Anti-Red Tape Authority

Data Privacy Policy

Declaration
The Anti-Red Tape Authority is guided by the principles of transparency, respect and
proactive protection of personal information of our employees, co-worker in the
government, service providers, clients and other stakeholders in accordance with the
requirements of RA 10173 or Data Privacy Act of 2012 and its Implementing Rules and
Regulations including the Circulars and Advisories issued by the National Privacy
Commission (NPC).

This Data Privacy Policy provides details about our collection, use, sharing, security,
disclosure, retention and disposal of personal information. We shall ensure compliance
with the strictest standards of security and confidentiality with respect to any and all
personal information submitted to us. This Data Privacy Policy also describes the
security measures we undertake to safeguard information and how you can
communicate regarding our privacy practices.

1) COLLECTION OF PERSONAL INFORMATION

The Authority collects personal information of data subject provided on the following
instances:

 - Complaints submission through call, text, chat, e-mail, website and in printed forms
 - Visitors’ logbook registration
 - Accessing the Authority’s social media accounts and websites
 - Applying for a job or entering into a contract of service with the Authority
 - Events or activities conducted by the Authority
 - The Report Card Survey in relation to government services
 - Publicly disclosed personal information from all forms of media available.
2) USE AND SHARING

Data subjects’ personal information shall be used primarily for documentation and for
any and all processes relative to the performance of our mandate, to wit:

 1. Responding to any application or request;

 2. Dealing with inquiries, complaints, and any other concerns;
 3. Complying with legal and regulatory requirements;
 4. Processing job applications and comply with other government agencies
 5. Carrying out research and generate statistical information, and;
 6. other purposes allowed by law.
The Authority may share and provide data subjects personal information with other
government instrumentalities who need access to such information for the fulfilment of
an application or request.

In case third-party service providers are contracted to process the data subjects’
personal information, they are bound by a non-disclosure agreement that prohibits them
from using or processing personal information for any purpose other than fulfilling their
obligation stated in the contract.

3) RETENTION AND DISPOSAL

Personal information shall be retained only for a period necessary to serve the purpose
for which it was collected, or as required under any obligation or applicable laws and
shall be made in accordance with the Records Disposal Policy and Records Disposition
under Republic Act 9470 or the National Archives of the Philippines Act of 2007.
Thereafter, data subjects’ personal information shall be disposed of in a secure manner
that would prevent further processing, unauthorized access or disclosure to any other
party.

4) SECURITY AND DISCLOSURE

The personal data gathered in physical or printed form shall be stored in the Authority’s
filing cabinets while electronic data will be transferred and stored in data servers.

The Authority adopts internationally accepted measures on safeguarding personal

information collected. However, absolute security is not guaranteed despite putting all
our efforts, so precaution is hereby advised.

Personal information will not be disclosed without the data subjects’ express or implied
consent unless required by law, or if needed to be accessed as part of an investigation
of a law enforcement agencye or for matters that involve national security.

5) CHANGES AND UPDATES

This Data Privacy Policy is effective as of 16 December 2019 and will remain effective
until its revision or amendments. The Authority reserves the right to amend this Data
Privacy Policy at any time to comply with the latest laws and regulations.
6) CONTACT US

For inquiries regarding the processing of personal information stated in this Data
Privacy Policy or complaints regarding the same, or the exercise of a data subject’s
rights under RA 10173, please contact the Authority Data Protection Officer through the
following contact information:

The Data Protection Officer

G/F HPGV Building 395 Sen. Gil J. Puyat Avenue Makati City, Philippines
Phone No. (02) 8478-5099
e-mail: [email protected]
 The right to be informed

Under R.A. 10173, your personal data is treated almost literally in the same way as your own
personal property. Thus, it should never be collected, processed and stored by any organization
without your explicit consent, unless otherwise provided by law. Information controllers usually
solicit your consent through a consent form. Aside from protecting you against unfair means of
personal data collection, this right also requires personal information controllers (PICs) to notify
you if your data have been compromised, in a timely manner.

