Issuance Text
NPC Circular No. 2023 - 07
DATE: 13 December 2023
SUBJECT: GUIDELINES ON LEGITIMATE INTEREST
WHEREAS, Section 7 of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA) provides that the National Privacy Commission (NPC) is charged with the administration and implementation of the DPA, which includes ensuring the compliance of personal information controllers (PICs), and carrying out efforts to formulate and implement plans and policies that strengthen the protection of personal information in the country in coordination with other government agencies and the private sector;
WHEREAS, under Section 9 of the Implementing Rules and Regulations of the DPA (IRR), the NPC is mandated to develop, promulgate, review, or amend rules and regulations for the effective implementation of the DPA;
WHEREAS, Section 12(f) of the DPA provides that personal information may be processed based on a legitimate interest pursued by the PIC or by a third party to whom the data is disclosed;
WHEREAS, there is a need to clarify how a PIC may establish the existence of legitimate interest, the necessity of personal information processing for such interest, and the assessment of such interest in relation to a data subject’s fundamental rights and freedoms;
WHEREFORE, in view of the foregoing, the NPC hereby issues this Circular to provide guidelines on legitimate interest as a lawful basis for processing personal information.
SECTION 1. Scope and Purpose. This Circular applies to all PICs and third parties engaged in the processing of personal information based on legitimate interest under Section 12(f) of the DPA.
This Circular provides guidelines for PICs and third parties relying on legitimate interest as a lawful basis to process personal information for a specific processing activity.
SECTION 2. Definition of Terms. The definition of terms in the DPA and its IRR, as amended, as well as in existing NPC issuances, are adopted herein.
SECTION 3. General Considerations. Section 12(f) of the DPA permits the processing of personal information when the processing is necessary for the legitimate interests pursued by the PIC or a third party to whom the personal information is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject that require protection under the Philippine Constitution.
-
A. Legitimate interest refers to any actual and real interest, benefit, or gain that a PIC or third party may have in or may derive from the processing of specific personal information.
-
B. Processing based on a legitimate interest may only be relied on for the processing of personal information. It cannot be relied upon when the processing involves sensitive personal information and privileged information.
-
C. The third party in Section 12(f) of the DPA refers to any natural or juridical person to whom personal information is disclosed and who is not the PIC, the personal information processor (PIP), or the data subject of the specific processing activity.
-
D. The fundamental rights and freedoms of data subjects protected under the Philippine Constitution and the effect and impact of the specific processing activity on such rights and freedoms shall be assessed and weighed against the legitimate interest of the PIC or third party through a legitimate interest assessment.
PROCESSING BASED ON LEGITIMATE INTEREST
SECTION 4. Requisites for Processing Based on Legitimate Interest; Legitimate Interest Assessment. Processing based on legitimate interest requires the fulfillment of the following conditions:
-
A. The legitimate interest is established;
-
B. The means to fulfill the legitimate interest is both necessary and lawful; and
-
C. The interest is legitimate and lawful, and it does not override fundamental rights and freedoms of data subjects.
There is no prescribed form for a legitimate interest assessment. The PIC or third party is not precluded from using any existing method, structure, or form, provided that the PIC or third party applies the requisites for processing based on legitimate interest in its assessment.
SECTION 5. The Legitimate Interest is Established (Purpose Test). A PIC shall determine the existence of a clearly established legitimate interest, including a determination of the objective of the specific processing activity.
-
A. The purpose of the specific processing activity must be specific, such that it is clearly defined and not vague or overbroad;
-
B. The purpose of the specific processing activity must not be contrary to laws, morals, or public policy following the principle of legitimate purpose; and
-
C. The interest established must be declared to the data subject prior to the processing or at the next practical opportunity, following the principle of transparency and the right of the data subject to be informed.
SECTION 6. The Means to Fulfill the Legitimate Interest is both Necessary and Lawful (Necessity Test). The means or method chosen for the specific processing activity undertaken to accomplish the legitimate interest of the PIC or the third party should be necessary and lawful.
-
A. The means to fulfill the legitimate interest must be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose, in accordance with the principle of proportionality; and
-
B. The means chosen to accomplish the legitimate interest is itself lawful. The PIC cannot violate any law in the process of accomplishing its legitimate interest.
