Text
27 December 2017
RE: REQUEST FOR ADVISORY OPINION
NEW CROSS GATE PHILIPPINES, INC.
Dear [Redacted],
This pertains to your request for advisory opinion on behalf of your client, New Cross Gate Philippines, Inc. (New Cross), received by the National Privacy Commission (NPC) on 03 October 2017.
We understand that New Cross operates an online platform called Uploan (https://www.uploan.ph/) which offers salary loans in the Philippines. Only salaried individuals of employers accredited by New Cross may be eligible for applying for a loan.
New Cross, through Uploan, forms a partnership with Philippine employers to reduce the financial hardship of their employees.1 The accredited employer agrees to partner with New Cross to deduct the loan repayment from the employee payroll.2 New Cross requires the accredited employers to submit personal information of its employees availing of a loan (Borrowers). The collection of information is authorized by the Borrowers themselves via contract.
As to the loan process, we understand that Uploan platform works by requiring the Borrowers to create an Uploan wallet. They may choose the loan amount, purpose of the loan and post a loan listing. If the loan is approved, the funds are disbursed to the Borrower’s Uploan wallet, and Uploan collects the payment of the loan through payroll deductions done by the accredited employer.
The personal information gathered includes personal identification information such as SSS and UMID ID as well as the Tax Identification Number (TIN), among others. In view of the foregoing, you seek NPC’s opinion with regards to the method of data collection being used by New Cross about the Borrowers, whereby these are collected from the Borrower’s employers rather than from the Borrower himself.
Processing of sensitive personal information
The SSS number, as well as the UMID ID number and the TIN of the Borrower are considered as sensitive personal information (SPI) as these are government-issued identification numbers peculiar to an individual.3 Due to their nature as SPI, stricter security measures must be implemented by the personal information controller (PIC) in order to ensure the protection of such information.
To clarify, the PIC is New Cross and not Uploan. Based on the description that you have provided, Uploan is an online platform owned and operated by New Cross. The latter is the entity which controls the collection, holding, processing or use of personal information4 and as such, is subject to the provisions of the DPA, its IRR and issuances of the NPC.
As to the collection and processing of personal and sensitive personal information (collectively, personal data), these are permitted under the DPA under the various criteria for lawful processing pursuant to Section 12 for personal information, and Section 13 for sensitive personal information.
We understand that the consent of the Borrowers for processing their personal data is obtained when they create their Uploan wallet and when they apply for a loan. We understand further that this loan service is optional on the part of the employees of the accredited employers.
We wish to emphasize the definition of consent under the DPA:
“Consent of the data subject refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so.”5
It is clear, that consent given by a data subject must be evidenced by written, electronic, or recorded means. An implied, passive, or negative consent does not meet such a requirement. From the foregoing, it is crucial that the processing of New Cross is compliant with the consent requirements of the DPA.
In relation to the above, the NPC was provided with the following documents:
- Investor Agreement – we note that the body of the instrument referred to this as the Employee Loan Agreement but it discusses the investment terms and conditions when one invests in a Wallet Credit which we understand is a separate service offering from the consumer/salary loans;
- Privacy Policy;
- Privacy Manual; and
- Memorandum of Agreement – this is the Employer Accreditation Agreement between New Cross and the pertinent employer.
We have requested that you furnish us with a copy of the loan contract, but we have not received said document. Thus, we checked the Uploan website and refer to the “Promissory Note & Authorization [sic] For Voluntary Payroll Deduction.”6 Said document has provisions on accepting the terms and conditions, authorizing the pertinent employer to deduct/collect his/her salaries and employment benefits and remit the same to the New Cross as payment of the loan, as well as consent to transact business online and electronically.
These specific provisions are in line with legitimate business purpose of offering salary loans and indicate terms on what the attendant conditions are for the promissory note, payment of the loan, and transacting online.
However, we note Item No. 13 of the document which we quote below:
“13. Data Privacy Waiver. The BORROWER hereby waivers [sic] any rights to data privacy in information shared by their employer and gives approval to the employer to share information requested by the LENDER.”
We take exception to this blanket waiver of rights of the data subject in information shared by the accredited employer to New Cross. There are several rights of the data subjects as follows:
- Right to information
- Right to object
- Right to access
- Right to rectification
- Right to erasure or blocking
- Right to damages
- Right to data portability
- Right to file a complaint
We see no justifiable reason for this waiver of rights. An accredited employer may duly submit the information requested by New Cross on a Borrower as may be necessary and expedient for the limited purpose of availing a loan and the payment thereof. There is no need for the blanket waiver of data privacy rights in relation to the said purpose.
For instance, a Borrower would still have the right to object where his personal data is being used for an unauthorized purpose, or the right to request for correction when he notes an error in his data. This is notwithstanding that he approved of the information sharing between his employer and New Cross.
We wish to reiterate Section 38 of the DPA, which reads:
“Interpretation. – Any doubt in the interpretation of any provision of this Act shall be liberally interpreted in a manner mindful of the rights and interests of the individual about whom personal information is processed.”
With this, it is advisable to review the above quoted provision of the Promissory Note & Authorization [sic] For Voluntary Payroll Deduction and effect the necessary revisions, taking into consideration the protection afforded to the data subjects whereby PICs are mandated to uphold the rights of data subjects, and adhere to general data privacy principles and the requirements of lawful processing.7
This opinion is rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
Uploan, https://www.uploan.ph/investors. (last visited 29 November 2017) ↩
-
Id. ↩
-
AN ACT PROTECTING INDIVIDUAL PERSONAL INFORMATION IN INFORMATION AND COMMUNICATIONS SYSTEMS IN THE GOVERNMENT AND THE PRIVATE SECTOR, CREATING FOR THIS PURPOSE A NATIONAL PRIVACY COMMISSION, AND FOR OTHER PURPOSES (“Data Privacy Act of 2012”) (Republic Act No. 10173)(15 August 2012), §3(l) ↩
-
Id., §3(h) ↩
-
Id., §3(b) ↩
-
Uploan, https://secure.uploan.ph/terms-and-condition. (last visited 1 December 2017) ↩
-
Implementing Rules and Regulations (IRR) of RA No. 10173, §6(a) ↩