NPC Issuance Wiki

NPC Advisory Opinion No. 2017-068 — Data Privacy Act and Its Implementing Rules and Regulations

Issued Advisory Opinion

Text

22 November 2017

Re: DATA PRIVACY ACT AND ITS IMPLEMENTING RULES AND REGULATIONS

Dear [Redacted],

This pertains to your request for advisory opinion received by the National Privacy Commission (NPC) on 14 September 2017, which sought to clarify matters regarding Republic Act No. 10173,1 also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR)2 and relevant issuances, and particularly respond to the following questions:

  1. Based on the definition of personal information, does it follow that an address or a mobile number are personal information because if combined with a name of a resident/user, the individual is already identified?
  2. Assuming that a mobile number alone constitutes personal information, do we make a distinction between a prepaid line vis-à-vis a postpaid line considering that a postpaid line has a registered user with the telco?; and
  3. Would it be sufficient to describe (e.g. electric company, telecommunication provider, money remittance center) the intended recipients of personal information as compared to specifically naming the intended recipients when obtaining the consent of the data subject?

Discussion

Personal Information

The law has defined personal information to be any information from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding information, or when put together with other information would directly and certainly identify an individual.3

Consequently, the address or the mobile number of an individual are considered as personal information because when these are combined with other information, the same would identify such person.

Mobile Number

A postpaid number is certainly considered as personal information given that the telecommunications companies assign a specific number to an individual subscriber in such a manner that no two individuals will have the same postpaid number at the same time.

On the other hand, a prepaid number standing alone may not yet be considered as personal information. However, once the said prepaid number is activated and associated/linked to an individual subscriber, i.e. through the use of the mobile number for various registrations, availment of products or services, etc., then the same is already considered as personal information. Other factors that may also be considered to determine whether a prepaid number shall be considered personal information, include the identity of the holder of information, and what data is reasonably available to the said holder, or any existing recordings on registered systems.

We understand that Home Credit Philippines (Home Credit) provides non-cash consumer loans through in-store financing for purchasing cellphones, computers, tablets, laptops, home appliances and musical instruments,4 and for this purpose, conducts credit verification. You inquire if it is sufficient to just describe the parties to whom Home Credit will verify information (i.e., electric company, telecommunication provider, money remittance center) instead of specifically naming such parties in the consent form to be signed by data subjects.

We agree that an exhaustive listing of specific entities may not be necessary for as long as the data subject is sufficiently informed of the nature and extent of processing of his or her data for availing of the loan, which includes the fact that Home Credit will conduct credit verification from certain third-party entities.

However, it is stated in the inquiry as an example that Home Credit conducts this credit verification by asking “utility companies to provide us information whether the client has late payments, disconnections, etc.” With this, it may likewise be incumbent upon these third-party entities to secure consent from the data subjects and inform them that their personal data is shared for credit verification purposes, given that a utility company’s primary purpose for processing personal data does not include processing for credit purposes.

We reiterate the requirement to uphold the rights of the data subject to be informed and notified of the processing activities done to his personal data,5 as well as the right to object to the processing of his or her personal data and the opportunity to withhold consent to the processing in case of changes or any amendment to the information supplied or declared to the data subject.6

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. AN ACT PROTECTING INDIVIDUAL PERSONAL INFORMATION IN INFORMATION AND COMMUNICATIONS SYSTEMS IN THE GOVERNMENT AND THE PRIVATE SECTOR, CREATING FOR THIS PURPOSE A NATIONAL PRIVACY COMMISSION, AND FOR OTHER PURPOSES, “Data Privacy Act of 2012” (15 August 2012). ↩

  2. Implementing Rules and Regulations of the Data Privacy Act (24 August 2016). ↩

  3. Supra note 1, §3(g). ↩

  4. Home Credit Philippines. Frequently Asked Questions. https://www.homecredit.ph/all-about-loans/frequently-asked-questions/. last visited: 13 October 2017. ↩

  5. Supra note 1, §16. ↩

  6. Implementing Rules and Regulations of RA No. 10173, §34(b). ↩

Backlinks