Text
28 June 2017
Re: PROCESSING OF SENSITIVE PERSONAL INFORMATION IN FINANCIAL TRANSACTIONS AND CREDIT CARD APPLICATIONS
Dear [Redacted],
Discussion
This pertains to your query received by the National Privacy Commission (NPC) on 29 May 2017 regarding the processing of sensitive personal information in financial transactions and credit card applications. You specifically inquire about the lawfulness of processing financial information, biometric data, and health information in these contexts.
The Data Privacy Act of 2012 (DPA) protects all forms of personal information, including sensitive personal information. Sensitive personal information refers to personal information regarding an individual’s physical health, mental health, genetic information, or any information concerning an individual’s race, ethnic origin, marital status, age, color, religious, philosophical or political affiliations, and other matters of similar nature.
Financial and credit institutions are personal information controllers covered by the DPA and must ensure compliance with all applicable data privacy requirements when processing personal information, including sensitive personal information.
The processing of sensitive personal information is generally prohibited unless one of the exceptions under Section 13 of the DPA applies. These exceptions include:
- When the data subject has given consent, specific to the purpose;
- When the processing is provided for by existing laws and regulations with adequate safeguards;
- When processing is necessary to protect the life and health of the data subject;
- When processing is necessary for the objectives of public organizations;
- When processing is necessary for medical treatment by qualified practitioners;
- When processing concerns information necessary for the protection of lawful rights and interests in legal proceedings or the establishment and defense of legal claims.
Financial institutions must obtain appropriate consent from data subjects before processing sensitive personal information and must implement adequate safeguards for its protection.
For sensitive personal information such as health data used in credit assessments, financial institutions must ensure that processing is limited to the minimum necessary for the stated purpose and that data subjects are informed of such processing.
For your reference.
Very truly yours,
IVY D. PATDU Officer-in-Charge and Deputy Privacy Commissioner for Policies and Planning