(Data)Sharing is Caring - Philippines NPC issues C2C Data Sharing Guide

National Privacy Commission of the Republic of the Philippines issues impressive, succinct and clear guidance on controller-controller data sharing agreements.

Per the guidance the agreement should contain the following provisions:

• Purpose and lawful basis for the data sharing;
• Objective of the data sharing;
• All parties, and for each party (i) the type of personal data it will share; (ii) whether any personal data processing will be outsourced, including the types of service providers; (iii) method to be used for the processing and (iv) designated data protection officer.
• Term (perpetual DSA's are invalid; but extension or renewal is permitted subject to period review of the sufficiency of the safeguards implemented);
• Operational details of the data sharing. If the recipient may share the data or grant public access to it, the agreement must specify: (i) justification for access; (ii) parties granted access; (iii) types of personal data made accessible; (iv) estimated frequency and volume of access; and (v) any other information that would sufficiently inform the data subject of the nature and extent of the data sharing and processing . If access is by an online platform - the program, middleware and encryption method should be identified;
• Security measures;
• Data subject rights and the mechanisms to exercise them including: (i) identity of the party responsible; (ii) procedure for getting a copy of the DSA (which may be redacted)
• Retention timeline and method of secure return, destruction of disposal of the shared data.
• Any other clauses or terms provided that they are not contrary to law, morals, public order or public policy.

Each party is also required to retain record of its data sharing arrangement including:

• Contact details of all parties, including their respective data protection officers;
• Legal bases for the data sharing arrangement/s;-
• Copy of the DSA/s, if executed;
• Written, recorded, or electronic proof of the consent obtained from data subjects, where applicable; and
• Date and/or time consent was obtained and withdrawn, where applicable.