Rajah & Tann Regional Round-Up
your snapshot of key legal developments in Asia
Issue 3 - Jul/Aug/Sep 2021

NPC Highlights Privacy Protection in Anti-fraud Data Sharing Initiatives of Financial Industry

In response to the initiatives of the financial services industry on cybersecurity that aim to thwart fraud incidents and uphold customers' confidence in digital payments systems, the National Privacy Commission ("NPC") has issued Advisory Opinion 2021-26 to guide personal information controllers in protecting the privacy of shared databases through strict adherence to the basic data privacy principles of transparency, legitimate purpose, proportionality, and the conduct of privacy impact assessments ("PIAs").

NPC recognises that data sharing for investigation and resolving fraud incidents is allowed under the Data Privacy Act of 2012. While the NPC Privacy Policy Office recognises that having a shared database for know-your-customer, enhanced due diligence, and anti-money laundering purposes may enhance the integrity of the financial system, there is a need to ensure that personal and sensitive personal information (collectively, "personal data") is processed fairly and lawfully. In this particular context, the NPC Privacy Policy Office emphasised that personal data in such database must be accurate, relevant, and kept up to date. Consequently, inaccurate or incomplete data must be rectified, supplemented, destroyed or their further processing restricted. 

The NPC Privacy Policy also recommends the conduct of a PIA to identify, assess, evaluate, and manage the risks represented by the processing of personal data in the shared database.

Equally important to the rights of financial services industry are the rights of data subjects. In this regard, the NPC Privacy Policy Office has reminded the financial services industry that data subjects should be provided the mechanism to exercise their rights.

Please note that whilst the information in this Update is correct to the best of our knowledge and belief at the time of writing, it is only intended to provide a general guide to the subject matter and should not be treated as a substitute for specific professional advice.


Gatmaytan Yap Patacsil Gutierrez
& Protacio (C&G Law)
30/F 88 Corporate Center
SedeƱo cor. Valero Streets
Salcedo Village, Makati City 1227


Ben Dominic R Yap
Managing Partner
D +632 8894 0377
F +632 8552 1978

Jaime Renato B Gatmaytan
D +632 8894 0377
F +632 8552 1978

Norma Margarita B Patacsil
D +632 8894 0377
F +632 8552 1978

Anthony Mark A Gutierrez
D +632 8894 0377
F +632 8552 1978

Rajah & Tann Asia is a network of legal practices based in Asia.

Member firms are independently constituted and regulated in accordance with relevant local legal requirements. Services provided by a member firm are governed by the terms of engagement between the member firm and the client.

This update is solely intended to provide general information and does not provide any advice or create any relationship, whether legally binding or otherwise. Rajah & Tann Asia and its member firms do not accept, and fully disclaim, responsibility for any loss or damage which may result from accessing or relying on this update.