Text
4 May 2018
Re: LAWFUL PROCESSING OF PERSONAL DATA
Dear [Redacted],
This is with reference to your request for advisory opinion which sought clarification on whether the processing of personal data by the Capital Markets Integrity Corporation (CMIC) is allowed under Republic Act No. 10173,1 also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR),2 and relevant issuances of the National Privacy Commission (NPC).
We understand that CMIC is a wholly-owned subsidiary of the Philippine Stock Exchange, Inc. It was granted by the Securities and Exchange Commission (SEC) its self-regulatory organization (SRO) status on 3 February 2012.3
We understand further that an SRO refers to an organized exchange, registered clearing agency, organization or association registered as an SRO under Section 39 of the Securities Regulation Code (SRC), and which has been authorized by the SEC to: (1) enforce compliance with relevant provisions of the Code and rules and regulations adopted thereunder; (2) promulgate and enforce its own rules which have been approved by the Commission, by their members and/or participants, and; (3) enforce fair, ethical and efficient practices in the securities and commodity futures industries including securities and commodities exchanges.4
Discussion
Considering the above, we confirm that CMIC may process personal, sensitive personal and privileged information of data subjects, taking into consideration the provisions of Sections 12 and 13 of the DPA on the criteria for lawful processing of personal data.
Specifically, Section 12 (c) of the DPA provides that processing of personal information shall be permitted when the processing is necessary for compliance with a legal obligation to which the personal information controller is subject. Similarly, for sensitive personal and privileged information, Section 13(b) of the DPA provides that the same may be lawfully processed when processing is provided for by existing laws and regulations: provided, that said laws and regulations do not require the consent of the data subject for the processing, and guarantee the protection of personal data.
We wish to emphasize that the DPA, its IRR and related issuances of the NPC should be read together with existing laws, such as the SRC. The DPA has the twin task of protecting the right to privacy and ensuring the free flow of information. The law cannot be used as an excuse for non-compliance with other existing laws, rules, and regulations.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
AN ACT PROTECTING INDIVIDUAL PERSONAL INFORMATION IN INFORMATION AND COMMUNICATIONS SYSTEMS IN THE GOVERNMENT AND THE PRIVATE SECTOR, CREATING FOR THIS PURPOSE A NATIONAL PRIVACY COMMISSION, AND FOR OTHER PURPOSES, “Data Privacy Act of 2012” (15 August 2012). ↩
-
Implementing Rules and Regulations of the Data Privacy Act (24 August 2016). ↩
-
Capital Markets Integrity Corporation. About Us. Available at http://www.cmic.com.ph/main/aboutUs.html (last accessed: 4 May 2018) ↩
-
2015 IMPLEMENTING RULES AND REGULATIONS OF THE SECURITIES REGULATION CODE (REPUBLIC ACT 8799), Rule 3.1.22. ↩