NPC Issuance Wiki

NPC Advisory Opinion No. 2023-012 — Collection of Information of Customers, Delinquent Borrowers, and Loan Applicants of CIBI Members

Issued Advisory Opinion

Official opinion tags

Text

05 May 2023

Re: COLLECTION OF INFORMATION OF CUSTOMERS, DELINQUENT BORROWERS, AND LOAN APPLICANTS OF CIBI MEMBERS

Dear [Redacted],

We respond to your request for an Advisory Opinion on the proposed creation by CIBI, Information Inc. (CIBI) of its own private credit bureau through the collection of data from its members’ customers, borrowers, and loan applicants.

Discussion

You state that CIBI1 is the Philippines’ first credit reporting agency. It was previously operated as a business information division of the Department of Loans and Credit of the Bangko Sentral ng Pilipinas (BSP). In 2020, CIBI was acquired by Creador, a regional private equity firm.

Based on CIBI’s website, CIBI aims to be the trusted partner of businesses and consumers for their hiring and lending needs by offering technology solutions to solve customer problems across hiring, lending, and partnering.2 CIBI’s goal is to assist individuals and organizations (hereafter referred to as “CIBI members”) in optimizing their risk-based credit and hiring decisions through its “proprietary datasets” to be collected from the CIBI members’ customers, borrowers or applicants.

CIBI’s private credit bureau initiative is targeted to provide solutions for market needs with respect to the management of the end-to-end credit cycle process, such as: a) establishing the creditworthiness of juridical entities and individuals using their payment/nonpayment history; b) identifying/detecting fraud using the application details voluntarily shared by applicants to banks and financial solutions in the Philippines; and c) improving debt or payment collection from delinquent customers or borrowers.

For such purpose, CIBI intends to collect the following specific datapoints:

a. individual’s name or juridical entity’s name; b. address; c. contact information; d. loan type; e. transaction involved; f. principal amount; g. amount unpaid; h. due date; i. days outstanding; and j. other details in the signed application form, if applicable.

Desiring to pursue its initiative while committed to comply with Republic Act No. 10173, or the Data Privacy Act of 2012 (DPA),3 CIBI seeks guidance on the following:

  1. Whether information pertaining to juridical entities that are in default of their payment obligations either from sales transactions or loans be shared to CIBI to improve debt or payment collection; 2. Whether information pertaining to individuals who are in default of their payment obligations either from sales transactions or loans be shared to CIBI to improve debt or payment collection; 3. Whether information collected from financial institutions’ application forms filled up by juridical entities be shared to CIBI to detect and prevent fraud; and 4. Whether information collected from financial institutions’ application forms filled up by individuals be shared to CIBI to detect and prevent fraud.

Scope of the DPA; Juridical Entities

The DPA applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing, subject to the exceptions laid down in the law.4 Personal information is defined as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.5 Hence, the DPA is limited in its application to the processing of personal data of natural persons, not juridical entities.

We had the opportunity to discuss further the foregoing precept in Advisory Opinion No. 2020-002,6 thus:

We wish to clarify that the DPA only applies to the processing of personal data of natural persons and not information of juridical entities recognized under the law, such as corporations, associations, and partnerships. Thus, if the requested copies of titles, tax declarations, business permits, tax identification numbers, certifications, registrations, clearances, and other documents pertain to a juridical person, the DPA does not apply.

Hence, the processing involved in your first and third questions above involve matters outside the scope of the DPA. Nevertheless, we explained in the same Advisory Opinion that while the DPA does not apply to the processing of information of juridical entities, there may exist other relevant laws and government issuances that govern their processing. In other words, if CIBI will process such data of juridical entities, it must find support in other laws and not the DPA.

On the other hand, the second and fourth questions involve matters that are covered by the DPA since it involves the processing of personal information of individuals. Hence, for the processing of personal information to be valid, there must be a legitimate purpose and its processing is not otherwise prohibited by existing law. Section 12 of the DPA provides the criteria for lawful processing of personal information. In the given scenario, Sections 12 (a) and (c) appear to be the most applicable basis for CIBI’s intended processing, to wit:

(a) The data subject has given his or her consent;

xxx

(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.

It must be noted that by virtue of the sale or loan transaction, it is the CIBI member that has the direct relationship with its individual customer, borrower, or applicant. As such, the DPA considers the CIBI member as the personal information controller (PIC) relative to the personal information of its individual clients who, in turn, are considered as data subjects. On the other hand, CIBI is considered as a third-party PIC to whom the personal information will be disclosed or shared.

