In the digital lending landscape of the Philippines, Online Lending Applications (OLAs) collect vast amounts of Personal Identifiable Information (PII), ranging from government IDs and contact lists to social media permissions. Under Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), borrowers retain specific rights over this data even after a loan is processed or terminated. Central to these is the Right to Erasure or Blocking.

I. The Legal Basis: Section 16(e) of the DPA

The Right to Erasure allows a data subject to demand the withdrawal, removal, or destruction of their personal information from a controller’s filing system. For borrowers using OLAs, this right is exercisable under specific conditions:

Withdrawal of Consent: When the borrower withdraws the consent that originally permitted the OLA to process the data.
Completion of Purpose: When the data is no longer necessary for the purpose for which it was collected (e.g., the loan is fully paid and the account is closed).
Unlawful Processing: If the OLA is found to be processing data in violation of the DPA or other Philippine laws.
Inaccuracy: If the data is proven to be false or outdated.

II. The Scope of Deletion

Permanent deletion refers to the "unrecoverable" removal of data. For an OLA, this includes:

Registration Data: Full name, address, and biometric data.
Contact Lists: Many OLAs require access to contacts; once the legal purpose is served, this data must be purged.
Financial Records: While some records must be kept for tax or regulatory compliance (as mandated by the BSP or SEC), marketing-related data and excessive PII should be deleted.

III. Limitations on the Right to Erasure

The right to demand deletion is not absolute. An OLA may legally deny a request for erasure if:

Existing Debt: If the loan is outstanding, the OLA has a legitimate interest and legal necessity to retain data for collection and credit reporting.
Statutory Requirements: Laws like the Anti-Money Laundering Act (AMLA) or Bureau of Internal Revenue (BIR) regulations may require financial institutions to retain certain records for a period of five (5) to ten (10) years.
Legal Claims: The data is necessary for the establishment, exercise, or defense of legal claims.

IV. Step-by-Step Procedure for Requesting Deletion

Borrowers seeking to exercise this right should follow a formal process to ensure a paper trail exists for potential escalation to the National Privacy Commission (NPC).

1. Verify Account Status

Ensure all outstanding balances, interest, and penalties are settled. Obtain a "Certificate of Full Payment" or a similar clearance. A pending debt is the most common legal ground for an OLA to refuse a deletion request.

2. Contact the Data Protection Officer (DPO)

Under the DPA, every OLA (as a Personal Information Controller) is required to appoint a Data Protection Officer.

Locate the DPO’s contact information in the "Privacy Policy" section of the app or website.
Send a formal Written Request for Erasure.

3. Draft the Request

The formal letter or email should include:

Identity Verification: Full name and the mobile number/email used for the account.
Specific Grounds: State that the loan is fully paid (attach proof) and that you are withdrawing consent for further data processing.
The Demand: Explicitly request the permanent deletion of your PII from their active databases, backups, and any third-party processors they may have shared data with.

4. Response Timeline

The OLA is generally expected to acknowledge and act upon the request within a reasonable timeframe. If the OLA fails to respond or provides an unsatisfactory justification for retention, it may be in violation of the DPA.

V. Remediation: Escalation to the NPC

If the OLA ignores the request or continues to use the data (e.g., for unsolicited marketing or harassment), the borrower can file a formal complaint with the National Privacy Commission.

Grounds for Complaint:

Refusal to honor the Right to Erasure without legal justification.
Processing data for a purpose different from what was declared (e.g., using contact lists for debt shaming).
Failure to implement reasonable security measures to protect the data before it is deleted.

VI. Summary Table of Rights

Right	Application to OLAs
Right to be Informed	Knowing how and why your data is being used.
Right to Access	Demand a copy of the specific data the OLA holds about you.
Right to Object	Stopping the OLA from using your data for direct marketing.
Right to Erasure	The permanent removal of data once the loan contract is terminated.

VII. Conclusion

In the Philippines, data privacy is a fundamental right. Borrowers are not perpetually bound to the data systems of lending companies. Once the contractual obligation—the loan—is fulfilled, the borrower has the legal standing to reclaim their digital footprint and demand that the OLA "forgets" their personal information. Compliance is not optional for the OLA; it is a statutory mandate under the Data Privacy Act of 2012.