Data Privacy Act of 2012

• Republic Act No. 10173 is an act protecting individual personal information in information and communications systems in the government and the private sector.
• The Act creates a National Privacy Commission.

General Provisions

• This Act is known as the "Data Privacy Act of 2012".
• The State protects the fundamental human right to privacy and communication while ensuring the free flow of information to promote innovation and growth.
• The State recognizes the vital role of information and communications technology in nation-building.
• The State has an obligation to ensure that personal information in information and communications systems in the government and private sector are secured and protected.

Key Definitions

• Commission refers to the National Privacy Commission.
• Consent of the data subject is a freely given, specific, informed indication of will that the data subject agrees to the collection and processing of personal information. It must be evidenced by written, electronic, or recorded means.
• Data subject refers to an individual whose personal information is processed.
• Direct marketing refers to communication of advertising or marketing material directed to particular individuals.
• Filing system refers to any act of information relating to natural or juridical persons, structured for accessibility.
• Information and Communications System refers to a system for generating, sending, receiving, storing, or processing electronic data messages or electronic documents, including related procedures.
• Personal information refers to any information from which the identity of an individual is apparent or can be reasonably and directly ascertained.
• Personal information controller refers to a person or organization who controls the collection, holding, processing, or use of personal information. This excludes those performing functions as instructed by another organization, and individuals handling data for personal, family, or household affairs.
• Personal information processor refers to a natural or juridical person qualified to act under this Act to whom a personal information controller may outsource the processing of personal data pertaining to a data subject.
• Processing refers to any operation performed upon personal information, including collection, recording, organization, storage, updating, modification, retrieval, consultation, use, consolidation, blocking, erasure, or destruction of data.
• Privileged information refers to data protected under the Rules of Court and other laws constituting privileged communication.
• Sensitive personal information refers to personal information about an individual’s race, ethnic origin, marital status, age, color, religious, philosophical or political affiliations; health, education, genetic or sexual life, or any offense committed; issued by government agencies like social security numbers, health records, and tax returns; and specifically established by an executive order or an act of Congress to be kept classified.

Scope and Applicability

• This Act applies to the processing of all types of personal information.
• This Act applies to natural and juridical persons involved in personal information processing, including controllers and processors who use equipment located in the Philippines, or who maintain an office, branch, or agency in the Philippines.

Exemptions

• Information about officers or employees of government institutions related to their position or functions.
• Information about individuals performing service under contract for a government institution.
• Information relating to any discretionary financial benefit like a license or permit.
• Personal information processed for journalistic, artistic, literary or research purposes.
• Information necessary for public authority functions, including processing by the central monetary authority, law enforcement, and regulatory agencies.
• Information necessary for banks and financial institutions to comply with Republic Acts No. 9510 and No. 9160 as long as compliant with the Anti-Money Laundering Act.
• Personal information originally collected from residents of foreign jurisdictions following their laws, which is being processed in the Philippines.

Protection of Journalists

• Establishes that nothing in this Act amends or repeals Republic Act No. 53.
• The R.A. No. 53, protects publishers, editors, and reporters from being compelled to reveal sources.

Extraterritorial Application

• The Act applies to acts done outside of the Philippines by an entity if the act relates to personal information about a Philippine citizen or resident, or if the entity has a link with the Philippines and is processing personal information about Philippine citizens or residents.

National Privacy Commission

• The National Privacy Commission is responsible for administering and implementing the provisions of the Act, and monitoring compliance with international data protection standards.
• The Commission is an independent body.

