Text
18 March 2019
Re: DISCLOSURE OF PERSONAL INFORMATION AND BASIC CREDIT DATA OF INDIVIDUAL BORROWERS FOR AUDIT PURPOSES
Dear [Redacted],
We write in response to your request for an advisory opinion on the propriety of disclosing to the Commission on Audit (COA)-LBP State Auditors the personal information1 and basic credit data2 of individual borrowers3 who availed and received loans from the Land Bank of the Philippines (LBP), for audit purposes and pursuant to the powers vested to COA under the 1987 Philippine Constitution and Rule II, Section 3 of its 2009 Revised Rules of Procedures.
In particular, you seek clarification on the propriety of disclosure given the exemption from the scope of the DPA, as claimed by COA.
Discussion
Scope of the DPA
The Data Privacy Act of 2012 (DPA)4 applies to all types of processing of personal data,5 including disclosure of basic credit data of individual borrowers.
We affirm that Section 4 of the DPA and Section 5 of its Implementing Rules and Regulations (IRR) exempt certain categories of information from its scope and application. However, such exemption applies only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned.6
Furthermore, the non-applicability is not absolute because the DPA still requires the personal information controller (PIC) or personal information processor (PIP) to comply with other conditions for personal data processing, including implementing security measures to protect personal data and upholding the rights of the data subjects.7
Thus, we emphasize that the requirements under the law, including penalties for violation thereof, will still be applicable to the processing of personal data that involves specific types of information belonging to any of the exemptions.
Criteria for lawful processing of personal information; mandate of the Commission on Audit
We take notice of the provision on confidentiality of information indicated under Part III Section X304.12 of the Manual of Regulations for Banks (MORB) Volume 1, which states:
Confidentiality of Information. Banks shall keep strictly confidential the data on the borrower or consumer, except under the following circumstances:
- a. disclosure of information is with the consent of the borrower or consumer;
- b. release, submission or exchange of customer information with other financial institutions, credit information bureaus, lenders, their subsidiaries and affiliates;
- c. upon orders of competent jurisdiction or any government office or agency authorized by law, or under such conditions as may be prescribed by the Monetary Board;
- d. disclosure to collection agencies, counsels and other agents of the bank to enforce its rights against the borrower;
- e. disclosure to third party service providers solely for the purpose of assisting or rendering services to the bank in the administration of its lending business; and
- f. disclosure to third parties such as insurance companies, solely for the purpose of insuring the bank from borrower default or other credit loss, and the borrower from fraud or unauthorized charges. (Circular No. 702 dated 15 December 2010)8
Based on the foregoing, all information pertaining to borrowers are strictly confidential unless the disclosure to be made by the banks falls under the circumstances enumerated, including disclosure to a government office or agency authorized by law.
On the other hand, the processing of personal and sensitive personal information may be based on the various criteria under Section 12 and 13 of the DPA, to wit:
SECTION 12. Criteria for Lawful Processing of Personal Information. – xxx
- (a) The data subject has given his or her consent;
- (b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract;
- (c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;
- (d) The processing is necessary to protect vitally important interests of the data subject, including life and health;
Based on the foregoing circumstances and the mandate of COA under the Constitution and existing laws, the disclosure of personal information and basic credit data of individual borrowers from the LBP to the COA may be considered as compliant with the DPA provided that such disclosure is necessary and is justified by the constitutional and statutory mandate of the COA as the supreme audit institution of the State.
However, in accordance with the principle of proportionality and data minimization, the LBP should disclose only such personal data and basic credit data as are necessary for COA to fulfill its audit mandate, and not all information in its files.
This opinion is based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
Data Privacy Act of 2012, § 3(g) - Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual. ↩
-
Republic Act 9510, 3(b) - “Basic Credit Data” refers to positive and negative information provided by a borrower to a submitting entity in connection with the application for and availment of a credit facility and any information on the borrower’s creditworthiness in the possession of the submitting entity and other factual and objective information related or relevant thereto in the submitting entity’s data files or that of other sources of information: Provided, that in the absence of a written waiver duly accomplished by the borrower, basic credit data shall exclude confidential information on bank deposits and/or clients funds under Republic Act No. 1405 (Law on Secrecy of Bank Deposits), Republic Act No. 6426 (The Foreign Currency Deposit Act), Republic Act No. 8791 (The General Banking Law of 2000), Republic Act No. 9160 (Anti-Money Laundering Law) and their amendatory laws. ↩
-
R.A. 9510, 3(c) - “Borrower” refers to a natural or juridical person, including any local government unit (LGU), its subsidiaries and affiliates, that applies for and/or avails of a credit facility. ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 5 (2016). ↩
-
Ibid. ↩
-
Part III, Section X304.12, Manual of Regulations for Banks (MORB), Volume 1. ↩