NPC Issuance Wiki

NPC Advisory Opinion No. 2024-010 — Disclosure of Cooperative Member's Loan Ledgers

Issued Advisory Opinion

Official opinion tags

Text

30 September 2024

Re: DISCLOSURE OF COOPERATIVE MEMBER’S LOAN LEDGERS

Dear ,

We respond to your request for an Advisory Opinion concerning various issues involving the disclosure of loan ledgers containing the personal data of cooperative members. Specifically, the following queries were posed:

Q1 (on DISCLOSURE): Can the Coop Office release/disclose the loan ledgers of Member A to Member B considering they also contain personal data (including financial) of Member A?

Q2 (on AUTHORITY TO DISCLOSE): If YES to Q1, who shall authorize the disclosure, shall it be the Cooperative Chairman being the highest Coop officer?

Q2.1. What if the highest Coop Officer also considers NOT authorizing the disclosure of said loan ledgers?

Q2.2. Can we elevate it to the Coop General Assembly (being the highest decision-making body in a Cooperative) and they can be the one (as a GA) to decide whether to disclose the ledgers or not?

Q3 (on CONSENT): Do we still need to get the consent of Member A about the Coop disclosing his loans ledgers (considering that he transferred his loan anyway to Member B)? Note: As for the consent, we already asked the consent of Member A about it and he signified that he will not provide consent.

Q4: If NO to Q1, can the Coop issue a Statement of Account which also reflects the contents of the ledgers without other personal data and as long as it is Certified Correct by a Coop Officer?

Q5: If it’s okay to ask, what other pertinent Philippine law/s apply to the stated situation? Note: Our Audit Committee hinted that a BSP ruling exempts the issuance of ledgers/info of a transferred loan from the DPA 2012. Will that said BSP ruling apply?

Considering that the issues raised are interrelated, we shall address them jointly below.

Discussion

Personal Information; Sensitive Personal Information; Criteria for Lawful Processing

Personal information is defined under Republic Act (R.A) No. 10173, or the Data Privacy Act of 2012 (DPA),1 as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual2.

On the other hand, sensitive personal information refers to personal information:

  1. About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;
  2. About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;
  3. Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and
  4. Specifically established by an executive order or an act of Congress to be kept classified.3

Meanwhile, processing is defined as any operation or any set of operations performed upon personal data including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data4.

Thus, the disclosure of personal and sensitive personal information (collectively referred to as “personal data”) from an individual or entity to another is considered processing under the DPA.

In this case, the loan ledgers and statements of account (SOA) are documents that contain personal data as they necessarily include information about members such as their name, address, and contact details. We assume it also includes members’ financial records and transaction histories. Hence, the processing either of the loan ledgers or SOA should be based on any of the following lawful criteria for processing under Sections 12 and 13 of the DPA, to wit:

SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

(a) The data subject has given his or her consent; (b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract; (c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;

xxx

(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.

SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

(a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing; (b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;

xxx

(d) The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, That such processing is only confined and related to the bona fide members of these organizations or their associations: Provided, further, That the sensitive personal information are not transferred to third parties: Provided, finally, That consent of the data subject was obtained prior to processing;

xxx

Based on these provisions, lawful processing of personal data is not always anchored on consent, as there are other criteria which may be more appropriate that may be invoked by the personal information controller (PIC).

Thus, the disclosure of the loan ledgers and/or SOAs of members to other members even without the member’s consent is permissible if it is based on any of the circumstances cited under Sections 12 and 13.

Appointment of Data Protection Officer; Obligations as PIC

The decision to disclose personal data rests with and its process owner.5 If no process owner is identified, , through its Board or General Assembly and in consultation with its Data Protection Officer (DPO), may decide whether and how much personal data will be disclosed.6

Please note that NPC Circular 22-0487 requires PICs to designate and register a DPO, who shall be responsible for ensuring compliance with the DPA, its IRR, NPC issuances, and other relevant laws. The DPO may be consulted and may be allowed to participate in meetings of senior and middle management to represent the interest of the members.

It is important to note that the registration and designation of a DPO is a legal requirement imposed upon PICs like . For further guidance, you may check https://privacy.gov.ph/appointing-a-data-protection-officer/.

Rights of the Data Subjects

‘s Data Protection Officer (DPO) or its Board of Directors or General Assembly, whichever is applicable, must also consider the Rights of the Data Subject8 when disclosing its members’ personal data.

These rights are likewise recognized in the Cooperative Development Authority (CDA)‘s Memorandum Circular No. 2023-149 or the CDA Implementing Rules and Regulations of the Financial Products and Services Consumer Protection Act (CDA FCPA IRR). It relevantly states that financial consumers have the right to expect that their financial transactions, as well as all personal information disclosed in the course of their transactions with CDA-Regulated Entities (CDAREs) are kept confidential and secured at all times. CDAREs are required to uphold privacy and protect the data of their financial consumers.

Data Privacy Principles; Appropriate Security Measures

As a PIC, is mandated by the DPA to adhere to the data privacy principles of transparency, legitimate purpose, and proportionality10. The principle of transparency dictates that the data subject must be aware of the nature, purpose and the extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of the PIC, his or her rights as a data subject, and how these can be exercised11. The principle of legitimate purpose mandates that the processing of personal data shall be compatible with a declared and specified purpose, which must not be contrary to law, morals, or public policy. Lastly, the principle of proportionality requires that the processing of personal information shall be adequate, suitable, necessary, and not excessive in relation to the purpose sought to be achieved by the PIC.

Hence, should the disclose the information being requested, they must comply with the foregoing principles. Otherwise, it may not be considered as lawful processing under the DPA. Further, NPC Circular 2023-0612 requires PICs to implement reasonable and appropriate organizational, physical, and technical security measures to ensure the protection of personal information against any accidental or unlawful destruction, alteration, or disclosure, and against any other unlawful processing. As a PIC, the must consider the issues it may encounter in the improper disclosure of personal data. This also includes the requirement to conduct privacy impact assessments to identify and assess various privacy risks and propose measures intended to address and mitigate their effect on the data subjects.

We emphasize that the DPA, its IRR, and other issuances of the NPC do not prohibit cooperatives from conducting their day-to-day activities and transactions.

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

For your reference.

Very truly yours,

(Sgd.) FRANKLIN ANTHONY M. TABAQUIN, IV Director IV, Privacy Policy Office

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communication Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. Id., §. 3(g) ↩

  3. Id., §. 3(l) ↩

  4. Id., §. 3(j) ↩

  5. Data Privacy Act of 2012, §. 20(e). ↩

  6. Data Privacy Act of 2012, §. 12. ↩

  7. National Privacy Commission, NPC Circular 2022-04 (05 December 2022) ↩

  8. Data Privacy Act of 2012, §. 16. ↩

  9. Cooperative Development Authority, Memorandum Circular No. 2023-14 (11 July 2023) ↩

  10. Data Privacy Act of 2012, §. 11. ↩

  11. Implementing Rules and Regulations of the Data Privacy Act of 2012, Rule IV, § 18. ↩

  12. National Privacy Commission, NPC Circular 2023-06 (01 December 2023) ↩

Backlinks

  • No backlinks found