Text
22 November 2018
Re: TREATMENT OF INSURANCE AGENTS UNDER THE DPA
Dear [Redacted],
We write in response to your request for an advisory opinion received by the National Privacy Commission (NPC) via email. You seek clarification on the nature of insurance agents in relation to the provisions of the Data Privacy Act of 20121 (DPA), and their relationship with the insurance companies they may represent, be connected to, or affiliated with.
From your inquiry, we understand that an insurance agent duly licensed by the Insurance Commission is allowed to carry or represent up to seven non-life insurance companies. You stated that these agents solicit business from individuals, businesses, and institutions, and then offer insurance quotations or proposals that the client will be amenable to. However, licensed agents also have the option to be an exclusive agent of an insurance company, and thus may no longer carry or represent other insurance companies.
In particular, you inquire on the following:
-
Are non-exclusive licensed agents still considered personal information processors of the insurance company despite such agents are the ones responsible in gathering the information and securing the consent of the client? You further mentioned that the practice of some non-exclusive agents is to not fully disclose the complete information gathered from the client for fear of losing the business directly to the insurance companies;
-
Considering that they are in control of the processing of personal data of the clients and they do not have one PIC as they can represent up to seven insurance companies, can the NPC or the company classify these non-exclusive licensed agents as their own personal information controller.
Insurance agent; personal information controller; personal information processor; control
To answer these two related questions, it is imperative to first analyze the nature of an insurance agent. Under the Insurance Code, as amended,2 an insurance agent is one “who for compensation solicits or obtains insurance on behalf of any insurance company or transmits for a person other than himself an application for a policy or contract of insurance to or from such company or offers or assumes to act in the negotiating of such insurance.”3 They are independent contractors and not employees of the company they represent.4 While the Insurance Code, as amended, dictates that licensed agents are independent contractors of the insurance company they may carry or represent, this does not necessarily go into their role and responsibility under the DPA.
A personal information controller (PIC) refers to a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.5 On the other hand, a personal information processor (PIP) refers to any natural or juridical person qualified to act as such under the DPA to whom a PIC may outsource the processing of personal data pertaining to a data subject.6
Thus, to determine whether there is a controller to processor or controller to controller relationship, there is a need to take a closer look at the contract provisions or special arrangements the insurance company has with the agent. The decisive element should be the level of control over the personal data processing, i.e. the decision on whose and what kind of data is to be processed, manner of collection, use thereof, and the like.
In this case, you mentioned in your inquiry that non-exclusive agents are solely responsible for the collection of personal data from their clients, and that they do not disclose all collected personal data of their clients to the insurance company. This circumstance, however, is not enough to the classify an agent as either a solely PIC or a PIP. In fact, there is a dynamic relationship between the agent, the insurance company, and the client.
These non-exclusive agents may then be considered as individual PICs as they act on their own initiative to obtain clients and their clients’ personal data for their own account and business, and not upon the instructions of the insurance company. While such agents solicit business insurance on behalf of the company, it would seem that the agent is in control of the processing of his or her client’s personal data.
As PICs, agents need to comply with the requirements set under the DPA, such as adherence to the principles of transparency, legitimate purpose and proportionality, upholding data subjects’ rights, and establishment of organizational, physical, and technical security measures for the protection of personal data.
Data sharing; data sharing agreement; outsourcing agreement
As to your third question on what is the more appropriate document to be executed between the insurance company and the non-exclusive agent - an outsourcing agreement or a data sharing agreement, we understand that insurance agents and insurance companies already have a contractual relationship between them pursuant to or as may be provided for under existing insurance laws and regulations. Hence, a separate data sharing agreement may no longer be necessary.
We understand further that as part of their contract, insurance agents provide the personal data of their clients for the latter to enter into an insurance contract with the insurance companies. While insurance agents are considered as PICs as to their own clients, the same may not apply to the contract they have with the insurance company.
As to the provision of client data for the insurance contract and the continuous fulfillment thereof, insurance agents are considered as PIPs of the insurance company. The insurance agent’s role as a processor is only limited to such instances, and the same acts are necessarily included in the contract with the insurance company as representatives or independent contractors.
Thus, provisions relating to the DPA, such as but not limited to security measures that aim to maintain the confidentiality, integrity, and availability of client data, may already be incorporated in the agents’ contracts as representatives of the insurance company.
Lastly, you asked on data sharing agreements with potential clients, specifically on whether it is correct to have a data sharing agreement between the client and the insurance company, and between the client and the agent separately, and whether a tripartite DSA recognized by the NPC.
Clients are properly classified as data subjects of both the agent and the insurance company, independently. Neither an outsourcing agreement nor a data sharing agreement should be executed by the client with the agent or the insurance company.
Provisions on data protection and security should be embedded in the main contract of insurance with the insurance company or contract with the agent, or in another document, such as a non-disclosure agreement. The client may choose to separately execute such document with the insurance company and the agent. While the NPC recognizes data sharing agreements with three parties or more, given the foregoing, the same is not applicable to this case.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
An Act Strengthening the Insurance Industry, Further Amending Presidential Decree No. 612, Otherwise Known as The Insurance Code, As Amended by Presidential Decree Nos. 1141, 1280, 1455, 1460, 1814 And 1981, and Batas Pambansa Blg. 874, and For Other Purposes [Insurance Code, as amended], Republic Act No. 10607 (2012). ↩
-
Insurance Code, as amended, § 309. ↩
-
Ibid. ↩