NPC Issuance Wiki

Guidelines on the Processing of Personal Data for Loan-Related Transactions (Circular No. 20-01)

Issued Circular

Issuance Text

NPC Circular No. 20-01

DATE: 14 September 2020

SUBJECT: GUIDELINES ON THE PROCESSING OF PERSONAL DATA FOR LOAN-RELATED TRANSACTIONS

WHEREAS, the National Privacy Commission (NPC) has received numerous complaints against some lending entities operating online lending applications (online apps) which can be downloaded and installed in mobile phones;

WHEREAS, these online apps are used to facilitate loan transactions between these lending entities and their clients. The online apps provide a platform for the processing of personal data relating to their clients, which includes access to their clients’ phones’ contact list, camera, location, and storage, among others;

WHEREAS, the complaints claimed that these lending entities, through the online apps, processed personal data of their clients without lawful basis under the law, and used such personal data about their clients and other individuals in their contact list causing damage to their reputation, in violation of their rights and freedoms as data subjects;

WHEREAS, Section 2 of Republic Act No. 10173 otherwise known as the Data Privacy Act of 2012 (DPA) provides that it is the policy of the State to protect the fundamental human right of privacy of communication while ensuring free flow of information to promote innovation and growth. The State recognizes the vital role of information and communications technology in nation-building and its inherent obligation to ensure that personal information in information and communications systems in the government and in the private sector are secured and protected;

WHEREAS, pursuant to Section 7 of the DPA, the NPC is charged with the administration and implementation of the provisions of the law, which includes ensuring compliance with the provisions of the DPA and with international standards for data protection, and carrying out efforts to formulate and implement plans and policies that strengthen the protection of personal information in the country, in coordination with other government agencies and the private sector;

WHEREFORE, in consideration of the foregoing premises, and without prejudice to the application of other pertinent laws and regulations on the matter, the NPC hereby issues this Circular that prescribes the guidelines for processing of personal data for loan transactions.

SECTION 1. Scope. This Circular shall apply to, among others, the processing of personal data for purposes of loan processing activities,1 through any modality, by lending or financing companies, as defined under the Lending Company Regulation Act of 2007 and Financing Company Act of 1998, respectively, or by any natural or juridical person who acts as such, whether or not granted with the requisite authority from the Securities and Exchange Commission (SEC). It shall likewise apply to personal information processors (PIP) or third-party service providers engaged by the lending or financing company, or any natural or juridical person who acts as such, whenever such PIPs or third-party service providers are engaged in the processing of the personal information of the latter’s clients.

For purposes of this Circular, a lending company (LC) shall refer to a corporation engaged in granting loans from its own capital funds or from funds sourced from not more than nineteen (19) persons. It shall not be deemed to include banking institutions, investment houses, savings and loan associations, financing companies, pawnshops, insurance companies, cooperatives and other credit institutions already regulated by law.2

Financing companies (FC) are corporations, except banks, investments houses, savings and loan associations, insurance companies, cooperatives, and other financial institutions organized or operating under other special laws, which are primarily organized for the purpose of extending credit facilities to consumers and to industrial, commercial, or agricultural enterprises, by direct lending or by discounting or factoring commercial papers or accounts receivable, or by buying and selling contracts, leases, chattel mortgages, or other evidences of indebtedness, or by financial leasing of movable as well as immovable property.3

While some entities are excluded from the definition above of lending and financing companies, these entities remain to be within the jurisdiction of the NPC with respect to all other obligations under the DPA, its Implementing Rules and Regulations (IRR), and applicable issuances of the NPC.

SECTION 2. Obligations of personal information controllers. All entities engaged in the processing of personal data for purposes of granting loan facilities are personal information controllers (PICs). As PICs, they shall process personal and sensitive personal information (collectively, personal data) of borrowers in accordance with any of the criteria for lawful processing provided for under Sections 12 and 13 of the DPA. They shall implement reasonable and appropriate organizational, physical, and technical security measures for the protection of personal data and uphold the rights of data subjects.

SECTION 3. Guidelines. The processing of personal data for evaluating loan applications, granting loans, collection of loans, and closure of loan accounts shall be subject to the following general guidelines:

  • A. Borrowers shall be provided all the details required under Section 16 (b) of the DPA and Section 34 (a)(2) of its IRR, in a clear language and in the most appropriate format.

