Text
14 July 2022
Re: REQUEST FOR OPINION ON PRIVACY MATTERS CONCERNING TRANSFER OF ASSETS/LIABILITIES
Dear [Redacted],
We respond to your request for an Advisory Opinion on whether Citibank, N.A., Philippine Branch can validly transfer the personal information of non-responsive depositors to Union Bank of the Philippines pursuant to the Share and Business Transfer Agreement (“SBTA”).
We understand that, Union Bank of the Philippines (the “Buyer”) and Citibank, N.A., Philippine Branch (the “Seller”), together with other affiliates of the Seller, entered into a Share and Business Transfer Agreement (“SBTA”) for the proposed acquisition by the Buyer of certain assets and liabilities of the Seller’s consumer business in the Philippines as well as other assets (the “Transaction”). The Transaction includes the Seller’s local credit card, unsecured lending, and deposit businesses.
We understand further, that the processing, profiling, and sharing of data and information of the Seller’s deposit customers are governed by the terms and conditions set out in its “CONSENT ON PROCESSING, PROFILING AND SHARING OF DATA AND INFORMATION” (the 2017 Data Privacy Terms) the pertinent portions of which, states:
PAR. (1): We agree that our application, enrollment, purchase, maintenance, access or continued use of any of [the Seller’s] products and services shall be deemed as our acceptance and agreement to be bound by the provisions of these terms. We hereby agree that all Personal Data (as defined under the Data Privacy Law of 2012 and its implementing rules and regulations), customer data and account or transaction information or records (collectively, the “Information”) relating to us with you from time to time may be processed, profiled or shared to, by and between [the Seller] and any of its affiliates and subsidiaries (collectively, [the “Seller”] or each of the Philippines) and for the purposes as set out in [the Seller’s] Data Statement in force provided by you to us from time to time or for compliance with any law, regulation, government requirement, treaty, agreement or policy or as required by or for the purpose of any court, legal process, examination, inquiry, audit or investigation of any Authority. The aforesaid terms shall apply notwithstanding any applicable nondisclosure agreement. We acknowledge that such Information may be processed or profiled by or shared with jurisdictions which do not have strict data protection or data privacy laws. (Emphasis supplied.)
Paragraphs 5 and 6 of the customer consent section of the 2017 Data Privacy Terms also states:
PAR. (5) We consent, in connection with any proposed novation, assignment, transfer or sale of any of your rights and/or obligations with respect to or in connection with our account and any products, facilities and services available in connection with the account, to any novatee, assignee, transferee, purchaser or any other person participating or otherwise involved in such transaction, to the disclosure, to any such person, by you, of any and all Information which may be required in relation thereto.
PAR. (6) We understand and consent that the processing, profiling and sharing apply during the prospecting and application stages, as well as for the duration of and even after the rejection, termination, closure or cancellation of the account or relationship or Services (collectively “Termination”) for a period of at least ten (10) years from the Termination of our last existing account or relationship or that of the Relevant Individual as determined by you. Where you deem it necessary or are required to fulfill foreign and domestic legal, regulatory, governmental, tax, law enforcement and compliance requirements and disclosure to each of the Authority or Industry Organization, we understand and consent that the storage will be made even after a period of ten (10) years from such Termination until the final conclusion of any requirement or disclosure obligation, dispute or action. (Emphasis supplied.)
You also stated in your letter that the Seller’s deposit customers were requested to confirm their consent and adherence to the 2017 Data Privacy Terms stated above, upon the application for and availment of the Seller’s products and services. To date, 56,561 out of the Seller’s 61,986 deposit customers have accepted and expressly consented to the 2017 Data Privacy Terms. The remaining 5,425 deposit customers have not consented to the 2017 Data Privacy Terms but are covered by the “Legacy T&Cs. The relevant section of the Legacy T&Cs on sharing of customer information reads as follows:
TRANSFER AND PROCESSING OF INFORMATION
As required under Republic Act 10173 and other applicable laws and regulations, I authorize and give consent for the following: … • For the Bank to transfer, disclose, use and process my Personal and Account Information (including information that the Bank obtains from third parties, such as Credit Institutions and other financial or non-financial institutions), to, between and among its Authorized Third Parties (now referred to the “Receiving and Disclosing Parties”), Credit Institutions, other financial or non- financial institutions, or the outsourced service providers of such entities, wherever situated, or a Government Requirement, for any lawful purpose such as business development, data processing, analysis and management, surveys, product and service offers, account servicing, including rewards redemption and fulfilment, marketing activities, risk management purposes, collections purposes and reporting, use in employment checking (for financial institutions), and compliance with laws, regulations and policies or anti-money
laundering, sanctions and/or the US Foreign Account Tax Compliance Act (FATCA), including withholding for purposes of the FATCA. In addition to the above, the Bank or any of the Receiving and Disclosing Parties may disclose any Information as may be required by any Government Requirement, and for compliance with any Government Requirement, or as required by or for the purposes of any audit or investigation of any authority. “Government Requirement” means any applicable law or regulation, legal, governmental or regulatory authority, or agreement entered into by the Bank and any governmental authority or between two or more governmental authorities (such law, regulation or authority may be domestic or foreign). (Emphasis supplied.)
