Text
25 July 2017
Re: LAWFUL PROCESSING OF PERSONAL INFORMATION
Dear [Redacted],
This is with regard to your query received by the National Privacy Commission (NPC) regarding lawful processing of personal information under the Data Privacy Act of 2012 (DPA) and its Implementing Rules and Regulation (IRR).
Specifically, you are asking guidance on whether it is common practice for personal information controllers (PIC) to rely on Section 12(b) of the Data Privacy Act of 2012 and Section 21(b) of its IRR on instances of lawful processing of personal information in relation to a fulfillment of a contract and if there are any particular considerations a PIC should keep in mind to be able to rely on such provision.
This particular provision states that processing of personal information is allowed when the processing is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract.
At the outset, please note that the Commission may not be able to say or determine if it is common practice for PICs to invoke or rely on the said provision to justify their processing of personal information since the Act and its IRR do not require PICs to furnish the Commission with a justification or explanation of whether or not they are lawfully processing personal information and on what grounds. Nevertheless, since such criteria is specifically provided for in the law, it can be invoked and relied on by PICs as basis for lawfully processing personal information. It should be noted that each of the criteria stated in the DPA provides an equally valid basis for processing personal information.
With regard to particular considerations, assuming that you are asking whether this provision applies to certain contracts only, please note that the contractual agreement contemplated in the Act refers to any contract as defined by the New Civil Code. An example of where this provision may be applied is when an employer processes the personal information of an employee as a consequence of their employer-employee relationship or in contemplation of entering into one. Another example is processing of personal information in relation to services requested by a data subject-depositor from a bank, among others.
Please note, however, that this criteria only applies to processing of personal information and not to sensitive personal information. As a general rule, processing of sensitive personal information is prohibited unless it falls under any of the processing allowed by law.1 Processing in relation to a fulfillment of a contract between the PIC/PIP and the data subject is not included.
For your reference.
Very truly yours,
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
See: RA No. 10173, §13. ↩