Text
29 August 2017
Re: SUBMISSION OF CREDIT INFORMATION BY COOPERATIVES TO THE CREDIT INFORMATION CORPORATION (CIC)
Dear [Redacted],
This pertains to your letter request for advisory opinion received by the National Privacy Commission (NPC) on 1 August 2017. Specifically, you require an opinion regarding the application of existing rules on data sharing as provided under the Implementing Rules and Regulations (IRR) of Republic Act (RA) No. 10173 and NPC Circular No. 16-02, in relation to the submission of credit information of borrowers to the CIC.
You cited CIC Circular No. 2015-01, 2015-02, and 2016-04 requiring such submission, setting the deadline for the same, and the extension thereof, respectively. We understand that the CEDC has already complied with the CIC requirement.
Submission of Credit Data to the Credit Information Corporation (CIC)
Republic Act (RA) No. 95101, otherwise known as the Credit Information System Act (CISA), was enacted to establish a comprehensive and centralized credit information system, particularly for the improved efficiency of financial institutions.2
The CISA deals with the collection and dissemination of information to, or arising from, credit and credit-related activities of all entities participating in the financial system.3 Specifically, the entities comprising the financial system include banks, quasi-banks, their subsidiaries and affiliates, life insurance companies, credit card companies, and other entities that provide credit facilities.4
To administer and implement the Act, the Credit Information Corporation (CIC) was created “to receive and consolidate basic credit data5, act as a central registry or central repository of credit information, and to provide access to reliable, standardized information or credit history and financial condition of borrowers.”6
On 15 May 2015, the CIC issued Circular No. 2015-01 enforcing the CISA and its IRR, listing down the entities within the scope of the law, the obligations of submitting entities, among others.
On 28 September 2015, the CIC issued Circular No. 2015-02 requiring the submission of credit data and technical requirements for several entities, including large and medium cooperatives. Large cooperatives as defined by the Cooperative Development Authority (CDA) were given until 30 October 2016 to submit. This deadline was extended to 30 June 2017.7
Scope of the Data Privacy Act of 2012
The DPA provides for a list of specified information that are not covered by the law. Section 5 of the IRR8 provides for the special cases wherein the law and the rules are not applicable, specifically Section 5(d) and (e):
“Section 5. Special Cases. The Act and these Rules shall not apply to the following specified information, only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned:
xxx xxx xxx
d. Information necessary in order to carry out the functions of public authority, in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function, including the performance of the functions of the independent, central monetary authority, subject to restrictions provided by law. Nothing in this Act shall be construed as having amended or repealed Republic Act No. 1405, otherwise known as the Secrecy of Bank Deposits Act; Republic Act No. 6426, otherwise known as the Foreign Currency Deposit Act; and Republic Act No. 9510, otherwise known as the Credit Information System Act (CISA);
e. Information necessary for banks, other financial institutions under the jurisdiction of the independent, central monetary authority or Bangko Sentral ng Pilipinas, and other bodies authorized by law, to the extent necessary to comply with Republic Act No. 9510 (CISA), Republic Act No. 9160, as amended, otherwise known as the Anti-Money Laundering Act, and other applicable laws;
Provided, that the non-applicability of the Act or these Rules do not extend to personal information controllers or personal information processors, who remain subject to the requirements of implementing security measures for personal data protection: Provided further, that the processing of the information provided in the preceding paragraphs shall be exempted from the requirements of the Act only to the minimum extent necessary to achieve the specific purpose, function, or activity.” (Underscoring supplied).
From the provisions above, it is apparent that the exemptions from the coverage of the law, the IRR and NPC issuances are those information being collected pursuant to the laws enumerated, including the CISA.
We reiterate that the exemption is not an exemption on the entity or agency but on the type of information processed. Also, this exemption is not a blanket exemption but only to the minimum extent necessary to achieve the specific purpose, function or activity.9
The exemption particularly pertains to information necessary in carrying out the functions of the CIC, in accordance to its regulatory mandate under the law creating it, as well as information necessary to comply with the CISA.
The CIC, as a personal information controller, is covered by the DPA’s requirement for implementing security measures for personal data protection. It is required to implement the appropriate and reasonable organizational, physical and technical security measures to protect the data it has collected from the submitting entities.
Data Sharing
Section 20(a) of the IRR of the DPA provides that data sharing shall be allowed when it is expressly authorized by law and that there are adequate safeguards for data privacy and security, and processing adheres to principle of transparency, legitimate purpose and proportionality.
The CISA which requires the submission of credit data was not amended by the DPA. Compliance to the said law should not be hampered by the DPA. Submitting entities, such as cooperatives, are obligated to inform its borrowers in writing of its obligation to submit basic credit data and other credit information to the CIC.10
When the reporting requirements is specifically provided by law, which does not require consent from data subjects, a Data Sharing Agreement (DSA) is not necessary. The CISA, its IRR and issuances of the CIC may serve as guidance for the CIC and the CEDC. But this does not preclude the parties to execute a separate DSA should they wish to do so, taking into consideration the provisions of the IRR and NPC Circular No. 2016-02.
This opinion is without prejudice to a further review of Republic Act No. 9510 (CISA) and related issuances.
For your reference.
Very truly yours,
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
cc: MR. JAIME CASTO JOSE P. GARCHITORENA
President
Credit Information System
6F Exchange Corner Building
107 VA Rufino corner Esteban St.,
Legaspi Village, Makati City 1229
Footnotes
-
AN ACT ESTABLISHING THE CREDIT INFORMATION SYSTEM AND FOR OTHER PURPOSES, “Credit Information System Act” (31 October 2008) ↩
-
Id., §2 ↩
-
Id., §2 ↩
-
Id., §4(a). ↩
-
Supra note 1, §3(b) “Basic Credit Data” refers to positive and negative information provided by a borrower to a submitting entity in connection with the application for and availment of a credit facility and any information on the borrower’s creditworthiness in the possession of the submitting entity and other factual and objective information related or relevant thereto in the submitting entity’s data files or that of other sources of information: Provided, that in the absence of a written waiver duly accomplished by the borrower, basic credit data shall exclude confidential information on bank deposits and/or clients funds under Republic Act No. 1405 (Law on Secrecy of Bank Deposits), Republic Act No. 6426 (The Foreign Currency Deposit Act), Republic Act No. 8791 (The General Banking Law of 2000), Republic Act No. 9160 (Anti-Money Laundering Law) and their amendatory laws. ↩
-
Id. §5. ↩
-
CIC Circular No. 2016-04, series of 2016 ↩
-
Implementing Rules and Regulations of Republic Act No. 10173, known as the “Data Privacy Act of 2012” (24 August 2016). ↩
-
Id. §5. ↩
-
CIC Circular No. 2015-01, §4.1 ↩