NPC Issuance Wiki

Amending Certain Provisions of NPC Circular No. 20-01 on the Guidelines on the Processing of Personal Data for Loan-Related Transactions (NPC Circular No. 2022-02)

Issued Circular

Issuance Text

NPC Circular No. 2022 – 02

DATE: 01 December 2022

SUBJECT: AMENDING CERTAIN PROVISIONS OF NPC CIRCULAR NO. 20-01 ON THE GUIDELINES ON THE PROCESSING OF PERSONAL DATA FOR LOAN-RELATED TRANSACTIONS

SECTION 1. Objective. This Circular aims to expound on NPC Circular No. 20-01 to respond to exigencies in the processing of personal data for loan-related transactions by lending and financing companies and other persons acting as such.

SECTION 2. Amendments. The following provisions of NPC Circular No. 20–01 are hereby amended as stated below:

  • A. In Section 3(A), fifth and sixth paragraphs shall be inserted to read:

    1. LCs, FCs and other persons acting as such shall obtain consent for the processing of personal data at the point where the personal data is necessary. They should provide just-in-time notices before obtaining the consent of the data subjects.

      A just-in-time notice provides data subjects with information on how a particular piece of information he or she is asked to provide will be processed. This information is provided at the point in time where the LCs, FCs, or other persons acting as such is about to process or processes such personal data of the data subject.

    2. The most appropriate format in providing details of processing to borrowers, as required by Section 16 (b) of the DPA and Section 34 (a) (2) of its Implementing Rules and Regulations (IRR), shall be the format which is aligned with the business processes of the LCs, FCs, or other persons acting as such, with utmost consideration to the accessibility of the information and convenience of the borrowers [e.g., if the loan transaction is being facilitated through a mobile application, the aforementioned information, shall be readily accessible and easily located within the mobile application].

  • B. Section 3 (D) is hereby amended to read as follows:

    • D. Where online applications are used for loan processing activities, LCs, FCs, or other persons acting as such shall be prohibited from conducting unnecessary processing including requiring unnecessary permissions that involve personal and sensitive personal information.

      1. Mobile applications shall only require data subjects to provide access to personal data through permissions or protected resources when suitable, necessary, and not excessive to the legitimate purposes provided in Section 3 (B) (1) and Section 3 (C) of this Circular, and debt collection, subject to the limitations provided by law and in accordance with applicable provisions of law.

        Processing of personal data from application permissions, such as but not limited to accessing contact lists and cameras of data subjects, should only commence at the point where the information is necessary for the purposes provided for in the preceding paragraph.

        In cases where the data subjects provide information that was not obtained through application permissions, such information should still be processed in a manner that is not excessive to the legitimate purpose.

      2. When the purpose for accessing an application permission has already been achieved and there are no other applicable lawful criteria for such access, such online applications shall prompt the data subject to turn off, disallow these permissions, or inform the data subject that access to the relevant application permissions may already be revoked.

      3. Where an online application requires access to the borrower’s phone camera, or access to the photo gallery to choose a photo for the legitimate purposes of KYC and preventing fraud at the beginning of the loan application or for payment verification and other similar legitimate purposes, permissions for such access may be allowed during that particular stage in the loan process and must be turned-off after the fulfillment of such purposes or the data subject shall be informed when such purposes have been fulfilled and access to the relevant application permission(s) may already be revoked.

        Where the photo has already been taken and saved in the application, the application should already turn off the relevant application permission by default, or at the very least, prompt the borrower through appropriate means (e.g., just-in time, pop-up notices) that he or she may already turn off or disallow such permission as the same is no longer necessary for the operation of the application. In no way shall the borrower’s photo be used to harass or embarrass the borrower in order to collect a delinquent loan or for any unfair collection practices.

      4. Access to and processing of contact lists may be allowed for the purpose of deriving proportional metadata1 about such contact lists subject to Section 3 (D) (1) and the requirements of Section 4.

        “Contact list” refers to any compilation or list of information maintained by the data subject that enables him or her to communicate with other individuals. This includes the data subject’s phone contact lists, email lists, or social media contacts.

        Unbridled processing of contact list, in whatever form, is prohibited. “Unbridled processing” refers to processing, that is unconstrained, excessive, and disproportional to its purpose such as but is not limited to:

        • a) Processing that leads to harassment;
        • b) Processing for collection of debt outside of the guarantors provided by the borrower; and
        • c) Processing that results in unfair collection practices.2

      5. Subject to the limitations of the immediately preceding paragraph, the processing of contact lists for purposes of identifying and contacting the character references or guarantors provided by the borrowers themselves is allowed. Online lending applications must have separate interfaces where borrowers can provide character references and guarantors of their own choosing. LCs, FCs, and other persons acting as such may only be provided limited access to and only to the minimum extent necessary to allow the borrowers to choose from their phone contact list their character references and guarantors, if any.

