Data Privacy Act (RA No 10173) (Philippines) PDF

DATA PRIVACY ACT (RA No 10173) AN ACT PROTECTING INDIVIDUAL PERSONAL Information and Communications System - refers to a system for generating, INFORMATION IN INFORMATION AND COMMUNICATIONS SYSTEMS IN THE...

DATA PRIVACY ACT (RA No 10173) AN ACT PROTECTING INDIVIDUAL PERSONAL Information and Communications System - refers to a system for generating, INFORMATION IN INFORMATION AND COMMUNICATIONS SYSTEMS IN THE sending, receiving, storing or otherwise processing electronic data messages or GOVERNMENT AND THE PRIVATE SECTOR, CREATING FOR THIS PURPOSE A electronic documents and includes the computer system or other similar device by NATIONAL PRIVACY COMMISSION, AND FOR OTHER PURPOSES or which data is recorded, transmitted or stored and any procedure related to the DECLARATION OF POLICY recording, transmission or storage of electronic data, electronic message, or It is the policy of the State to protect the fundamental human right of privacy, of electronic document communication while ensuring free flow of information to promote innovation and Personal information - refers to any information whether recorded in a material form growth The State recognizes the vital role of information and communications or not, from which the identity of an individual is apparent or can be reasonably and technology in nation-building and its inherent obligation to ensure that personal directly ascertained by the entity holding the information, or when put together with information in information and communications systems in the government and in other information would directly and certainly identify an individual. the private sector are secured and protected Personal information controller - refers to a person or organization who controls the collection, holding, processing or use of personal information, including a person or FUNCTIONS OF THE NATIONAL PRIVACY COMMISSION (NPC) organization who instructs another person or organization to collect, hold, process, To administer and implement the provisions of this Act, and to monitor and use, transfer or disclose personal information on his or her behalf. ensure compliance of the country with international standards set for data protection, there is hereby created an independent body to be known as the The term excludes: NPC. (Sec. 7) (1) A person or organization who performs such functions as instructed by The Commission shall ensure at all times the confidentiality of any personal another person or organization; and information that comes to its knowledge and possession. (Sec. 8) (2) An individual who collects, holds, processes or uses personal information Commission shall refer to the National Privacy Commission created by virtue of this in connection with the individual’s personal, family or household affair Act Personal information processor - refers to any natural or juridical person qualified to act as such under this Act to whom a personal information controller may TERMINOLOGIES TO TAKE NOTICE UNDER R.A. 10173 outsource the processing of personal data pertaining to a data subject. CONSENT of the data subject refers to any freely given, specific, informed indication Processing - refers to any operation or any set of operations performed upon of will, whereby the data subject agrees to the collection and processing of personal personal information including, but not limited to, the collection, recording, information about and/or relating to him or her. Consent shall be evidenced by organization, storage, updating or modification, retrieval, consultation, use, written, electronic or recorded means it may also be given on behalf of the data consolidation, blocking, erasure or destruction of data. subject by an agent specifically authorized by the data subject to do so. Privileged information - refers to any and all forms of data which under the Rides of Data subject - refers to an individual whose personal information is processed. Court and other pertinent laws constitute privileged communication.  SENSITIVE PERSONAL INFORMATION (2) The title, business address and office telephone number of the individual; Refers to personal information: (3) The classification, salary range and responsibilities of the position held by the (1) About an individual’s race, ethnic origin, marital status, age, color, and religious, individual; and philosophical or political affiliation (4) The name of the individual on a document prepared by the individual in the (2) About an individual’s health, education, genetic or sexual life of a person, or to course of employment with the government; any proceeding for any offense committed or alleged to have been committed by (B) Information about an individual who is or was performing service under contract for a such person, the disposal of such proceedings, or the sentence of any court in such government institution that relates to the services performed, including the terms of the proceedings; contract, and the name of the individual given in the course of the performance of those services; (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or cm-rent health records, licenses or (C) Information relating to any discretionary benefit of a financial nature such as granting its denials, suspension or revocation, and tax returns; and of a license or permit given by the government to an individual, including the name of the individual and the exact nature of the benefit; (4) Specifically established by an executive order or an act of Congress to be kept classified (D) Personal information processed for journalistic, artistic, literary or research purposes; (E) Information necessary in order to carry out the functions of public authority which SCOPE OF APPLICATION (SEC. 4) includes the processing of personal data for the performance by the independent, central This Act applies to the processing of all types of personal information and to any monetary authority and law enforcement and regulatory agencies of their constitutionally natural and juridical person involved in personal information processing including and statutorily mandated functions. Nothing in this Act shall be construed as