Summary: Philippines Data Privacy Act controller, except where overridden by the fundamental

and Implementing Regulations rights and freedoms of the data subject.

In 2012 the Philippines passed the Data Privacy Act Required agreements
2012, comprehensive and strict privacy legislation “to protect
the fundamental human right of privacy, of communication The law requires that when sharing data, the sharing
while ensuring free flow of information to promote be covered by an agreement that provides adequate
innovation and growth.” (Republic Act. No. 10173, Ch. 1, Sec. safeguards for the rights of data subjects, and that these
2). This comprehensive privacy law also established a agreements are subject to review by the National Privacy
National Privacy Commission that enforces and oversees it Commission.
and is endowed with rulemaking power. On September 9,
2016, the final implementing rules and regulations came into Sensitive Personal and Privileged Information
force, adding specificity to the Privacy Act.
The law defines sensitive personal information as being:
Scope and Application  About an individual’s race, ethnic origin, marital status,
age, color, and religious, philosophical or political
The Data Privacy Act is broadly applicable to affiliations;
individuals and legal entities that process personal  About an individual’s health, education, genetic or
information, with some exceptions. The law has sexual life of a person, or to any proceeding or any
extraterritorial application, applying not only to businesses offense committed or alleged to have committed;
with offices in the Philippines, but when equipment based in  Issued by government agencies “peculiar” (unique) to
the Philippines is used for processing. The act further applies an individual, such as social security number;
to the processing of the personal information of Philippines  Marked as classified by executive order or act of
citizens regardless of where they reside. Congress.
All processing of sensitive and personal information is
prohibited except in certain circumstances. The exceptions
One exception in the act provides that the law does not apply
are:
to the processing of personal information in the Philippines
 Consent of the data subject;
that was lawfully collected from residents of foreign
 Pursuant to law that does not require consent;
jurisdictions — an exception helpful for Philippines
 Necessity to protect life and health of a person;
companies that offer cloud services.
 Necessity for medical treatment;
 Necessity to protect the lawful rights of data subjects in
Approach court proceedings, legal proceedings, or regulation.
The Philippines law takes the approach that “The Surveillance
processing of personal data shall be allowed subject to
adherence to the principles of transparency, legitimate Interestingly, the Philippines law states that the
purpose, and proportionality.” country’s Human Security Act of 2007 (a major anti-terrorism
law that enables surveillance) must comply with the Privacy
Collection, processing, and consent Act.
The act states that the collection of personal data Privacy program required
“must be a declared, specified, and legitimate purpose” and
further provides that consent is required prior to the The law requires that any entity involved in data
collection of all personal data. It requires that when processing and subject to the act must develop, implement
obtaining consent, the data subject be informed about the and review procedures for the collection of personal data,
extent and purpose of processing, and it specifically mentions obtaining consent, limiting processing to defined purposes,
the “automated processing of his or her personal data for access management, providing recourse to data subjects, and
profiling, or processing for direct marketing, and data appropriate data retention policies. These requirements
sharing.” Consent is further required for sharing information necessitate the creation of a privacy program. Requirements
with affiliates or even mother companies. for technical security safeguards in the act also mandate that
Consent must be “freely given, specific, informed,” an entity have a security program.
and the definition further requires that consent to collection
and processing be evidenced by recorded means. However, Data subjects' rights
processing does not always require consent.
Consent is not required for processing where the The law enumerates rights that are familiar to
data subject is party to a contractual agreement, for privacy professionals as related to the principles of notice,
purposes of fulfilling that contract. The exceptions of choice, access, accuracy and integrity of data.
compliance with a legal obligation upon the data controller,
protection of the vital interests of the data subject, and
The Philippines law appears to contain a “right to be
response to a national emergency are also available.
forgotten” in the form of a right to erasure or blocking, where
An exception to consent is allowed where processing
the data subject may order the removal of his or her personal
is necessary to pursue the legitimate interests of the data
data from the filing system of the data controller. Exercising It is unclear at present whether the commission
this right requires “substantial proof,” the burden of would allow a delay in notification of data subjects to allow
producing which is placed on the data subject. This right is the commission to determine whether a notification is
expressly limited by the fact that continued publication may unwarranted. By the law, this would appear to be a gamble.
be justified by constitutional rights to freedom of speech,
expression and other rights.
Notification contents
Notably, the law provides a private right of action for
damages for inaccurate, incomplete, outdated, false,
unlawfully obtained or unauthorized use of personal data. The contents of the notification must at least:

A right to data portability is also provided.  Describe the nature of the breach;
 The personal data possibly involved;
 The measures taken by the entity to address the breach;
 The measures take to reduce the harm or negative
Mandatory personal information breach notification consequence of the breach;
 The representatives of the personal information
The law defines “security incident” and “personal controller, including their contact details;
data breach” ensuring that the two are not confused. A  Any assistance to be provided to the affected data
“security incident” is an event or occurrence that affects or subjects.
tends to affect data protection, or may compromise
availability, integrity or confidentiality. This definition
includes incidents that would result in a personal breach, if
Penalties
not for safeguards that have been put in place.
The law provides separate penalties for various
A “personal data breach,” on the other hand, is a
violations, most of which also include imprisonment.
subset of a security breach that actually leads to “accidental
Separate counts exist for unauthorized processing,
or unlawful destruction, loss, alteration, unauthorized
processing for unauthorized purposes, negligent access,
disclosure of, or access to, personal data transmitted, stored,
improper disposal, unauthorized access or intentional breach,
or otherwise processed.
concealment of breach involving sensitive personal
information, unauthorized disclosure, and malicious
disclosure.
Requirement to notify
Any combination or series of acts may cause the entity to be
The law further provides that not all “personal data subject to imprisonment ranging from three to six years as
breaches” require notification., which provides several bases well as a fine of approximately $20,000 to $100,000.
for not notifying data subjects or the data protection
authority. Section 38 of the IRRs provides the requirements Notably, there is also the previously mentioned private right
of breach notification: of action for damages, which would apply.

 The breached information must be sensitive personal

information, or information that could be used for
Penalties for failure to notify
identity fraud, and
 There is a reasonable belief that unauthorized
acquisition has occurred, and Persons having knowledge of a security breach
 The risk to the data subject is real, and involving sensitive personal information and of the obligation
 The potential harm is serious. to notify the commission of same, and who fail to do so, may
be subject to penalty for concealment, including
imprisonment for 1 1/2 to five years of imprisonment, and a
The law provides that the Commission may
fine of approximately $10,000 - $20,000.
determine that notification to data subjects is unwarranted
after taking into account the entity’s compliance with the
Privacy Act, and whether the acquisition was in good faith. Depending upon the circumstances additional
violations might apply.
Notification timeline and recipients

The law places a concurrent obligation to notify the

National Privacy Commission as well as affected data subjects
within 72 hours of knowledge of, or reasonable belief by the
data controller of, a personal data breach that requires
notification.