NPC Issuance Wiki

NPC Advisory Opinion No. 2022-002 — Disclosure by Car Dealers/Automotive Repair Shops of Personal Data of Abandoned Vehicle Owners

Issued Advisory Opinion

Official opinion tags

Text

11 February 2022

RE: DISCLOSURE BY CAR DEALERS/AUTOMOTIVE REPAIR SHOPS OF PERSONAL DATA OF THE ABANDONED VEHICLE OWNERS

Dear [Redacted],

We write in response to the request for an Advisory Opinion received by the National Privacy Commission (NPC) regarding the disclosure by car dealers/automotive repair shops of personal data of abandoned vehicle owners.

We understand that your client is engaged in the business of operating car dealerships and repair shops. In line with this, several vehicles it received for repair and/or maintenance as early as 2015 remain in its possession despite notice to the owners of the completion of service/s. This has caused prejudice to your client as the vehicles require sustained maintenance and space causing undue cost and potential legal issues in relation thereto.

We understand further that a number of these vehicles were purchased under financing arrangements with banks or financing companies. As the vehicles have been left in the repair shop for several months, if not years, there is the probability that the owners have stopped amortization payments for the abandoned vehicles.

You now ask whether informing the concerned mortgagee banks or financing companies on the status of the unclaimed vehicles that they have financed is sanctioned under the Data Privacy Act of 20121 (DPA), particularly as a valid disclosure falling under Section 12 (f) on legitimate interest.

Discussion

Lawful processing of personal information; legitimate interest of personal information controllers; Section 12 (f) of the Data Privacy Act of 2012

Under the DPA, the processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the conditions under Section 12 of the law exists. One condition under the law is processing necessary for the purposes of the legitimate interests of the personal information controller (PIC) or by a third party to whom the data is disclosed,2 to wit:

“(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.”

In the determination of legitimate interest, the following must be considered:3

  1. Purpose test – The existence of a legitimate interest must be clearly established, including a determination of what the particular processing operation seeks to achieve;
  2. Necessity test – The processing of personal information must be necessary for the purpose of the legitimate interest pursued by the PIC or third party to whom personal information is disclosed, where such purpose could not be reasonably fulfilled by other means; and
  3. Balancing test – The fundamental rights and freedoms of data subjects must not be overridden by the legitimate interests of the PIC or third party, considering the likely impact of the processing on the data subjects.

Indeed, legitimate interest as a ground for lawful processing of personal data is a flexible concept that may be applicable in certain instances where processing will not have unwarranted impacts on the rights and freedoms of data subjects.4

Nevertheless, PICs that consider relying on this basis should undergo a legitimate interest assessment using the aforementioned tests as guidance, and document the outcome of the assessment. This gives data subjects some guarantee that this criterion for processing will not be misused.5

We emphasize as well that legitimate interest is applicable only to the processing of personal information. If the disclosure will involve sensitive personal information, the PIC should determine the appropriate lawful basis under Section 13 of the DPA.

Adherence to the general data privacy principles

Nonetheless, the existence of a lawful basis for disclosure of personal or sensitive personal information (collectively, personal data) under the DPA is just one of the requirements in relation to the processing personal data. PICs are still required to adhere with the principles of transparency, legitimate purpose, and proportionality prescribed under the law.6

In this case, the data subjects involved must be informed that their personal data will be disclosed to the banks/financing companies in relation to the abandoned vehicles. This may be embodied through an appropriate notice sent to the vehicle owner’s last known address and/or contact details stating the actions the PIC intends to make. It is suggested that a similar privacy notice be prepared and made part of the documentation with respect to future repairs and maintenance service contracts, or other similar agreements of your client.

The PIC is also reminded that the disclosure to the banks and/or financing companies should be limited to its declared and specified purpose, and that only those personal data that is adequate, relevant, suitable, necessary, and not excessive in relation to the purpose should be disclosed. Thus, personal data disclosed to the banks and financial companies should be limited to information necessary to identify the owner and the vehicle.

In addition, it is expected that the proposed disclosure will be done with accuracy – in that the details of a particular vehicle owner and abandoned vehicle should only be disclosed to the bank or financing company that financed the purchase of the vehicle and not to all possible banks or financing companies. Disclosures cannot be done in an indiscriminate manner since it would violate the principle of proportionality.

Finally, we note that it was unclear how the banks and/or financing companies involved in the financing of specific abandoned vehicles were determined by the PIC. We highlight that in the identification of these banks and/or financing companies, it is important that PICs likewise observe compliance with the general data privacy principles and other provisions of the DPA.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC – Director IV, Privacy Policy Office

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission and for other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. Data Privacy Act of 2012, § 12 (f). ↩

  3. See: National Privacy Commission, Advisory Opinion Nos. 2021-10 (March 22, 2021) and 2020-50 (Nov. 26, 2020) citing Data Privacy Act of 2012, § 12 (f); United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/. ↩

  4. Article 29 Data Protection Working Party, Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC, Adopted on 9 April 2014 (available at https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf). ↩

  5. Id. ↩

  6. Data Privacy Act of 2012, § 11. ↩

Backlinks