Text
31 March 2020
Re: TERMINATION OF SERVICES DUE TO CORPORATE DISSOLUTION
Dear [Redacted],
We write in response to your request for an advisory opinion received by the National Privacy Commission (NPC) which sought to clarify matters in relation to the termination of the Software Implementation Agreement (SIA) entered into by and between The Bayleaf, Lyceum of the Philippines (Bayleaf) and HDI System Technologies, Inc. (HDI) vis-à-vis the provisions of the Data Privacy Act of 20121 (DPA).
We understand that Bayleaf and HDI executed a SIA for the latter to provide human resource software modules to the former.
However, in anticipation of the forthcoming corporate dissolution of HDI, the parties drafted a Letter of Agreement (Letter) detailing the terms for the termination of the SIA. In the Letter, it was stated among others, that:
“In consideration of complete and proper disposal of the above enumerated data/information conducted by HDI Systech in the presence of and under the supervision of ''''' ''''' ''''''''''' on January 28, 2020, TBM hereby release, discharge and waive any and all actions of whatever nature which Bayleaf may have against HDI Systech, its directors, officers, employees and agents by reason of or arising from any data/information regarding transactions and dealings of HDI Systech with Bayleaf and its employees, such as but not limited to electronic mail (e-mail), physical and digital copies of documents, codes, and database that HDI Systech acquired under the Software Implementation Agreement with Bayleaf executed in January 28, 2020.”
In line with the forgoing provision in the Letter, Bayleaf would now like to seek clarification on the following matters:
-
Is the stipulation in the Letter cited above tenable? Should Bayleaf require HDI to issue a certification of complete and proper disposal in lieu of the Letter? What instrument should be prepared which will best uphold the data privacy of the data subjects in this case?
-
Who shall be made liable for any negligence or punishable acts under the DPA if the responsible party is a dissolved corporation? Based on the facts, who should be made liable?
Discussion
Relationship between Bayleaf and HDI
An examination of the SIA executed between the parties would reveal that Bayleaf is the customer and HDI is the supplier of the software. In this scenario, Bayleaf is the personal information controller (PIC) while the latter may be considered a personal information processor (PIP), depending on whether or not Bayleaf authorized HDI to process personal and sensitive personal information (collectively, personal data) on its behalf.
Looking at the SIA’s provisions on Implementation Services and Technical Services, it seems that HDI’s role is limited only with respect to assisting and preparing Bayleaf to implement the new system, guide and provide input for the converting of data, assist Bayleaf in designing the integration of the software, provide Bayleaf specific knowledge on how to configure the software and train Bayleaf’s trainers and/or users on the operations of the software.
But as stated in your letter request, “in the course of performing the services, HDI processed personal data.” With this, we therefore assume that HDI is a PIP who had the occasion to process personal data during the implementation of the SIA.
Disposal of information upon termination of agreement
The determination of the appropriate security measures to be undertaken by the parties with regard to the disposal and turnover of confidential information is best left with the parties as they are more competent in determining the needs of their organizations. This includes determining whether or not there is a need to issue a certification of complete and proper disposal or any other instrument to ensure that proper safeguards were put in place.
In this case, Paragraph 11.4 of the SIA provides for the proper and full turnover of confidential information upon termination of the Agreement between the parties. While there is a provision providing for the proper and full turnover of confidential information, the parties may also be guided by Section 27 (d) of the Implementing Rules and Regulations (IRR) of the Data Privacy Act of 20122. Said provision mandates the parties to implement policies and procedures regarding the transfer, removal, disposal, and re-use of electronic media, to ensure appropriate protection of personal data.
On the other hand, in determining the appropriate level of security that should be implemented, the parties may be guided by Section 29 of the IRR. As such, the parties should take into account the nature of the personal data that requires protection, the risks posed by the processing, the size of the organization and complexity of its operations, current data privacy best practices, and the cost of security implementation.
Waiver of actions; liability for punishable acts under the DPA; dissolution; Revised Corporation Code
We note that the Letter of Agreement provides for the release, discharge and waiver of all actions of whatever nature which Bayleaf may have against HDI in connection with any data/information which HDI acquired under the SIA. However, basic is the principle that the law is deemed written into every contract, such that while a contract is the law between the parties, the provisions of positive law which regulate contracts shall limit and govern their relations.3
We note that pursuant to the principle of accountability under the DPA, PICs are expected to be responsible for any personal data under its control or custody, including the processing of information that have been outsourced to a PIP by the use of contractual or other reasonable means. With this, PIPs may still be held contractually liable to the PIC for violations of their agreement despite the provision on waiver in the Letter of Agreement.
In any case, a data subject may file a complaint in case of violation of his or her rights. Section 3 of NPC Circular No. 16-04 provides that persons who are the subject of a privacy violation or personal data breach, or who are otherwise personally affected by a violation of the Data Privacy Act, may file complaints for violations of the Act.4
Dissolution of a corporation and concomitant obligations and liabilities
With respect to the dissolution of a corporation and the concomitant obligations and liabilities of its directors, officers, and/or employees, the same shall be governed by its Articles of Incorporation and By-Laws, and the provisions of the Revised Corporation Code (RCC).5
Particularly, Section 139 of the RCC provides that a corporation shall remain a body corporate for three (3) years for purposes of prosecuting and defending suits by or against it and enabling it to settle and close its affairs, dispose of and convey its property, and distribute its assets, and at any time within the said period, the corporation is authorized to convey all its property to trustees to which legal interest vests in, for the benefit of its stockholders, members, creditors and other persons in interests.
In case all of the corporation’s properties are conveyed to trustees within the said three (3) year period, the trustees may sue and be sued as such in all matter connected with the liquidation. The trustees become the legal owners of the property conveyed, subject to the beneficial interest therein of creditors and stockholders.6
Such being the case, the liability of HDI’s directors, officers, employees, agents or representatives as stated in paragraphs 15.5 and 15.6 of the SIA will remain until the time provided for under the RCC and existing rules and jurisprudence, to enable it to defend any suit against it.
In addition, the dissolution of the company will not affect its liability because the clauses in the SIA, by nature and intent, are intended to survive the termination of the agreement, as provided for in paragraph 11.5 of the same. Thus, the obligation for confidentiality as stated in paragraph 13.2 as well as the liability of responsible officers, who participated in, or by their gross negligence, allowed the commission of the crime, shall remain.
While we make no determination on the rights of the parties, the nature of their agreement, or possible liabilities, what is clear is that reasonable and appropriate safeguards must be put in place to protect the rights of data subjects.
This advisory opinion is based on the information provided and may vary based on additional information or when the facts are changed or elaborated.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 (2016). ↩
-
Heirs of Severina San Miguel v. CA, 416 Phil. 943, 954 (2001). ↩
-
National Privacy Commission, NPC Advisory Opinion No. 2017-058 (October 3, 2017). ↩
-
An Act Providing for the Revised Corporation Code of the Philippines [Revised Corporation Code of the Philippines], Republic Act No. 11232 (2019). ↩
-
Sec OGC-Opinion No. 18-09 dated June 4, 2018 citing Reburiano v. CA (G.R. No. 102965, January 21, 1999). ↩