Text
30 July 2018
RE: PERSONAL INFORMATION CONTROLLER IN THE PROCESSING OF CONCESSIONARY BEEP™ CARDS
Dear [Redacted],
We write in response to your request for advisory opinion received by the National Privacy Commission (NPC) which sought to clarify whether the Department of Transportation (DOTr) is considered as the personal information controller (PIC) in the context of data processing for the issuance of Concessionary BEEP™ Cards.
In your letter, you have mentioned that there is currently a discussion as to who is the PIC and personal information processor (PIP) between the DOTr and AF Payments Inc. (AFPI), the entity tasked to issue the Concessionary BEEP™ Cards to identified patrons, in compliance with the Automated Fare Collection System (AFCS) Concession Agreement between AFPI and the DOTr.
Republic Act No. 10173,1 also known as the Data Privacy Act of 2012 (DPA), clearly defines a PIC in Section 3(h) as the person or entity who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.
There is control if the natural or juridical person or any other body decides on what information is collected, or the purpose or extent of its processing.2
On the other hand, a PIP is any natural or juridical person to whom a PIC may outsource the processing of personal data pertaining to a data subject.3
Discussion
Based on the definitions, it is apparent that it is the DOTr, with its mandate to establish and administer comprehensive and integrated programs to improve the transportation system of the country,4 that has control over the AFCS, and is thereby considered as the PIC.
As described in your letter addressed to [Redacted] of AFPI dated [Redacted], personal information of the applicants is gathered by the Public Transport Operators (PTOs) then submitted to AFPI for their processing.
Although AFPI directly handles and processes personal information of applicants turned over by the PTO, we understand that such direction was derived from the instructions given by the DOTr. AFPI remains to be the PIP to whom DOTr has outsourced the processing under the AFCS Concession Agreement, notwithstanding the fact that AFPI manages and oversees the system.
It is worthy to note that indeed, while PIPs exercise some degree of control and are given freedom to execute technical strategies to carry out the activities instructed by the PIC, it is still the PIC who exercises overall control over the purpose and manner of processing.5 Particularly, when the basis of personal data processing is the statutory mandate of an entity, such organization continues to be the PIC.6
Considering the above discussion, it then follows that the scope and limitation of the processing activities to be performed by AFPI should be clearly defined in the Outsourcing Agreement. It is the duty of the PIC to ensure that the contract contains all the provisions discussed in Rule 10 of the Implementing Rules and Regulations (IRR) of the DPA and issuances of the NPC, particularly on the required security measures and personal data breach management.
As to the role of the PTOs in the AFCS, there is a need to clarify and define their obligations with respect to its contract with AFPI vis-à-vis the AFCS Concession Agreement between DOTr and AFPI.
Finally, we wish to emphasize that should AFPI and/or the PTOs use the personal data collected for purposes other than the processing for the issuance of the Concessionary BEEP™ Cards or as instructed by the DOTr pursuant to the AFCS Concession Agreement, they risk violating the law. In these cases, they are to be considered as PICs with respect to the personal data being processed outside the agreement with DOTr. To do this lawfully, the processing must be based on consent or some authority provided by law and regulation. The criteria for lawful processing is provided in Section 12 and 13 of the DPA.
This opinion is being rendered based on the limited information you have provided. The NPC is not cognizant of the contents of the AFCS Concession Agreement, the full scope of work of AFPI as well as the extent of the responsibilities of PTOs in this endeavor. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission and for other Purposes [DATA PRIVACY ACT OF 2012], Republic Act No. 10173 (2012). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 3(m) (2016). ↩
-
Amending Executive Order No. 125, Entitled “Reorganizing the Ministry of Transportation and Communications, Defining its Powers and Functions, and For Other Purposes”, [REORGANIZATION ACT OF THE MINISTRY OF TRANSPORTATION AND COMMUNICATIONS], Executive Order No. 125-A, (1987), §5. ↩
-
Data Controllers and Data Processors: What the difference is and what the governance implications are, pages 4 and 7, available at https://ico.org.uk/media/for-organisations/documents/1546/data-controllers-and-data-processors-dp-guidance.pdf, (last accessed on 07 June 2018). ↩
-
Id, page 5. ↩