Text
11 October 2018
Re: PUBLICATION OF NAMES OF SANCTIONED DIRECTORS AND OFFICERS OF BSP-SUPERVISED FINANCIAL INSTITUTIONS
Dear [Redacted],
We write in response to your request for an advisory opinion on your practice of publishing the names of sanctioned directors and officers of Bangko Sentral ng Pilipinas (BSP)-supervised financial institutions (BSFIs) for their failure to address BSP requirements and supervisory expectations.
Section 4 of Data Privacy Act of 20121 (DPA) states that the law is applicable to the processing of all types of personal information and to any natural and juridical person involved in personal information processing. However, it provides for certain exemptions – one of which is personal data necessary in order to carry out the functions of public authority, including the processing of personal data for the performance by the independent, central monetary authority of its constitutionally and statutorily mandated functions.2
As Section 3 of Republic Act No. 7653, or the New Central Bank Act, charged the BSP with supervising operations of banks and exercise such regulatory powers as provided for by the New Central Bank Act and other pertinent laws over the operations of finance companies and non-bank financial institutions performing quasi-banking functions, and institutions performing similar functions, which necessarily includes the issuances of directives and enforcement actions, it satisfies this provision in the DPA.3
The DPA has the twin task of protecting the fundamental human right of privacy and ensuring the free flow of information to promote innovation and growth.4 For this reason, the DPA will not operate to hinder the BSP to disclose certain information it deems crucial that the public be informed of, anchored on its mandate to maintain financial stability, as enforced by Circular No. 875, dated 15 April 2015.5
Likewise, the following quasi-judicial administrative bodies also publish its decisions, including the names of individuals that are the subject of or involved in the cases:
- Civil Service Commission on cases involving public officials and employees;6
- Commission of Audit;7
- Bureau of Internal Revenue on tax evasion cases;8 and
- Securities and Exchange Commission.9
Similar lists are also published by the Asian Development Bank (ADB) and the World Bank. The ADB publishes on its website a sanctions list of individuals and entities who violated its anticorruption policies.10 Also, the World Bank publishes a list of ineligible firms and individuals who have been sanctioned under the Bank’s fraud and corruption policy.11
The business of banking is imbued with public interest. The stability of the banking industry largely depends on the confidence of the people in the honesty and efficiency of banks and the people managing the banks. Thus, BSP has a legitimate purpose in making the public aware of sanctions imposed by BSP through its publication.
Discussion
Extent of exemption
However, it should be noted that the exemptions set forth in the DPA are limited to the minimum extent necessary to achieve the specific purpose, function or activity. The BSP, in processing personal data, assumes the role of a personal information controller (PIC),12 which is required by the DPA to take all measures necessary to protect personal data.
Furthermore, said publication should also adhere to the principle of proportionality especially since it would involve public disclosure of personal information. The principle requires that “the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if purpose of the processing could not reasonably be fulfilled by other means.13
This opinion is rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For you reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Bangko Sentral ng Pilipinas, Overview of Functions and Operations, available at http://www.bsp.gov.ph/about/functions.asp, (last accessed on 24 May 2018). ↩
-
Bangko Sentral ng Pilipinas (BSP) Supervisory Enforcement Policy ↩
-
See: Civil Service Commission Must-read Resolutions available at http://www.csc.gov.ph/2014-02-21-08-28-23/pdf-files/category/38-must-read-resolutions (last accessed 19 July 2018). ↩
-
See: Commission on Audit Legal Information Archive available at https://lia.coa.gov.ph/browse/5 (last accessed 19 July 2018). ↩
-
See: Bureau of Internal Revenue RATE Cases available at https://www.bir.gov.ph/images/bir_files/old_files/pdf/ratex.pdf (last accessed 19 July 2018). ↩
-
Securities and Exchange Commission Decisions available at http://www.sec.gov.ph/public-information-2/sec-issuances/securities-and-exchange-commission-decisions/ (last accessed 19 July 2018). ↩
-
Asian Development Bank Anticorruption and Integrity Published List available at https://lnadbg4.adb.org/oga0009p.nsf/sancALL1P?OpenView&count=999 (last accessed 29 July 2018). ↩
-
World Bank Listing of Ineligible Firms & Individuals available at http://web.worldbank.org/external/default/main?contentMDK=64069844&menuPK=116730&pagePK=64148989&piPK=64148984&querycontentMDK=64069700&theSitePK=84266 (last accessed 29 July 2018). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (c) (2016). ↩