Text
13 August 2021
RE: INTERNAL DISSEMINATION OF INFORMATION REGARDING BANK-RELATED CRIMES
Dear [Redacted],
We write in response to your letter request received by the National Privacy Commission (NPC) seeking guidance on the proposed processing activities of a bank in relation to strengthening the campaign against fraud.
We understand that the bank proposes the conduct of effective training for and raise awareness of its employees about the consequences of committing crimes against the bank, its depositors, and other stakeholders.
You now seek opinion from the NPC on the following matters, as to whether:
- Publication and uploading of names, photos, and other details (e.g., criminal charge that gave rise to the issuance of an arrest warrant or conviction) of erring personnel due to his/her administrative or criminal offense, through an internal e-mail dissemination or posting in an intranet (internal repository) as a measure to assist the bank’s efforts to combat fraud and create a deterrent effect is permissible under the Data Privacy Act of 20121 (DPA); and
- A caveat in the publication or email message warning its internal stakeholders that unauthorized dissemination of the information contained therein may be punishable under the DPA.
Discussion
Anti-fraud campaigns; disclosure of sensitive personal information; lawful basis; general data privacy principles
While we recognize the objectives of the bank to combat fraud, raise awareness regarding the consequences of committing crimes against the bank, and create a deterrent effect vis-à-vis the publication of personal and sensitive personal information (collectively, personal data) of personnel having arrest warrants or convictions, this personal data processing activity should have a lawful basis under the DPA.
With this, we note that the details of the criminal or administrative charges, the disposal of such proceedings, and the decision rendered on the same may be considered as sensitive personal information under the DPA.
Recall that the processing of sensitive personal information, as a general rule, is prohibited, unless the processing falls under any of the instances under Section 13 of the DPA. In this instance, there seems to be no applicable lawful criteria for such processing. Further, this disclosure of personal data, even if just within the internal systems of the bank where access is limited to the employees and other internal stakeholders, and even with the caveat on unauthorized dissemination, the same may still be deemed disproportionate to the specified purposes above.
We reiterate the principle of proportionality which requires that the processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.2
With this, the bank should reevaluate its proposed internal anti-fraud initiatives. To our mind, these may be accomplished through other less privacy-intrusive means without necessarily exposing sensitive personal information of former or current employees of the bank. We note that the Bangko Sentral ng Pilipinas (BSP) has recently issued a directive which addresses the management of human resource-related risk, requiring banks to embed in their enterprisewide risk management framework measures to identify, measure, monitor, and control the so-called “people risk.”3
Lastly, it is also necessary for the bank to assess the proposed personal data processing activity in relation to how the same may possibly affect the other fundamental rights and freedoms of the data subject, such as the right to due process.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC – Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 17 (c) (2016). ↩
-
Bangko Sentral ng Pilipinas, Amendments to Operational Risk Management and Internal Control Measures [Circular No. 1112, series of 2021] (April 8, 2021). ↩