Data Privacy Act of the Philippines

 Implementing rules and regulations of Republic

Act 10173, known as the "Data Privacy Act of
2012‘

General data privacy principles.

 The processing of personal data shall be

allowed, subject to compliance· with the
requirements of the act and other laws allowing
disclosure of information to the public, and
adherence to the principles of transparency, General principles in collection, processing and
legitimate purpose, and proportionality. retention
Principles of transparency, legitimate purpose and
 The processing of personal data shall adhere to·
proportionality.
the following general principles in the
Transparency. collection, processing, and retention of personal
data:
 The data subject must be aware of the. nature,  A. Collection must be for a declared, specified,
purpose, and extent of the processing of his or and legitimate purpose,
her personal data, including the risks and  B. Personal data shall be processed fairly
safeguards involved, the identity of personal and .lawfully.
information controller, his or her rights as a  C. Processing should ensure data: quality.. ,
data subject, and how these can be exercised.  D. Personal data shall not be retained longer
 Any information and communication relating to than necessary.
the processing of personal data should be easy  E. Any authorized further processing shall have
to access and understand, using clear and plain adequate safeguards.
language.
Data privacy and security.
Legitimate purpose.
 Personal information controllers and personal
 The processing of information shall be information processors shall
compatible with a declared and specified implement ,reasonable .and, appropriate
purpose which must not be contrary to law, organizational, .. physical, and technical security
morals, or public policy measures for the protection of personal data.
Proportionality.  These measures shall be implemented to
protect personal data against natural dangers
 The processing of information shall be such as accidental loss or destruction, and
adequate, relevant, suitable, necessary, and not human dangers such as-unlawful access,
excessive in relation to a declared and specified fraudulent misuse, unlawful .destruction,
purpose. Personal data shall be processed only alteration and contamination.
if the purpose of the processing could not
reasonably be fulfilled by other means. Privacy

 A state of mind, freedom from intrusion, or

control over the exposure of self or personal
information

Security

 Information security and confidentiality of

personal information represent major concerns
 in today’s society amidst growing reports of Security Measures
stolen and compromised information.
firewalls
Information security
 barrier created from software and hardware
 The protection of information against threats to  User sign-on and passwords or other means of
its integrity, inadvertent disclosure, or identity management
availability determines the survivability of a  Access on a need-to-know basis- level of access
system  automatic sign-off physical restrictions to
systems
Information system security
Identity management
 Ongoing protection of both information housed
on the system and the system itself from  Area that deals with identifying individuals in a
threats or disruption system and controlling their access to resources
 Primary goal within that system By associating user rights
- Protection of client confidentiality and restrictions with the established identity
- Protection of information integrity
authentication
- Ready availability of information when
needed  Process of determining whether someone is
Security planning who he or she professes to be
 methods:
 Saves time - access codes
 Guard against: - logon passwords
- Downtime - digital certificates
- Breeches in confidentiality - public or private keys used for encryption
- Loss of consumer confidence and biometric measures
- Cybercrime
password
- Liability
- Lost productivity  Collection of alphanumeric characters that the
 Helps ensure compliance with regulatory user types into the computer
body/laws  May be required after the entry of an access
code or user name
Steps to Security
 Assigned after successful system training
 Assessment of risks and assets  Inexpensive but not the most effective means of
 An organizational plan authentication
 A "culture" of security
password selection and handling
 The establishment and enforcement of policies
 Do:
Threats to System Security and Information
- Choose passwords that are 8-12 characters
 Thieves long.
 Hackers and crackers - Avoid obvious passwords.
 Denial of service attacks - Keep your password private- ie, do not
 Terrorists share.
 Viruses, worms - Change password frequently.
 Flooding sites  Do not:
 Power fluctuations - Post or write down passwords.
 Revenge attacks - Leave computers or applications running
when not in use.
 - Re-use the same password for different  Right to erasure or blocking.
systems.
Data Privacy Act as Applied In Nursing Practice Nurse's
- Use the "browser save" feature.
Guidelines to avoid Data Breach
Biometrics
Maintain
 Identification based on a unique biological trait,
 Maintain the integrity of patient confidentiality-
such as:
DO NOT SHARE INFORMATION ABOUT THE
- a fingerprint
PATIENT TO THOSE OUTSIDE OF CARE
- voice or iris pattern
- retinal scan Seek
- hand geometry
- face recognition  If you are unsure about disclosing a patient's
- ear pattern information, seek guidance from the Hospital’s
- smell Data Protection Officer (DPO)
- blood vessels in the palm Know by
- gait recognition
 Know by heart your hospital's Privacy Manual
Antivirus software without fail
 Computer programs that can locate and Seek
eradicate viruses and other malicious programs
from scanned memory sticks, storage devices,  Never seek information about a patient for
individual computers, and networks whom you are not providing care.

