NPC Issuance Wiki

NPC Advisory Opinion No. 2018-059 — Skip Tracing and Probing of Contact Details Through the Internet and Third Parties

Issued Advisory Opinion

Text

4 October 2018

Re: SKIP TRACING AND PROBING OF CONTACT DETAILS THROUGH THE INTERNET AND THIRD PARTIES

Dear [Redacted]:

We write in response to your inquiry about the applicability of the Data Privacy Act of 20121 (DPA) to the practice of skip tracing and probing of collection agencies, particularly on the following points:

  1. Whether the DPA prohibits collection agencies to obtain and use contact information of a borrower or subscriber made publicly available online, otherwise known as skip tracing; and
  2. Whether collection agents are allowed to ask third parties, over the phone or in person, for the updated contact details and address of borrowers in case they can no longer be reached through the contact information you possess, which is known as probing.

The DPA does not prohibit the collection of personal information through skip tracing or probing, provided that the collection or any further processing is done in accordance with the law. In general, processing of personal data should adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality.2 There should be procedures in place for data subjects to exercise their rights3 and appropriate security measures for data protection.

It should be clarified that the public availability of personal information does not exclude it from the scope of the DPA. This law applies to the processing of all types of personal information, publicly available or not, and to any natural and juridical person involved in personal information processing.4 “Processing” in this context refers to the collection, use, storage, disposal and any other operation performed upon personal information.5

Discussion

Publicly Available Personal Information

As your inquiry concerns publicly available personal information, it may be useful to note that personal information is considered publicly accessible if:

  • The information about an individual is readily observed through reasonably expected means at a public location where the individual appears;
  • The information has been manifestly made public by the data subject; or
  • The information is obtained from sources that are intended to be accessible to any member of the public.

Collection Agencies as Personal Information Processors

Collection agencies are considered personal information processors (PIPs) to whom a personal information controller (PIC) has outsourced the processing of personal data of borrowers. This is due to the nature of their business, which, in general, performs the processing of personal data for the benefit of other companies. As PIPs, collection agencies are expected to process personal data only in accordance with their agreement with a PIC.

Lawful Processing and Legitimate Interest

The processing of personal data should meet one of the conditions for lawful processing provided in Sections 12 and 13 of the DPA, for personal information and sensitive personal information, respectively. One of the conditions that may be applicable in this case is “legitimate interest.” The DPA provides that processing of personal information is permissible when it is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed.6 It should be noted that the processing under this ground shall only involve personal information like contact details and addresses of borrowers. The DPA does not provide legitimate interest as criteria for lawful processing of sensitive personal information.

To determine if there is “legitimate interest” in processing personal information, PICs must consider the following:7

  1. Purpose test - The existence of a legitimate interest must be clearly established, including a determination of what the particular processing operation seeks to achieve.
  2. Necessity test - The processing of personal information must be necessary for the purposes of the legitimate interest pursued by the PIC or third party to whom personal information is disclosed, where such purpose could not be reasonably fulfilled by other means; and
  3. Balancing test - The fundamental rights and freedoms of data subjects must not be overridden by the legitimate interests of the PICs or third party, considering the likely impact of the processing on the data subjects.

Legitimate interest refers to matters that are desired by or important to a personal information controller (PIC) or third party, which must not be contrary to law, morals or public policy. This includes business, financial, or any other reasonable purpose. The legitimate interest pursued by the PIC or by a third party or parties to whom the data is disclosed should be clearly identified, and the reasonable purpose and intended outcome clarified.8 The PIC to whom a debt is owed and the third-party agency to whom collection is outsourced may have a legitimate interest to pursue and satisfy the debt.

It is not enough, however, to simply establish the purpose of processing personal information and how it will serve the interests of the PIC for legitimate interest to be considered as lawful basis of processing. The necessity of the particular processing operations should be evaluated. Legitimate interest will not justify intrusive practices, such as harassment, deceptive practices, or vexatious procedures, for these are not necessary to realize the legitimate interests.

Furthermore, while collection agencies may ask third parties such as employers and relatives for updated contact details of borrowers, these third parties are not obligated to give such information, absent a lawful basis for such disclosures. In communicating with third parties, collection agencies should also be mindful of what information to disclose, and whether the same may unduly prejudice the data subject.

PICs have the obligation to balance their legitimate interests against the interests, rights, and freedoms of the data subject considering the particular circumstances relevant to the processing. Legitimate interest is not intended to be a broad justification for all purposes assumed by PICs. NPC may evaluate whether legitimate interest is the proper basis for the specific processing, considering the interpretation clause under Section 38 of the DPA, where the law is liberally interpreted in a manner mindful of the rights and interests of the data subject. PICs are advised to determine whether data subjects could be better protected by using other lawful criteria for processing.

The interests and fundamental rights of the data subject could in particular override the interest of the personal information controller where personal data is processed in circumstances where data subjects do not reasonably expect further processing.9 PICs must also consider the reasonableness of the means employed for processing personal data. In general, personal data should be processed fairly, lawfully, and in a transparent manner.10 These may include ensuring that only necessary information is collected, using information only to the extent necessary for debt collection, and providing adequate notice to data subjects about how their personal information may be processed.

For instance, where “skip tracing” involves automated processes, the PIC may have separate obligations to provide information on such methods to data subjects, and even to notify the NPC, where such automated processing becomes the sole basis for any decisions that will significantly affect the data subject. Data subjects also have a right to information relevant to the methods of collection and sources of information.

While skip tracing and probing for purposes of pursuing the debt are not prohibited if done in accordance with the provisions of the DPA, the PICs and collection agencies should likewise comply with other applicable laws or regulations on consumer protection and fair collection practices.

This opinion is rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) IVY D. PATDU Officer-in-Charge and Deputy Privacy Commissioner for Policies and Planning

Footnotes

  1. An Act Protecting Individual Personal Information In Information And Communications Systems In The Government And The Private Sector, Creating For This Purpose A National Privacy Commission, And For Other Purposes [DATA PRIVACY ACT OF 2012], Republic Act No. 10173 (15 August 2012). ↩

  2. Data Privacy Act of 2012, § 11-13, 20-21 ↩

  3. Data Privacy Act of 2012, § 16. ↩

  4. Id., § 4. ↩

  5. Id., § 3(j). ↩

  6. Id., § 12(f). ↩

  7. See generally, Data Privacy Act of 2012, § 12(f); United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ [last accessed on June 11, 2018]. ↩

  8. See generally, United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ [last accessed on June 11, 2018]. ↩

  9. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC [General Data Protection Regulation], Recital 47. ↩

  10. Data Privacy Act of 2012, § 11, 16. ↩

Backlinks