SECTION 7. The Interest is Legitimate and Lawful, and it does not Override Fundamental Rights and Freedoms of Data Subjects (Balancing Test). A PIC or third party relying on legitimate interest shall determine whether the processing undertaken does not override the data subject’s fundamental rights and freedoms. In doing so, the PIC or third party shall look at the effect or impact of accomplishing the legitimate interest and consider the purpose of processing the interest established and the means by which it is fulfilled.
The factors that may be considered include but are not limited to:
-
A. Effect or impact of the specific processing activity on the data subject;
-
B. Measures implemented to protect the personal information involved in the specific processing activity or to mitigate the effect or impact of the specific processing activity on the data subject (e.g., privacy-enhancing technologies);
-
C. Availability of other means or methods to fulfill the legitimate purpose; and
-
D. Reasonable expectation of the data subject on the specific processing of their personal information taking into consideration the surrounding circumstances of each case. A PIC shall consider what a reasonable person would find acceptable under the circumstances taking into consideration the interest established.
OBLIGATIONS OF THE PERSONAL INFORMATION CONTROLLER
SECTION 8. Documentation. A PIC shall document the conduct and results of its legitimate interest assessment.
-
A. A PIC must regularly evaluate its compliance with the requisites for legitimate interest as part of their regular process.
-
B. A PIC must keep the records of the legitimate interest assessment made as the basis for relying on Section 12(f) of the DPA to process personal information.
-
C. In case of an investigation or a compliance check, the NPC may require the submission of the records of the legitimate interest assessment.
SECTION 9. Further Processing of Personal Information Based on Legitimate Interest. For personal information originally collected based on consent, further processing for additional purposes that constitute a legitimate interest of the PIC may be allowed in accordance with Section 6(B) of the Circular on the Guidelines on Consent.
SECTION 10. Legitimate Interest of Third Parties. A PIC shall verify the legitimate interest of the third party to whom personal information may be disclosed, either through its own legitimate interest assessment or on the basis of the third party’s legitimate interest assessment, as stated in Section 4 of this Circular.
If a third party intends to process personal information from another PIC for its own legitimate interest, such third party is considered a PIC.
SECTION 11. Sectoral Determination of Specific Legitimate Interest. The NPC encourages industry sectors to determine common personal information processing activities within their respective industries that may be based on legitimate interest.
SECTION 12. Processing Carried Out by Public Authorities. As a general rule, legitimate interest shall not apply to the processing carried out by public authorities in the performance of their constitutional or statutory mandates.
Legitimate interest may be considered the appropriate lawful basis for specific processing activities carried out by government agencies that are not expressly provided in their mandate and do not fall squarely on any of the other criteria for processing under Section 12 of the DPA or as a special case under Section 4 of the DPA. Legitimate interest may apply as lawful basis for ancillary processing activities performed in the ordinary course of business. In such cases, the PIC must conduct a legitimate interest assessment.
SECTION 13. Interpretation. Any doubt in the interpretation of any provision of this Circular shall be liberally interpreted in a manner mindful of the rights and interests of the data subject.
SECTION 14. Penalties. The processing of personal data in violation of this Circular shall carry criminal, civil, and administrative liability pursuant to the provisions of the DPA, its IRR, and related issuances of the Commission.
SECTION 15. Transitory Provision. All affected PICs shall be given a period of ninety (90) calendar days from the effectivity of this Circular to comply with the requirements provided in Section 8(B) herein.
SECTION 16. Separability Clause. If any portion or provision of this Circular is declared null and void, or unconstitutional, the other provisions not affected thereby shall continue to be in force and effect.
SECTION 17. Repealing Clause. All other rules, regulations, and issuances contrary to or inconsistent with the provisions of this Circular are deemed repealed or modified accordingly.
SECTION 18. Effectivity. This Circular shall take effect fifteen (15) calendar days after its publication in the Official Gazette or a newspaper of general circulation.
Approved:
SGD.
JOHN HENRY D. NAGA
Privacy Commissioner
SGD.
LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner
SGD.
NERISSA N. DE JESUS
Deputy Privacy Commissioner