As a data subject, you have the right to be informed that your personal data will be, are being, or
were, collected and processed.

The Right to be Informed is a most basic right as it empowers you as a data subject to consider
other actions to protect your data privacy and assert your other privacy rights.

To protect your privacy, the Philippine data privacy law explicitly require organizations to notify
and furnish you the following information before they enter your personal data into any
processing system (or at the next practical opportunity at least):

 Description of the personal data to be entered into the system

 Exact Purposes for which they will be processed (such as for direct marketing, statistical,
scientific etc.)
 Basis for processing, especially when it is not based on your consent
 Scope and method of the personal data processing
 Recipients, to whom your data may be disclosed
 Methods used for automated access by the recipient, and its expected consequences for
you as a data subject
 Identity and contact details of the personal information controller
 The duration for which your data will be kept
 You also have to be informed of the existence of your rights as a data subject.

In recording a conversation or interview with someone, it is enough to verbally ask for a
direct consent from an individual data subject. If the subject yields, it would be useful to
also mention as part of the recorded conversation that the subject knows the conversation
is being recorded and that you asked and were given the consent. It would even be better
if you could get the subject to verbally confirm his consent.

Banks involved in phone banking tell their callers that the conversation with their call
center agent would be recorded, and that proceeding with the call is indication of their
consent. This practice is considered sufficient notice.

Websites resort to publishing a Privacy Notice page, which essentially accomplishes the
same thing. Similar privacy notices should be made in public establishments equipped
with security CCTVs.
 Whenever anyone is making an audio or video recording of you, or even just taking your
pictures, you have a right to know, and you must always be given the chance to opt out
when you don’t feel comfortable.

The right to access

This is your right to find out whether an organization holds any personal data about you and if
so, gain “reasonable access” to them. Through this right, you may also ask them to provide you
with a written description of the kind of information they have about you as well as their
purpose/s for holding them.

Under the Data Privacy Act of 2012, you have a right to obtain from an organization a copy of
any information relating to you that they have on their computer database and/or manual filing
system. It should be provided in an easy-to-access format, accompanied with a full explanation
executed in plain language.

You may demand to access the following:

 The contents of your personal data that were processed.

 The sources from which they were obtained.
 Names and addresses of the recipients of your data.
 Manner by which they were processed.
 Reasons for disclosure to recipients, if there were any.
 Information on automated systems where your data is or may be available, and how it
may affect you.
 Date when your data was last accessed and modified
 The identity and address of the personal information controller.

Some exceptions may disallow the exercise of an individual’s right to access. This is to balance
the right to privacy of an individual versus the needs of civil society. Here are some examples:

 A criminal suspect is not allowed access to the personal data held about him by law
enforcement agencies as it may impede investigation.
 You are not allowed access to information about you as contained in communications
between a lawyer and his or her client, if such communication is subject to legal privilege
in court.
 Your right to access your own medical and psychological data may be denied you in the
rare instance where is is deemed that your health and well-being might be negatively
affected.

The right to object

You can exercise your right to object if the personal data processing involved is based on consent
or on legitimate interest. When you object or withhold your consent, the PIC should no longer
process the personal data, unless the processing is pursuant to a subppoena, for obvious purposes
(contract, employer-employee relationship, etc.) or a result of a legal obligation.

In case there is any change or amendment to the information previously given to you, you should
be notified and given an opportunity to withhold consent.

The right to object is most specifically applicable when organizations or personal information
controllers are processing your data without your consent for the following purposes:

