Text
7 February 2020
Dear [Redacted],
Re: COLLECTION AGENCY COMMUNICATING WITH HUMAN RESOURCE DEPARTMENT
We write in response to your letter received by the National Privacy Commission (NPC). Upon further evaluation, the Complaints and Investigation Division of the NPC endorsed your letter to the Policy Review Division for an advisory opinion in accordance with the Rules of Procedure of the NPC. You inquired on whether the Human Resource (HR) department of your employer is allowed to communicate with the collection agency regarding your unpaid personal loan without your consent.
We understand that you are an employee of an insurance company. You further disclosed that a collection agency allegedly representing a certain bank sent an email to your employer’s customer service email address regarding your unsettled loan.
After having been forwarded to two other departments, the email was eventually forwarded to the HR department, which then informed you about the same. They further informed you that two cases will be filed against you in court if you fail to communicate with collection agency. The HR department also told you to resolve the issue immediately so as not to jeopardize your employment and further requested for a copy of the settlement made with the collection agency.
You now inquire on how the HR department came to know about the two court cases that will be filed against you, since such details were not included in the email that was sent, and if the corresponding actions of the HR department are in violation of your rights under the Data Privacy Act of 20121 (DPA).
Discussion
Lawful criteria for processing; legitimate interests of the personal information controller
Under the DPA, the employment details of an individual are considered personal information.2 Information about an individual’s employment, when put together with other information, would directly and certainly identify an individual.3 Subject to prohibition by existing law, the processing of such information shall be allowed only if at least one of the criteria provided by Section 12 of the DPA are met.
In particular, Section 12 (f) of the DPA provides that the processing of personal information is allowed when it is “necessary for the purpose of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.”
For this criterion, the personal information controller (PIC) must be able to establish that it has a legitimate interest or purpose in the processing of personal information. Legitimate interests, as discussed in our NPC Advisory Opinion No. 2018-061, are matters that are desired by or important to a PIC, which may include business, financial or other reasonable purpose.4 Such legitimate interest, reasonable purpose and intended outcome must be clearly identified by the PIC or a third party or parties to whom the personal data is disclosed.5
Furthermore, the PIC must consider the following in using legitimate interest as its basis for lawful processing:
- Purpose test – the processing of personal information must be compatible the PIC’s objectives for its business, which must be clearly determined;
- Necessity test – the processing of personal information must be necessary for the purpose of pursuing the legitimate interests of the PIC and such purpose could not be reasonably achieved by other means; and
- Balancing test – the data subject’s interests, rights or freedoms should not be overridden by the legitimate interests pursued by the PIC.6
Although employers are not obliged to respond to requests for confirmation of employment status, they may do so, provided it is done truthfully, in good faith and pursuant to a legitimate interest of the company or the third party to whom the data is disclosed. Hence, the HR department may confirm the employment status of its employee as long as it can establish that it was done pursuant to a legitimate interest of the company or the third party. The disclosure must be reasonable, limited only to the fact of verification of the employment status and must not include the disclosure of other personal data.
It is also worth noting that the HR department may implement policies with regard to employment confirmation requests to address similar incidents in the future. For instance, such policies may provide for the type of information to be disclosed, among others.
As to your question on whether the company may communicate with the collection agency, if the communication is for the sole purpose of confirming the employment status of an employee, the same may fall under the legitimate interest of the company and/or the collection agency, as discussed above.
We note that the collection agency, allegedly collecting on behalf of a bank, is considered a personal information processor (PIP). Hence, the collection agency must also adhere to the requirements of the DPA in the processing of personal data and must ensure the protection of personal data at all times.
Hence, if the purpose of the collection agency’s communication to the employer’s HR department is to discuss the alleged unsettled loan obligation and the filing of cases in court for an alleged offense/s by one of its employees then such communication/disclosure should have a basis under Section 13 of the DPA dealing with processing of sensitive personal information, the definition of which includes information about any proceeding for any offense committed or alleged to have been committed by such person. If otherwise, there may be a violation of the DPA.
Employer-employee relationship; labor matter
Lastly, you sought clarification on whether the HR Department can threaten an employee due to an unsettled obligation. As this may be a labor matter, the NPC is not the appropriate agency to address this concern.
This opinion is based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission and other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Data Privacy Act of 2012, § 3 (g). ↩
-
Ibid. ↩
-
National Privacy Commission, NPC Advisory Opinion No. 2018-061 citing United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ (Anything illegitimate, unethical or unlawful is not a legitimate interest). ↩
-
Ibid. ↩
-
United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ (last accessed Aug. 8, 2019). ↩