Text
16 April 2021
Re: DOCUMENTARY REQUIREMENTS FOR ACCREDITATION AS FINANCIAL INSTITUTION
Dear [Redacted],
We write in response to your request for assistance and clarification received by the National Privacy Commission (NPC) on matters relating to the application of the Public Safety Savings and Loan Association, Inc. (PSSLAI) for accreditation as a financial institution with the Philippine National Police (PNP).
We understand that the PNP, through its Committee on Accreditation and Automatic Deduction (CAAD), certifies and accredits financial institutions who are likewise granted the privilege to avail of the PNP’s Automatic Salary and Pension Deduction Scheme (ASPDS).
For PSSLAI’s continued accreditation, the CAAD requested from PSSLAI the submission of, among others, a copy of PSSLAI’s Credit Redemption Insurance (CRI) and the Summary List of PNP borrowers-members which includes Billing Reports containing the Schedule of Computations of Loans such as principal amount, date of grant of loan, mode of payment/terms, interest and other charges, effectivity of first billing, and maturity.
However, the PSSLAI did not submit the abovementioned requirements invoking the Data Privacy Act of 20121 (DPA) and bank secrecy laws.
You now seek clarification on whether the PSSLAI can furnish copies of the said documents to the PNP without violating the provisions of the DPA, its Implementing Rules and Regulations (IRR) and other relevant issuances of the NPC.
Discussion
Public Safety Savings and Loan Association, Inc.
We understand that the PSSLAI is a non-stock savings and loan association (NSSLA) founded to uphold the best interest of the public safety sector, specifically dedicated to serving the members of the PNP and the Bureau of Fire Protection (BFP).2 The PSSLAI offers loans and other investment opportunities.3 It is under the regulatory supervision of the Bangko Sentral ng Pilipinas (BSP).4
Scope; Data Privacy Act of 2012; personal information; lawful basis for processing
We wish to clarify that the DPA only applies to the processing of personal information. Section 3 (g) thereof defines personal information as any information from which the identity of an individual is apparent or can reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.
We understand that the parties to the CRI are the insurer and PSSLAI. We note that these are juridical persons. Thus, generally speaking, the insurance document contains information about such juridical persons, and not an individual’s personal information. Hence, the submission of a copy of the same may be beyond the scope of the DPA. Nevertheless, should there be any personal information in the CRI, i.e., details of signatories, etc., the DPA may still be applicable.
In any case, it may be prudent for PSSLAI to check for any confidentiality clauses and/or exceptions thereto in the insurance contract prior to submitting a copy of the CRI to the PNP.
As to the processing of personal information involving the submission of the CRI as well as the summary list and billing reports, the DPA provides for the various criteria for lawful processing.
For personal information, processing may be allowed subject to the provisions of Section 12. Particularly in this case, the following may be applicable: Section 12 (c), where the processing is necessary for compliance with a legal obligation or Section 12 (e), where processing is necessary to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate.
For processing sensitive personal information in the given scenario, Section 13 (b) recognizes the processing that is provided for by existing laws and regulations, while Section 13 (f) provides for the processing for the establishment, exercise, or defense of legal claims, or when provided to government or public authority.
We note that the PNP issued Memorandum Circular No. 2014-42 which established, inter alia, the procedures and effective control measures in the accreditation of financial institutions. We likewise note the relevant provisions in PNP Memorandum Circular No. 2014-45 on documentary requirements, viz:
“IV. Policies/Guidelines xxx xxx xxx
b. Procedures The Committee shall require the Financial Institutions/Entities to submit the following documents in their application for accreditation and/or renewal of accreditation: xxx xxx xxx
- In addition to the aforementioned documentary requirements, all applicants for accreditation shall submit certified true copy of the following documents:
5.a For new applicants’ accreditation: 5.a.1 Letter Request; 5.a.2 Copy of Credited Redemption Insurance; 5.a.3 Updated Audited Financial Statements; 5.a.4 Summary list of PNP borrowers-members which includes Billing Reports containing therein are Schedule of Computations of Loans such as Principal amount, date of loan granted, mode of payment/terms, interest and other charges, effectivity of 1st billing, and maturity; 5.a.5 Copy of the Loan Release Vouchers, Promissory Note/Policy Contract signed by PNP members; 5.a.6 List of Planholders (for insurance company), which includes amount of premium, effectivity, and maturity date of policy contract; and 5.a.7 At least 500 memberships.
5.b For renewal of accreditation, submit the same requirements stated in para 5.a except item 5.a.5.”
We understand that these Memorandum Circulars were issued by the Chief of the PNP in the exercise of powers and functions pursuant to the provisions of Republic Act (RA) No. 6975 or the Department of the Interior and Local Government Act of 1990,6 as amended, and other applicable laws and regulations. Having said that, these issuances are presumed to be valid until declared otherwise by a proper court.
As applied in this case, it may be possible for PSSLAI to submit these documents, even without the consent of the data subjects, as the disclosure is not based on consent, but rather on another more appropriate lawful basis for processing, i.e., legal obligation, fulfillment of the functions of public authority, or due to a particular regulation which the PSSLAI must comply with.
General data privacy principles
However, as a personal information controller (PIC), the PSSLAI has the duty to inform its data subjects as to the nature, extent, and purpose of such disclosure pursuant to the principle of transparency.
Moving forward, PSSLAI should consider including a privacy notice in the loan agreements, explaining that personal information of the PNP member-borrowers, including the summary lists and billing reports, will be disclosed to the PNP for accreditation purposes. For existing member-borrowers, such notice should also be provided to apprise them about the required disclosure.
