NPC Issuance Wiki

NPC Advisory Opinion No. 2019-019 — Exemption from Coverage of NPC Circular No. 17-01

Issued Advisory Opinion

Official opinion tags

Text

12 March 2019

Re: REQUEST FOR EXEMPTION FROM THE COVERAGE OF NPC CIRCULAR NO. 17-01

Dear [Redacted],

We write in response to your letter-request received by the National Privacy Commission (NPC) which sought the exemption of the Credit Management Association of the Philippines (CMAP) from the coverage of NPC Circular No. 17-01.1

We understand that CMAP is a non-stock and non-profit organization, formed by a group of credit professionals who saw the need for an organization which would promote credit information exchange.2 It currently has close to more than three hundred members from various industries such as banking, financing, services, trading, manufacturing, and insurance.3

Discussion

Scope of the DPA

The Data Privacy Act of 2012 (DPA)4 applies to the processing of all types of personal information5 and to any natural and juridical person involved in personal information processing.

Processing is defined in the DPA as “any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.”6

As stated in your letter, CMAP collates public records such as court cases for easy access by members. This act of collating falls squarely on the above definition of processing.

In addition, you mentioned that CMAP members exchange information on loan defaults, past due accounts, bouncing checks, and other unfavorable credit standing of clients. It is not apparent whether these information are also made available to CMAP itself.

However, upon checking CMAP’s website, it states the following as its services,7 among others:

  1. Credit Information Exchange is an exchange of credit and collection data through mutual and reciprocal use of quality information.

  2. Listing of Court Cases is a compilation of court cased filed in the different courts of Metro Manila, Cebu and Davao in the following categories:

    • a. attachment
    • b. Batas Pambansa #22
    • c. Estafa
    • d. Forclosure
    • e. Illegal Recruitment
    • f. Ejectment
    • g. Other Deceits
    • h. Falsification of Public Document
    • i. Replevin
    • j. Sum of Money
    • k. Unlawful Detainer
    • l. Swindling

  3. Listing of Returned Checks is a compilation of clients who issued check(s) which was/were dishonored by the drawee bank submitted by CMAP’s members.

  4. Listing of Accounts Endorsed to Lawyers is a compilation of accounts endorsed to legal submitted by the members of CMAP.

  5. Listing of Past Due Accounts from telecommunication companies.

  6. Listing of Past Due Accounts from manufacturing companies.

From the foregoing, it is clear that CMAP is a personal information controller8 (PIC) who is collecting, exchanging, using, storing or processing personal data of its members’ clients, and thus, it is covered by the DPA, its Implementing Rules and Regulations (IRR) and other relevant issuances of the NPC.

Appointment of a Data Protection Officer (DPO)

PICs are required to designate an individual or individuals who are accountable for the organization’s compliance with the law.9 This requirement is further clarified in NPC Advisory No. 2018-019 dated 18 April 2018 on the Designation of Data Protection Officers (DPO).

The Advisory applies to all PICs and personal information processors (PIPs) both in the government or private sector. The designation of a DPO is mandatory for PICs and PIPs, regardless of the number of employees, number of sensitive personal information processed, nature of processing or duration or regularity of processing activities.10

Thus, CMAP is mandated to appoint or designate a DPO to ensure CMAP’s compliance with the DPA, its IRR and related issuances of the NPC. Any of the current employees of CMAP who possess the general qualifications of a DPO may perform such role – there is no need hire another person to function as the DPO.

Registration of the Data Processing Systems

To clarify, the registration of the data processing system (DPS) and the designation of the DPO are separate and distinct compliance requirements.

NPC Circular No. 2017-01 dated 31 July 2017 on the registration of DPS provides that in line with Sections 46 and 47 of the IRR, PICs or PIPs that employ fewer than two hundred fifty (250) shall not be required to register unless the processing it carries out is likely to pose risk to the rights and freedoms of the data subject, is not occasional, or includes sensitive personal information of at least one thousands (1,000) individuals.

You stated in your letter that the CMAP does not employ at least 250 persons and does not process 1,000 records involving sensitive personal information. We defer to such conclusion as the CMAP is in a better position of determining such numbers.

Nonetheless, it is advisable to review and re-evaluate the same, given that CMAP may be processing personal data of its members’ clients when it provides the services abovementioned. These activities of collating various lists which may contain both personal and sensitive personal information is included in making a determination of the 1,000-record threshold.

It is important to emphasize that the registration of the DPS is just one of the means to comply with the DPA. This means that while a PIC may not be required to register, it is still required to have a DPO, implement reasonable and appropriate security measures intended for the protection of personal information, and uphold the rights of the data subjects by adhering to the principles of transparency, legitimate purpose and proportionality.

This opinion is based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. National Privacy Commission, Registration of Data Processing Systems and Notifications regarding Automated Decision-Making Operations, Circular No. 17-01 [NPC Circular No. 2017-01] (31 July 2017). ↩

  2. Credit Management Association of the Philippines, About Us, available at http://www.cmaphil.com/portal/AboutCMAP/History.aspx (last accessed 26 February 2019). ↩

  3. Id. ↩

  4. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  5. Id. §3(g). ↩

  6. Id. § 3 (j). ↩

  7. Credit Management Association of the Philippines, Services, available at http://www.cmaphil.com/portal/AboutCMAP/Services.aspx (last accessed 12 March 2019). ↩

  8. Id. § 3 (b). ↩

  9. Data Privacy Act of 2012, § 21 (b). ↩

  10. National Privacy Commission, NPC Advisory Opinion No. 2018-019 (18 April 2018). ↩

Backlinks

  • No backlinks found