Text
6 September 2018
Re: PROCESSING OF PERSONAL INFORMATION FOR CHARACTER REFERENCE
Dear [Redacted]:
We write in response to your request for an advisory opinion regarding the applicability of Section 12(f) of the Data Privacy Act of 2012 (DPA)1 as a basis for the processing of the name and contact number of character references that were supplied by an applicant for a loan, making the processing permissible even without the consent of the said character reference.
We understand that HC Consumer Finance Philippines, Inc. (Home Credit) is a financing company whose primary purpose is to extend loans, credits and all types of financial accommodations from its own capital without collateral. To support the loan collection process, the company requires applicants and borrowers to supply at least two (2) character references and their respective contact numbers.
The name and contact information of the character reference are considered personal information, and the processing of such information shall be permitted only if not otherwise prohibited by law, and when at least one of the conditions set by the Section 12 of the DPA is met.
Among the criteria provided in the law for the processing of personal information is when “the processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.”2
Discussion
Legitimate Interest as Basis for Processing
Legitimate interest refers to matters that are desired by or important to a personal information controller (PIC), which must not be contrary to law, morals or public policy. This includes business, financial or other reasonable purpose. The legitimate interest pursued by the PIC or by a third party or parties to whom the data is disclosed should be clearly identified, and the reasonable purpose and intended outcome clarified.3 In order to use legitimate interest as criteria for lawful processing, PICs must consider the following:4
- Purpose test - The existence of a legitimate interest must be clearly established, including a determination of what the particular processing operation seeks to achieve.
- Necessity test - The processing of personal information must be necessary for the purposes of the legitimate interest pursued by the PIC or third party to whom personal information is disclosed, where such purpose could not be reasonably fulfilled by other means; and
- Balancing test - The fundamental rights and freedoms of data subjects should not be overridden by the legitimate interests of the PICs, considering the likely impact of the processing on the data subjects.
We also note Recital 47 of the General Data Protection Regulation (GDPR) which states that the processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned.5
Application to Home Credit’s Processing of Character Reference Information
Taking into account that the sole purpose of Home Credit in requesting the names and contact numbers of the character references is to ask for additional information about the applicant or borrower, such as new address and/or new contact number of the applicant or borrower, in the event that the latter defaults in his/her loan obligation and can no longer be reached at the contact information he/she provided, the same may be considered as a legitimate interest of Home Credit for verification and fraud prevention.
The NPC may evaluate whether the PIC correctly relied on legitimate interest as the proper basis for the specific processing, taking into consideration the interpretation clause of the DPA under Section 38, and whether the rights of the data subject could be better protected by using the other lawful criteria for processing.
However, taking into consideration the rights of data subjects, it is likewise advisable that moving forward, Home Credit should endeavor to make changes in the processing of loan applications and the terms necessary for the same, i.e. the loan application or contract with the borrower may reflect that the borrower guarantees and certifies that the character references have been informed by the borrower that his or her personal details will be submitted to Home Credit and that he or she consented to the processing of their personal information. It is important to specify that personal information will only be used to achieve the above-mentioned purposes.
As it is the applicants or borrowers that supply the character references to Home Credit, it is incumbent upon them to seek the approval of these references that they have selected if they indeed consent to the use of their personal information.
Further, there should be a manual of operations on how Home Credit and its employees or agents handle calls with character references should Home Credit proceed to contact these persons.
For instance, it is advisable that at the start of the call, the data subject be adequately informed of the purpose of the same, how Home Credit obtained his or her contact details, ask for consent to continue with the call, provide the option of ending the call should the data subject wish to do so, clarify that they may be contacted again in the future should it be necessary, provide the option also of having their personal data removed as a character reference, if the same is feasible, etc.
All of these should take into account the data privacy principles of transparency, legitimate purpose and proportionality, and upholding the rights of data subjects.
Finally, we emphasize that the NPC may prescribe or determine, in certain cases, the proper criteria for lawful processing of personal data. It can also determine whether there is a violation of the provisions of the DPA, and consequently, recommend to the Department of Justice the prosecution of crimes and imposition of penalties specified in the law.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMOND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information In Information And Communications Systems In The Government And The Private Sector, Creating For This Purpose A National Privacy Commission, And For Other Purposes [DATA PRIVACY ACT OF 2012], Republic Act No. 10173 (2012). ↩
-
See also United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ [last accessed on September 5, 2018] (Anything illegitimate, unlawful or unethical is not a legitimate interest). ↩
-
See generally, United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ [last accessed on September 5, 2018]. ↩
-
See generally, Data Privacy Act of 2012, § 12(f); United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ [last accessed on September 5, 2018]; Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC [General Data Protection Regulation] 2016 O.J. (L 119), Recital 47. ↩