Functions of the National Privacy Commission

• Ensure compliance of personal information controllers with the provisions of the Act.
• Receive complaints, institute investigations, facilitate settlement through alternative dispute resolution, adjudicate matters, award indemnity, prepare reports, and publicize reports.
• Issue cease and desist orders and impose bans on processing detrimental to national security and public interest.
• Compel entities and government agencies to abide by its orders.
• Monitor compliance of government agencies and recommend actions to meet minimum standards.
• Coordinate with government agencies and the private sector to strengthen the protection of personal information.
• Publish a guide to all laws relating to data protection.
• Publish a compilation of agency system of records and notices.
• Recommend prosecution and penalties to the Department of Justice (DOJ).
• Review, approve, reject, or require modification of privacy codes voluntarily adhered to by personal information controllers.
• Provide assistance on matters relating to privacy or data protection.
• Comment on the data privacy implication of proposed national or local statutes, regulations, or procedures, issue advisory opinions, and interpret data privacy laws.
• Propose legislation, amendments, or modifications to Philippine laws on privacy or data protection.
• Coordinate with data privacy regulators in other countries, participate in international and regional initiatives.
• Negotiate and contract with other data privacy authorities for cross-border application implementation of respective privacy laws.
• Assist Philippine companies doing business abroad to respond to foreign privacy or data protection laws and regulations.
• Generally perform acts to facilitate cross-border enforcement of data privacy protection.

Confidentiality

• The Commission ensures the confidentiality of personal information that comes to its knowledge and possession.

Organizational Structure

• The Commission is attached to the Department of Information and Communications Technology (DICT).
• The Commission is headed by a Privacy Commissioner who acts as Chairman.
• The Privacy Commissioner is assisted by two Deputy Privacy Commissioners, one for Data Processing Systems, and one for Policies and Planning.
• The President of the Philippines appoints the Privacy Commissioner and Deputy Privacy Commissioners for a term of three years, with possible reappointment for another term.
• The Privacy Commissioner must be at least 35 years of age, of good moral character, unquestionable integrity, known probity, and a recognized expert in information technology and data privacy.
• The Privacy Commissioner enjoys benefits, privileges, and emoluments equivalent to the rank of Secretary.
• Deputy Privacy Commissioners must be recognized experts in information and communications technology and data privacy, and enjoy benefits equivalent to the rank of Undersecretary.
• The Privacy Commissioner, Deputy Commissioners, or any person acting on their behalf is not civilly liable for acts done in good faith, but is liable for willful or negligent acts.
• The Commission can reimburse reasonable litigation costs if an official is sued for lawful implementation of duty.

Provision for Secretariat

• Majority of the members of the Secretariat must have served for at least five (5) years in any agency of the government that is involved in the processing of personal information.
• Relevant agencies include: Social Security System (SSS), Government Service Insurance System (GSIS), Land Transportation Office (LTO), Bureau of Internal Revenue (BIR), Philippine Health Insurance Corporation (PhilHealth), Commission on Elections (COMELEC), Department of Foreign Affairs (DFA), Department of Justice (DOJ), and Philippine Postal Corporation (Philpost).

General Data Privacy Principles - Processing of Personal Information

• The processing of personal information must comply with the requirements of this Act and other laws, adhering to the principles of transparency, legitimate purpose, and proportionality.
• Personal information must be collected for specified and legitimate purposes determined and declared before or as soon as reasonably practicable after collection, and later processed in a way compatible with such declared, specified, and legitimate purposes only.
• Processed fairly and lawfully.
• Accurate, relevant, and kept up to date.
• Inaccurate or incomplete data must be rectified, supplemented, destroyed or their further processing restricted;
• Adequate and not excessive in relation to the purposes for which they are collected and processed.
• Retained only as long as necessary or for the establishment, exercise or defense of legal claims, or legitimate business purposes, or as provided by law.
• Kept in a form which permits identification of data subjects for no longer than is necessary.
• Personal information collected for other purposes may lie processed for historical, statistical or scientific purposes, and in cases laid down in law may be stored for longer periods.
• The personal information controller must ensure implementation of personal information processing principles set out herein.

