What a lending app may and may not access on your phone

When you install a lending app, it may ask for access to your contacts, photos, files, camera and location. Borrowers often grant everything because the app will not proceed otherwise. It is worth knowing what is legitimate and what is not.

The law that applies

The Data Privacy Act of 2012 (Republic Act No. 10173) governs the processing of personal data in the Philippines and is enforced by the National Privacy Commission. Two of its principles matter here:

• Legitimate purpose — data may be collected only for a declared and lawful purpose.
• Proportionality — the data collected must be adequate, relevant and not excessive in relation to that purpose.

Consent obtained by making an unrelated permission a condition of the service is difficult to describe as freely given. The NPC has acted against lending applications over precisely this kind of collection.

What is actually necessary

To assess and disburse a loan, a lender reasonably needs your identity documents, contact details, income information and disbursement details. That is the scope of the transaction.

What is not

• Your contact list. Nothing in a credit assessment requires knowing who is in your phonebook. In practice it is harvested for collection pressure — which the SEC separately prohibits.
• Your photo gallery and files. A specific document can be uploaded one at a time; full gallery access is not needed for that.
• Your call and message logs.
• Continuous location tracking after the loan is released.

If an app will not function without these, treat it as a reason to choose a different lender rather than a normal cost of borrowing.

How to check permissions

You can review what any installed app can reach:

• Android: Settings → Apps → select the app → Permissions. You can revoke individual permissions here.
• iPhone: Settings → Privacy & Security, or Settings → the app itself.

Also read the privacy notice before installing: it should identify the company, say what data is collected, why, how long it is kept and with whom it is shared. A lending app with no privacy notice, or one that names no company, is a warning in itself.

If you already granted access

1. Revoke the permissions in your phone settings — contacts, photos, files and location first.
2. Send the company a written request to delete the data it collected, and keep a copy. You have rights of access, correction, objection and erasure under the Data Privacy Act.
3. Take screenshots of the permissions the app requested and of the app listing, before uninstalling.
4. If your contacts were messaged about your loan, ask those people to screenshot what they received.

Uninstalling the app does not by itself delete data already collected — the written request matters.

How to complain

Complaints about misuse of personal data go to the National Privacy Commission. Generally you should first raise the matter with the company and give it a chance to respond, then file with the NPC if the response is inadequate or absent. Keep your written request and any reply.

Where the same app is also collecting abusively — messaging your contacts, using threats — that part goes to the Securities and Exchange Commission. The two complaints can proceed in parallel and address different violations.