NPC Issuance Wiki

NPC Advisory Opinion No. 2019-009 — Application for Exemption Under the Data Privacy Act of 2012

Issued Advisory Opinion

Official opinion tags

Text

14 January 2019

Re: APPLICATION FOR EXEMPTION UNDER THE DATA PRIVACY ACT OF 2012

Dear [Redacted],

We write in response to your request which sought for the exemption of the Judiciary Savings and Loans Association, Inc. (JUSLA) from the coverage of Republic Act No. 10173,1 also known as the Data Privacy Act of 2012 (DPA), it being a non-bank financial institution, based on Section 4 (f)2 the law.

Discussion

Scope of the DPA

We understand that JUSLA is a non-bank financial institution (NBFI) having 4,710 members nationwide.3 It is a non-stock, non-profit corporation engaged in the business of accumulating the savings of its members and using such accumulations for loans to members to serve the needs of households by providing long term financing for home building and development and for personal finance.4

It is important to note that the DPA applies to the processing of all types of personal information5 and to any natural and juridical person involved in personal information processing.

JUSLA is principally engaged in the processing of personal and sensitive personal information (collectively, personal data) of its members. As provided for in Section 3(j) of the law, processing involves any operation or any set of operations performed upon personal information including, but not limited to the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.

Accordingly, the collection, organization, storage, and use of the personal data of JUSLA members for their savings and loans, among others, are considered as processing activities undertaken by JUSLA as a personal information controller6 (PIC). Thus, it is covered by the law.

Exemption from the Coverage of the Law

Section 4 of the DPA and Section 5 of its Implementing Rules and Regulations7 (IRR) exempt specific types or classes of information from its scope — in particular, paragraph (e) of the latter states:

Section 5. Special Cases. The Act and these Rules shall not apply to the following specified information, only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned:

xxx xxx xxx

(e) Information necessary for banks, other financial institutions under the jurisdiction of the independent, central monetary authority or Bangko Sentral ng Pilipinas, and other bodies authorized by law, to the extent necessary to comply with Republic Act No. 9510 (CISA), Republic Act No. 9160, as amended, otherwise known as the Anti-Money Laundering Act, and other applicable laws;

xxx xxx xxx

Provided, that the non-applicability of the Act or these Rules do not extend to personal information controllers or personal information processors, who remain subject to the requirements of implementing security measures for personal data protection: Provided further, that the processing of the information provided in the preceding paragraphs shall be exempted from the requirements of the Act only to the minimum extent necessary to achieve the specific purpose, function, or activity. (Emphasis supplied).

From the provision above, it is evident that the non-applicability of the law will only apply to the specified information to the minimum extent of collection, access, use, disclosure or other processing activities performed upon such personal information. The natural or juridical entity processing the specified personal information remains to be covered by the law and other relevant issuances of the National Privacy Commission (NPC).

The non-applicability does not extend to the duties and responsibilities of the entity or organization as a PIC or personal information processor8 (PIP), such as the duty to uphold the rights of data subjects, adhere to the data privacy principles (transparency, legitimate purpose and proportionality), to designate a data protection officer, and to ensure implementation of security measures to protect personal data, among others.9

Based on the foregoing, JUSLA as a PIC is covered by the law and is then obliged to comply with the provisions of the DPA, its IRR and other NPC issuances applicable to its processing activities.

This opinion is based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. Id. § 4. This Act does not apply to the following: (f) Information necessary for banks and other financial institutions under the jurisdiction of the independent, central monetary authority or Bangko Sentral ng Pilipinas to comply with Republic Act No. 9510, and Republic Act No. 9160, as amended, otherwise known as the Anti-Money Laundering Act and other applicable laws. (Emphasis supplied). ↩

  3. Judiciary Savings and Loans Association, Inc., About Us, available at https://jusla.com.ph/about_us.html. ↩

  4. Judiciary Savings and Loans Association, Inc., Frequently Asked Questions, available at https://jusla.com.ph/forms/JUSLA%20FAQs.pdf. ↩

  5. Id. § 3 (g). ↩

  6. Id. § 3 (h). ↩

  7. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 (2016) ↩

  8. Id. § 3 (i). ↩

  9. National Privacy Commission, NPC Advisory Opinion No. 2017-44 (16 August 2017). ↩

Backlinks

  • No backlinks found