Text
6 November 2019
Re: AUTHORITY TO SHARE CUSTOMERS’ PERSONAL INFORMATION TO PARTNER LOAN PROVIDER
Dear [Redacted],
We write in response to your letter requesting for an advisory opinion on sharing customers’ personal information. As stated in your letter, CIS Bayad Center, Inc. (Bayad Center) accepts payments for Social Security System (SSS) contributions and stores the payment details including SSS numbers in the database for purposes such as addressing payment history inquiries, Bayad Center promotions, rewards, loyalty programs, advisories and updates, as well as credit scoring purposes upon a customer’s request. These purposes are contained in the Data Privacy Consent Form filled out by your clients.
Discussion
Further, we understand that there is a proposed contract between Bayad Center and its partner loan provider, Home Credit, for the latter’s credit scoring of your customers. In the proposed contract, Home Credit will provide Bayad Center the SSS numbers of its loan applicants, which will then be cross-matched with Bayad Center’s database. If a match occurs, Bayad Center will send to Home Credit the following: (1) biller code, (2) transaction amount, (3) transaction date, and (4) SSS number. If otherwise, no data shall be shared.
You now inquire whether Bayad Center customer’s consent to the processing of their personal data for credit scoring purposes upon the customer’s request and/or Bayad Center’s loan provider partner’s separate Consent Form clause will be sufficient to vest Bayad Center the authority to share its customers’ data to Home Credit for credit scoring.
Discussion
Consent of the data subject required for processing of personal data for other purposes
Section 3(b) of the Data Privacy Act of 20121 defines “consent of the data subject” as any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. The law further provides that consent shall be evidenced by written, electronic or recorded means.
While the NPC was not furnished with Bayad Center’s Consent Form, we note that in your letter, it was qualified that credit scoring was made “upon customer’s request.” This phrase, in effect, limits the consent for the processing of personal data given by the data subject to Bayad Center through the Consent Form such that the processing of customer’s personal data for credit scoring shall be allowed only upon a separate request from the customer.
The DPA provides that the purpose for processing must be specific and declared to the data subject. Therefore, the Bayad Center’s Consent Form filled out by its client alone, without the separate request for credit scoring is not sufficient to vest Bayad Center the authority to share its customers’ personal data to its loan provider partner for credit scoring.
On the other hand, you have quoted paragraphs (2), (3), (4) and (7) of the Home Credit Consent Form. You inquire whether the provisions are sufficient to vest Bayad Center the authority to share its customers’ data. You posit that Bayad Center is specifically mentioned as a Partner in the consent form. And even assuming that Bayad Center is not explicitly named as a Partner in the form, it is nonetheless included in the full list of partners in Home Credit’s website.
We take note of item (3) of the consent form which provides:
(3) I allow (loan provider), directly or through the Partners, to collect and process my personal information and sensitive personal information including my name, age, photographs, fingerprints, other biometric data (facial recognition and voice recognition), employment details, income, financial data, financial profile, credit standing, loan payment history, and other information required in the application form. I allow the use of these information for credit verification, credit scoring, data analytics, collection, automated processing of the loan, collecting, data profiling, direct marketing of products and services of Partners, and offering of existing and new financial services.
Given the above, Home Credit’s loan applicants who duly sign the consent form have agreed to the processing of their personal data for credit scoring, and such personal data may be obtained from Home Credit’s Partners. Thus, the collection of personal data, including the customer’s biller code, transaction amount, transaction date and SSS number from Bayad Center for credit scoring may be allowed.
However, we take this opportunity to emphasize that Bayad Center, as a personal information controller (PIC), is ultimately responsible for compliance to the law, including adherence to the data privacy principles of transparency, legitimate purpose, and proportionality.2 Under the DPA, each PIC is responsible for personal information under its control or custody, including information that have been transferred to a third party for processing.3
In this case, on the part of Bayad Center’s customers, it is unclear that the company will be sharing personal data to third parties even without their request. While there is basis for Bayad Center to disclose personal data to Home Credit on the basis of the latter’s consent form, Bayad Center should be transparent to its customers and inform them of that their personal data will be processed for credit scoring should they be a loan applicant of Home Credit. At the very least, this information should be stated in Bayad Center’s privacy notice.
Execution of a data sharing agreement required
Bayad Center and Home Credit should execute a data sharing agreement in accordance with Section 20 of the Implementing Rules and Regulations (IRR) of the DPA which provides that data sharing for commercial purposes, including direct marketing, shall be covered by a DSA. The agreement shall establish adequate safeguards for the protection of personal data and uphold rights of data subjects.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