Text
16 August 2017
Re: ISSUES CONCERNING PERSONAL INFORMATION
OBTAINED FROM FOREIGN JURISDICTIONS UNDER
IMPLEMENTING RULES AND REGULATIONS OF REPUBLIC ACT NO. 10173
Dear [Redacted],
This pertains to your request for advisory opinion dated 24 July 2017, received by the Policy Development Division of the National Privacy Commission (NPC) on 31 July 2017, which sought to clarify whether business processing companies are exempt from the requirements of Republic Act No. 101731, also known as the Data Privacy Act of 2012 (DPA), provided such processing is done in accordance with foreign privacy laws, pursuant to Section 5(f) of the Implementing Rules and Regulations of the DPA.
A government agency or a private company involved in the processing of personal data, as a general rule, shall be within the scope of the Data Privacy Act, subject to provisions of the law on extraterritorial application. Business processing outsourcing companies (BPOs), by the very nature of their operations, process volumes of personal data as a core activity. In your letter-request, you have listed and discussed privacy laws of different jurisdictions from which you have been collecting personal information of clients. In order to fully address your concerns, we request for the following additional information:
-
A close estimate of the percentage of records being processed by BPOs involving personal information originally collected from residents of foreign jurisdictions;
-
A copy of an outsourcing contract between a BPO and company located abroad, (for this submission, the names and other sensitive information, may be redacted);
-
Information, if any, on whether the laws of foreign jurisdictions you have cited, and other relevant international instruments, allow for joint investigations between Data Protection Authorities and coordination for global enforcement.
We understand that the BPO industry in the country is a critical sector, considered a “sunshine industry”, and lauded for its contributions to the economy. The sector has received support from the government, from incentives to attract foreign investments to the enactment of the Data Privacy Act, a law primarily intended to support BPOs. We shall take these into consideration, and other information you will provide, in addressing your concerns. The National Privacy Commission shall also remain mindful that while the Data Privacy Act is often seen as legislation for strengthening of the Philippine economy, at its core, it is a law that is intended for the protection of a fundamental human right—the right to privacy, and specifically the right to information privacy.
We look forward to receiving the additional information from you, and welcome the opportunity to clarify issues relevant to the Business Process Outsourcing Sector.
For your reference.
Very truly yours,
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
AN ACT PROTECTING INDIVIDUAL PERSONAL INFORMATION IN INFORMATION AND COMMUNICATIONS SYSTEMS IN THE GOVERNMENT AND THE PRIVATE SECTOR, CREATING FOR THIS PURPOSE A NATIONAL PRIVACY COMMISSION, AND FOR OTHER PURPOSES, “Data Privacy Act of 2012” (15 August 2012). ↩