Lawful Processing

• The processing of personal information is permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:
• The data subject has given his or her consent
• Processing of personal information related to fulfilment of a contract with the data subject
• Processing necessary for compliance with a legal obligation
• Processing necessary to protect vitally important interests of the data subject, including life and health
• Processing necessary to respond to national emergency, to comply with requirements of public order and safety, or to fulfill functions of public authority
• Processing necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party

Sensitive and Privileged Information

• Processing sensitive personal information and privileged information is generally prohibited, except in specific cases.
• Exceptions include the data subject's consent, processing provided by law, necessary protection of life and health, or necessary for lawful and noncommercial objectives of public organizations.

Subcontracting

• A personal information controller may subcontract the processing of personal information, provided that they ensure confidentiality, prevent unauthorized use, and comply with the Act and other applicable laws.

Rights of the Data Subject

• To be informed whether personal information pertaining to him or her shall be, is being or have been processed.
• To be furnished information before their personal information is entered into a processing system including:
  • A description of the personal information to be entered into the system;
  • The purposes for which it is being or is to be processed;
  • The scope and method of the personal information processing;
  • The recipients or classes of recipients to whom it is or may be disclosed;
  • Methods utilized for automated access, if allowed
  • The identity and contact details of the personal information controller or its representative;
  • The period for which the information will be stored;
  • The existence of their rights, i.e., to access, correction, as well as the right to lodge a complaint before the Commission.
• Reasonable acess to personal information.
• To dispute inaccurarcy of errors in personal information.
• To suspend, withdraw, to block removal or destruction of personal information from the personal information controller's filing system.
• To be indemnified from damages sustained

Transmissibility

• Lawful heirs and assigns of the data subject may invoke rights of the data subject in certain circumstances.

Right to Data Portability

• The data subject has the right to obtain a copy of their data in a commonly used electronic format.

Non-Applicability

• The immediately preceding sections are not applicable if the processed personal information are used only for the needs of scientific and statistical research and, on the basis of such, no activities are carried out and no decisions are taken regarding the data subject:
• Immediately preceding sections are not applicable to processing of personal information gathered for the purpose of investigations in relation to any criminal, administrative or tax liabilities of a data subject.

Security of Personal Information

• Personal information controllers must implement reasonable organizational, physical, and technical measures for data protection.
• Measures should address accidental or unlawful destruction, alteration, disclosure, and other unlawful processing.
• Measures should address natural and human dangers, such as accidental loss, unlawful access, and fraudulent misuse.
• Appropriate level of security must take into account the nature of the personal information to be protected, the risks represented by the processing and the size and complexity of the organization.
• Third parties must implement security measures.
• Employees and representatives involved in processing must maintain strict confidentiality.
• Controllers must promptly notify the Commission and data subjects of security breaches involving sensitive personal information that are reasonably believed to have been acquired by an unauthorized person that is likely to give rise to a real risk of serious harm to any affected data subject.

Accountability for Transfer

• Each personal information controller is responsible for personal information under its control, and shall use contractual or other reasonable means to provide a comparable level of protection while the information are being processed by a third party.

Security of Sensitive Information in Government

• All sensitive personal information maintained by the government must be secured using appropriate standards.
• Heads of government agencies are responsible for complying with security requirements set by the Commission.

Access Requirements

• Government employees must receive security clearance to access sensitive personal information.
• Off-site access requires an approved request from the agency head, with a deadline of two business days.
• Approved requests shall limit access to one thousand (1,000) records.
• Secured by the use of the most secure encryption standard recognized by the Commission
• Compliance should apply no later than six months after the date of the enactment of this Act

Government Contractors

• Agencies must require contractors and their employees to register their systems and comply with this Act when contracts involve accessing sensitive personal information from more than one thousand individuals.

Penalties

• Penalties include imprisonment and fines for unauthorized processing, accessing, or disclosing personal and sensitive personal information without consent or authority.
• Penalties also apply to improper disposal, unauthorized access, concealment of security breaches, and malicious disclosure of information.

