Text
30 July 2021
Re: PROCESSING OF PERSONAL DATA CONTAINED IN ABANDONED SERVERS OR COMPUTERS
Dear [Redacted],
We write in response to your request for guidance regarding a situation wherein an office lessee of Eton Properties Philippines, Inc. (Eton for brevity) has defaulted and abandoned the leased building premises.
We understand that Eton will soon be taking possession of all the items that the lessee had abandoned inside its BPO building project. One of these items is the lessee’s data server which may contain personal and sensitive personal information (collectively, personal data), such as its customer database. You likewise mentioned the full extent of the contents of the server is not known as of yet.
As such, you have raised the following points for clarification:
- Are there any guidelines issued by the National Privacy Commission (NPC) as to how to handle this situation; 2. Since these are abandoned properties, can the data be wiped, and the hardware re- used for other business purposes? Eton can archive the data, if necessary and affordable; 3. Can the lessee still require Eton to return their data on their server? 4. In case Eton ends up repossessing other workstations/computers, will these be treated the same way as the data servers; and 5. Recommendations to ensure that there are no data privacy-related issues in the future.
Discussion
Scope of the Data Privacy Act of 2012; criteria for lawful processing of personal data
The Data Privacy Act of 20121 (DPA) applies to the processing of personal data and to any natural and juridical person involved in the processing within and outside the Philippines.
Under the DPA, processing refers to any operation or any set of operations performed upon personal data including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.2
The processing of personal data which may be contained in the server and/or other workstations/computers of the lessees, which includes erasing and archiving, shall be allowed only upon compliance with the requirements of the law and adherence to the general data privacy principles of transparency, legitimate purpose, and proportionality.3
The various criteria for lawful processing of personal and sensitive personal information by personal information controllers (PICs) are provided under Sections 12 and 13 of the DPA, respectively.
Section 12 enumerates the various criteria for processing personal information, such as processing that is necessary for compliance with a legal obligation,4 or necessary for the purposes of the legitimate interests pursued by the PIC or by a third party or parties to whom the data is disclose,5 among others.
Note, however, that if the database contains sensitive personal information, the processing thereof is prohibited, except for certain instances provided under Section 13 such as when the processing is provided for by existing laws and regulations,6 or necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings or the establishment, exercise, or defense of legal claims.7
Therefore, Eton’s proposed actions as to the further processing of the personal data of its lessee shall be governed by the any of the lawful bases for processing under the DPA.
Appropriating abandoned properties; erasure or archiving of personal data of the lessee
Although the lessee has abandoned its servers, workstations, and computers in the leased premises, the same does not give the lessor the right to automatically appropriate the same and the contents thereof to satisfy the unpaid rentals or recover the leasing revenue loss it has incurred. The treatment of the abandoned properties of the lessee would then depend upon the stipulations in the lease agreement and the orders or judgement from a competent court.
To reiterate, wiping or archiving of personal data falls squarely on the above definition of processing and the appropriation of the lessee’s abandoned properties by Eton in order to reuse them may likely result to processing personal data of which Eton may not be authorized.
Hence, in the meantime, it is best that Eton refrain from appropriating the abandoned properties and the contents thereof. It is recommended that Eton safekeep the same while waiting for the results of the pending case.
Duties and responsibilities of PICs; accountability; five pillars of compliance
Moreover, we wish to note that under the principle of accountability, each PIC is responsible for personal information under its control or custody.8
If Eton, based on the lease agreement and/or the orders or judgement from a competent court, takes control over the abandoned servers, workstations, and computers, it may be deemed to be a PIC as well and should be cognizant of the duties, responsibilities, and risks associated with having custody of personal data. In CID Case No. 18-E-040,9 the Commission elaborated on the accountability of the PIC:
“By having the control of and discretion in the use of personal information of individuals, they are already considered the controller. They are thus accountable for the protection of the information and for the observation of the obligations under the law. These persons and entities must be able to justify their processing of personal data under any of the lawful criteria provided in the law. They have an obligation to provide mechanisms for the access, correction, and removal of personal data upon request, as well as the filing of a complaint. They are further required to secure the processing of any personal data by documenting and implementing organizational, technical, and physical measures to respect the abovementioned rights.”
While the servers, workstations, and computers are properties of the lessee, the personal data contained therein cannot be treated in the same manner as with any other property given the provisions of the DPA. Since the personal data was collected by a different PIC for purposes different than that of Eton’s, any further personal data processing by Eton should be supported by lawful criterion specific to the personal data and separate from whatever action it may take against its lessee. Likewise, should Eton decide to process the personal data, it is still required to notify the data subjects regardless of the lawful basis that it may eventually rely on.
As to whether the lessee can still require Eton to return the personal data from the abandoned properties even if the latter takes control over the abandoned properties, this will depend upon the existing policies of Eton as to retention of personal data, taking into account as well any applicable provisions of the lease agreement and/or orders of a competent court. We emphasize that personal data shall not be retained in perpetuity in contemplation of a possible future use yet to be determined.10
Finally, we wish to clarify that one can never be assured that there will be no data privacy- or DPA-related issues in the future as these may not be completely avoided. Nevertheless, we have always reminded PICs to follow the five pillars of compliance as this serves as the basic steps towards complying with the DPA and issuances of the NPC.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. We are not privy to the terms and conditions of the lease agreement between Eton and its lessee and the same has not been reviewed for purposes of this opinion. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission and for other Purposes DATA PRIVACY ACT OF 2012, Republic Act No. 10173 (2012). ↩
-
Data Privacy Act of 2012, § 3 (j). ↩
-
National Privacy Commission, CID Case No. 18-E-040, Rala v. Burguillos, et al. (May 12, 2020). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 19 (e) (3) (2016). ↩