If you cannot

PROTECT it, Do not

COLLECT it
Analogy time!
 If you cannot
PROTECT it, Do
not COLLECT
BOTPA
Who stores data about you?
SPEED OF
INFORMATION
Which is more valuable?

Data Money
“Data is more valuable than Money. If someone
takes your money, that's all they have. If you let
someone take your data, they may eventually
take your money too!“
from: Deputy Privacy Commissioner Dondi Mapa
In today’s environment,
where competitors can copy your
products, pirate your employees,
and mirror your algorithms,
data is the only
sustainable
competitive
advantage.

FORMER
DEPUTY PRIVACY
COMMISSIONER
DAMIAN MAPA
What is the Data Privacy Act of 2012?
• SECTION 1. Short Title. – This Act shall be known as the “Data Privacy Act of 2012”.

• Republic Act 10173, the Data Privacy Act of 2012

AN ACT PROTECTING INDIVIDUAL PERSONAL INFORMATION IN INFORMATION AND
COMMUNICATIONS SYSTEMS IN THE GOVERNMENT AND THE PRIVATE SECTOR, CREATING
FOR THIS PURPOSE A NATIONAL PRIVACY COMMISSION, AND FOR OTHER PURPOSES

• The National Privacy Commission (NPC) is a body that is mandated to administer and implement this
law. The functions of the NPC include:
– rule-making,
– advisory,
– public education,
– compliance and monitoring,
– investigations and complaints,
– and enforcement.
Main Author of R.A. 10173 and the NPC Commissioners
 Timeline of DPA Law and IRRs passed to
Organization’s Compliance

Sept. 9,
March August Sept. 9,
2012 2016 2016 2016 2017

Data National Implementing IRRs came into Comply with

Privacy Act Privacy rules and effect registration
(DPA) Commission Regulations (compy with requirements
Passed into (NPC) was (IRRs) was all provisions
law formed published except
registration
Registration Requirements: All personal data processing systems (DPS) operating in the requirments)
Philippines that involve Personally Identifiable Information (PII) concerning at least
1,000 individuals/personal records must be registered with NPC
12 months
 KEY ROLES IN THE DATA PRIVACY ACT
• Data Subjects
– Refers to an individual whose, sensitive personal, or privileged information is processed personal

• Personal Information Controller (PIC)

– Controls the processing of personal data, or instructs another to process personal data on its behalf.

• Personal Information Processor (PIP)

– Organization or individual whom a personal information controller may outsource or instruct the processing of personal data
pertaining to a data subject

• Data Protection Officer (DPO)

– Responsible for the overall management of compliance to DPA

• National Privacy Commission

– Independent body mandated to administer and implement the DPA of 2012, and to monitor and ensure compliance of the country
with international standards set for personal data protection
Examples of Breaches and Live Cases
1. COMELeak (1 and 2) 15. Privacy notice
2. BPI – consent form 16. Use of USB
3. Hospital – unsecure storage records 17. Personal laptop stolen
4. Student transferred by her parent without her knowledge 18. Lost a CD in transit
5. Clinical record of a student to disclose with her parents 19. An error in viewing of student records in the online
6. List of top students/passers system
7. Known Fastfood delivery – disclosing personal info of 20. Use of re-cycled papers
clients 21. Raffle stubs
8. No Data sharing agreement (DSA) between and among 22. Universities and Colleges websites with weak
Schools and Universities authentication
9. Cedula in malls 23. Personal Records stolen from home of an employee
10. Security issues in buildings – logbook 24. Photocopiers re-sold without wiping the hard drives
11. Profiling of customers from a mall 25. Release of CCTV Footage
12. Unjustifiable collection of personal data of a school 26. Hard drives sold online
13. No Privacy Notice 27. Password hacked/revealed
14. Use of USB 28. Unencrypted Data
 Potential Penalties listed in the Data Privacy Act
DPA Punishable Act For Personal For Sensitive Personal Fine (Pesos)
Section Information Information

JAIL TERM
25 Unauthorized processing 1-3 years 3-6 years 500 k – 4 million

26 Access due to negligence 1-3 years 3-6 years 500 k – 4 million

27 Improper disposal 6 months – 2 years 3-6 years 100 k – 1 million

28 Unauthorized purposes 18 months – 5 years 2-7 years 500 k – 2 million

29 Intentional breach 1-3 years 500 k – 2 million

30 Concealment of breach 18 months – 5 years 500 k – 1 million

31 Malicious disclosure 18 month – 5 years 500 k – 1 million

32 Unauthorized disclosure 1-3 years 3-5 years 500 k – 2 million

33 Combination of acts 1-3 years 1 million – 5 million

Top 20 Government-imposed Data Privacy Fines
W orldwide, 1999-2014 **
Amount of
Privacy principles
Rank Fined entity fines Year Country
violated
and penalties

