NPC Issuance Wiki

NPC Advisory Opinion No. 2020-055 — Lawful Processing of Personal Data for Securitization

Issued Advisory Opinion

Official opinion tags

Text

29 December 2020

Re: APPLICABILITY OF THE CRITERIA FOR LAWFUL PROCESSING OF PERSONAL AND SENSITIVE PERSONAL INFORMATION

Dear [Redacted],

We write in response to your respective requests for advisory opinion which sought to confirm the applicability of the criteria for lawful processing of personal and sensitive personal information (collectively, personal data) under the Data Privacy Act of 2012 (DPA)1 in the intended transactions of the following:

  • National Home Mortgage Finance Corporation (NHMFC) in relation to the securitization of housing receivables through the issuance and sale of bonds/securities to the capital market; and
  • Social Housing Finance Corporation (SHFC) for the securitization of loan receivables through the sale of bonds to residential developers.

In particular, both requests sought clarification on whether the consent of the individual housing loan borrowers and/or member beneficiaries for the processing of personal data provided in the loan documents is no longer required for the conduct of the due diligence and in the preparation and implementation of the securitization plan.

Discussion

NHMFC and SHFC mandates; powers and functions; public authority

We understand that the NHMFC is a government-owned and controlled corporation (GOCC), created by virtue of Presidential Decree No. 12672 (PD No. 1267) to develop and provide for a secondary market for home mortgages granted by public and/or private home financing institutions, with a mandate to purchase home loan mortgages to serve as the underlying asset for its securitization issuances. NHMFC was mandated to implement the Unified Home Lending Program (UHLP), a lending system of subsidized lending for low-cost housing, as provided for under Executive Order No. 90.3 Loans originated under the UHLP lending guidelines were purchased by NHMFC for eventual securitization.

We understand further that the SHFC is also a GOCC, established under Executive Order No. 257.4 Under the Executive Order No. 257, the SHFC shall be the lead government agency to undertake social housing programs that will cater to the formal and informal sectors in the low-income bracket and shall take charge of developing and administering social housing program schemes, particularly the Community Mortgage Program (CMP) and the AKPF Program (amortization support program and development financing program).

From the above, both the NHMFC and SHFC may be considered as public authorities engaged in personal data processing.

We understand that both NHMFC and SHFC plans to securitize receivables from various loan programs. NHMFC plans to offer the same to the capital market, while SHFC offer it to residential developers as Balai bonds.

We also understand there must be prior approval by the Securities and Exchange Commission (SEC) of the respective securitization plans before the securities can be issued. And to prepare and complete such plans, both GOCCs will be assisted by transaction advisors who will be conducting due diligence and reviewing all the executed loan documents which include the processing of PI and SPI of the individual borrowers/member beneficiaries. These are required pursuant to the relevant provisions of Republic Act No. 9267 or the Securitization Act of 2004.5

It is evident that the preparation and implementation of the securitization plans would entail processing of personal data and should comply with any of the various criteria for lawful processing under the DPA, specifically under Sections 12 or 13 of the law.

For processing personal and sensitive personal information, this may be done pursuant to the applicable provisions Section 12 and 13, to wit:

SECTION 12. Criteria for Lawful Processing of Personal Information. — The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists: xxx xxx xxx

c. The processing is necessary for compliance with a legal obligation to which the personal information controller is subject; xxx xxx xxx

e. The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; xxx xxx xxx

SECTION 13. Sensitive Personal Information and Privileged Information. — The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases: xxx xxx xxx

b. The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information; xxx xxx xxx.

From the foregoing, it is worthy to note that lawful processing is not always anchored or based on the presence of consent as there are other criteria which may be more appropriate and may be invoked by the personal information controller as contemplated above.

Thus, both NHMFC and SHFC may be allowed to process personal data based on the above provisions of law, and the consent of the individual borrowers/member beneficiaries is no longer required in the conduct of due diligence and in the implementation of the securitization plan.

Finally, we would like to reiterate that while a government agency may collect and process personal data even without the consent of the data subject, where such collection and processing is based on a statutory mandate, this is with the concomitant responsibility of ensuring that organizational, physical, and technical security measures are in place to protect the personal data it is processing.6

Implementing security measures; non-disclosure agreement

The NHMFC and SHFC, as personal information controllers, are duty-bound to comply with the DPA, its Implementing Rules and Regulations (IRR), and other relevant issuances of the National Privacy Commission, including the implementation of security measures.

For this purpose, the transaction advisors and personnel who will be engaged and authorized by both GOCCs to process personal data in the conduct of due diligence and in preparing the securitization plan may be required to sign a non-disclosure agreement or similar contract to ensure confidentiality and to prevent any unauthorized processing of the collected personal data. Please refer also to Sections 43-45 of the IRR of the DPA on guidance for outsourcing and subcontracting agreements.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. Creating A National Home Mortgage Finance Corporation Defining its Powers and Functions and for Other Purposes, Presidential Decree No. 1267 [PD No. 1267] (December 21, 1977). ↩

  3. Identifying the Government Agencies Essential for the National Shelter Program and Defining Their Mandates, Creating the Housing and Urban Development Coordinating Council, Rationalizing Funding Sources and Lending Mechanisms for Home Mortgages and for Other Purposes, Executive Order No. 90, [EO No. 90] (December 17, 1986). ↩

  4. Executive Order No. 272, Authorizing The Creation Of The Social Housing Finance Corporation And Directing The Transfer Of The Community Mortgage Program, Abot-Kaya Pabahay Fund Program, And Other Social Housing Powers And Functions Of The National Home Mortgage Finance Corporation To The Social Housing Finance Corporation (20 January 2004). ↩

  5. An Act Providing The Regulatory Framework For Securitization And Granting For The Purpose Exemptions From The Operation Of Certain Laws [The Securitization Act of 2004], Republic Act No. 9267 (2004). ↩

  6. See: NPC Advisory Opinion No. 2018-02 (15 January 2018). ↩

Backlinks

  • No backlinks found