    1. The details shall include all the information concerning all phases of the loan processing activity, from loan solicitation, loan origination, repayment, debt collection and remedial measures;
    2. Whenever the loan processing activity entails the use of profiling, automated processing, automated decision-making, or credit rating or scoring, the borrower shall be informed of the same before the entry of his or her personal data into the data processing system or at the next practical opportunity;
    3. Pursuant to the borrower’s right to information and access, LCs, FCs and other persons acting as such shall disclose the categories of data considered in deciding whether to approve or disapprove a loan application. Recognizing, however, that the integrity of the evaluation process and methods used must be maintained to avoid possible manipulation or exploitation of the same, LCs, FCs and other persons acting as such may implement reasonable policies determining the minimum information and manner of disclosure to a borrower; and
    4. LCs, FCs, and other persons acting as such shall adopt policies and procedures to adequately address borrowers’ inquiries and clarifications.

  • B. In cases where a borrower’s personal data will be further processed for purposes compatible with the primary purpose, the same may be allowed, provided that:

    1. A direct and objective link must exist between the primary purpose for the processing of the personal data and the other compatible purposes. Such other purposes may include customer behavior analysis, system administration, service quality maintenance, customer service or support, among others; and
    2. Should information be used for marketing, cross-selling, or sharing to third parties for purposes of offering other products or services not related to loans, LCs, FCs and other persons acting as such must have a separate lawful criterion for such processing pursuant to Sections 12 and/or 13 of the DPA.

  • C. LCs, FCs, and other persons acting as such shall limit the collection of personal data from the borrowers to those which are adequate, relevant, suitable, necessary, and not excessive in relation with the applicable know your customer (KYC) policies, rules and regulations, as well as those necessary for determining creditworthiness and preventing fraud.

  • D. Where online apps are used for loan processing activities, LCs, FCs, and other persons acting as such shall be prohibited from requiring unnecessary permissions that involve personal and sensitive personal information.

    1. Application permissions shall only be allowed when suitable, necessary, and not excessive for the purpose of KYC, determining creditworthiness, preventing fraud, and collecting the debt in accordance with applicable provisions of law.

    2. When such purpose has already been achieved, such online apps shall prompt the data subject to turn off or disallow these permissions.

    3. Where an online app requires access to the borrower’s phone camera to take a photo of the borrower and/or the photo gallery to choose a photo for the exclusive purpose of KYC and preventing fraud at the beginning of the loan application, permission for such access may be allowed at that stage in the loan application process.

      Where the photo has already been taken and saved in the application, the application should already turn off such permission by default, or at the very least, prompt the borrowers through appropriate means, i.e. just-in-time, pop-up notices, etc. that they may already turn off or disallow such permission as the same is no longer necessary for the operation of the application. In no way shall the borrower’s photo be used to harass or embarrass the borrower in order to collect a delinquent loan.

    4. Access to contact details in whatever form, such as but not limited to phone contact list or e-mail lists, the harvesting of social media contacts, and/or copying or otherwise saving these contacts for use in debt collection or to harass in any way the borrower or his/her contacts, are prohibited. In all instances, online lending apps must have a separate interface where borrowers can provide character references and/or co-makers of their own choosing.

  • E. LCs, FCs, and other persons acting as such shall bear in mind that they are at all times accountable for personal data under its control or custody. They shall not use any personal data to engage in unfair collection practices as defined under SEC Memorandum Circular No. 18 series of 2019. Such practices may also be construed as a punishable act under the DPA; and

  • F. LCs, FCs, and other persons acting as such shall adopt and implement reasonable policies regarding the retention of the personal data of those whose loan applications were denied and of borrowers who have fully settled their loans. Personal data shall not be retained in perpetuity in contemplation of a possible future use yet to be determined. Otherwise, applicable penalties as provided for in the DPA may be imposed.

SECTION 4. Character references. Borrowers may be required to provide names and contact numbers of character references to support the evaluation of the loan application and/or the loan collection process. To this end, it shall be the responsibility of the borrower to inform their character reference regarding the latter’s inclusion as character reference.