Fines and Imprisonment

• Unauthorized Processing of Info: 1-3 years imprisonment and Php500,000-2,000,000 fine
• Unauthorized Processing of Sensitive Info: 3-6 years imprisonment and Php500,000-4,000,000 fine
• Accessing Info Due to Negligence: 1-3 years imprisonment and Php500,000-2,000,000 fine
• Accessing Sensitive Info Due to Negligence: 3-6 years imprisonment and Php500,000-4,000,000 fine
• Improper Disposal of Info: 6 months-2 years imprisonment and Php100,000-500,000 fine
• Improper Disposal of Sensitive Info: 1-3 years imprisonment and Php100,000-1,000,000 fine
• Processing Info for Unauthorized Purposes: 1 year & 6 months-5 years imprisonment and Php500,000-1,000,000 fine
• Processing Sensitive Info for Unauthorized Purposes: 2-7 years imprisonment and Php500,000-2,000,000 fine
• Unauthorized Access or Intentional Breach: 1-3 years imprisonment and Php500,000-2,000,000 fine
• Concealment of Security Breaches Involving Sensitive Personal Information: 1 year & 6 months-5 years imprisonment and Php500,000-1,000,000 fine
• Malicious Disclosure: 1 year & 6 months-5 years imprisonment and Php500,000-1,000,000 fine
• Unauthorized Disclosure if not covered by the section on Malicious Disclosure above: 1-3 years imprisonment and Php500,000-1,000,000 fine
• Unauthorized Disclosure of Sensitive Personal Information if not covered by the section on Malicious Disclosure above: 3-5 years imprisonment and Php500,000-2,000,000 fine

Combination of Acts

• Any combination or series of acts as defined in Sections 25 to 32 shall make the person subject to imprisonment ranging from three (3) years to six (6) years and a fine of not less than One million pesos (Php1,000,000.00) but not more than Five million pesos (Php5,000,000.00).

Liability

• If the offender is a corporation, partnership or any juridical person, the penalty shall be imposed upon the responsible officers.
• Court may suspend or revoke rights.
• Alien offenders will be deported.
• Public officials are disqualified from office.

Large Scale

• The maximum penalty in the scale of penalties respectively provided for the preceding offenses shall be imposed when the personal information of at least one hundred (100) persons is harmed, affected or involved as the result of the above mentioned actions.

Public Officer

• An accessory penalty consisting in the disqualification to occupy public office for a term double the term of criminal penalty imposed shall he applied.

Restitution

• Restitution for any aggrieved party shall be governed by the provisions of the New Civil Code.

Interpretation of the Act

• Any doubt in the interpretation of any provision of this Act shall be liberally interpreted in a manner mindful of the rights and interests of the individual about whom personal information is processed.

Implementing Rules and Regulations (IRR)

• The Commission shall promulgate the rules and regulations to effectively implement the provisions of this Act within ninety days from the effectivity of this Act.

Reports and Information

• The Commission shall annually report to the President and Congress on its activities.
• The Commission shall undertake efforts to inform and educate the public of data privacy, protection and fair information rights and responsibilities.

Appropriations Clause

• The Commission shall be provided with an initial appropriation of Twenty million pesos (Php20,000,000.00) to be drawn from the national government.
• Shall receive Ten million pesos (Php10,000,000.00) per year for five (5) years.

Transitory Provision

• Existing industries, businesses and offices affected by the implementation of this Act shall be given one year transitory period from the effectivity of the IRR.

Separability Clause

• If any provision or part hereof is held invalid or unconstitutional, the remainder of the law or the provision not otherwise affected shall remain valid and subsisting.

Repealing Clause

• The provision of Section 7 of Republic Act No. 9372 is hereby amended.
• All other laws, decrees, executive orders, proclamations and administrative regulations or parts thereof inconsistent herewith are hereby repealed or modified accordingly.

Effectivity Clause

• This Act shall take effect fifteen (15) days after its publication in at least two (2) national newspapers of general circulation.