Simplified Data Privacy Act 2012 Philippines

CHAPTER I

SEC. 2. Declaration of Policy. – The state will protect:

• the fundamental human right of privacy
• communication while ensuring free flow of information

SEC. 3. Definition

(a) Commission = NPC

(b) Consent of the data subject = free agreement of the data subject to the collection and processing of his personal information

• Consent is evidenced by:
  • written
  • electronic
  • recording
• Consent can also be given on behalf of the data subject by an agent authorized by the data subject

(c) Data subject refers to a person whose personal information is processed.

(d) Direct marketing 

(e) Filing system = storage and retrieval system of information relating to a person

(f) Information and Communications System

(g) Personal information = information which can be used to identify an individual.

(h) Personal information controller = the  organization who controls the personal information on behalf of that person. The term excludes:

(1) An entity who controls the info on behalf of another entity

(2) A person who controls personal information in connection with the individual’s personal, family or household affairs.

(i) Personal information processor = outsourcee of the personal information controller

(j) Processing

(k) Privileged information =

(l) Sensitive personal information

• personal
  • race
  • ethnic origin
  • marital status
  • age
  • color
  • religious
  • philosophical
  • political affiliations
• health
  • education,
  • genetic or sexual life of
  • any proceeding for any offense committed by such person,
    • the disposal of such proceedings
    • or the sentence of any court in such proceedings
• gov’t info
  • social security numbers
  • previous or current health records,
  • licenses or its denials,
  • suspension or revocation, and
  • tax returns
• Congress mandated

SEC. 4. Scope. – This only applies to data processed in the Philippines

This Act does not apply to:

(a) information on gov’t employees on their gov’t info:

• being part of the gov’t
• title, business address and office telephone number of the person
• The classification, salary range and responsibilities held by the person
• person’s name on gov’t documents

(b) Information about persons contracting for gov’t

(c) Information relating to any financial benefit such as the granting of a license or permit from gov’t

(d) Personal information processed for journalistic, artistic, literary or research purposes;

(e) This does not affect

• Republic Act No. 1405 Secrecy of Bank Deposits Act;
• Republic Act No. 6426, Foreign Currency Deposit Act
• Republic Act No. 9510, the Credit Information System Act (CISA);
• Republic Act No. 9510, and Republic Act No. 9160, Anti-Money Laundering Act

(g) Personal information of foreign residents in accordance with the laws of those foreign jurisdictions, including any applicable data privacy laws, which is being processed in the Philippines.

SEC. 5. Protection for Journalists and Their Sources. – This does not affect Republic Act No. 53

SEC. 6. Extraterritorial Application. – This Act applies to acts done in the Philippines and overseas if:

• (a) The act relates to personal information of a Philippine citizen or resident;
• (b) The entity has a link with the Philippines
• The entity is processing personal information in or outside of the Philippines as long as it is about Philippine citizens or residents such as:
  • (1) A contract is entered in the Philippines;
  • (2) A juridical entity unincorporated in the Philippines but has central management and control in the country; and
  • (3) An entity that has a branch, agency, office or subsidiary in the Philippines and the parent or affiliate of the Philippine entity has access to personal information; and
  • (1) The entity carries on business in the Philippines; and
  • (2) The personal information was collected or held by an entity in the Philippines.

CHAPTER II – NPC
THE NATIONAL PRIVACY COMMISSION

SEC. 7. Functions of the National Privacy Commission

• (a) Ensure compliance of personal information controllers
• (b) Receive complaints
• institute investigations
• facilitate or enable settlement of complaints through alternative dispute resolution processes,
• adjudicate, award indemnity on matters affecting any personal information,
• prepare reports on disposition of complaints and resolution of any investigation it initiates, and publicize any such report:
  • Provided, That in resolving any complaint or investigation (except where amicable settlement is reached by the parties), the Commission shall act as a collegial body.
• For this purpose, the Commission should:
  • have access to personal information complained about and
  • collect such information
• (c) Issue cease and desist orders
• impose a temporary or permanent ban on the processing of personal information, if the processing is bad for national security and public interest;
• (d) Compel or petition any entity to abide by its orders
• (e) Monitor the compliance of other government agencies
• recommend the actions needed to meet minimum standards
• (f) Coordinate with other government agencies and the private sector on efforts to formulate and implement plans and policies
• (g) Publish a guide to all laws relating to data protection;
• (h) Publish a compilation of agency system of records and notices, including index and other finding aids;
• (i) Recommend to the Department of Justice (DOJ) the prosecution and imposition of penalties specified in Sections 25 to 29 of this Act;
• (j) Review, approve, reject or require modification of privacy codes voluntarily adhered to by personal information controller, Provided:
  • that the privacy codes shall adhere to this Act’s principles
  • that such privacy codes may include private dispute resolution mechanisms for complaints against any participating personal information controller.
  • ..
• (k) Help with privacy or data protection at the request any person;
• …
• (p) Help Philippine companies doing business abroad to respond to foreign privacy or data protection laws and regulations; and
• (q) Do cross-border enforcement of data privacy protection.