1 Apple $32.5M 2014 U.S. Choice and Consent

2 Google $22.5M 2012 U.S. Co llection
3 Google $17M 2013 U.S. Co llection and No tice
4 ChoicePo int $15M 2006 U.S. Security
5 Hewlitt-Packard $14,5M 2006 U.S. Co llection
6 LifeLock $12M 2010 U.S. Accuracy, Security
7 TJ Maxx $9.8M 2009 U.S. Security
8 Dish Network $6M 2009 U.S. Choice and Consent
9 DirecTV $5.3M 2005 U.S. Choice and Consent
10 HSBC $5M 2009 UK Security
1999-
11 US Banco rp $5M U.S. Disclosure
2000
12 Craftmatic $4.3 2007 U.S. Choice and Consent
13 Cignet Health $4.3M 2011 U.S. Access
14 Barclays Bank $3.8M 2013 U.S. Use and Retention
15 Certegy Check Services $3.5M 2013 U.S. Accuracy
16 Playdom $3M 2011 U.S. Co llection and No tice
17 The Broadcast Team $2.8M 2007 U.S. Co llection
Equifax, TransUnion and
18 $2.5M 2000 U.S. Access
Experian
19 CVS Caremark $2.3M 2009 U.S. Security and Disposal
20 No rwich Union Life $1.8M 2007 UK Disclosure

**SOURCE IAPP 17 FEB 2014

 Rights of the Data Subject
• Right to be informed - IRR, Section 34.a
• Right to object - IRR, Section 34.b
• Right to access - IRR, Section 34.c
• Right to data portability - IRR, Section 36
• Right to correct (rectification) - IRR, Section 34.d
• Right to erasure or blocking - IRR, Section 34.e
• Right to file a complaint - IRR, Section 34.a.2
• Right to damages - IRR, Section 34.f
• Transmissibility of Rights - IRR, Section 35
CLASSIFICATION OF PERSONAL DATA

Personal Information:
Personal information refers to any information
whether recorded in a material form or not,
from which the identity of an individual is
apparent or can be reasonably and directly
ascertained by the entity holding the
information, or when put together with other
information would directly and certainly
identify an individual.
Sensitive Personal Information.
Refers to personal information about an individual’s:
race, ethnic origin, marital status, age,
color, religious, philosophical or political
affiliations, health, education, genetics, sexual
life, any proceeding for any offense committed
or alleged to have been committed, the disposal
of such proceedings, the sentence of any court
in such proceedings;

Also includes information issued by government

agencies peculiar to an individual which includes, but
not limited to:
social security numbers, previous or
current health records, licenses or its denials,
suspension or revocation, and tax returns;
and specifically established by an executive order
or an act of Congress to be kept classified.
Personal Data Lifecycle
Acquisition Storage USE

• Key considerations when listing your personal

data:
Transfer Destruction – What personal data do you collect?
– In what form and through which channels?
– For what purpose you collect personal data
– How is it used?
Retention/Disposal should be – Who is this data shared with internally and
externally?
based on:
– Who is authorized to access this data?
1. Law – Where do you keep your data?
2. Industry Best Practice – How long do you keep your data?
3. Business Needs – How do you dispose this data?
 TRANSPARENCY – “the CONSENT Regime”

Principle of Transparency
A data subject must be aware of the nature, purpose, and extent of the processing of his
or her personal data, including the risks and safeguards involved, the identity of personal
information controller, his or her rights as a data subject, and how these can be
exercised. Any information and communication relating to the processing of personal
data should be easy to access and understand, using clear and plain language.
LEGITIMATE PURPOSE

Principle of Legitimate Purpose

The processing of information shall be
compatible with a declared and specified
purpose, which must not be contrary to
law, morals, or public policy.
 PROPORTIONALITY

Principle of Proportionality
The processing of information shall be adequate, relevant, suitable, necessary, and
not excessive in relation to a declared and specified purpose. Personal data shall be
processed only if the purpose of the processing could not reasonably be fulfilled by
other means.

