Text
25 June 2021
Re: INSTALLATION AND USE OF GLOBAL POSITIONING SYSTEMS (GPS) ON MOTORCYCLE UNITS
Dear [Redacted],
We write in response to your request for advisory opinion received by the National Privacy Commission (NPC) to provide guidance on the legality of the installation of global positioning systems (GPS) tracker in your motorcycle units considering the provisions of the Data Privacy Act of 20121 (DPA).
Further, '''''''''''''''''' '''''''''''''''''''' seeks to implement the following privacy safeguards in case the installation of GPS trackers is allowed:
- Only the CEO, COO and IT Department will be given the administrative access rights to the said GPS Portal;
- Viewing/review access to the GPS portal will only be given when there is an urgent requirement and justifications approved by the CEO, COO and Audit Head;
- There will be time limits to viewing/review access to the GPS portal;
- There will be limits to the retention period of historical locations;
- Compliance with recommendations of external auditors regarding the usage of the GPS portal;
- Most importantly, '''''''''''''''''' ''''''''''''''''' will require the lessee or borrower/mortgagor to provide his/her express consent to the installation and continuous operation of the GPS device on his/her motorcycle; and
- The GPS device will be uninstalled or removed when the motorcycle has been returned/surrendered to the company or when the loan is fully paid.
Thus, you now seek guidance on the legality and propriety of installing and using GPS devices in rented and collateralized units.
Discussion
GPS Device Installation and Use; Proportionality Principle
The pertinent issue in this case is whether the processing of personal information, or more particularly, the collection of location data of the lessee or borrower, through the installation of GPS devices in motorcycle units that are rented or on collateral, is warranted in the situation given. Processing, including the collection, access to and storage of an individual’s location has with it various risks and threats to one’s privacy and security.
Under the DPA, the processing of personal information shall be allowed upon compliance with the requirements of the law and adherence to the general data privacy principles of transparency, legitimate purpose and proportionality.2
The principle of proportionality dictates that the processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.3 Furthermore, personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.4
We note that the purpose sought by '''''''''''''''''' ''''''''''''''''' is to prevent or deter the loss or theft of the motorcycles it has for rent or on loan may initially be seen as legitimate. However, this must be scrutinized against the possible violation of the individual’s privacy and threats to security.
It is worth noting that ''''''''''''''''' ''''''''''''''''', being a finance corporation, would already have in place proper procedures in the provision of motorcycles on rent or collateral, including KYC or Know-Your-Customer requirements or applications requiring the disclosure of personal data by the client. Likewise, it is of common knowledge that this type of service requires the company and the client to come under a contractual agreement that would have provisions on penalties in case of default on loan payments or in cases of theft or loss of the vehicle.
In a broader perspective, the company would then have the means to properly account for any damage it may incur from any loss or theft of its motorcycles on rent or collateral without having to unnecessarily intrude upon the privacy of its clients.
Consent
Even if there is a proposal to obtain consent from the individual, such consent may not be considered as freely given in the sense that the client has no other option but to accede to the requirement to be able to rent or obtain on collateral the motorcycle.
We reiterate that consent has to be freely given, specific, and an informed indication of will, whereby the data subject agrees to the collection and processing of personal data about and/or relating to him or her.5 In this case, if doubts are raised regarding the voluntariness of the consent obtained, the validity of the consent can be put into question as well.
While there are proposed guidelines to protect privacy and to obtain the consent of the individual, we deem that the installation of GPS devices on the motorcycles for rent or on collateral is disproportional to the purpose sought to be achieved by the company. The company should consider other less privacy-intrusive means to achieve its objectives.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (c) (2016). ↩
-
Ibid. ↩