Text
16 November 2017
Re: COMPLIANCE OBLIGATIONS OF BROKERS AND DEALERS UNDER THE DATA PRIVACY ACT OF 2012
Dear [Redacted],
This pertains to your letter received by the National Privacy Commission (the Commission) on 6 February 2017, via email. You requested for guidance from the Commission on the obligations of stockbrokers under the Data Privacy Act (DPA) and its Implementing Rules and Regulations (IRR).
You have enumerated several provisions of the 2015 Securities Regulation Code (SRC) IRR which in your opinion are violative of the DPA. These provisions pertain to the requirement to submit certain client information to the SEC as well as the requirement to provide SEC with direct access to the brokers’ respective databases and back office records. We noted that there is a statement in the letter that there is a pending case in court involving the enumerated provisions.
You likewise stated that in view of the said requirements, the most prudent course of action is securing your clients’ consent, and you seek advise on how specific the statement of the purpose should be when obtaining consent.
Scope of the DPA
The DPA has the twin task of protecting the fundamental human right of privacy of communication while ensuring free flow of information to promote innovation and growth.1 There is no absolute prohibition in the processing of personal and sensitive personal information as the law provides for certain criteria for lawful processing. The general rule is that processing should adhere to the principles of transparency, legitimate purpose and proportionality.2
One of the exceptions to the scope of the law is information necessary in order to carry out the functions of public authority which includes the processing of personal data for the performance by regulatory agencies of their constitutionally and statutorily mandated functions.3
Thus, it is with more reason that the DPA and its IRR cannot be invoked to refuse compliance with the SEC’s requirements under the 2015 SRC IRR.
We understand that it is the SEC’s mandate to administer the SRC, and it is given powers and functions relative to the said mandate, i.e. formulate policies and recommendations on issues concerning the securities market.4
But while the said information is included in the exceptions to the law, the same is not absolute. The non-applicability of the DPA and its IRR do not extend to personal information controllers or personal information processors, who remain subject to the requirements of implementing security measures for personal data protection.5 The processing of the information shall be exempted from the requirements of the DPA only to the minimum extent necessary to achieve the specific purpose, function, or activity.6
Thus, when brokers submit the personal and sensitive personal information to the SEC in compliance with the SRC IRR, the SEC, as the personal information controller, is mandated to comply with the provisions of the DPA, its IRR, and related issuances of the Commission.
Lawful Processing of Personal and Sensitive Personal Information Vis-à-vis Consent
Under the DPA, the processing of personal information is only allowed when it complies with the requirements of the Act and other laws that allow the disclosure of information to the public, and when it adheres to the principles of transparency, legitimate purpose and proportionality.7
Sections 12 and 13 of the DPA provide for the criteria for lawful processing of personal and sensitive personal information, to wit:
SECTION 12. Criteria for Lawful Processing of Personal Information. — The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:
(a) The data subject has given his or her consent;
(b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract;
(c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;
(d) The processing is necessary to protect vitally important interests of the data subject, including life and health;
(e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or
(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.SECTION 13. Sensitive Personal Information and Privileged Information. — The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:
(a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing;
(b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;
(c) The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing;
(d) The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, That such processing is only confined and related to the bona fide members of these organizations or their associations: Provided, further, That the sensitive personal information are not transferred to third parties: Provided, finally, That consent of the data subject was obtained prior to processing;
(e) The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured; or
(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority. (Underscoring supplied)
From the foregoing, lawful processing is not always anchored on the presence of consent as there are other criteria which may be invoked by the personal information controller.
Where consent is required, or where the PIC determines that obtaining consent is best course of action, it must be freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of his or her personal, sensitive personal, or privileged information.8
The example given in your letter as to the statement of the purpose of processing, i.e. “may be disclosed to the SEC in the future for the purpose of investigating a possible violation of the Securities Regulation Code, for surveillance, in the course of an official inquiry, or in compliance with other pertinent laws”, may already be sufficient in order to inform your clients and for them to give their consent to the same.
We note that this statement may be included in the Client Agreement together with the provisions on confidentiality and exceptions thereto.
If the SEC uses the submitted information for some other purpose, it is the onus of the SEC to determine if the processing will fall under any of the criteria for lawful processing and that said processing adheres to the data privacy principles.
For your reference.
Very truly yours,
(Sgd). RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
RA No. 8799 – SRC, §5(b) ↩
-
IRR of RA No. 10173, §5, last paragraph ↩
-
Id. ↩