NPC Issuance Wiki

NPC Advisory Opinion No. 2021-022 — Processing Personal Data For Electronic Know-your-customer (eKYC)

Issued Advisory Opinion

Official opinion tags

Text

2 July 2021

Re: PROCESSING PERSONAL DATA FOR ELECTRONIC KNOW-YOUR-CUSTOMER (eKYC)

Dear [Redacted],

We write in response to your request for an advisory opinion received by the National Privacy Commission (NPC) which sought to clarify the appropriate lawful basis for processing for a digitization project of a bank to ensure compliance with the provisions of the Data Privacy Act of 20121 (DPA) and the requirements of the Bangko Sentral ng Pilipinas (BSP).

We understand that the bank is currently in the process of designing its digital onboarding process will entail the processing of personal and sensitive personal information (collectively, personal data) from applicants who wish to open a bank account or apply for a bank loan online.

We understand further that the bank will obtain the applicants’ consent through a tick box and/or clicking on an Agree button after reading the Data Privacy Consent/terms and that the same will be recorded in the system.

In addition to the above, you likewise mentioned that opening an account or applying for a loan will then entail prior identity verification or know-your-customer (KYC) verification in accordance with the requirements of the BSP which allows electronic KYC.

You now ask whether consent or the regulatory requirement of the BSP would be the lawful basis for processing which will allow the bank to provide the captured information in the digital onboarding platform (e.g., valid ID, selfie, or liveness capture) to a third party eKYC solutions provider for the sole purpose of accurately verifying the identity of the applicant or customer. You further ask if consent is the lawful basis, will the affirmative and recorded consent via tick box or Agree button suffice as evidence of consent.

Discussion

Lawful Basis for Processing of Personal Data; Law or Regulation; Privacy Notice

For this scenario, Section 13 (b) of the DPA on the processing of sensitive personal information based on existing laws and regulations is applicable and may be the most appropriate lawful basis for processing considering the bank’s relationship with its customers vis-à-vis compliance requirements with the BSP Manual of Regulations for Banks (MORB).

For the digital onboarding platform, we suggest that instead of asking for consent, the bank should provide a privacy notice which is an embodiment of the observance or demonstration of the data privacy principle of transparency and upholding the right to information of data subjects.2 It is a statement made to data subjects that describes how the organization collects, uses, retains, and discloses personal information.3

Outsourcing; Data Subjects Rights

For outsourcing, we note the MORB provisions you have provided. These are read together with the provisions of the Implementing Rules and Regulations4 (IRR) of the DPA, specifically Sections 43-45. The stipulations for outsourcing agreements indicated in these provisions should be included in the bank’s agreement with its eKYC solutions provider.

We emphasize that the bank, as a personal information controller, shall use contractual or other reasonable means to ensure that proper safeguards are in place in an outsourcing arrangement, which includes ensuring the confidentiality, integrity, and availability of the personal data processed, prevent its unauthorized processing, assure that the personal information processor cooperates and coordinates with the bank in addressing any requests for the exercise of data subject rights, and generally, comply with the requirements of the DPA and other applicable issuances of the NPC.5

Privacy by Design

Lastly, as industries shift to digital platforms, the NPC encourages the adoption of a privacy by design approach that ensures that privacy and data protection have been taken into account during the design phase of a system, project, program, and process and will continue to be taken into account throughout its lifecycle and implementation.6

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. National Privacy Commission, Data Subject Rights NPC Advisory No. 2021-01 (Jan. 29, 2021). ↩

  3. Id. citing National Privacy Commission, NPC Advisory Opinion 2018-013 (2018). ↩

  4. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 (2016). ↩

  5. Id. § 43 and NPC Advisory No. 2021-01, § 5 (c). ↩

  6. See generally: Cavoukian, Ann Ph.D., Privacy by Design - The 7 Foundational Principles - Implementation and Mapping of Fair Information Practices, available at https://iapp.org/media/pdf/resource_center/pbd_implement_7found_principles.pdf (last accessed 2 July 2021). ↩

Backlinks

  • No backlinks found