  • C. The following provisions shall be added to Section 3:

    • G. LCs, FCs, and other persons acting as such shall, as part of their registration with the NPC, submit a complete list of the names of all publicly available applications owned or operated by such entities including all publicly available online applications used for loan processing activities, in accordance with the applicable Rules on Registration of Data Processing Systems and Notifications regarding Automated Decision-Making;
    • H. PIPs or third-party service providers operating in the Philippines, engaged by LCs, FCs, and other persons acting as such, shall likewise be required to register with the NPC whenever they are engaged in the processing of personal data under the instructions of the LCs, FCs, or other persons acting as such;
    • I. For PIPs or third-party service providers outside the Philippines, LCs, FCs, and other persons acting as such, shall ensure that appropriate technical and contractual controls are in place to ensure appropriate protection in the processing of personal data, taking into consideration Sections 28 to 29 and 43 to 45 of the IRR of the DPA;
    • J. Upon determination of any violation of this Circular, the NPC shall revoke the registration of the PIC or PIP upon due notice and after providing the PIC or PIP an opportunity to explain pursuant to the NPC’s existing rules on revocation of registration; and
    • K. LCs, FCs, and other persons acting as such or PIPs or third-party service providers whose Certificate of Registration has been revoked by the NPC or those determined to have violated the registration requirements, shall be subject to penalties and disciplinary measures as provided in the DPA, its IRR and other issuances of the NPC.

  • D. Section 4 is hereby amended to read as follows:

    SECTION 4. Character references. A character reference is a person whose contact information is provided for verification of the identity and veracity of the information provided by the borrower for the grant of a loan.

    • A. A borrower may be required to provide names and contact numbers of character references to support the evaluation of the loan application process. To this end, it shall be the responsibility of the borrower to inform his or her character reference regarding the latter’s inclusion as such.
    • B. LCs, FCs, and other persons acting as such shall adopt policies and procedures in handling the personal data of such character references, which may include policies on handling calls.
    • C. LCs, FCs, and other persons acting as such shall adequately inform the concerned individuals that they were chosen as character reference of the loan applicant and how their contact details were obtained. LCs, FCs and other persons acting as such shall also provide the character reference with the option of having his or her personal data removed as a character reference.
    • D. Contacting character references for purposes other than for the verification of identity and veracity of the information provided by the borrower, such as but not limited to, marketing, cross-selling, or sharing to third parties for purposes of offering other products or services, is prohibited.
    • E. A character reference shall not be automatically treated as a guarantor.

  • E. A new Section 5 is hereby added to read as follows:

    SECTION 5. Guarantors. A guarantor is one who expressly binds himself or herself to the creditor to fulfill the obligation of the individual borrower in case the latter should fail to do so. For a person to be considered a guarantor, he or she should have given his or her consent to be a guarantor in accordance with the provisions of the Civil Code on guaranty.

    • A. The guarantor’s separate consent must be obtained by the LC, FC or other persons acting as such, in accordance with the applicable provisions of the DPA, particularly those on transparency, the right of data subjects to be informed, and consent as a lawful basis for processing personal data.
    • B. For purposes of debt collection, LCs, FCs or persons acting as such may only contact the guarantor. Contacting persons in the borrower’s contact list other than those who were named as guarantors is prohibited in accordance with this Circular and the applicable issuances of the Securities and Exchange Commission on unfair debt collection practices.3

  • F. The succeeding Sections on Credit Data, Outsourcing, Rights of the data subject are hereby renumbered accordingly:

    SECTION 6. Credit Data. x x x

    SECTION 7. Outsourcing. x x x

    SECTION 8. Rights of the data subjects. x x x

SECTION 3. Transitory Provisions. All LCs, FCs, and other persons acting as such shall register all online applications used for loan processing activities with the NPC in accordance with the applicable Rules on Registration of Data Processing Systems and Notifications regarding Automated Decision-Making within fifteen (15) days after the effectivity of this Circular or within thirty (30) days from the availability of the NPC’s registration system, whichever comes later.

All online applications which will be made publicly available after the effectivity of this Circular shall be registered with the Commission in accordance with Section 2 (C) of this Circular.

SECTION 4. Separability Clause. If any portion or provision of this Circular is declared null and void, or unconstitutional, the other provisions not affected thereby shall continue to be in force and effect.

SECTION 5. Repealing Clause. All other rules, regulations, and issuances contrary to or inconsistent with the provisions of this Circular are deemed repealed or modified accordingly.

SECTION 6. Effectivity. This Circular shall take effect fifteen (15) days after its publication in the Official Gazette or a newspaper of general circulation.

Approved:

SGD.
JOHN HENRY D. NAGA
Privacy Commissioner

SGD.
LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner

Footnotes

  1. Metadata as used in this Circular is understood to be any information that may define or describe contact lists. ↩

  2. Securities and Exchange Commission, “Prohibition on Unfair Debt Collection Practices of Financing Companies (FC) and Lending Companies (LC),” SEC Memorandum Circular No. 18, series of 2019 [SEC MEMO. CIRC. 18, s. 2019], § 1 (19 August 2019): Unfair collection practices are as those which use or involve threats of use of violence or other criminal means to harm the physical person, reputation or property of any person, as well as those which use threats to take any action that cannot be legally taken. ↩

  3. See: Securities and Exchange Commission, “Prohibition on Unfair Debt Collection Practices of Financing Companies (FC) and Lending Companies (LC),” SEC Memorandum Circular No. 18, series of 2019 [SEC MEMO. CIRC. 18, s. 2019], § 1 (19 August 2019). ↩

Backlinks