Text
26 December 2024
Re: INSPECTION OF CORPORATE RECORDS BY THE U.S. SECURITIES AND EXCHANGE COMMISSION VIS-À-VIS THE DATA PRIVACY ACT OF 2012
Dear [Redacted], et. al:
We respond to your request for an Advisory Opinion on whether the records processed by your client, (Company), are exempted from the application of the Data Privacy Act of 2012 (DPA),1 and whether the DPA would pose any impediment to the United States Securities and Exchange Commission (U.S. SEC) ability to examine and access the Company’s records.
You also seek clarification on whether the National Privacy Commission (NPC) can issue a letter of assurance to the U.S. SEC stating that: 1) NPC shall allow the U.S. SEC direct access to its records in accordance with the exemption stated in Section 4 of the DPA; and 2) the DPA shall not operate as a restriction in preventing the U.S. SEC from exercising its authority to review and examine relevant records kept and processed by the Company.
As background, you state that the Company is a business process outsourcing corporation duly organized under Philippine laws providing services to offshore clients. The Company is registered with both the Philippine Economic Zone Authority (PEZA) and the Board of Investments (BOI) as an export enterprise.
The Company’s affiliate company, , entered into a contract with the Bank of for the purpose of providing business processing services. The services involves mutual fund transactions for the clients of the Bank, including performance of procedures relating to subscription, redemptions, switching, know-your-client (KYC) procedures, processing of account opening forms, risk disclosures, and distribution of dividends, among others. The Bank’s target mutual fund clients are United States citizens and residents, but all data processing services will be performed by the Company in the Philippines.
In the performance of the services above, the Bank will collect the data and the same will be passed to the Company for processing. The data are personal and sensitive personal information, specifically: names, birthdates, home addresses, social security numbers, national ID information, and account/banking information.
To process the Bank customers’ data under its contract, the Bank is required under United States laws to deal only with registered transfer agents. Thus, the Company filed an application to obtain a transfer agent registration from the U.S. SEC. Briefly, a transfer agent registration allows an entity to record changes of ownership, maintain the issuer’s security holder records, cancel and issue certificates, and distribute dividends.
The Company’s transfer agent application is currently pending before the U.S. SEC, and the latter requested the former to produce a written assurance issued by its local authorities to the effect that the Company, as a matter of law, can provide the U.S. SEC with prompt direct access to its books and records (which includes personal data of its clients and employees) and to submit to onsite inspection and examination by the U.S. SEC once registered.
From the foregoing, this Advisory Opinion seeks to address issues:
-
Whether the U.S. SEC may be granted access to records processed by the Company in light of Section 4 of the DPA, particularly on the extraterritorial application of the DPA; and
-
Whether the DPA poses any impediment to the U.S. SEC’s authority to examine and access the Company’s records. This considers the balance between the DPA’s provisions on data protection and the U.S. SEC’s mandate as a regulatory agency to conduct examinations and investigations involving personal data.
Discussion
Scope of the DPA; Special Cases; Foreign Jurisdiction2
The DPA and its Implementing Rules and Regulations (IRR) exclude from its scope the personal and sensitive personal information of foreigners originally collected in foreign jurisdictions and subsequently processed in the Philippines. Section 4(g) of the DPA explicitly states:
Section 4. Scope – […] This act does not apply to the following:
xxx
(g) Personal information originally collected from residents of foreign jurisdictions in accordance with the laws of those foreign jurisdictions, including any applicable data privacy laws, which is being processed in the Philippines.
Similarly, the IRR provides a parallel provision in Section 5(f):
Section 5. Special Cases – The Act and these Rules shall not apply to the following
specified information, only to the minimum extent of collection, access, use, disclosure, or other processing necessary to the purpose, function, or activity concerned:
f. Personal information originally collected from residents of foreign jurisdictions in accordance with the laws of those foreign jurisdictions, including any applicable data privacy laws, which is being processed in the Philippines. The burden of proving the law of the foreign jurisdiction falls on the person or body seeking exemption. In the absence of proof, the applicable law shall be presumed to be the Act and these Rules:
Provided, that the non-applicability of the Act or these Rules do not extend to personal information controllers or personal information processors, who remain subject to the requirements of implementing security measures for personal data protection: Provided further, that the processing of the information provided in the preceding paragraphs shall be exempted from the requirements of the Act only to the minimum extent necessary to achieve the specific purpose, function, or activity.
