Text
12 April 2018
Re: CONSENT REQUIREMENT ON OUTSOURCING AGREEMENT WITH AN EXTERNAL SERVICE PROVIDER
Dear [Redacted]:
This is in response to your letter received by the National Privacy Commission (NPC) on 15 February 2018 regarding your request for clarification on whether the consent of employees is required for the engagement of an external provider for the analysis of the results of skills, personality, and behavior assessments in relation to provision of employee training and development programs and operationalization of workforce competency framework.
Discussion
Outsourcing
The Implementing Rules and Regulations (IRR)1 of Republic Act No. 10173,2 otherwise known as the Data Privacy Act of 2012 (DPA), defines outsourcing as the disclosure of personal data by a personal information controller (PIC) to a personal information processor (PIP)3 for the latter to perform processing activities as instructed by the former.
It is important to note that in an outsourcing agreement, the PIP does not have its own purpose for processing but merely carries out the instruction given by the PIC. Further, it cannot amend or process personal data outside the bounds of its agreement with the PIC. Hence, BSP should be the one to determine the purpose and means of the processing and ensure that the external service provider will not process the personal data for its own purpose or any purpose outside that determined in the service agreement.4
Please note also that BSP remains responsible for personal information under its control or custody, which necessarily includes information that have been transferred to a third party for processing, whether domestically or internationally.
BSP is still accountable for complying with the requirements of the DPA and shall use contractual or other reasonable means to provide a comparable level of protection while the information is being processed by a third party.5
Consent
Whether processing is based on consent, law, or some other criteria for lawful processing, the PIC is not required to obtain a separate consent from the data subject before entering into an outsourcing agreement as the purpose of the processing remains to be the same and the PIC remains to be the same.
As such, if the consent of employees has already been obtained for processing of personal data related to human resource activities, a separate consent for the outsourcing is no longer needed. Also, the processing of personal information for employee training and development programs and operationalization of workforce competency framework could be considered as necessary and is related to the fulfillment of a contract between BSP as employer and its employees.
Nevertheless, considering the right of data subjects to be informed and notified of the processing of their personal data, the PIC must indicate in its privacy notice or privacy policy the particular data processing activities that are outsourced.6 BSP may also use other means, such as through appropriate internal communications, to ensure that its employees are adequately informed of the processing involved under the outsourcing agreement.
This opinion is being rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
Implementing Rules and Regulations (IRR) of the Data Privacy Act of 2012 (24 August 2016). ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes, “Data Privacy Act of 2012” (15 August 2012). ↩
-
Supra note 1, §3(f). ↩
-
See: Implementing Rules and Regulations (IRR) of Republic Act No. 10173, § 44(b). ↩
-
See: Republic Act No. 10173, § 21(a) and IRR, Rule X. ↩