to have those personal information controllers and processors who, although not found or amended or repealed Republic Act No. 1405, otherwise known as the Secrecy of Bank established in the Philippines, use equipment that are located in the Philippines, or Deposits Act; Republic Act No. 6426, otherwise known as the Foreign Currency Deposit those who maintain an office, branch or agency in the Philippines subject to the Act; and Republic Act No. 9510, otherwise known as the Credit Information System Act immediately succeeding paragraph. (CISA); (F) Information necessary for banks and other financial institutions under the jurisdiction This Act does not apply to the following: the independent, central monetary authority or Bangko Sentral ng Pilipinas to comply with (A) Information about any individual who is or was an officer or employee of a Republic Act No. 9510, and Republic Act No. 9160, as amended, otherwise known as the government institution that relates to the position or functions of the Anti-Money Laundering Act and other applicable laws; and individual, including: (G) Personal information originally collected from residents of foreign jurisdictions in (1) The fact that the individual is or was an officer or employee of the accordance with the laws of those foreign jurisdictions, including any applicable data government institution; privacy laws, which is being processed in the Philippines.  DATA PRIVACY PRINCIPLE (SEC. 11) LAWFUL PROCESSING OF PERSONAL INFORMATION The processing of personal information shall be allowed, subject to compliance with the requirements of this Act and other laws allowing disclosure of information to The processing of personal information shall be permitted only if not otherwise the public and adherence to the principles of transparency, legitimate purpose and prohibited by law, and when at least one of the following proportionality. conditions exists: Personal information must be: (a) The data subject has given his or her consent; (a) Collected for specified and legitimate purposes determined and declared before, or soon as reasonably practicable after collection, and later processed in a way (b) The processing of personal information is necessary and is related to the compatible with such declared, specified and legitimate purposes only; fulfillment of contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract; (b) Processed fairly and lawfully; (c) Accurate, relevant and, where necessary for purposes for which it is to be used (c) The processing is necessary for compliance with a legal obligation to which the the processing of personal information, kept up to date; inaccurate or incomplete personal information controller is subject; data must be rectified, supplemented, destroyed or their further processing (d) The processing is necessary to protect vitally important interests of the data restricted; subject, including life and health; (d) Adequate and not excessive in relation to the purposes for which they are collected and processed; (e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of (e) Retained only for as long as necessary for the fulfillment of the purposes for public authority which necessarily includes the processing of personal data for the which the data was obtained or for the establishment, exercise or defense of legal fulfillment of its mandate; claims, or for legitimate business purposes, or as provided by law; and (f) The processing is necessary for the purposes of the legitimate interests pursued (f) Kept in a form which permits identification of data subjects for no longer than by the personal information controller or by a third party or parties to whom the necessary for the purposes for which the data were collected and processed: data is disclosed, except where such interests are overridden by fundamental rights Provided, that personal information collected for other purposes may lie processed and freedoms of the data subject which require protection under the Philippine for historical, statistical or scientific purposes, and in cases laid down in law may Constitution. be stored for long periods: Provided, further, that adequate safeguards are guaranteed by said laws authorizing their processing. The personal information controller must ensure implementation of personal information processing principles set out herein.  SENSITIVE PERSONAL INFORMATION AND PRIVILEGED INFORMATION RIGHTS OF THE DATA SUBJECT The data subject is entitled to: The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases: (A) Be informed whether personal information pertaining to him or her shall be, are being or have been processed; (a) The data subject has given his or her consent, specific to the purpose prior to the processing or in the case of privileged information, all parties to the exchange (B) Be furnished the information indicated hereunder before the entry of his or her have given their consent prior to processing; personal information into the processing system of the personal information controller, or at the next practical opportunity: (b) The processing of the same is provided for by existing laws and regulations: Provided, that such regulatory enactments guarantee the protection of the sensitive (1) Description of the personal information to be entered into the system; personal information and the privileged information: Provided, further, That the (2) Purposes for which they are being or are to be processed; consent of the data subjects are not required by law or regulation permitting the (3) Scope and method of the personal information processing; processing of the sensitive personal information or the privileged information; (4) The recipients or classes of recipients to whom they are or may be (c) The processing is necessary to protect the life and health of the data subject or disclosed; another person, and the data subject is not legally or physically able to express his or her consent prior to the processing; (5) Methods utilized for automated access, if the same is allowed by the data subject, and the extent to which such access is authorized; (d) The processing is necessary to achieve the lawful and noncommercial (6) The identity and contact details of the personal information controller objectives of public organizations and their associations: Provided, that such or its representative; processing is only confined and related to the Bonafide members of these organizations or their associations: Provided, further, That the sensitive personal (7) The period for which the information will be stored; and information is not transferred to third parties: Provided, finally, that consent of the (8) The existence of their rights, i.e., to access, correction, as well as the data subject was obtained prior to processing; right to lodge a complaint before the Commission. (e) The processing is necessary for purposes of medical treatment, is carried out Any information supplied or declaration made to the data subject on these matters shall not by a medical practitioner or a medical treatment institution, and an adequate level be amended without prior notification of data subject: Provided, that the notification under of protection of personal information is ensured; or subsection (b) shall not apply should the personal information be needed pursuant to a subpoena or when the collection and processing are for obvious purposes, including when it (f) The processing concerns such personal information as is necessary for the is necessary for the performance of or in relation to a contract or service or when necessary protection of lawful rights and interests of natural or legal persons in court or desirable in the context of an employer-employee relationship, between the collector and proceedings, or the establishment, exercise or defense of legal claims, or when the data subject, or when the info is being collected and processed as a result of legal provided to government or public authority. obligation. (C) Reasonable access to, upon demand, the following: (E) Suspend, withdraw or order the blocking, removal or destruction of his or her personal information from the personal information controller’s filing system upon (1) Contents of his or her personal information that were processed; discovery and substantial proof that the personal information is incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes or are no (2) Sources from which personal information were obtained; longer necessary for the purposes for which they were collected. In this case, the (3) Names and addresses of recipients of the personal information; personal information controller may notify third parties who have previously received such processed personal information; and (4) Manner by which such data were processed; (F) Be indemnified for any damages sustained due to such inaccurate, incomplete, (5) Reasons for the disclosure of the personal information to recipients; outdated, false, unlawfully obtained or unauthorized use of personal information. (6) Information on automated processes where the data will or likely to be made as the sole basis for any decision significantly affecting or will affect the data subject (7) Date when his or her personal information concerning the data subject were last accessed and modified; and (8) The designation, or name or identity and address of the personal information controller; (D) Dispute the inaccuracy or error in the personal information and have the personal information controller correct it immediately and accordingly, unless the request is vexatious or otherwise unreasonable. If the personal information has been corrected, the personal information controller shall ensure the accessibility of both the new and the retracted information and the simultaneous receipt of the new and the retracted information by recipients thereof: Provided, that the third parties who have previously received such processed personal information shall he informed of its inaccuracy and its rectification upon reasonable request of the data subject;  DELAY OF NOTIFICATION PERSONAL DATA BREACH Notification may be delayed only to the extent necessary to determine the scope The notification shall include, but not be limited to: of the breach, to prevent further disclosures, or to restore reasonable integrity to the information and communications system. 1. Nature of the breach a. In evaluating if notification is unwarranted, the Commission may take into 2. Personal data possibly involved account compliance by the personal information controller with this section and 3. Measures taken to address the breach existence of good faith in the acquisition of personal data. b. The Commission may exempt a personal information controller from The Commission reserves the right to require additional information, if necessary. notification where, in its reasonable judgment, such notification would not be in the public interest, or in the interest of the affected data subjects. DATA BREACH NOTIFICATION c. The Commission may authorize postponement of notification where it may hinder the progress of a criminal investigation related to a serious breach. a. The Commission and affected data subjects shall be notified by the personal information controller within seventy-two (72) hours upon knowledge of, or when BREACH REPORT there is reasonable belief by the personal information controller or personal information processor that, a personal data breach requiring notification has a. The personal information controller shall notify the Commission by occurred. submitting a report, whether written or electronic, containing the required contents of notification. The report shall also include the name of a designated b. Notification of personal data breach shall be required when sensitive personal representative of the personal information controller, and his or her contact information or any other information that may, under the circumstances, be used to details. enable identity fraud are reasonably believed to have been acquired by an b. All security incidents and personal data breaches shall be documented unauthorized person, and the personal information controller or the Commission through written reports, including those not covered by the notification believes that such unauthorized acquisition is likely to give rise to a real risk of requirements. In the case of personal data breaches, a report shall include the serious harm to any affected data subject. facts surrounding an incident, the effects of such incident, and the remedial c. Depending on the nature of the incident, or if there is delay or failure to notify, actions taken by the personal information controller. In other security incidents the Commission may investigate the circumstances surrounding the personal data not involving personal data, a report containing aggregated data shall constitute breach. Investigations may include on-site examination of systems and procedures. sufficient documentation. These reports shall be made available when requested by the Commission. A general summary of the reports shall be submitted to the Commission annually.  