Text
October 24, 2019
Re: COLLABORATION WITH INSURANCE COMPANIES FOR ACCESS TO CONTACT DETAILS OF DATA SUBJECTS FOR PURPOSES OF PRODUCT RECALL
Dear [Redacted],
We write in response to your inquiry which sought to clarify matters regarding the Data Privacy Act of 20121 (DPA), particularly on the legitimate purpose in seeking assistance from and collaborating with insurance companies for access to the updated personal information and contact details of the insured vehicle owners, in relation to the on-going campaign of Honda Cars Philippines, Inc. (HCPI) for the product recall pertaining to the replacement of vehicle parts/components relating to the safety of the vehicle and its passengers.
HCPI has experienced low campaign and completion ratio (CCR) with respect to the product recall because HCPI’s customer records are no longer current. Many of the notices sent by HCPI to owners of affected vehicles has been returned unserved.
Hence, HCPI would like to request from insurance agencies or companies for the updated contact details of insurance policy holders with Honda vehicles for the sole purpose of enabling HCPI to reach out to those covered by the product recall. HCPI anticipates that the insurance agencies or companies will be apprehensive about sharing personal data of their insured clients because of the provisions of the DPA.
Discussion
Vitally important interests of data subject; further processing of a data subject’s personal information
Based on your representation, HCPI’s proposed processing of the personal data of the insured vehicle owners is with the intention of protecting the vitally important interests of the said Honda car owners, pursuant to Section 12(d) of the DPA, thus, there is a need to inform as many of the current vehicle owners as possible of the product recall.
However, the EU General Data Protection Regulation (GDPR),2 the successor of the EU Data Protection Directive (Directive 95/46/EC) which highly influenced the DPA, provides further insight on this particular lawful criterion for processing, to wit:
“The processing of personal data should also be regarded to be lawful where it is necessary to protect an interest which is essential for the life of the data subject or that of another natural person. Processing of personal data based on the vital interest of another natural person should in principle take place only where the processing cannot be manifestly based on another legal basis. Some types of processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread or in situations of humanitarian emergencies, in particular in situations of natural and man-made disasters.”3
Also, the UK Information Commissioner’s Office discussed “vital interest” as intended to cover only interests that are essential for someone’s life, and generally only applies to matters of life and death.4 It is likely to be particularly relevant for emergency medical care.5 Finally, in order to rely on this criterion, the processing must be necessary - if one can reasonably protect the data subjects’ vital interests in another less intrusive ways, this basis will not apply.6
From the foregoing, it seems that such criterion for lawful processing to protect the vitally important interests of data subjects is not squarely applicable for the HCPI’s processing vis-à-vis its product recall campaign.
Other lawful bases for processing; contract; legitimate interest
HCPI may consider the other lawful criteria for processing of personal information as provided for in Section 12, i.e. processing is necessary and is related to the fulfillment of the contract7 of sale in relation to HCPI’s obligation to warrant the goods against any hidden defects or legitimate interest8 of HCPI. For the insurance companies, they may be able to process and disclose the insured’s information based on its duty to fulfill the contract of insurance or even the legitimate interest of the insurance company.
In any case, HCPI and the insurance companies are advised to determine the most appropriate basis for the sharing or disclosure of such personal information, with due consideration of the rights and freedoms of the data subjects.
General data privacy principles; proportionality
The processing of personal information must adhere to the data privacy principles of transparency, legitimate purpose, and proportionality. As such, the data subject must be aware of the nature, purpose and extent of the processing of his or her personal data including the risks and safeguards involved, the identity of the personal information controller, his or
her rights as data subject, and how these rights can be exercised. With regard to proportionality, the processing of information must be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.9 Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.10
From the foregoing, the proposed HCPI collaboration with the insurance companies for access to the updated personal information of the insured vehicle owners should strictly be limited to the sharing of the personal information which is adequate and necessary for the on-going product recall campaign.
In addition, HCPI should also consider the availability of other measures to inform such owners of the product recall, i.e. launching an intensified information campaign through various traditional media and social media, utilizing the resources of its dealerships across the country to intensify the campaign, among others. HCPI may likewise request the insurance companies to check their respective records and determine if there are insured Honda vehicles which are qualified for the product recall. Such insurance companies may then directly inform these insured car owners of the HCPI’s product recall campaign.
This opinion is based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), Recital 26. ↩
-
Id., Recital 46. ↩
-
UK Information Commissioner’s Office, Vital interests, available at https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/vital-interests/ (last accessed: 27 August 2019). ↩
-
Id. ↩
-
Id. ↩
-
Id., § 12 (f). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (c) (2016). ↩
-
Id. ↩