Text
4 January 2019
Re: CREDIT VERIFICATION
Dear [Redacted],
We write in response to your inquiry regarding credit verification in relation to know-your-customer (KYC) requirements vis-à-vis the provisions of the Data Privacy Act of 2012 (DPA).1 In particular, you are seeking to use the existing government databases to confirm vital information submitted by credit card applicants.
The use, including access thereto, of government databases is primarily subject to laws and regulations governing the respective databases. The purpose of access and use of the requesting party, as well as the particular information required to be obtained, depends upon the policy of the government agency, the purpose of the establishment of such database, and other relevant regulations.
As such, it is not within the authority of the National Privacy Commission (NPC) to grant permission as to the use of these databases.
The DPA applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing.2 This includes databases containing personal data managed and maintained by government agencies. The use of government databases to confirm vital information of credit card applicants comes under the scope of the law and is subject to the general principles of legitimate purpose, transparency, and proportionality.3
Discussion
We understand that for credit card applications, applicants provide both personal and sensitive personal information. Lawful processing of these personal data should be in accordance with Sections 12 and 13 for personal information and sensitive personal information, respectively.
As stated in your letter, part of a bank’s responsibility prior to issuing a credit card is to perform proper credit verification to confirm the identity and financial capability of the applicant. Likewise, the verification is important to strengthen KYC and credit underwriting processes and mitigate fraud.
When personal information is involved, the verification may fall under the following basis for processing:
a. The data subject has given consent; b. The processing is necessary/related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract; c. The processing is necessary for compliance with a legal obligation; or d. The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.
On the other hand, if it concerns sensitive personal information, processing is allowed when the data subject has given consent, specific to the purpose prior to the processing, or when processing is provided for by existing laws and regulations.
Likewise, you mentioned that the consent of applicants shall be secured before disclosing all declared information to third parties, including government agencies, for KYC purposes. As consent is a criterion for processing both personal and sensitive personal information, banks may disclose personal data to government agencies for verification purposes pursuant to such consent obtained. The consent from the data subjects should include an authorization given to the bank to request information from a government database, subject to that particular agency’s governing law and internal policies.
We emphasize that consent of the data subject as defined under Section 3(b) of the DPA refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of his or her personal, sensitive personal, or privileged information. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of a data subject by a lawful representative or an agent specifically authorized by the data subject to do so.
The consent contemplated by the law is an express consent wherein the data subject voluntarily assents to the collection and processing of personal information, rather than an implied or inferred consent resulting from the data subject’s inaction or continued use or availment of services offered by a particular entity.4
While the verification for KYC purposes is allowed under the DPA, banks still have the obligation to observe the principles of transparency and proportionality while taking the necessary steps to protect the rights of the data subject.
The principle of transparency dictates that the data subject must be aware of the nature, purpose, and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of personal information controller, his or her rights as a data subject, and how these can be exercised.5
Moreover, the proportionality principle requires that “the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.”6
Hence, upon application, applicants should be informed when their personal data will be verified with specific government databases and that only information relevant and necessary to the attainment of the purpose of processing will be collected, used and stored for verification purposes.
This opinion is rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
See: National Privacy Commission, NPC Advisory 2017-42 (August 14, 2017). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18(a) (2016). ↩