Text
28 February 2022
Re: TRANSPORT OF PHYSICAL MEDIA CONTAINING PERSONAL DATA
Dear [Redacted],
We write in response to your request for an advisory opinion received by the National Privacy Commission (NPC or the Commission) on whether the act of transporting physical media that may contain personal and sensitive personal information (collectively, personal data) is considered as “processing” of the personal data that are contained therein under existing data privacy legislation such as the Data Privacy Act of 20121 (DPA), its Implementing Rules and Regulations (IRR) and applicable NPC issuances.
We understand that your company is a courier and logistics company engaged in pick-up, transport and delivery of mails, letters, pouches, cargoes and personal effects of all kinds, wherein the collection and processing of the personal data of both the shipper (sender) and of the consignee (receiver) are necessary parts of its business.
Further, we understand that among the items that are endorsed to your company for delivery are physical media such as paper documents, laptops, and other data storage devices that may contain personal data.
You now come to the Commission to seek clarification on the following matters:
-
Whether the act of transporting physical media that may contain personal data be considered as “processing” of the personal data that are contained therein under the DPA, IRR and applicable NPC issuances?
-
Whether a courier company is liable under existing data privacy legislation in the event of loss or damage to the shipment of a physical media that contains personal data?
-
Can the data subject claim for damages from the courier company for data privacy breach if such data subject becomes a victim of identity fraud or identity theft arising from the lost or damaged shipment of a physical media that may contain personal data?
Discussion
Personal Information Controller and Processor; Personal Information; Processing
A personal information controller (PIC) is the person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.2 There is control if the natural or juridical person or any other body decides on what information is collected, or the purpose or extent of its processing.3
On the other hand, a personal information processor (PIP) is any natural or juridical person to whom a PIC may outsource the processing of personal data pertaining to a data subject.4
Based on the definitions, and as described in your letter with regard to the business of your company, it is apparent that your company is a PIC with regard to the personal data of shippers (sender) and consignees (receiver) and should therefore comply with all of its obligations under the DPA.
However, there is a need to clarify and define its role and obligations with respect to its supervision or control over physical media that are endorsed to it for pick-up, transport and or delivery.
The DPA defines personal information as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.5
Whereas processing of personal information, refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.
Considering the above, physical media being transported may or may not contain personal data. In the instance that such contains personal data, the identity of an individual may or may not be apparent and cannot be ascertained by your company.
We should distinguish between situations wherein your company has knowledge or should have knowledge on whether the physical media endorsed to it for pick-up, transport and delivery contains personal data because such is apparent on its face or due to the nature of its engagement with the other PIC/s, such as but not limited to the pick-up, transport and or delivery of credit cards, credit card statements, bills, passports, civil registry documents, and the like.
As for transactions wherein your company has no way of knowing whether the physical media endorsed to it for pick-up, transport and delivery contains personal data, it cannot be said outright that your company is engaged in personal data processing. In these cases, the company would only be acting as a PIC in relation to the personal data of the shipper (sender) and consignee (receiver).
In addition, we must emphasize that in order for the company to be considered as a PIP in this instance, the PIC-consignor has to declare that the physical media contains personal information and that there is likewise the declaration that it is acting as a PIC and the intention of the transaction is to make the company a PIP. However, in transactions wherein the consignor is an individual who holds, processes, or uses personal information in connection with one’s personal, family, or household affairs, the company, cannot be considered as a PIP, as in this situation the law provides that in such an instance, the individual involved is not considered as a PIC.
Therefore, to determine the company’s role in transporting physical media, the above declarations from the consignor should be made in an appropriate form provided by the company.
Determination of Liability; Loss or Damage Physical Media Which Contains Personal Data
The determination of liability in the event of loss or damage to the transportation of physical media which contains personal data would generally be covered by the ordinary terms and conditions of a given service, or some other law or regulation applicable to a courier for any normal loss, damage, and or destruction to the physical media endorsed to it for pick-up, transport and delivery.
The same will not automatically constitute a data privacy violation under the DPA. Following the discussion above, this determination will depend on whether the company is acting as a PIP or not either because it knew or should have known that the physical media contains personal data or pursuant to its contract with its PIC. In the latter case, it’s liability may be determined based on the specific terms of its contract with its PIC and its level of compliance with its duty as a PIP.
Specific to loss or damage, we refer further to Sections 26 of the DPA on Accessing Personal Information and Sensitive Personal Information Due to Negligence. If the loss or damage resulted in allowing an unauthorized person to have access to the personal information contained in the physical media through negligence, the determination of the presence of negligence and the ensuing liability may depend on whether the company is transporting the physical media as a PIP.
Damages for Personal Data Breach; Principle of Accountability
As to the claim of damages by data subjects, the determination of liability and indemnification for any damages sustained are made on a case-to-case basis.
We reiterate that pursuant to the principle of accountability under Section 21 of the DPA, each PIC is responsible for personal information under its control or custody, including information that have been transferred to a third party for processing, whether domestically or internationally, subject to cross-border arrangement and cooperation. Whereas, the PIP has the duty to comply with the requirements of the DPA, its Rules, other applicable laws, and other issuances of the Commission, in addition to obligations provided in a contract or other legal act with a PIC.6
Further, the DPA IRR provides that the PIC and PIP shall implement reasonable and appropriate security measures for the protection of personal data7 and shall aim to maintain the availability, integrity, and confidentiality of personal data and are intended for the protection of personal data against any accidental or unlawful destruction, alteration, and disclosure, as well as against any other unlawful processing.8 Such measures should be implemented to protect personal data against natural dangers such as accidental loss or destruction, and human dangers such as unlawful access, fraudulent misuse, unlawful destruction, alteration and contamination.
As discussed, the liability of the company may also depend on certain factors: first, the personality of the consignor-shipper, whether the same is considered as a PIC under the DPA or not, and second, if the consignor-shipper declared to the company that the physical media contains personal data.
Lastly, it is suggested that the company consider implementing changes to its processes so that it is duly informed at the outset on whether a consignor is a PIC and that the intention of the transaction is to make the company a PIP, and whether particular items shipped contain personal data so that the appropriate safeguards can be implemented accordingly. This may be done through appropriate forms, by informing the consignor at the outset of what their role would be in the transport of the physical media, and by making it declare in the appropriate form, that it is the PIC and that the intention of the transaction is to make the company a PIP.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 3 (m). ↩
-
Id. § 3 (g). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 45. ↩
-
Id. ↩