Avoid this mentality:

“just in case we need it”
“this is what we always do”
THE
THE
FIVE
FIVE
PILLARS
PILLARS
OF
OF
COMPLIANCE
COMPLIANCE
Commit to Know Your Risk: Be Accountable:
Comply: Appoint a Conduct a Privacy Create your
Data Protection Impact Privacy
Officer (DPO) Assessment (PIA) Management
Program and
Privacy Manual
 Be Prepared for
Demonstrate Your
Breach:
Compliance:
Regularly exercise
Implement your
your Breach
privacy and data
Reporting
protection (PDP)
Procedures
measures.
(BRP).
Other Requirements
• Annual Breach Drill Privacy notice
 Notification to NPC within 72 hours
 (in the event of a personal data breach)  What information is being
collected?
• Annual Breach Report
 Who is collecting it?
• Security Clearance
• Privacy Notice  How is it collected?

• Data Sharing Agreement (DSA), if applicable  Why is it being collected?

• Sub-contracting Agreement / Outsourcing Agreement  How will it be used?

 Who will it be shared with?

 The Data Privacy Principles
• Personal data shall be:
1. processed fairly and lawfully
2. processed only for specified, lawful and compatible
purposes
3. adequate, relevant and not excessive
4. accurate and up to date
5. kept for no longer than necessary
6. processed in accordance with the rights of data subjects
7. kept secure
 Self-help checklist on data protection policy
Remember: you should be able to answer YES to all of the questions below. If you can, your business is in good shape from a data protection
viewpoint. If you don't have a clean sheet, the checklist can help you identify the areas where you need to improve.

Rule 1: Fair obtaining: Rule 2: Purpose specification

• At the time when we collect information • Are we clear about the purpose (or purposes) for
about individuals, are they made aware of which we keep personal information?
the uses for that information? • Are the individuals on our database also clear
about this purpose?
• Are people made aware of any disclosures
• If we are required to register with NPC, does
of their data to third parties? our register entry include a proper,
• Have we obtained people's consent for any comprehensive statement of our
secondary uses of their personal data, purpose? [Remember, if you are using personal data for a
which might not be obvious to them purpose not listed on your register entry, you may be
committing an offence.]
• Can we describe our data-collection
• Has responsibility been assigned for
practices as open, transparent and up- maintaining a list of all data sets and the
front? purpose associated with each?
 Self-help checklist on data protection policy
Remember: you should be able to answer YES to all of the questions below. If you can, your business is in good shape from a data protection
viewpoint. If you don't have a clean sheet, the checklist can help you identify the areas where you need to improve.

Rule 3: Use and disclosure of information Rule 4: Security

• Are there defined rules about the use and • Is there a list of security provisions in place for
disclosure of information? each data set?
• Are all staff aware of these rules? • Is someone responsible for the development and
• Are the individuals aware of the uses and review of these provisions?
disclosures of their personal data? Would they be • Are these provisions appropriate to the
surprised if they learned about them? Consider sensitivity of the personal data we keep?
whether the consent of the individuals should be
• Are our computers and our databases password-
obtained for these uses and disclosures.
protected, and encrypted if appropriate?
• If we are required to register with NPC, does our
• Are our computers, servers, and files securely
register entry include a full list of persons to whom
we may need to disclose personal data? [Remember, locked away from unauthorized people?
if you disclose personal data to someone not listed on
your register entry, you may be committing an offence .]
 Self-help checklist on data protection policy
Remember: you should be able to answer YES to all of the questions below. If you can, your business is in good shape from a data protection
viewpoint. If you don't have a clean sheet, the checklist can help you identify the areas where you need to improve.

Rule 5: Adequate, relevant and not excessive Rule 6: Accurate and up-to-date
• Do we collect all the information we need • Do we check our data for accuracy?
to serve our purpose effectively, and to
deal with individuals in a fair and • Do we know how much of our
comprehensive manner? personal data is time-sensitive, i.e.
• Have we checked to make sure that all the likely to become inaccurate over
information we collect is relevant, and not time unless it is updated?
excessive, for our specified purpose? • Do we take steps to ensure our
• If an individual asked us to justify every
databases are kept up-to-date?
piece of information we hold about him or
her, could we do so?
• Does a policy exist in this regard?
 Self-help checklist on data protection policy
Remember: you should be able to answer YES to all of the questions below. If you can, your business is in good shape from a data protection
viewpoint. If you don't have a clean sheet, the checklist can help you identify the areas where you need to improve.