We understand that the Seller has undertaken an information campaign and successfully sent notices (“first notice”) to its deposit customers commencing on or about 25 February 2022, through one or more of the following channels: courier, postage mail, email, SMS, branches, interactive voice response facility, recorded phone calls, the Seller’s online and mobile applications, and the Seller’s website (such notices, the “Notices to Depositors”). In the Notices to Depositors, the Seller advised its customers of the intended sale and transfer to the Buyer, and in addition to consenting to the transfer of their customer account to the Buyer, requested them to reaffirm their previous express consent to the 2017 Data Privacy Terms.
You also informed us, that the Seller sent another letter (“Second Notice”) to depositors who did not reply to the First Notice. In that letter, these depositors were advised that in the absence of any objection from the regulators:
(a) the depositors’ failure to respond or expressly object to the transfer and/or continued availment of the Seller’s products and services would be deemed their consent to the transfer of their accounts to the Buyer and a reaffirmation of their previous express consent to the 2017 Data Privacy Terms, and
(b) accordingly, the Seller will transfer their accounts and personal information to the Buyer upon the closing of the Transaction.
You further disclosed that to date, some 46,148 depositors, representing 74.4% of the Seller’s total depositors, have given their consent or signified their objection to the transfer of their accounts. For those who consented, the depositors also reaffirmed their previous express consent to transfer their personal information under the 2017 Data Privacy Terms to the Buyer. However, the remaining 15,838 depositors have not, to date, replied to the Notices to Depositors (the “Non-Responsive Depositors”).
These Non-Responsive Depositors may be further segregated as follows:
Classification Number of Description Depositors 1. Non-Responsive 11,483 Of the 15,838 Non-Responsive Depositors who have Depositors, 11,483 have adhered to the 2017 consented to, and are bound by, Data Privacy Terms the 2017 Data Privacy Terms. These Non- Responsive Depositors have been sent, on
average, eleven (11) Notices to Depositors or reminders through one or more of the following channels: courier, postage mail, email, SMS, branches, interactive voice response facility, recorded phone calls, the Seller’s online and mobile applications, and the Seller’s website. 2. Non-Responsive 1,164 The processing, profiling and Depositors under sharing of the personal “and/or” accounts information of 4,355 out of the that were originally 15,838 Non-Responsive subject to Legacy Depositors were initially T&Cs, but where a co governed by the terms set out in accountholder has the Seller’s August 2016 General expressly consented: Terms and Conditions (a) to the transfer of Governing Accounts (the the account holders’ “Legacy T&Cs”). information to the Buyer, and (b) to be Of these 4,355 Non-Responsive bound by the 2017 Depositors, 1,164 depositors Data Privacy Terms hold “and/or” accounts but, in response to the First Notice, at least one of the accountholders under such accounts have consented to the transfer of their accounts to the Buyer and to update their data privacy consent to the 2017 Data Privacy Terms.
- Non-Responsive 3,191 Of the 4,355 Non-Responsive Depositors whose Depositors, 3,191 depositors accounts are governed continue to be governed by the by the Legacy T&Cs. Legacy T&Cs. Of this number, 2,180 are sole accountholders, while 1,011 are co- accountholders with a depositor who consented to the 2017 Data Privacy Terms.
Through the clarification letter you sent to us on 29 June 2022, we understand that the relevant sections of the T&Cs for the Seller’s Deposit and Cards/Loans products, as well as the 2017 Data Privacy Terms states:
You thus seek clarification on the following:
-
Whether the Seller may validly transfer to the Buyer the personal information of the 11,483 Non-Responsive Depositors who have adhered to the 2017 Data Privacy Terms upon the completion of the Transaction, on the basis of their prior express consent to the 2017 Data Privacy Terms and the implied reaffirmation of such consent by their failure to object and continued availment of the Seller’s products and services notwithstanding several Notices to Depositors/reminders sent?
