IT2028

Philippine Data Privacy Law o General authority to compel any entity, public or private,
to abide by its orders or to take action in a matter
Data Privacy Act of 2012 affecting data privacy.
• In 2012 the Philippines passed the Data Privacy Act 2012, o Recommend the prosecution and imposition of penalties
comprehensive and strict privacy legislation “to protect the specified in the DPA to the Department of Justice.
fundamental human right of privacy, of communication while
ensuring free flow of information to promote innovation and Data Controller vs. Data Processor
growth.” (Republic Act. No. 10173, Ch. 1, Sec. 2) • The data controller has the most responsibility when it comes
• The law applies to the processing of all types of personal to protecting the privacy and rights of the data's subject, such
information and any legal entity involved in personal information as the user of a website. Simply put, the data controller controls
processing the procedures and purpose of data usage
• Companies with at least 250 employees or access to the • The data controller will be the one to dictate how and why data
personal and identifiable information of at least 1,000 people are is going to be used by the organization.
required to register with the National Privacy Commission and • A data processor simply processes any data that the data
comply with the Data Privacy Act of 2012 controller gives them.
• Under R.A. 10173, your data is treated almost literally in the o For instance, Sterling Company has a website that
same way as your personal property. Thus, it should never be collects data on the pages their visitors visit. This
collected, processed, and stored by any organization without includes the page they enter the site with, the pages that
your explicit consent, unless otherwise provided by law. they visited next, and how long they stayed on each
Information controllers usually solicit your consent through a page. Sterling Company is the data controller, as they
consent form. Aside from protecting you against unfair means of decide how all this information is going to be used and
personal data collection, this right also requires personal processed, and for what purpose
information controllers (PICs) to notify you if your data have been o Sterling Company uses Google Analytics to find out
compromised, on time. which of their pages are most popular and which ones
• The law requires that when sharing data, the sharing be covered are making Web site visitors leave. This helps them plan
by an agreement that provides adequate safeguards for the their content better by knowing exactly how much time
rights of data subjects, and that these agreements are subject to each visitor spends on a particular page. Not only does
review by the National Privacy Commission Sterling Company know which topics to write on, but
• The DPA creates the National Privacy Commission ('NPC'), also discovers new topics that might be of interest to
the agency tasked with administering and implementing the their customers. Plus, it helps them improve on the
provisions of the act, which is headed by a Privacy content that is already there
Commissioner, assisted by two Deputy Commissioners. The o Sterling Company needs to share the data that they get
NPC has the following powers: to Google to get the insights they want from Google
o Monitor and ensure compliance with the DPA, as well as Analytics. In this case, Google Analytics is the data
the rules and regulations implementing its provisions. processor.
o Receive and resolve complaints and institute
investigations. • The DPA makes a distinction between personal information
o Issue cease and desist orders and impose a temporary controllers and personal information processors, where the
or permanent ban on personal information processing. former refers to those who decide on the scope of the information
collected, including the purpose or extent of its processing, while
06 Handout 1 *Property of STI
 [email protected] Page 1 of 2
 IT2028

the latter refers to those to whom the processing of personal data which should establish adequate safeguards for data privacy
is outsourced. While processing can be subcontracted, the and security.
controller remains responsible for ensuring the confidentiality of o Consent is defined as any freely given, specific,
data and can be made liable for damages to a data subject, even informed indication of will, whereby the data subject
if the processor was at fault. agrees to the collection or processing of his or her
personal data. This may be evidenced by written,
electronic, or recorded means. Consent may also be
given on behalf of data subjects by other persons
specifically authorized by them.

Data Privacy Law Penalties

• When it comes to the Data Privacy Law, there are different
penalties that could be given. The penalty when a business fails
to act in accordance with the Data Privacy Law is minimum
imprisonment of one (1) year to the maximum of seven (7) years
with a fine of not less than One million pesos (Php1,000,000.00)
up to Seven million pesos (Php7,000,000.00).
• The penalty can be applied when one of the following has been
committed:
Figure 1. Data Controller and Data Processor o Unauthorized processing of personal and sensitive
information
Outsourcing vs. Data Sharing o Accessing personal information and sensitive personal
• The DPA allows the disclosure or transfer of personal data by a information due to negligence
personal information controller to a personal information o Improper disposal of personal information and sensitive
processor for the purposes of outsourcing the processing of personal information
personal data. The personal information controller must ensure, o Processing of personal information for unauthorized
through contractual or other reasonable means, that proper purposes
safeguards necessary for maintaining the confidentiality, o Unauthorized access or intentional breach
integrity, and availability of personal data are in place o Concealment of security involving sensitive personal
• Data sharing, on the other hand, refers to an arrangement information
involving the disclosure of personal data by the controller to a o Malicious disclosure
third party. o Unauthorized disclosure
• Data sharing is allowed as long as the data subject consents and
has been provided with specific information regarding the References:
Aguda, HR., Tiojanco, BD., Montes, MF. (2017). Data Privacy & Cybercrime
purpose and extent of data sharing, including the intended Prevention in the Philippine Digital Age. Vibal Group.
recipients or categories of recipients of his or her personal data. Dominguez, M. (2018). A Quick Guide to Philippine Data Privacy Law Compliance.
Consent is required even when the data is to be shared with an Clifford Chance.
affiliate or mother company, or with others of similar Stallings, W. (2019). Information privacy engineering and privacy by design:
Understanding privacy threats, technologies, and regulations. Addison-Wesley
relationships. Data sharing for a commercial purpose, including Professional.
direct marketing, must be covered by a data-sharing agreement,
06 Handout 1 *Property of STI
 [email protected] Page 2 of 2