Text
13 September 2017
Re: RIGHT OF ONLINE MERCHANTS TO SAVE CREDIT CARD DETAILS OF CUSTOMERS
Dear [Redacted],
This has reference to your inquiry to the Consumer Protection and Advocacy Bureau of the Department of Trade and Industry (DTI-CPAB) on 26 May 2017, via e-mail. You sought their assistance regarding an alleged unauthorized transaction on MetroDeal1 involving your credit card and the Metrodeal account of your officemate, [Redacted].
From the limited information provided in the email thread attached to the DTI-CPAB Endorsement, we understand that your BPI credit card was allegedly charged for a transaction through the MetroDeal account of your officemate, [Redacted].
You mentioned in the email dated 26 May 2017 to support@metrodeal.com that the 4 May 2017 transaction was unauthorized as there was no one-time-pin (OTP) used and that [Redacted] did not receive any email order acknowledgement/confirmation for the transaction.
In view of the foregoing, you specifically asked if online merchants such as MetroDeal have the right to save the credit card details of their customers. The matter was referred to the National Privacy Commission (NPC) by the DTI-CPAB on 6 July 2017.
Criteria for Lawful Processing of Personal and Sensitive Personal Information
Online merchants, including MetroDeal, as personal information controllers2 under the Data Privacy Act of 2012 (DPA), may save the credit card details and other personal information of their customers pursuant to the various criteria for lawful processing of personal as well as sensitive personal information under Sections 12 and 13 of the DPA, specifically the following provisions:
SECTION 12. Criteria for Lawful Processing of Personal Information. — The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:
a) The data subject has given his or her consent;
b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract;
…
f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.
SECTION 13. Sensitive Personal Information and Privileged Information. — The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:
a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing; …
Ordinarily, when the customer engages in certain activities on the MetroDeal website such as ordering a product or service from its partners, filling out a survey, posting a review, and submitting content and/or posting content in discussion forums, among others, the website may ask for certain information about him or her, some of which are mandatory, and some are voluntary.3 Personal data that is not sensitive in nature may be processed without express consent of clients if the processing, including retention of personal data, is necessary and is related to the fulfillment of a contract with the data subject, or for purpose of legitimate interests of MetroDeal.
MetroDeal may save credit card details of its customers for as long as necessary for the fulfillment of the purposes for which data was obtained. The Data Privacy Act provides that:
Personal information must be retained only for as long as necessary for the fulfillment of the purposes for which the data was obtained or for the establishment, exercise or defense of legal claims, or for legitimate business purposes, or as provided by law.4
This would mean that the credit details should be saved primarily for purpose of completing the particular transaction for which they were given. As a general rule, consent of the client is required where the purpose of processing, including retention, is no longer directly related and compatible with the primary purpose of collection. Storing these details longer, such as for instance, for purpose of facilitating future transactions or for convenience of clients, requires consent. Without consent, the company should be able to demonstrate the basis for its retention periods, particularly whether the same would be related to the fulfillment of a contract with the data subject or for legitimate business purpose.
When processing personal information without express consent of the data subject, it is still necessary that adequate information about the nature and extent of processing is provided to the data subject. The company’s privacy policy should provide information on the processing in a clear and understandable way. Data subjects should be provided information on the following, which may be clearly laid out in the company’s privacy notice or policy:
(1) Description of the personal information to be entered into the system;
(2) Purposes for which they are being or are to be processed;
(3) Scope and method of the personal information processing;
(4) The recipients or classes of recipients to whom they are or may be disclosed;
(5) Methods utilized for automated access, if the same is allowed by the data subject, and the extent to which such access is authorized;
(6) The identity and contact details of the personal information controller or its representative;
(7) The period for which the information will be stored; and
(8) The existence of their rights, i.e., to access, correction, as well as the right to lodge a complaint before the Commission.
We emphasize that the data subject also has the right to “suspend, withdraw, or order the blocking, removal or destruction of his or her personal information from the personal information controller’s filing system upon discovery and substantial proof that the personal information are incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes or are no longer necessary for the purposes for which they were collected.”5
In saving credit card details of its customers, it is not sufficient to have legal basis for the storage. It is equally important to ensure implementation of appropriate security measures for personal data protection, to prevent accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.
Online merchants, including MetroDeal, may process personal data of their customers, including retaining credit card details of their customers, taking into account the following:
(1) Retention of personal data should be only to the extent required for the fulfillment of the purposes for which the data was obtained, unless data subjects consent to allow longer retention periods;
(2) Data subjects or the clients should be adequately informed of the nature and extent of the processing of their personal data; and
(3) Security measures for the protection of personal data should be implemented.
The opinion provided herein is based on the limited information provided and is not intended to address other issues which are not subject of the inquiry.
For your reference.
Very truly yours,
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
cc: ASSISTANT DIRECTOR LILIAN G. SALONGA
Officer-in-Charge
Consumer Protection and Advocacy Bureau
cpab-cpad@dti.gov.ph
Footnotes
-
RA No. 10173, §3(h) - Personal information controller refers to a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf. ↩
-
See Privacy Policy, Item No. 2; available at: http://www.metrodeal.com/privacy-policy ↩