SUBCONTRACT OF PERSONAL INFORMATION REGISTRATION OF PERSONAL DATA PROCESSING SYSTEMS A personal information controller may subcontract the processing of personal The personal information controller or personal information processor that information: Provided, That the personal information controller shall be employs fewer than two hundred fifty (250) persons shall not be required to responsible for ensuring that proper safeguards are in place to ensure the register unless the processing it carries out is likely to pose a risk to the rights confidentiality of the personal information processed, prevent its use for and freedoms of data subjects, the processing is not occasional, or the unauthorized purposes, and generally, comply with the requirements of this Act processing includes sensitive personal information of at least one thousand and other laws for processing of personal information. The personal information (1,000) individuals. processor shall comply with all the requirements of this Act and other applicable laws. (SEC. 14) a. The contents of registration shall include: 1. The name and address of the personal information controller or personal information processor, and of its representative, if any, including their contact details; ACCOUNTABILITY FOR TRANSFER OF PERSONAL INFORMATION 2. The purpose or purposes of the processing, and whether processing is being done under an outsourcing or subcontracting agreement; Principle of Accountability. Each personal information controller is responsible for 3. A description of the category or categories of data subjects, and of the data personal information under its control or custody, including information that have or categories of data relating to them; been transferred to a third party for processing, whether domestically or 4. The recipients or categories of recipients to whom the data might be internationally, subject to cross-border arrangement and cooperation. disclosed; 5. Proposed transfers of personal data outside the Philippines; (a) The personal information controller is accountable for complying with the 6. A general description of privacy and security measures for data protection; requirements of this Act and shall use contractual or other reasonable means to 7. Brief description of the data processing system; provide a comparable level of protection while the information is being processed 8. Copy of all policies relating to data governance, data privacy, and information by a third party. security; (b) The personal information controller shall designate an individual or individuals 9. Attestation to all certifications attained that are related to information and who are accountable for the organization’s compliance with this Act. The identity of communications processing; and the individual(s) so designated shall be made known to any data subject upon 10. Name and contact details of the compliance or data protection officer, which request. shall immediately be updated in case of changes. b. The procedure for registration shall be in accordance with these Rules and other issuances of the Commission  NOTIFICATION OF AUTOMATED PROCESSING OPERATIONS REVIEW BY THE COMMISSION The personal information controller carrying out any wholly or partly automated The following are subject to the review of the Commission, upon its own processing operations or set of such operations intended to serve a single initiative or upon the filing of a complaint by a data subject: purpose or several related purposes shall notify the Commission when the automated processing becomes the sole basis for making decisions about a a. Compliance by a personal information controller or personal data subject, and when the decision would significantly affect the data subject. information processor with the Act, these Rules, and other issuances a. The notification shall include the following information: of the Commission; 1. Purpose of processing; 2. Categories of personal data to undergo processing; b. Compliance by a personal information controller or personal 3. Category or categories of data subject; information processor with the requirement of establishing adequate 4. Consent forms or manner of obtaining consent; safeguards for data privacy and security; 5. The recipients or categories of recipients to whom the data are to be c. Any data sharing agreement, outsourcing contract, and similar disclosed; contracts involving the processing of personal data, and its 6. The length of time the data are to be stored; implementation; 7. Methods and logic utilized for automated processing; 8. Decisions relating to the data subject that would be made on the basis d. Any off-site or online access to sensitive personal data in of processed data or that would significantly affect the rights and government allowed by a head of agency; freedoms of data subject; and e. Processing of personal data for research purposes, public functions, 9. Names and contact details of the compliance or data protection officer. or commercial activities; b. No decision with legal effects concerning a data subject shall be made solely on f. Any reported violation of the rights and freedoms of data subjects the basis of automated processing without the consent of the data subject. g. Other matters necessary to ensure the effective implementation and administration of the Act, these Rules, and other issuances of the Commission