outsourcing. Processing by a personal information processor shall be governed by a contract or other legal act that binds the personal information processor to the personal information controller.
a. The contract or legal act shall set out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, the obligations and rights of the personal information controller, and the geographic location of the processing under the subcontracting agreement.
b. The contract or other legal act shall stipulate, in particular, that the personal information processor shall:
Process the personal data only upon the documented instructions of the personal information controller, including transfers of personal data to another country or an international organization, unless such transfer is authorized by law;
Ensure that an obligation of confidentiality is imposed on persons authorized to process the personal data;
Implement appropriate security measures and comply with the Act, these Rules, and other issuances of the Commission;
Not engage another processor without prior instruction from the personal information controller: Provided, that any such arrangement shall ensure that the same obligations for data protection under the contract or legal act are implemented, taking into account the nature of the processing;
Assist the personal information controller, by appropriate technical and organizational measures and to the extent possible, fulfill the obligation to respond to requests by data subjects relative to the exercise of their rights;
Assist the personal information controller in ensuring compliance with the Act, these Rules, other relevant laws, and other issuances of the Commission, taking into account the nature of processing and the information available to the personal information processor;
At the choice of the personal information controller, delete or return all personal data to the personal information controller after the end of the provision of services relating to the processing: Provided, that this obligation shall not apply where retention of the personal data is required by law.
These detailed provisions lay bare the solemn responsibility that the law thrusts upon the PIC in the event of any outsourcing or subcontracting arrangement. It underscores the very nature of the PIC as the party ultimately accountable for the personal data in its custody, even if the actual processing thereof is done by another party, i.e., the PIP.
The outsourcing of the loan or debt collection function by the SSS to accredited banks, as described in your query, is thus allowed. However, SSS must ensure that the requirements as laid out in the DPA and its IRR are complied with. These include the execution of appropriate agreements with the banks and the implementation of necessary safeguards.
For your reference.
Sincerely,
[Signature block not included in advisory opinion body]
Footnotes
-
Id., §3(i). ↩