 Direct marketing purposes. When business organizations give you sales materials about
products and services, they must explicitly inform or remind you of your right to object.
If you feel uncomfortable to being target of a direct marketing campaign, you must be
able to easily invoke your right to object. If you previously acceded but wishes to opt-out,
you must be given an easy way to opt-out. In asserting your right to object being included
in a direct marketing campaign, businesses have no recourse but to accede as there are no
exemptions or grounds for refusal in this case.
 Profiling purposes. Businesses customarily resort to profiling, or the creation of profiles
of individual customers and clients without their consent. This is done either for
marketing or customer care purposes. The cross-referencing of customer information to
product marketing brings about practical advantages to both the buyer and seller in any
potential business transaction. Under RA 10173, however, profiling of this requires your
consent as customer, or else you are justified in invoking your right to object. The right of
state agents to do profiling for law enforcement purposes, however, may override your
right to object.
 Automated processing purposes. In technology-driven industries, such as banking and
finance, many decisions affecting individuals are arrived at electronically via automatic
data processing systems based on personal information stored in computerized data files.
This reduces the business transaction process down to a few seconds and facilitates a
speedy exchange of economic value. Potentially, however, it may also inadvertently
arrive at decisions prejudicial to your interests and lead to the weakening of your position
as a transacting party. As such, organizations are required to notify you whether your
personal data will undergo automatic processing, and inform you that you have a right to
object.

The right to erasure or blocking

Under the law, you have the right to suspend, withdraw or order the blocking, removal or
destruction of your personal data. You can exercise this right upon discovery and substantial
proof of the following:

1. Your personal data is incomplete, outdated, false, or unlawfully obtained.

2. It is being used for purposes you did not authorize.
3. The data is no longer necessary for the purposes for which they were collected.
 4. You decided to withdraw consent, or you object to its processing and there is no
overriding legal ground for its processing.
5. The data concerns information prejudicial to the data subject — unless justified by
freedom of speech, of expression, or of the press; or otherwise authorized (by court of
law)
6. The processing is unlawful.
7. The personal information controller, or the personal information processor, violated your
rights as data subject.

One of the major objectives of society as it is now constituted, and of the administration of our penal
system, is the rehabilitation of the fallen and the reformation of the criminal.” The court held that the
unnecessary use of the plaintiff’s real name inhibited her right to obtain rehabilitation.”

The right to damages

You may claim compensation if you suffered damages due to inaccurate, incomplete, outdated,
false, unlawfully obtained or unauthorized use of personal data, considering any violation of
your rights and freedoms as data subject.

The right to file a complaint with the National Privacy

Commission

If you feel that your personal information has been misused, maliciously disclosed, or
improperly disposed, or that any of your data privacy rights have been violated, you have a right
to file a complaint with the NPC.

The right to rectify

You have the right to dispute and have corrected any inaccuracy or error in the data a personal
information controller (PIC) hold about you. The PIC should act on it immediately and
accordingly, unless the request is vexatious or unreasonable. Once corrected, the PIC should
ensure that your access and receipt of both new and retracted information. PICs should also
furnish third parties with said information, should you request it.

The right to data portability

This right assures that YOU remain in full control of YOUR data. Data portability allows you to
obtain and electronically move, copy or transfer your data in a secure manner, for further use. It
enables the free flow of your personal information across the internet and organizations,
according to your preference. This is important especially now that several organizations and
services can reuse the same data.
Data portability allows you to manage your personal data in your private device, and to transmit
your data from one personal information controller to another. As such, it promotes competition
that fosters better services for the public.

Transmissibility of Data Subject Rights

Just like any physical property, such as real estate, you can assign your rights as a data subject to
your legal assignee or lawful heir. Similarly, you may assert another person’s rights as a data
subject, provided he or she authorized you as a “legal assignee”.

You may also invoke another person’s data privacy rights after his or her death if you are his or
her legal heir. This same principle applies to parents of minors, or their legal guardian, who are
responsible for asserting their rights on their behalf.

This right, however, is not applicable in case the processed personal data being contested are
used only for scientific and statistical research.

Limitations on Rights

The provisions of the law regarding transmissibility of rights and the right to data portability will
not apply if the processed personal data are used only for the needs of scientific and statistical
research and, based on such, no activities are carried out and no decisions are taken regarding the
data subject. There should also be an assurance that the personal data will be held under strict
confidentiality and used only for the declared purpose.

They will not also apply to the processing of personal data gathered for investigations in relation
to any criminal, administrative or tax liabilities of a data subject. Any limitations on the rights of
the data subject should only be to the minimum extent necessary to achieve the purpose of said
research or investigation.