SEC. 8. Confidentiality. – The Commission shall ensure the confidentiality of any personal information it gets

SEC. 9. Organizational Structure of the Commission. – It will be a part of DICT.

CHAPTER 3: PROCESSING OF PERSONAL INFORMATION

SEC. 11. General Data Privacy Principles. –

• transparency,
• legitimate purpose
• proportionality.

Personal information must, be:,

• (a) Collected for legitimate purposes declared before collection
• (b) Processed fairly and lawfully;
• (c) Accurate, relevant, kept up to date;
• inaccurate or incomplete data must be corrected or destroyed or further processing restricted
• (d) Adequate and not excessive in relation to the purposes for which they are collected and processed;
• (e) Retained only as is necessary for legal claims, business purposes, or as provided by law
• (f) Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected and processed Provided,
  • That personal information collected for other purposes may lie processed for historical, statistical or scientific purposes, and in cases laid down in law may be stored for longer periods:
  • That adequate safeguards are guaranteed by said laws authorizing their processing.

SEC. 12. Criteria for Lawful Processing of Personal Information:

• (a) The data subject has given his or her consent;
• (b) The processing of personal information is:
  • necessary
  • related to:
    • the fulfillment of a contract with the data subject or
    • take steps at the request of the data subject prior to entering into a contract;
• (c) The processing is needed to comply with a legal obligation to which the personal information controller is subject;
• (d) The processing is needed to protect vitally important interests of the data subject, including life and health;
• (e) The processing is needed to:
  • respond to national emergency
  • comply with the requirements of public order and safety
  • fulfill functions of public authority which includes the processing of personal data
• (f) The processing is necessary for the legitimate interests of the personal information controller or by third parties which have such data, except when overridden by the Constitution.

 

SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive and privileged information is allowed when:

• (a) for sensitive info: the data subject has given consent, specific to the purpose prior to the processing
• for privileged information, all parties involved have given their consent prior to processing;
• (b) The processing of such data is allowed by existing laws and regulations: Provided,
  • That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information:
  • That the consent of the data subjects are not required by law, allowing the processing of such information;
• (c) The processing is necessary to protect the life and health of the data subject or another person
• The data subject is not legally or physically able to express his or her consent prior to the processing;
• (d) The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations:
  • Provided That such processing is only confined and related to members of these organizations or their associations:
  • Provided, further, That the sensitive personal information are not transferred to third parties:
  • Provided, finally, That consent of the data subject was obtained prior to processing;
• (e) The processing is:
  • necessary for purposes of medical treatment,
  • done by a medical practitioner or a medical treatment institution,
  • processing has an adequate level of protection of personal information is ensured; or
• (f) The processing of such information is needed to protect the rights and interests of persons in:
  • court proceedings,
  • exercise or defense of legal claims, or
  • times when provided to government or public authority.

 

SEC. 14. Subcontract of Personal Information. A personal information controller may subcontract the processing of personal information: Provided,

• That the personal information controller shall be responsible for:
  • the confidentiality of the personal information processed,
  • prevent its use for unauthorized purposes, and
  • process personal information lawfully.
• The personal information processor shall comply with the laws

 

SEC. 15. Extension of Privileged Communication

• Personal information controllers may invoke the principle of privileged communication over privileged information that they have
• Any evidence gathered on privileged information is inadmissible.

CHAPTER 4: RIGHTS OF THE DATA SUBJECT

SEC. 16. Rights of the Data Subject

• (a) Be informed whether his personal information is being /has been processed
• (b) Be given his information before it is entered into the PIC’s system, or at the next practical opportunity:
  • (1) Description of the personal information to be entered;
  • (2) Why they are being processed;
  • (3) Scope and method of the personal information processing;
  • (4) The recipients;
  • (5) Methods utilized for automated access
    • the extent to which such access is authorized;
  • (6) The identity and contact details of the PIC or its representative;
  • (7) The period the information will be stored; and
  • (8) The existence of their rights:
    • , i.e., to access, correct, and the right to lodge a complaint before the Commission.

• Any information supplied to the data subject on these matters shall not be amended without prior notification of data subject:
  • Provided, That the notification under subsection (b) shall not apply should the personal information be needed pursuant to a subpoena or when the collection and processing are for obvious purposes, including:
    • when it is needed for a contract or service or
    • when needed in an employer-employee relationship, between the collector and the data subject, or
    • when the information is used for a legal obligation;

(c) Reasonable access to, upon demand, the following:

• (1) Contents of his or her personal information that were processed;
• (2) Sources from which personal information were obtained;
• (3) Names and addresses of recipients of the personal information;
• (4) Manner by which such data were processed;
• (5) Reasons for the disclosure of the personal information to recipients;
• (6) Information on automated processes where the data will or likely to be made as the sole basis for any decision significantly affecting or will affect the data subject;
• (7) Date when his personal information on the data subject were last accessed and modified; and

(8) The designation, or name or identity and address of the personal information controller;

(d) Dispute the inaccuracy or error in the personal information and have the personal information controller correct it immediately and accordingly, unless the request is vexatious or otherwise unreasonable.