Rule 7: Retention time

• Is there a clear statement on how long Rule 8: The Right of Access
personal data are to be retained? • Is a named individual responsible
• Are we clear about any legal requirements
on us to retain data for a certain period?
for handling access requests?
• Do we regularly purge our databases of • Are there clear procedures in place
data which we no longer need, such as data for dealing with such requests?
relating to former customers or staff • Do these procedures guarantee
members?
compliance with the RA 10173
• Do we have a policy on deleting personal
data as soon as the purpose for which we requirements?
obtained the data has been completed?
 Self-help checklist on data protection policy
Remember: you should be able to answer YES to all of the questions below. If you can, your business is in good shape from a data protection
viewpoint. If you don't have a clean sheet, the checklist can help you identify the areas where you need to improve.

Registration Training & Education

• Are we clear about whether or not we • Do we know about the levels of
need to be registered with the NPC? awareness of data protection in our
• If registration is required, is the organization?
registration kept up to date? Does the • Are our staff aware of their data
registration accurately reflect our protection responsibilities - including
practices for handling personal the need for confidentiality?
data? [Remember, if your data-handling practices • Is data protection included as part of
are out of line with the details set out in your register the training program for our staff?
entry, you may be committing an offence .]
 Self-help checklist on data protection policy
Remember: you should be able to answer YES to all of the questions below. If you can, your business is in good shape from a data protection
viewpoint. If you don't have a clean sheet, the checklist can help you identify the areas where you need to improve.

Co-ordination and Compliance

Other Requirements
• Has a Data Protection Officer (DPO) /
• Annual Breach Drill
Compliance Officer for Privacy (COP) been
appointed? – Notification to NPC within 72 hours (in
the event of a personal data breach )
• Are all staff aware of his or her role?
• Are there mechanisms in place for formal • Annual Breach Report
review by DPO activities within our • Security Clearance
organization? • Privacy Notice
• Is the Privacy Impact Assessment (PIA) • Data Sharing Agreement (DSA), if applicable
carefully planned and executed according to its • Sub-contracting Agreement / Outsourcing
purpose? Agreement
• Is there a Breach Management Program (BMP)
in place?
1 Technical

2 Organisational – other
measures
Technical

Encryption Backups
To what standard? (cost Vs benefit) Secure: encrypted tapes | cloud-provider

All devices or just some? Auditable process

Passwords Access control

Enforced strength and updates?
Who decides permissions and privileges (‘need to
know’)?
Sharing data
Technical solutions – e.g. via email; portals
Remote access
How delivered securely?
System testing & maintenance
Permit Bring Your Own Device?
Who has access, to what (System Administrators)

Live or dummy data? Firewalls / Anti-virus / Spam filters

Organisational – physical security

Secure Office Storage Remote working

Secure both hardcopies and devices when in transit.
For removable devices and hardcopy information

Kept out of sight: in transit | at home.

Identifying marks? Locked print?

Kensington locks? Lockable pedestals | Kensington locks?

Offsite?

Building access control Secure disposal

Secure premises – CCTV | locked windows | perimeter
Shredding of hardcopies

Locked CCTV room | server room

Beyond use | Reuse | Resale

ID badges, supervised visitors | contractors
Organisational – other measures

Policy, procedures, guidance & training

Eliminate ambiguities Clearly communicated, readily accessible and understood

Procurement (and contracts)

Human Resources
i.e. outsourced services like IT and software
Explicit roles and responsibilities in Job Descriptions
and Terms of Reference
Due diligence

Terms and Conditions: confidentiality clauses

Compliant contract Terms and Conditions:
• Act on your instructions
Clear expectations | reporting lines • Equivalent security

Disciplinary process Training records Auditing and monitoring

 Other Security Measures
• Shredding all confidential waste.
• Using strong passwords.
• Installing a firewall and virus checker on your computers.
• Encrypting any personal information held electronically.
• Disabling any ‘auto-complete’ settings.
• Holding telephone calls in private areas.
• Checking the security of storage systems.
• Keeping devices under lock and key when not in use.
• Not leaving papers and devices lying around.
 12 offline measures to keep your physical data secure
• Lock rooms containing confidential information when not in use.
• Make sure employees don’t write their passwords down.
• Use swipe cards or keypads to access the office.
• Use CCTV cameras to monitor your office space.
• Shield keyboards when inputting passwords.
• Shred confidential waste.
• Use forensic property marking equipment and spray systems to mark assets.
• Use anti-climb paint on exterior walls and drains.
• Install an alarm system.
• Place bars on ground floor windows.
• Hide valuable equipment from view when not in the office.
• Assign a limited number of trustworthy employees as key safe holders.
 Holding Data and Keeping it Up-to-Date
• Carry out an information audit at least annually.
– Write a letter at the start of each school year asking parents and students to check that
their details are correct. This also helps prevent emergency risks, e.g. if an old address or
phone number is on record.
– Check that ‘live’ files are accurate and up to date.
– Any time you become aware that information needs amending, do so immediately
– Any personal data that is out of date or no longer needed should be ‘destroyed’. This may
involve shredding documents or deleting computer files securely so that they cannot be
retrieved.
– Schools must follow the disposal of records schedule. This schedule states how long
certain types of personal data can be held for until it must be destroyed. Some
stipulations are legal obligations while others are best practice.