The DPA and its IRR provide an exemption from the coverage of the DPA for personal data processed in the Philippines when the following conditions are met: 1) the personal information is collected from residents of foreign jurisdictions; 2) the collection complies with the data privacy laws of those foreign jurisdictions; and 3) the personal information is being processed within the Philippines.
In this case, you mentioned that the Company will process personal data that: 1) is obtained by its client, the Bank, from residents of a foreign jurisdiction (specifically, the United States of America); 2) such data has been collected in compliance with the data privacy laws of that jurisdiction; and 3) such data is transferred to the Company in the Philippines strictly for processing purposes.
While the Company’s current situation qualifies for an exemption under the DPA, it is important to emphasize that the exemptions cited under the DPA and its IRR is not absolute. As stated in Section 5 of the IRR, personal information controllers (PICs) and personal information processors (PIPs) are permitted to process personal data in special cases; however, such processing must be strictly limited to what is necessary to achieve the specific purpose, function, or activity.
In other words, PICs and PIPs remain accountable for ensuring compliance with the DPA’s requirement on the implementation of robust organizational, physical, and technical security measures to protect personal data and to uphold the data privacy principles.
For example, a government agency with a statutory mandate may process personal data without the necessity of obtaining the data subject’s consent or presenting any other lawful criteria for processing.3 However, this processing must be strictly limited to what is essential to fulfill the agency’s mandate. The agency is required to collect only the data necessary to perform its functions, use it solely for the intended purpose, and disclose only the information required for co-regulation or public disclosure. Additionally, the agency must ensure that robust security measures are in place to protect the personal data it processes.
In the same vein, the U.S. SEC’s review of relevant records in the Company’s custody qualifies as a special case of lawful processing under Section 4(g) of the DPA, in relation to Section 5 of the IRR. The processing conducted by the U.S. SEC serves the specific purpose of fulfilling regulatory requirements under the U.S. Securities and Exchange Act. Such processing complies with the requirement to be strictly limited to what is necessary to achieve the specified purpose. Further, as a government agency, the U.S. SEC is presumed to implement adequate safeguards to protect the personal data in its custody, thereby fulfilling the requirement to establish robust security measures for data protection.
At the same time, the personal data processed in the Philippines by the Company, acting as a PIP, remains protected under the DPA. The U.S. SEC may be granted direct access to the Company’s records and conduct inspections. However, such access is subject to the Company’s strict adherence to the DPA’s principles of transparency, legitimate purpose, proportionality, and accountability.
Principle of Comity and Reciprocity; Request for Letter of Assurance; Lawful Processing
While Philippine corporations are primarily governed by local laws, their participation in international markets often necessitates compliance with additional regulatory requirements imposed by foreign entities, such as the U.S. SEC. These requirements are generally upheld in the Philippines under the principle of comity, where such additional regulatory requirements imposed by foreign entities are often complied with, provided they do not conflict with Philippine laws. Comity, in this context, is neither an absolute obligation nor a mere act of goodwill. Rather, it represents the mutual respect one nation extends to the laws and actions of another, balancing international duty, practical considerations, and the protection of its own citizens’ rights.4
Similarly, the principle of reciprocity also finds application in the present concern. Reciprocity refers to the mutual exchange of rights or obligations between nations, fostering cooperation and ensuring equitable treatment. It is a cornerstone of international relations, particularly in areas such as trade, finance, and regulatory compliance, where mutual respect for legal frameworks is crucial.5
The Philippines adheres to both the principles of comity and reciprocity and is committed to fostering international cooperation and conformity to global standards, all while ensuring compliance with its own legal requirements including those related to privacy and data protection.
In this context, the letter of assurance requested by the U.S. SEC from the NPC may not be appropriate given that the issuance of the same goes beyond the NPC’s function. Instead, this Advisory Opinion serves the same purpose as it clarifies that the DPA should not be interpreted as a hindrance to the U.S. SEC’s regulatory functions, particularly in the examination of books and records containing personal data processed by the Company.
In sum, the NPC will recognize the U.S. SEC’s inspection of the Company’s records as constituting lawful processing under the DPA, provided that the data privacy principles of transparency, legitimate purpose, proportionality, and accountability are upheld.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
For your reference.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN, IV Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, (2012). ↩
-
Foreign jurisdiction; special cases; legitimate purpose; lawful processing. ↩
-
National Privacy Commission, NPC Advisory Opinion No. 2017-020 (18 July 2017). ↩
-
Sison v. The Board of Accountancy and Ferguzon, G.R. No. L-2529, December 31, 1949. ↩
-
Sison, G.R. No. L-2529, Id. ↩