Text
23 October 2019
Re: CREDIT CARD FRAUD INVESTIGATION
Dear [Redacted],
We write in response to your inquiry seeking clarification on the provisions of the Data Privacy Act of 20121 (DPA) in relation to the Philippine Credit Card Industry Regulation Law2 on credit card fraud investigations.
Discussion
As stated in your letter, we understand that one of the main drivers of credit card fraud losses is the unauthorized or fraudulent transactions in e-commerce platforms or those involving online merchants, whereby credit cards are used by unauthorized persons to purchase goods.
We understand further that in order to combat this type of fraud and launch an investigation, the personal information submitted to the online merchant during the order taking is needed to be able to track the delivery of the goods sold, and thereafter apprehend the perpetrator with the assistance of law enforcement agencies.
You ask whether the disclosure of the personal information provided to the online merchants, such as the name, address, delivery address, email address, and mobile or other contact number, to the credit card issuers for purposes of fraud investigation, is allowed under the DPA.
Discussion
Credit card details; personal information; lawful processing
We consider the above details provided to the online merchants during the order taking as personal information, the processing of which should comply with the provisions of the DPA, its Implementing Rules and Regulations3 (IRR), and related issuances of the National Privacy Commission (NPC).
Based on the given scenario, the disclosure of the personal information held by the online merchants to the credit card issuers for fraud investigation may fall under Section 12 (f) of the DPA, where processing is necessary for the purposes of the legitimate interests pursued by the personal information controller (PIC) or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.4
In the determination of legitimate interest, PICs must consider the following:5
- Purpose test — The existence of a legitimate interest must be clearly established, including a determination of what the particular processing operation seeks to achieve;
- Necessity test — The processing of personal information must be necessary for the purpose of the legitimate interest pursued by the PIC or third party to whom personal information is disclosed, where such purpose could not be reasonably fulfilled by other means; and
- Balancing test — The fundamental rights and freedoms of data subjects must not be overridden by the legitimate interests of the PIC or third party, considering the likely impact of the processing on the data subjects.
As to the disclosure of such personal information to law enforcement, regulatory, or investigative agencies, the same is also recognized under Section 12 (c) of the DPA, where processing is necessary for compliance with a legal obligation to which the PIC is subject, or Section 12 (e) — processing that is necessary to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate.
Under any of these provisions, it is understood that the government agencies involved are processing information which is necessary to carry out their respective mandates as provided by law, and there is strict adherence to all substantive and procedural processes.
We also take note of the provisions of the Philippine Credit Card Industry Regulation Law. Section 16 of the law recognizes several instances where credit card issuers may disclose data of cardholders, to wit:
Section 16. Confidentiality of information. — Credit card issuers, their officers, employees and agents shall keep strictly confidential the data on the cardholder, except under any of the following circumstances:
a. Disclosure is with consent of the cardholder; b. Customer information is released, submitted or exchanged with credit information bureaus, industry association, or card association; c. Upon orders of a court of competent jurisdiction or any government office or agency authorized by law, or under such conditions as may be prescribed by the Monetary Board of the BSP; d. Disclosure to third party service providers is necessary for the sole purpose of assisting or rendering service to the credit card issuer in enforcing its rights against the cardholder; e. Disclosure to third parties such as insurance companies is necessary for the sole purpose of insuring the credit card issuer from cardholder default or other credit loss, and the cardholder from fraud or unauthorized charges; f. Disclosure to third parties is for the purpose of investigating fraud or unauthorized activities or mitigating risk involving card issuance, use and acquiring. xxx.
In this instance, disclosures by the credit card issuers of personal information pertaining to the unauthorized persons fraudulently using another person’s credit card may be allowed (1) upon orders of a government office or agency authorized by law, or (2) for the purpose of investigating fraud or unauthorized activities.
General data privacy principles; proportionality; data subjects’ rights
While the processing of personal information for the above purpose may be allowed under the DPA and relevant laws, online merchants, credit card issuers, as well as the pertinent government agencies still have the obligation to observe the general data privacy principles of transparency, legitimate purpose and proportionality, and take the necessary steps to protect and uphold the rights of the data subject.
Specifically for the proportionality principle, the same requires that “the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.”6
Hence, the disclosure of the personal information should be limited to that which is relevant and necessary to the transaction under investigation, which in this case is limited to the name, address, delivery address, and contact details of the unauthorized person fraudulently using the credit card.
It is further recommended that credit card issuers and their partner-merchants implement reasonable and appropriate security measures to ensure that the personal information of cardholders are properly protected, endeavor to educate them on how to secure their credit cards against fraudulent activities, and have procedures in place whereby cardholders would be able to easily report lost or stolen credit cards and other suspicious transactions.
This is in keeping with the declared policy of the state to institute appropriate mechanisms to protect and educate credit cardholders, thereby ensuring the vibrancy and growth of the credit card industry.7
This opinion is rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
An Act Regulating The Philippine Credit Card Industry [Philippine Credit Card Industry Regulation Law], Republic Act No. 10870 (2016). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 (2016). ↩
-
See generally, Data Privacy Act of 2012, § 12 (f); United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ [last accessed on June 11, 2018]. ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, § 17 (c). ↩
-
Philippine Credit Card Industry Regulation Law, § 2. ↩