Text
29 December 2023
Re: EMPLOYER’S DATA PRIVACY OBLIGATIONS CONCERNING ITS FINANCIAL SERVICES BENEFIT TO ITS EMPLOYEES.
Dear [Redacted],
We respond to your request for an Advisory Opinion on the obligations of Infosys BPM Philippines’ (IBPM) under the Data Privacy Act of 2012 (DPA)1 concerning the financial services benefit it desires to extend to its employees.
Discussion
You state that IBPM is a business process management company. IBPM intends to partner with Templetech Finance Corp (TendoPay) for the provision of financial services to IBPM employees, including the option to obtain loans. Under the proposed partnership, your employees will directly engage with TendoPay to secure their loans. The repayment of these loans may be facilitated through payroll deductions in accordance with relevant legal requirements.
Thus, you ask if you will be classified as a Personal Information Controller and/or Processor under the proposed partnership with TendoPay and your concomitant obligations as such.
Personal Information Controller and Personal Information Processor
The DPA defines a Personal information Controller (PIC) as a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.2 Whereas a Personal Information Processor (PIP) refers to any natural or juridical person to whom a personal information
controller may outsource the processing of personal data pertaining to a data subject.3 The decisive element in determining whether an individual or an entity is a PIC or PIP is the existence and level of control over the processing of personal information.
Control over personal data exists when an individual or entity has the authority to determine the kind of information gathered, its intended use, or the scope of data processing. It bears stressing that a PIP does not have a right to control the collection, holding, processing, or use of personal information of data subjects. PIPs must process personal data only in accordance with instructions from or under an agreement with a PIC.
Under the proposed scheme, both IBPM and TendoPay will be considered as a PIC. As the employer, IBPM is considered as a PIC responsible for managing the personal data of its employees. On the other hand, Tendopay will necessarily have to process the IBPM employees’ personal data in order for it to determine if the employees are eligible for the financial services it offers. Hence, Tendopay is likewise considered as a PIC with the concomitant responsibilities of such. Moreover, the proposed partnership will also inevitably involve the sharing of the personal data of IBPM employees with TendoPay. NPC Circular No. 2020-03 defines data sharing as the sharing, disclosure, or transfer to a third party of personal data under the custody of a personal information controller to one or more personal information controller/s. In this regard, it is important for both entities to manage the shared personal data in a collaborative and responsible manner. We recommend that the parties execute a Data Sharing Agreement (DSA) containing the terms and conditions of the sharing arrangement. Though the execution of a DSA is no longer mandatory under NPC Circular No. 2020-03, it is still considered as a best practice and a demonstration of accountability by the PICs.
Furthermore, as PICs processing employees’ personal data, both IBPM and TendoPay must adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality. In line with these data privacy principles stated under the DPA, both parties should have a privacy notice informing data subjects of the nature, scope, and purpose of data sharing between the two PICs involved. Furthermore, the PICs should choose the appropriate lawful basis under Sections 12 and 13 of the DPA that is most applicable for the purpose of the intended processing. In this instance, it appears that IBPM and TendoPay have distinct legal bases in processing the employees’ personal data. IBPM’s processing is anchored on its employment contract with covered data subjects, while TendoPay’s lawful basis for processing is for the fulfillment of a loan contract or other financial service to be availed of by the employee. Finally, in adherence to the principle of proportionality, IBPM should only disclose to TendoPay the necessary personal data required to facilitate the utilization of financial services offered by TendoPay.
Obligations of a PIC and PIP
Apart from adherence to the data privacy principles, PICs also have the duty to uphold data subjects’ rights under Sections 16 and 18 of the DPA. The exercise of data subjects’ rights will be different for IBPM and TendoPay, since their processing have different purposes.
In addition, Section 20 of the DPA requires PICs to implement reasonable and appropriate physical, organizational and technical security measures for the protection of the personal data of employees. To determine if the security measures are appropriate with the processing of
personal data, factors such as the nature of the personal data to be protected, the risks represented by the processing, the size of the organization and complexity of its operations, current data privacy best practices and the cost of security information must be considered.4
Finally, we underscore that both the PICs have the obligation and duty to adhere to the DPA, its IRR, issuances by the NPC, and all other applicable laws. Notably, PICs remain accountable for personal information that is in its control including data outsourced to third parties.5
Please be advised that the foregoing was rendered based solely on the information provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Note that this communication is not intended to adjudicate the rights and obligations of the parties involved.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN, IV Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 ↩