On Consent and Data Sharing Agreements
Section 20(b) of the Implementing Rules and Regulations to the Data Privacy Act states that:
Data Sharing shall be allowed in the private sector if the data subject consents to data sharing, and the following conditions are complied with:
- Consent for data sharing shall be required even when the data is to be shared with an affiliate or mother company, or similar relationships; ...
Does this mean that the only legal basis for data sharing between PICs is consent?
Not so. NPC clarifies on its Circular on Data Sharing Agreements:
SECTION 6. Authorized processing. — Data sharing may be based on any of the criteria for lawful processing of personal data in Sections 12 and 13 of the Act...