Text
30 August 2018
RE: DISCLOSURE OF PERSONAL INFORMATION TO THE BANGKO SENTRAL NG PILIPINAS
Dear [Redacted],
We write in response to your inquiry seeking clarification on Section 4 of Republic Act No. 10173,1 also known as the Data Privacy Act of 2012 (DPA) in relation to the Bangko Sentral ng Pilipinas’ (BSP) examination of financial institutions, pursuant to its supervisory and regulatory powers.
We understand that the Public Safety Savings and Loan Association, Inc. (PSSLAI) is a non-stock, non-profit corporation engaged in the business of accumulating the savings of its members. PSSLAI’s membership is limited to the public safety personnel under the Department of Interior and Local Government (DILG), which includes the members of the Philippine National Police (PNP), Bureau of Fire Protection (BFP), and Bureau of Jail Management and Penology (BJMP), among others.
The PSSLAI is a financial institution subject to BSP regulation. Every year, the BSP conducts on-site examination of PSSLAI’s books and records, business affairs, administration and financial condition.
We understand, based on your letter, that the BSP requests for information of your members, particularly their personal addresses. You are of the opinion that such disclosure is irrelevant to the BSP’s examination and has implications on the safety and security of such members.
You would like to seek guidance on the extent of the BSP’s authority to request for information. Specifically, whether PSSLAI can disclose to the BSP, during its examination, personal information pertaining to your members without the latter’s consent.
You likewise ask for clarification on the limitations to BSP’s authority and the conditions that must be met for the exercise of the same taking into consideration the provisions of the DPA.
Discussion
Exclusions from the Scope of the DPA
Under Section 4(e) of the DPA, information necessary in order to carry out the functions of public authority is excluded from the scope of the law. This includes the processing of personal data for the performance by the independent central monetary authority its constitutionally and statutorily mandated functions.
The exclusion above is not absolute. The exclusion of the information specified in Section 4 of the DPA is only to the minimum extent necessary to achieve the specific purpose, function or activity. Given this, the personal and sensitive personal information (collectively, personal data) enumerated in Section 4 may be lawfully processed by a personal information controller (PIC), even without meeting the conditions under Sections 12 and 13 of the DPA, but the processing shall be limited to that necessary to achieve the specific purpose, function or activity. The PIC is still required, however, to implement measures to secure and protect the personal data.
We reiterate that the exclusion particularly pertains to information necessary in carrying out the functions of the BSP. This does not mean that all information collected by the BSP is outside the scope of the DPA. Being an exception to the rule, it must be established that the information claimed to be outside the scope of the DPA is:
- Necessary in order to carry out the functions of the public authority; and
- Processing of personal data is for the fulfillment of a constitutional or statutory mandate.
Thus, only the information required to be processed pursuant to the said function are not covered by the law, while the BSP, as an entity, is still covered by the DPA. The BSP is mandated under the DPA to adhere to the data privacy principles of transparency, legitimate purpose and proportionality, implement appropriate security measures for personal data protection, and ensure that data subjects are able to exercise their rights as provided for by law.
Mandate of the BSP; Request for Personal Addresses of PSSLAI’s Members
Based on a formal communication with the BSP, the “information on the addresses of members is necessary in order to: (i) conduct direct confirmation of loan accounts with the end in view of ascertaining the facts relative to the loans and true condition of PSSLAI; and (ii) determine whether the Association complies with the regulatory requirement, pertinent to the well-defined group statutory provision, to obtain the minimum information, such as addresses, of its members.”
Further, the BSP stated that the director and examiners of the concerned department is authorized to compel the presentation of all books, documents, papers or records necessary in their judgement to ascertain the facts relative to the overall condition of any Association or to any loan, pursuant to Section 22 of Republic Act No. 8367 or the Revised Non-Stock Savings and Loan Association Act of 1997.
In this case, the BSP, having a constitutional2 and statutory3 mandate to collect and process personal data, may do so even without the consent of the data subjects. But this is with the concomitant responsibility of ensuring that organizational, physical, and technical security measures are in place to protect the personal data it is processing.
In addition, we trust that the BSP is well aware of its obligations under the DPA, its IRR, and issuances of the NPC, specifically NPC Circular No. 16-01 on the Security of Personal Data in Government Agencies, which requires all government agencies engaged in the processing of personal data to observe the following duties and responsibilities:
A. through its head of agency, designate a Data Protection Officer; B. conduct a Privacy Impact Assessment for each program, process or measure within the agency that involves personal data; C. create privacy and data protection policies, taking into account the privacy impact assessments; D. conduct a mandatory, agency-wide training on privacy and data protection policies once a year, and that a similar training shall be provided during all agency personnel orientations; E. register its data processing systems with the NPC; F. cooperate with the NPC when the agency’s privacy and data protection policies are subjected to review and assessment.
Should you wish to seek additional guidance and clarification, you may communicate with the BSP’s Data Protection Officer at this email address: dataprotection@bsp.gov.ph.
This opinion is being rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMOND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information In Information And Communications Systems In The Government And The Private Sector, Creating For This Purpose A National Privacy Commission And For Other Purposes [DATA PRIVACY ACT OF 2012], Republic Act No. 10173 (2012). ↩
-
1987 Phil. Const. Art. XIII, § 20. ↩
-
An Act Providing For The Regulation Of The Organization And Operations Of Banks, Quasi-Banks, Trust Entities And For Other Purposes [THE GENERAL BANKING LAW OF 2000], Republic Act No. 8791 (2000), § 4; THE NEW CENTRAL BANK ACT, Republic Act No. 7653 (1993), § 23 and 28 ↩