-
Whether upon the completion of the Transaction, the Seller may validly transfer to the Buyer the personal information of the 1,164 Non-Responsive Depositors whose “and/or” accounts were originally subject to Legacy T&Cs, but where a co- accountholder has consented: (a) to the transfer of the account holders’ personal information to the Buyer, and (b) to be bound by the 2017 Data Privacy Terms. UBP believes this is supported by the authority granted to any co-accountholder to act on behalf of the co-account holders under Deposit T&Cs, the express consent given by a co-accountholder to the updating of their data privacy consent to the 2017 Data Privacy Terms, and the provisions of paragraph 8 of the 2017 Data Privacy Terms in relation to Section 2.D of NPC Circular No. 2020-03, which grants any co-account holder the authority to update or reconfirm the data privacy consents of the accountholders?
-
Whether upon the completion of the Transaction, the Seller may validly transfer to the Buyer the personal information of the 3,191 Non-Responsive Depositors who have given their prior express consent (as set out in the Legacy T&Cs) to transfer their accounts and personal information to any other financial institution for any lawful purpose. This action is supported by their prior express consent to the Legacy T&Cs, the implied reaffirmation of such consent by their failure to object and continued availment of the Seller’s products and services notwithstanding several Notices to Depositors/reminders, and, in the case of the 1,011 Non- Responsive Depositors who are co-account holders with a depositor who consented to the 2017 Data Privacy Terms, the grounds set out in paragraphs 18 and 19?
-
Whether the seller may transfer to the buyer the personal information of its Non- Responsive Depositors with bounced notifications (wherein the seller could not confirm receipt of communications)?
-
Whether the seller may transfer to the buyer the personal information of its depositors with closed card/loan accounts?
Discussion
The Seller May Validly Transfer to the Buyer the Personal Information of the 11,483 Non-Responsive Depositors Who Have Adhered to the 2017 Data Privacy Terms
For processing personal and sensitive personal information, this may be done pursuant to the applicable provisions of Section 12 and 13 of the DPA, to wit:
SECTION 12. Criteria for Lawful Processing of Personal Information. — The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists: xxx xxx xxx
(a) The data subject has given his or her consent; (b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract;
SECTION 13. Sensitive Personal Information and Privileged Information. — The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases: xxx xxx xxx
(a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing; (b) The processing of the same is provided for by existing laws and regulations: Provided, that such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information; xxx xxx xxx.”
From the foregoing, it is worthy to note that lawful processing is not always anchored or based on the presence of consent as there are other criteria which may be more appropriate and may be invoked by the personal information controller as contemplated above.
Under Section 3(b) of the DPA, consent is defined as any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so. From the definition provided above, it is clear that consent must be evidenced by written, electronic, or recorded means.1
The NPC would like to reiterate that implied or inferred consent is not recognized in this jurisdiction. The entity, as personal information controller or personal information processor must never assume the data subject’s consent for any activity involving his or her personal information, most especially, sensitive personal information, unless circumstances permit the processing of personal or sensitive personal information without consent, pursuant to the DPA and the IRR.
In this instance, we understand that as far as the 11,483 Non-Responsive Depositors is concerned, the basis of processing their personal data would be based on the 2017 Data Privacy Terms of the Seller, to which they have expressed their consent and hence they are bound thereto. The pertinent provisions of which states:
PAR. (5) We consent, in connection with any proposed novation, assignment, transfer or sale of any of your rights and/or obligations with respect to or in connection with our account and any products, facilities and services available in connection with the account, to any novatee, assignee, transferee, purchaser or any other person participating or otherwise involved in such transaction, to the disclosure, to any such person, by you, of any and all Information which may be required in relation thereto.
PAR. (6) We understand and consent that the processing, profiling and sharing apply during the prospecting and application stages, as well as for the duration of and even after the rejection, termination, closure or cancellation of the account or relationship or Services (collectively “Termination”) for a period of at least ten (10) years from the Termination of our last existing account or relationship or that of the Relevant Individual as determined by you. Where you deem it necessary or are required to fulfill foreign and domestic legal, regulatory, governmental, tax, law enforcement and compliance requirements and disclosure to each of the Authority or Industry Organization, we understand and consent that the storage will be made even after a period of ten (10) years from such Termination until the final conclusion of any requirement or disclosure obligation, dispute or action. (Emphasis supplied.)
Consent should cover all processing activities carried out for the same purpose or purposes. We maintain that as long as the purpose, scope, method and extent of the processing remains to be the same as that disclosed to the data subject when consent was given,3 the consent given by the non-responsive depositors upon agreeing to the 2017 Data Privacy Terms of the Seller remains to be valid.
