Text
31 March 2020
Re: OUTSOURCING THE PROCESSING OF PERSONAL DATA
Dear [Redacted],
We write in response to your request for an advisory opinion received by the National Privacy Commission (NPC) which sought to clarify on whether it is permissible to relax or if there are alternatives to the requirement of an outsourcing agreement in instances where a stringent application of the Data Privacy Act of 2012 (DPA)1 and its Implementing Rules and Regulations (IRR)2 is operationally or relationally not feasible.
In your letter, you disclosed that the University of the Philippines (UP) outsources the processing of personal data to various personal information processors (PIPs). Among others, UP is currently using Google’s Gmail services for its email, Microsoft’s OneDrive for the storage of data files, Facebook and Twitter for the process of posting information to the public and local couriers and logistic providers for delivery needs.
Discussion
Outsourcing; personal information controllers and personal information processors
Outsourcing is defined as the disclosure or transfer of personal data by a personal information controller (PIC) to a service provider, considered as a personal information processor (PIP).3 The purpose of such disclosure is for the PIP to perform processing activities on the personal data upon the instructions of the PIC.4 Under an outsourcing agreement, the PIP has no other purpose for the personal data and it cannot amend or process the same outside the bounds of its agreement with the PIC.5 The PIP’s processing of the personal data is merely to carry out the instructions given by the PIC in accordance with their agreement.
Hence, the PIC remains to be responsible for any personal data that have been outsourced or transferred to a PIC.6 Among others, the PIC is responsible for determining the purpose and means for the processing of the personal data. The PIC shall also ensure that the personal data transferred to a PIP for processing must not be used by the latter for other purposes and that the PIP has physical, technical and organizational security measures in place to ensure protection of the personal data.
Legal obligations of the PIC and PIP
To reiterate, the DPA allows a PIC to outsource the processing of personal data to a PIP provided proper safeguards are in place to ensure the security of such personal data.7 One way of ensuring both parties’ compliance with the DPA is through a contract or other legal act that binds the PIP to the PIC.8
Based on the wording of the law, the DPA does not require every outsourcing arrangement to be governed by an outsourcing agreement. In fact, it provides that such arrangement may also be governed by any other legal act that clearly indicates the legal obligations of the parties. This way, the PIC can ensure that the PIP is legally bound to it and may be held accountable in case of breach of the agreement.
In view of the foregoing, although there is an arrangement wherein the processing of personal data is outsourced to a service provider, the wording of the DPA must not be construed literally to the effect that an outsourcing agreement must be entered into by the parties.
For instance, the applicable terms and conditions indicated when availing of the email services of Google or the engagement letter with the terms and conditions provided by a local courier shall suffice for as long as proper safeguards in the protection of personal data are in place, as required by the DPA.
We note that UP, as a PIC, is still accountable for complying with the requirements of the DPA and shall use reasonable means to provide a similar level of protection while personal data is being processed by a service provider.
This opinion is provided based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 (2016). ↩
-
Id. ↩
-
See: National Privacy Commission, NPC Advisory Opinion No. 2018-015 (April 12, 2018). ↩
-
Ibid. ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, § 50. ↩