LCs, FCs, and other persons acting as such shall adopt policies and procedures in handling the personal data of such character references, which may include policies on handling calls.

LCs, FCs, and other persons acting as such shall adequately inform the concerned individuals that they were chosen as character reference of the loan applicant and how their contact details were obtained. LCs, FCs and other persons acting as such shall also provide the option of having their personal data removed as a character reference, if the same is feasible.

SECTION 5. Credit data. Where the credit data of a borrower is required to be disclosed or submitted pursuant to law or regulation, the relevant provisions of the DPA shall apply.

All other instances where LCs, FCs, and other persons acting as such either share credit data to a third party or obtain personal data from other entities that may help determine creditworthiness of their borrowers, must also be authorized under the DPA. LCs, FCs, and other persons acting as such shall, at all times, ensure the protection of the rights and freedoms of the individual about whom the personal data is processed in accordance with the DPA, its IRR and relevant NPC issuances.

SECTION 6. Outsourcing. LCs, FCs, and other persons acting as such may outsource any personal data processing activity it may deem appropriate. Details of the authorized PIPs or third-party service providers shall be made available to borrowers to ensure that they are transacting only with authorized individuals or entities.

Parties to such outsourcing arrangements shall be guided by the provisions of the IRR of the DPA on Outsourcing and Subcontracting Agreements. Pursuant to the principle of accountability under the DPA, PICs are expected to be responsible for any personal data under its control or custody, including the processing of information that have been outsourced to a PIP.

LCs, FCs, and other persons acting as such shall ensure, through contractual or other reasonable means, that the PIPs are aware of their obligations under the DPA, its IRR and issuances of the NPC, and may be held contractually liable to the PIC for violations of their agreement.

SECTION 7. Rights of the data subject. All borrowers shall be accorded their rights as provided for under the DPA. Similar rights as may be provided for under other applicable laws, i.e. Section 4 (o) of the Credit Information System Act (CISA), shall be available to the borrower.

LCs, FCs, and other persons acting as such shall adopt policies and procedures which enables borrowers to exercise their rights under the DPA.

In all cases, loan processing activities shall be consistent with the relevant provisions of the DPA, its IRR and relevant issuances of the NPC. LCs, FCs, and other persons acting as such who shall fail to do so shall be liable under the applicable provisions of the DPA.

SECTION 8. Transitory Provisions. Upon effectivity of this Circular, all LCs, FCs, and other persons acting as such who are in possession of their borrowers’ contact list in whatever form, in contravention of Section 3 (D) (4) shall dispose of the same in a secure manner that would prevent further unauthorized processing, access, or disclosure to any other party or the public.

SECTION 9. Separability Clause. If any portion or provision of this Circular is declared null and void, or unconstitutional, the other provisions not affected thereby shall continue to be in force and effect.

SECTION 10. Repealing Clause. All other rules, regulations, and issuances contrary to or inconsistent with the provisions of this Circular are deemed repealed or modified accordingly.

SECTION 11. Effectivity. This Circular shall take effect fifteen (15) days after its publication in the Official Gazette or two newspapers of general circulation.

Approved:

Sgd.
RAYMUND E. LIBORO
Privacy Commissioner

Sgd.
LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner

Sgd.
JOHN HENRY D. NAGA
Deputy Privacy Commissioner

Footnotes

  1. “Loan processing activities” shall refer to any undertaking by lending or financing companies and other persons acting as such, for purposes of soliciting, evaluating, granting and maintaining a loan facility, including determination of creditworthiness. This shall include among others, activities to enforce Know-Your-Customer (KYC) policies, loan solicitation, submission of loan application and required documents by the borrower, loan servicing, repayment of the loan, debt collection, and remedial measures undertaken by the LCs, FCs, other persons acting as such, and their authorized representatives. ↩

  2. An Act Governing the Establishment, Operation and Regulation of Lending Companies [Lending Company Regulation Act of 2007], Republic Act No. 9474 (2007). ↩

  3. An Act Amending Republic Act No. 5980, As Amended, Otherwise Known As The Financing Company Act [Financing Company Act of 1998], Republic Act No. 8556 (1998). ↩

Backlinks