Additionally, the processing of the personal information of the 11,483 Non-Responsive Depositors may also be based on the existing contract that the Seller has with its depositors. We clarify that, while there is a lawful criteria for processing based on contract in section 12 of the DPA, this does not appear in section 13. Considering, however, that consent is an essential element of contracts, in the past, the Commission has applied the lawful criteria of consent under Section 13 to also include contracts as long as the contract referred still complies with the requirements for consent under the DPA.
We note that in cases where consent is not required, a privacy notice would be sufficient. However, we wish to emphasize that a privacy notice is not equivalent to consent. This document is an embodiment of the observance of the data privacy principle of transparency and upholding the right to information of data subjects.
You mentioned that the Seller has notified the affected data subjects of the proposed transfer of their personal information to the buyer by sending them eleven (11) notices as of present date. Considering the foregoing, we affirm that such notices comply with the principle of transparency adhered to by the DPA which dictates that the data subject must be aware of the nature, purpose, and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of personal information controller, his or her rights as a data subject, and how these can be exercised.
Finally, the personal information controller is not required to obtain a separate consent from the data subject as long as the purpose, scope, method and extent of the processing remains to be the same as that disclosed to the data subject through the privacy notice and the processing is still covered by the consent given or the processing does not go beyond what the applicable law or regulation requires.
The Seller May Validly Transfer to the Buyer the Personal Information of the 1,164 Non-Responsive Depositors Whose “And/Or” Accounts Were Originally Subject to Legacy T&Cs, But Where a Co-Accountholder Has Consented
As to the 1,164 Non-Responsive Depositors whose “and/or” accounts were originally subject to Legacy T&Cs but where a co-accountholder has consented, we affirm that the Seller may likewise validly transfer to the buyer their personal information, considering that the processing of their personal information is based also on the Seller’s 2017 Data Privacy Terms which states:
“a co-account holder is specifically authorized to reconfirm and update their data privacy consent to the 2017 Data Privacy Terms and the consents under such terms.”
In addition, thereto, “The “Joint Account” section of the General Terms and Conditions Governing [the Seller’s] Philippines Account (“Deposit T&Cs”) applicable to the Seller’s bank accounts provides that:
“Your Joint Accounts authorize [the Seller] to accept, to pay, or to act upon the order of any of the co-account holders or signatories indicated in the Signature Card, upon written or oral instruments from any one of you, and automatically vests in any of you to do whatever is desired with the funds without the consent of the other co-account holders.”
As previously discussed, there are several criteria for processing personal and sensitive personal information under Sections 12 and 13 of the DPA. We must emphasize that the aforementioned criteria as discussed is applicable as well to these 1,164 Non-Responsive Depositors whose “and/or” accounts were originally subject to Legacy T&Cs.
Therefore, the authority granted to any co-accountholder to act on behalf of the co-account holders under the Seller’s Deposit T&Cs, as well as the consent given by a co-accountholder to the updating of their data privacy consent to the 2017 Data Privacy Terms allows the seller to process and transfer the personal information of the 1,164 Non- Responsive Depositors in this case to the buyer.
The Seller May Validly Transfer to the Buyer the Personal Information of the 3,191 Non-Responsive Depositors Whose Accounts Are Governed by the Legacy T&Cs
The remaining 3,191 Non-Responsive Depositors are those whose accounts are governed by the Legacy T&Cs. As mentioned in your letter, the Legacy T&C provide that these 3,191 depositors authorize the Seller to transfer their personal information to other financial institutions for any lawful purpose.
The relevant portion of the Seller’s Legacy T&C states:
As required under Republic Act 10173 and other applicable laws and regulations, I authorize and give consent for the following: … For the Bank to transfer, disclose, use and process my Personal and Account Information (including information that the Bank obtains from third parties, such as Credit Institutions and other financial or non-financial institutions), to, between and among its Authorized Third Parties (now referred to the “Receiving and Disclosing Parties”), Credit Institutions, other financial or non- financial institutions, or the outsourced service providers of such entities, wherever situated, or a Government Requirement, for any lawful purpose… xxx
In addition, there are existing provisions in the Seller’s T&C which provide:
xxx You agree that your application, enrollment, purchase, maintenance, access or continued use of any of Citi’s products and services shall be deemed as your acceptance and agreement to be bound by the provisions of these terms xxx
It is evident from the prior discussions, that the transfer of the personal information of these Non-Responsive Depositors should comply with any of the of the various criteria for lawful processing under the DPA, specifically under Sections 12 or 13 of the law. Both the Seller and the Buyer may be allowed to process personal data based on the above provisions, and the consent of the Non-Responsive Depositors is no longer required in the conduct of due diligence and in the implementation of the planned transfer.