You are violating the Data Privacy Act if you keep any data for longer than it is needed.
Designating a DPO is the first essential step.
You cannot register with the NPC unless you
have a DPO.
 General Qualifications
• The Data Protection Officer (DPO) should possess specialized knowledge
and demonstrate reliability necessary for the performance of his or her
duties and responsibilities. As such, the DPO should have expertise in
relevant privacy or data protection policies and practices. He or she should
have sufficient understanding of the processing operations being carried
out by the Personal Information Controller (PIC) or the Personal
Information Processor (PIP), including the latter’s information systems,
data security and/or data protection needs.

• Knowledge by the DPO of the sector or field of the PIC or PIP, and the
latter’s internal structure, policies, and processes is also useful.

• The minimum qualifications for a DPO shall be proportionate to his or her

functions.
 Duties and Responsibilities Of the DPO
a. monitor the PIC’s or PIP’s compliance with the DPA, its IRR,
issuances by the NPC and other applicable laws and policies.
For this purpose, he or she may:
1. collect information to identify the processing operations, activities,
measures, projects, programs, or systems of the PIC or PIP, and maintain
a record thereof;
2. analyze and check the compliance of processing activities, including the
issuance of security clearances to and compliance by third-party service
providers;
3. inform, advise, and issue recommendations to the PIC or PIP;
4. ascertain renewal of accreditations or certifications necessary to maintain
the required standards in personal data processing; and
5. advice the PIP or PIP as regards the necessity of executing a Data
Sharing Agreement with third parties, and ensure its compliance with the
law;
b. ensure the conduct of Privacy Impact Assessments relative to
activities, measures, projects, programs, or systems of the
PIC or PIP;
c. advice the PIC or PIP regarding complaints and/or the
exercise by data subjects of their rights (e.g., requests for
information, clarifications, rectification or deletion of
personal data);
d. ensure proper data breach and security incident management
by the PIC or PIP, including the latter’s preparation and
submission to the NPC of reports and other documentation
concerning security incidents or data breaches within the
prescribed period;
e. inform and cultivate awareness on privacy and data
protection within the organization of the PIC or PIP,
including all relevant laws, rules and regulations and
issuances of the NPC;
f. advocate for the development, review and/or revision of
policies, guidelines, projects and/or programs of the PIC
or PIP relating to privacy and data protection, by
adopting a privacy by design approach;
g. serve as the contact person of the PIC or PIP vis-à-vis
data subjects, the NPC and other authorities in all
matters concerning data privacy or security issues or
concerns and the PIC or PIP;
h. cooperate, coordinate and seek advice of the NPC
regarding matters concerning data privacy and security;
and
i. perform other duties and tasks that may be assigned by
the PIC or PIP that will further the interest of data
privacy and security and uphold the rights of the data
subjects.
Additional functions of a Data Protection Officer (DPO):

1. ensuring that controllers and data subjects are informed of their

rights and obligations;
2. ensuring in an independent manner the internal application of the
Regulation;
3. carrying out inquiries where necessary;
4. keeping a register of the processing operations carried out by the
controller;
5. notifying the NPC of processing operations which may present
specific risks;
6. responding to requests from NPC and cooperating with NPC
What support is needed from the rest of the org’n?
What support is needed from the rest of the org’n?
What support is needed from the rest of the org’n?
What support is needed from the rest of the org’n?
What support is needed from the rest of the org’n?
In Closing: How the NPC can help

Help in delivering Generic guidance

the message to top and frameworks
management (www.privacy.gov.ph)

Updates on new When requested,

standards and/or advice on specific
circulars matters
(www.privacy.gov.ph) ([email protected])
“Compliance to Data Privacy Act is not a
one-shot initiative. It is a discipline and
culture that must be embedded on a
continuous basis within the
organization.”
CULTURE OF PRIVACY in the
PHILIPPINES
Thank you! Any questions?
[email protected]