Thus, one way of legally enabling the sharing of personal data between CIBI and its members is to obtain the consent of the clients of the CIBI member. The DPA defines consent of the data subject as any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her.7 Thus, in clear and concise language, the CIBI member must first inform its individual clients of the intent to share their personal information to CIBI, its purpose, and other relevant details involved in the processing. Thereafter, the individual clients‘ consent must be evidenced by written, electronic or recorded means as prescribed by the DPA.

In keeping with best practices, CIBI may enter into a data sharing agreement (DSA) with each of its members to properly document the obligations, responsibilities, and liabilities of the PICs involved in the transfer of personal data. Under NPC Memorandum Circular No. 2020- 03,8 the execution of a DSA demonstrates accountability on the part of the PICs as Section 21 of the DPA requires the PIC to use contractual or other reasonable means to provide a comparable level of protection while the personal data is being processed by a third party.

Should the individual client refuse to consent to the processing, CIBI can also rely on Section 12 (f) which considers legitimate interests pursued by the PIC or by a third party or parties to whom the data is disclosed as lawful ground for processing.

The NPC previously adopted the three-part test of the United Kingdom’s Information Commissioner’s Office in the assessment of legitimate interest as a ground for processing of personal information, thus:

  1. Purpose test – The existence of a legitimate interest must be clearly established, including a determination of what the particular processing operation seeks to achieve; 2. Necessity test – The processing of personal information must be necessary for the purposes of the legitimate interest pursued by the PIC or third party to whom personal information is disclosed, where such purpose could not be reasonably fulfilled by other means; and 3. Balancing test – The fundamental rights and freedoms of data subjects should not be overridden by the legitimate interests of the PICs, considering the likely impact of the processing on the data subjects.9

Subsequently, the NPC provided in MAF v. Shopee10 the conditions for lawful processing based on legitimate interest under the DPA, viz.:

Processing based on legitimate interest requires the fulfillment of the following conditions: (1) the legitimate interest is established; (2) the processing is necessary to fulfill the legitimate interest that is established; and (3) the interest is legitimate or lawful and it does not override fundamental rights and freedoms of data subjects.

The CIBI member must therefore carefully assess and justify whether the above conditions provided in the Shopee case are met before it can process the personal data of its individual customers, borrowers, or applicants to CIBI based on legitimate interest.

Proportionality; Data Subjects Rights

The DPA further mandates that a PIC should adhere to the data privacy principles of transparency, legitimate purpose, and proportionality. The principle of transparency dictates that the data subject must be informed of the processing of his or her personal information and the details thereof. Meanwhile, the principle of proportionality requires that the processing of personal information shall be adequate, suitable, necessary, and not excessive in relation to the purpose sought to be achieved by the PIC. Hence, even if CIBI and its members may justify the processing based on consent or legitimate interest, they must still comply with the foregoing principles of transparency and proportionality. As otherwise, the processing can still be invalidated.

It is worth mentioning further the recommendations stated in NPC Advisory Opinion 2020- 039,11 that PICs are required to implement reasonable and appropriate organizational, physical, and technical security measures to protect the disclosed personal data. As PICs, CIBI and its members are required to regularly monitor for security breaches and take preventive, corrective and mitigating measures against incidents which may lead to security breaches.

In the same vein, the PICs shall uphold the rights of the data subject at all times. For more information on the rights of the data subjects, please see NPC Advisory No. 2021-01.

Please be advised that this Advisory Opinion was rendered based solely on the information you provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

Please be guided accordingly.

Very truly yours,

(Sgd.) FRANKLIN ANTHONY M. TABAQUIN, IV Director IV, Privacy Policy Office

Footnotes

  1. Formerly known as the Credit Information Exchange System. ↩

  2. CIBI website, About Us, available at https://www.cibi.com.ph/about-us/ (last accessed 27 March 2023). ↩

  3. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  4. Data Privacy Act of 2012, § 4. ↩

  5. Id. § 3 (g). ↩

  6. National Privacy Commission, NPC Advisory Opinion No. 2020-002 (06 Feb 2020). ↩

  7. Id. § 3 (b). ↩

  8. National Privacy Commission, Data Sharing Agreements, Memorandum Circular No. 2020-03 [NPC Circular 2020-03] (23 December 2020). ↩

  9. See generally, Data Privacy Act of 2012, § 12 (f); United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ (last accessed Feb. 12, 2020). ↩

  10. National Privacy Commission, MAF v. Shopee [NPC 19-073] (March 2021). ↩

  11. National Privacy Commission, NPC Advisory Opinion No. 2020-039 (11 December 2020). ↩

Backlinks

  • No backlinks found