In addition, we clarify that the fact of the continuity of use by the data subject of a personal information controller’s services does not automatically signify one’s consent. The personal information controller should be able to prove that such act of the data subject/s constitutes their consent.
We note that in this case the data subjects herein agreed to the provisions of the T&Cs stated above. Aside from this, the Seller sent numerous notices and reminders through one or more of the following channels: courier, postage mail, email, SMS, branches, interactive voice response facility, recorded phone calls, the Seller’s online and mobile applications, and the Seller’s website. Notwithstanding such notices and reminders, the data subjects did not respond. Hence, the Seller sent a “Second Notice” to the data subjects wherein the depositors were advised of the intended transfer to the Buyers and that if they fail to object to the transfer and/or continue to avail of the Seller’s products and
services, they will be deemed to have consented to the transfer and to have full knowledge of, and acceded to, the transfer.
As such, the transfer of the personal information of the 3,191 Non-Responsive Depositors, who continued availing of the Seller’s products and services, finds basis in the T&Cs previously consented to by these data subjects taking into consideration the efforts exerted by the Seller to notify and remind them.
The Seller May Validly Transfer to the Buyer the Personal Information of its Non-Responsive Depositors With Bounced Notifications
In your clarificatory letter dated 29 June 2022, you stated that the Seller has non-responsive depositors with bounced notifications, whom it could not confirm their receipt of the various communications sent but who are nevertheless covered by the 2017 Data Privacy terms and/or the Legacy terms on the disclosure of information.
In this instance, the various criteria for lawful processing under the DPA, specifically under Sections 12 or 13 of the law as discussed above also applies to these non-responsive depositors with bounced notifications. We emphasize that Processing of personal information may be based on consent, contract, legal obligation, legitimate interest, among others. Similarly for sensitive personal information, the processing thereof may be based on consent, law or regulation, legal claims, among others.
Given the foregoing, we clarify that as long as the scope, method, purpose, and extent of the processing as contained in the terms and conditions, privacy policies, and policies on the processing of information provided by the PIC to their data subjects at the time the consent was given remains the same, the consent given by the data remains to be valid as well.
Therefore, we conclude that the personal information of these data subjects (non-responsive depositors and/or card / loan accounts with bounced notifications) may be transferred by the Seller to the Buyer, as the consent given by the data subjects herein applies to this Transaction, as is clearly agreed upon by the data subjects in the 2017 Data Privacy terms and/or the Legacy terms on the disclosure of information.
The Seller May Validly Transfer to the Buyer the Personal Information of its Data Subjects With Closed Card/Loans Account
There are also those data subjects who have closed card/loan accounts but who are likewise covered either by the Seller’s T&C’s enabling the Seller to assign its rights and obligations without any notice or the 2017 Data Privacy Terms which allows the disclosure of information to an assignee and allows the Seller to process the data subject’s information up to 10 years following termination or closure of the account for various purposes, such as customer servicing, remediating customers’ and/or regulatory claims/refunds as well as other compliance requirements.
In this case, the previous discussions with regard to the various criteria for lawful processing under the DPA, specifically under Sections 12 or 13 of the law as discussed also applies to these data subjects.
We note that in this case, the personal information of herein data subjects may be transferred by the Seller to the Buyer given that the data subjects have consented to the processing of their information up to 10 years following termination or closure of the card account, for various purposes, such as customer servicing, remediating customers’ and/or regulatory claims/refunds and compliance to obligation as a card issuer etc. as stated in the Seller’s 2017 Data Privacy Terms.
In addition, the herein data subjects have also agreed to the provisions in the Cards T&C of the Seller, which enables the Seller to assign its rights and/or obligations without any notice. However, we note that despite such provision, the Seller still sent out notices to the herein data subjects to inform them of the Transaction with the Buyer.
Given the foregoing, the consent given by the data subjects in either of the aforementioned terms and conditions remains to be valid in this instant case, as the herein Transaction involves the transfer of the Seller’s local credit card, unsecured lending, and deposit businesses to the Buyer, which means that the purpose, scope, method and extent of the processing of personal data, would remain to be the same as to what the data subjects have consented to.
As a general rule, as long as the scope, method, purpose, and extent of the processing as contained in the terms and conditions, privacy policies, and policies on the processing of information provided by the PIC to their data subjects at the time the consent was given remains the same, the consent given by the data remains to be valid as well.2
Please be advised that this Advisory Opinion was rendered based solely on your provided information. Any extraneous fact that may be subsequently furnished to us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
Please be guided accordingly.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012), § 3(b). ↩