NPC Issuance Wiki

NPC Advisory Opinion No. 2017-057 — Consent for Data Sharing and Outsourcing Agreements

Issued Advisory Opinion

Text

03 October 2017

Re: CONSENT FOR DATA SHARING AND OUTSOURCING AGREEMENTS

Dear [Redacted],

This pertains to your request for advisory opinion received by the National Privacy Commission (NPC) on 16 August 2017, which sought to clarify matters regarding Republic Act No. 101731, also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR)2 and relevant issuances, and particularly respond to the following questions:

  1. Whether the personal information controller (PIC) is required to obtain the data subject’s consent before entering into an outsourcing agreement with a personal information processor (PIP); and
  2. Whether outsourcing agreements should also comply with the conditions outlined in Rule IV, Section 20(b) for data sharing.

First, it is important to take note of the difference between a data sharing agreement and an outsourcing agreement. As defined in the IRR, data sharing pertains to the disclosure or transfer to a third party of personal data under the custody of a PIC or a PIP wherein such transfer was directly instructed by the PIC.3

The data sharing agreement then refers to the contract which contains the terms and conditions of a data sharing arrangement between two or more PICs.4 Despite sharing directly by the PIP, the party to the agreement will be the PIC, and not the PIP. Every data sharing agreement must comply with the conditions set forth in Section 20(b) of the IRR, as well as those indicated in NPC Circular 16-02 where the sharing arrangement involves the government.

On the other hand, an outsourcing agreement pertains to the disclosure or transfer of personal data by the PIC to a PIP in order for the latter to perform the particular activities outsourced by the former.5 Outsourcing or subcontracting agreements must then comply with Section 44 of the IRR.

In your email, you inquired about consent for outsourcing agreements because the definition of data sharing excludes outsourcing.

Indeed, data sharing excludes outsourcing because the purpose of the transfer is different. PICs share personal information to fulfill specific objectives such as a public function or a public service for government,6 and commercial purposes for the private sector.7 Data sharing agreements also limit the types of data to be shared and the duration of the sharing.8

The main purpose of an outsourcing agreement is to put into writing the terms and conditions of the processing9 activities to be performed by the PIP for and in behalf of the PIC. The PIP does not have its own purpose for processing, but merely carries out the instructions given by the PIC. It cannot share, amend or further process personal data, outside the bounds of the contract. Likewise, the PIP shall not store the information beyond the term of their agreement or upon fulfillment of the objectives of the PIC.

Hence, whether processing is based on consent, law, or some other criteria for lawful processing, the PIC is not required to obtain a separate consent from the data subject before entering into an outsourcing agreement as the purpose of the processing remains to be the same and the PIC remains to be the same.

This is different in the case of a data sharing agreement as there will be two (or more) PICs which shall have separate and distinct purposes for processing personal data, to which the data subject must provide his consent to.

Given that the data subject has the right to be informed and notified of the processing activities done to his personal data, the PIC must indicate in the privacy notice or privacy statement that particular data processing activities are outsourced in order to deliver their services effectively and efficiently.

Consequently, outsourcing agreements need not comply with the requirements for data sharing, but must ensure its compliance with Section 44, in relation to Sections 43 and 45 of the IRR.

For your reference.

Very truly yours,

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. AN ACT PROTECTING INDIVIDUAL PERSONAL INFORMATION IN INFORMATION AND COMMUNICATIONS SYSTEMS IN THE GOVERNMENT AND THE PRIVATE SECTOR, CREATING FOR THIS PURPOSE A NATIONAL PRIVACY COMMISSION, AND FOR OTHER PURPOSES, “Data Privacy Act of 2012” (15 August 2012). ↩

  2. Implementing Rules and Regulations of the Data Privacy Act (24 August 2016). ↩

  3. Id., §3(f). ↩

  4. NPC Circular 16-02: Data Sharing Agreements Involving Government Agencies (10 October 2016), §3(e). ↩

  5. Supra note 3. ↩

  6. Supra note 4, §6(a). ↩

  7. Supra note 3, §20(b). ↩

  8. Supra note 4, §6(b)&(c). ↩

  9. IRR of RA No. 10173, §3(o) “Processing” refers to any operation or any set of operations performed upon personal data including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data. Processing may be performed through automated means, or manual processing, if the personal data are contained or are intended to be contained in a filing system. ↩

Backlinks