We acknowledge the concern on the submission of the summary list of member-borrowers and the respective billing reports. The PSSLAI’s data protection officer is not precluded from seeking dialogue with the PNP for a possible review of the 2014 Memorandum Circular An Act Establishing the Philippine National Police under a Reorganized Department of the Interior and Local Government, and for Other Purposes [Department of the Interior and Local Government Act of 1990], Republic Act No. 6975, § 26 (1990).
requirements to evaluate if the disclosure is proportional to the purpose of the accreditation.
Revised Non-Stock Savings Loan Association Act of 1997; nature of loan records; deposits definition
Another point raised in the letter is that if the PSSLAI will submit to the PNP the summary list and other details, the PSSLAI may run the risk of violating bank secrecy laws. We note that Section 6 of RA No. 8367 or the Revised Non-Stock Savings Loan Association Act of 19977 provides as follows:
“Section 6. Prohibition against inquiry into or disclosure of deposits. – All deposits of whatever nature with an Association in the Philippines are hereby considered as of an absolutely confidential nature and may not be examined, inquired or looked into by any person, government official, bureau or office, except upon written permission of the depositor, or in cases of impeachment, or upon order of a competent court in cases of bribery or dereliction of duty of public officials, or in cases where the money deposited or invested is the subject matter of litigation. xxx xxx xxx.”
The above-quoted provision must be read together with RA No. 3591 or the Philippine Deposit Insurance Law, as amended by RA No. 10846, which defines deposits as:
“(g) The term deposit means the unpaid balance of money or its equivalent received by a bank in the usual course of business and for which it has given or is obliged to give credit to a commercial, checking, savings, time or thrift account, evidenced by a passbook, certificate of deposit, or other evidence of deposit issued in accordance with Bangko Sentral ng Pilipinas rules and regulations and other applicable laws, together with such other obligations of a bank, which, consistent with banking usage and practices, the Board of Directors shall determine and prescribe by regulations to be deposit liabilities of the bank: Provided, That any obligation of a bank which is payable at the office of the bank located outside of the Philippines shall not be a deposit for any of the purposes of this Act or included as part of the total deposits or of insured deposit: Provided, further, That subject to the approval of the Board of Directors, any insured bank which is incorporated under the laws of the Philippines which maintains a branch outside the Philippines may elect to include for insurance its deposit obligations payable only at such branch.”
Therefore, since the summary lists and billing reports requested by the PNP pertains to loan records and not necessarily deposits, the same may not fall within the prohibition under RA No. 8367.
In addition, the BSP Manual of Regulations for Non-Bank Financial Institutions8 (MORNBFI) provides:
“Sec. 4312S Confidentiality of Information. NSSLAs shall keep strictly confidential the data on the borrower or consumer, except under the following circumstances:
a. disclosure of information is with the consent of the borrower or consumer; b. release, submission or exchange of customer information with other financial institutions, credit information bureaus, lenders, their subsidiaries and affiliates; c. upon orders of court of competent jurisdiction or any government office or agency authorized by law, or under such conditions as may be prescribed by the Monetary Board;
An Act Providing For The Regulation Of The Organization And Operation Of Non-Stock Savings And Loan Associations [Revised Non- Stock Savings and Loan Association Act of 1997], Republic Act No. 8367 (1997). Bangko Sentral ng Pilipinas, Manual of Regulations for Non-Bank Financial Institutions, available at https://www.bsp.gov.ph/Regulations/MORB/2016_01MORNBFI2.pdf (last accessed 17 April 2021).
d. disclosure to collection agencies, counsels and other agents of the NSSLA to enforce its rights against the borrower; e. disclosure to third party service providers solely for the purpose of assisting or rendering services to the NSSLA in the administration of its lending business; and f. disclosure to third parties such as insurance companies, solely for the purpose of insuring the NSSLA from borrower default or other credit loss, and the borrower from fraud or unauthorized charges. (Circular No. 702 dated 15 December 2010)” (Underscoring supplied)
From our understanding, PSSLAI is seeking accreditation with the PNP to avail of the automatic salary and pension deduction scheme. While we are not privy to the actual terms and conditions of the PSSLAI’s accreditation and actual deduction scheme, the PNP may in effect be considered as a third-party that assists PSSLAI’s lending business through the collection and remittance of loan payments.
Consequently, the disclosure of the summary list of the names of the member-borrowers and the latter’s billing reports may be allowed under the MORNBFI. However, we defer to the BSP on matters involving the proper interpretation of the above provisions of the MORNBFI.
Advisory Opinions as guidance
Finally, we take this opportunity to clarify the advisory functions of the NPC. In your letter, we noted that one of the actions requested of the Commission is to authorize PSSLAI to submit to the PNP the required documents.
We wish to emphasize the provisions on NPC Circular No. 18-01 – Rules of Procedure on Requests for Advisory Opinions,5 that the advisory opinions of the NPC provide guidance to the requesting party and the general public on matters relating to the interpretation of the provisions of the DPA, its IRR, and NPC issuances, compliance requirements, enforcement of data privacy laws and regulations, and other related matters on personal data privacy, security, and protection.6
As such, an advisory opinion does not operate to provide any authorization or clearance to process personal information. These are left to the sound determination of PICs, taking into consideration the provisions of the DPA, its IRR, and NPC issuances.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Public Safety Savings and Loan Associations, Inc. About Us, available at https://www.psslai.com/company-information/ (last accessed 13 April 2021). ↩
-
Id. ↩
-
Bangko Sentral ng Pilipinas, Financial Stability - Directories and Lists, Directory Of Banks and Non-Bank Financial Institutions, available at https://www.bsp.gov.ph/Sitepages/Financialstability/Dirbanksfilist.Aspx (last accessed 16 April 2021). ↩
-
National Privacy Commission, NPC Circular No. 18-01, Rules of Procedure on Requests for Advisory Opinions. ↩
-
Id. § 5 (a). ↩