Spyware Detection Software Maintain

 Spyware  Always maintain your patient's information

- a type of software that installs itself without confidential.
the user's permission, collects passwords,
Get
PIN numbers, and account numbers and
sends them to another party  Always get consent in obtaining information as
 Spyware Detection Software well as in taking photographs
- Detects and eliminates spyware
Ten Rules of Netiquette
Organizational Security Measures
 There are Ten rules of Netiquette that everyone
 Where appropriate, personal information who goes online should follow.
controllers and personal information processors  You should remember them every time you go
shall comply with the following guidelines for online.
organizational security  Netiquette is a set of rules for behaving
 A. Compliance officers properly online.
 B. Data protection policies.
The ten rules are as follows.
 C. Records of processing activities.
 D. Management of human resources. Rule No. 1: Remember the Human
 E. Processing of personal data
 You need to remember that you are talking to a
Rights of Data Subjects real person when you are online.
 The internet brings people together who would
 Right to be informed.
otherwise never meet.
 Right to object.
 Remember this saying when sending an email:
 Right to access.
Would I say this to the person's face.
 Right to rectification.
Rule No.2: Adhere to the same standards online that Rule No. 8: Respect other people's privacy
you follow in real life
 Do not read other people's mail without their
 You need to behave the same way online that permission.
you do in real life.  Going through other people's things could cost
 You need to remember that you can get caught you your job or you could even go to jail.
doing things you should not be doing online just  Not respecting other people's privacy is bad
like you can in real life. Netiquette.
 You are still talking to a real person with
Rule No.9: Don't abuse your power.
feelings even though you can't see them.
 Do not take advantage of other people just
Rule no. 3: Know where you are in cyberspace.
because you have more knowledge or power
 Always take a look around when you enter a than them.
new domain when surfing the web.  Treat others as you would want them to treat
 Get a sense of what the discussion group is you if the roles were reversed.
about before you join it.
Rule No. 10: Be forgiving of other people's mistakes.
Rule no.4: Respect other people's time and bandwidth.
 Do not point out mistakes to people online.
 Remember people have other things to do  Remember that you were once the new kid on
besides read your email. You are not the center the block.
of their world.  You still need to have good manners even
 Keep your post and emails to a minimum by though you are online and can not see the
saying what you want to say. person face to face.
 Remember everyone won't answer your
Email Etiquette
questions.
 There are etiquette rules for email messages
Rule No. 5: Make yourself look good online.
also. They are as follows:
 Remember to always check your spelling and  Check your email daily
grammar before posting.  Delete unwanted messages.
 Always know what you are talking about and  Keep messages in your box to a minimum
make sense saying it.  Mail messages can be downloaded and save for
 Be polite and pleasant to everyone. future references.
 Never assume that your Email can be read by
Rule no. 6: Share expert knowledge
no one but yourself.
 Ask questions online  Remember there are always be lurking around
 Share what you know online. online
 Post the answers to your questions online
Ten Commandments of Computer Ethics
because someone may have the same question
you do. Ten commandments taken from the User Guidelines
and Netiquette By Arlene Rinaldi, Ten commandments
Rule No.7: Help keep flame wars under control
are as follows:
 Netiquette does not forbid flaming.
 Thou shalt not use computer to harm people.
 Netiquette does however forbid people who
 Thou shalt not interfere with other people's
are flaming to hurt discussion groups by putting
work.
the group down.
 Thou shalt not snoop around other people's
files.
 Thou shalt not use a computer to steal
  Thou shalt not use a computer to bear false SET B. Give at least 8 offline measures to keep your
witness physical data secure:
 Thou shalt not use or copy software.
Answer SET B
 Thou shalt not use other people's computer
resources.  Lock rooms containing confidential information
 Thou shalt not appropriate other people's when not in use.
intellectual output.  Make sure employees don't write their
 Thou shalt think about the social consequences passwords down.
of the program you write.  Use swipe cards or keypads to access the office.
 Thou shalt use a computer in ways tha show  Use CCTV cameras to monitor your office space.
consideration and respect.  Shield keyboards when inputting passwords.
 Shred confidential waste.
Netiquette
 Use forensic property marking equipment and
 Remember the Ten rules of Netiquette and the spray systems to mark assets.
Ten commandments for computer Ethics while  Use anti-climb paint on exterior walls and
you are online and you will not have any drains.
problems.  Install an alarm system.
 Place bars on ground floor windows.
Determine if the following information is considered
 Hide valuable equipment from view when not
(P) Personal Information or (SP) Sensitive Personal
in the office.
Information:
 Assign a limited number of trustworthy
employees as key safe holders.

SET A Answer Key

 Name p
 Race SPI
 Ethnic Origin SPI
 Place of Work p
 Color SPI
 Marital Status SPI
 Telephone number p
 Gender p
 Genetics SPI
 Sexual Life SPI .
 Health SPI
 Education SPI
 Birth date p
 Citizenship p
 Location at a particular time p
 Political Affiliations SPI