• If the personal information have been corrected, the PIC shall ensure the accessibility of:
  • both the new and the retracted information and
  • the simultaneous receipt of the new and the retracted information by recipients
    • Provided, That the third parties who have previously received such processed information shall he informed of:
      • its inaccuracy and
      • its rectification upon reasonable request of the data subject;

(e) Suspend, withdraw or order the blocking, removal or destruction of his or her personal information from the PIC’s system upon proof that the personal information are:

• incomplete,
• outdated,
• false,
• unlawfully obtained,
• used for unauthorized purposes or
• no longer necessary for the purposes for which they were collected.
  • In this case, the PIC may notify third parties who have previously received such processed personal information

(f) Be indemnified for any damages from such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information.

SEC. 17. Transmissibility of Rights of the Data Subject. – The lawful heirs and assigns of the data subject may invoke the rights of the data subject after his death or incapacity

SEC. 18. Right to Data Portability. – If personal information is processed electronically, the data subject shall have the right to obtain from the PIC a copy of data in an electronic format

SEC. 19. Non-Applicability. – The immediately preceding sections are not applicable if the processed personal information are used only for the needs of scientific and statistical research and, on the basis of such, no activities are carried out and no decisions are taken regarding the data subject: Provided, That the personal information shall be held under strict confidentiality and shall be used only for the declared purpose. Likewise, the immediately preceding sections are not applicable to processing of personal information gathered for the purpose of investigations in relation to any criminal, administrative or tax liabilities of a data subject.

CHAPTER V SECURITY OF PERSONAL INFORMATION

SEC. 20. Security of Personal Information. –

• (a) The personal information controller must protect personal information against:
  • any accidental or unlawful destruction, alteration and disclosure,
  • any other unlawful processing.
• (b) The personal information controller shall implement reasonable and appropriate measures to protect personal information against natural dangers such as accidental loss or destruction, and human dangers such as unlawful access, fraudulent misuse, unlawful destruction, alteration and contamination.

(c) The determination of the appropriate level of security under this section must take into account the nature of the personal information to be protected, the risks represented by the processing, the size of the organization and complexity of its operations, current data privacy best practices and the cost of security implementation. Subject to guidelines as the Commission may issue from time to time, the measures implemented must include:

(1) Safeguards to protect its computer network against accidental, unlawful or unauthorized usage or interference with or hindering of their functioning or availability;

(2) A security policy with respect to the processing of personal information;

(3) A process for identifying and accessing reasonably foreseeable vulnerabilities in its computer networks, and for taking preventive, corrective and mitigating action against security incidents that can lead to a security breach; and

(4) Regular monitoring for security breaches and a process for taking preventive, corrective and mitigating action against security incidents that can lead to a security breach.

(d) The personal information controller must further ensure that third parties processing personal information on its behalf shall implement the security measures required by this provision.

(e) The employees, agents or representatives of a personal information controller who are involved in the processing of personal information shall operate and hold personal information under strict confidentiality if the personal information are not intended for public disclosure. This obligation shall continue even after leaving the public service, transfer to another position or upon termination of employment or contractual relations.

(f) The personal information controller shall promptly notify the Commission and affected data subjects when sensitive personal information or other information that may, under the circumstances, be used to enable identity fraud are reasonably believed to have been acquired by an unauthorized person, and the personal information controller or the Commission believes (bat such unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject. The notification shall at least describe the nature of the breach, the sensitive personal information possibly involved, and the measures taken by the entity to address the breach. Notification may be delayed only to the extent necessary to determine the scope of the breach, to prevent further disclosures, or to restore reasonable integrity to the information and communications system.

(1) In evaluating if notification is unwarranted, the Commission may take into account compliance by the personal information controller with this section and existence of good faith in the acquisition of personal information.

(2) The Commission may exempt a personal information controller from notification where, in its reasonable judgment, such notification would not be in the public interest or in the interests of the affected data subjects.

(3) The Commission may authorize postponement of notification where it may hinder the progress of a criminal investigation related to a serious breach.

Back To Top

CHAPTER VI
ACCOUNTABILITY FOR TRANSFER OF PERSONAL INFORMATION

SEC. 21. Principle of Accountability. – Each personal information controller is responsible for personal information under its control or custody, including information that have been transferred to a third party for processing, whether domestically or internationally, subject to cross-border arrangement and cooperation.

(a) The personal information controller is accountable for complying with the requirements of this Act and shall use contractual or other reasonable means to provide a comparable level of protection while the information are being processed by a third party.

(b) The personal information controller shall designate an individual or individuals who are accountable for the organization’s compliance with this Act. The identity of the individual(s) so designated shall be made known to any data subject upon request.

CHAPTER VII SECURITY OF SENSITIVE PERSONAL INFORMATION IN GOVERNMENT

SEC. 22. Responsibility of Heads of Agencies. – All sensitive personal information maintained by the government, its agencies and instrumentalities shall be secured, as far as practicable, with the use of the most appropriate standard recognized by the information and communications technology industry, and as recommended by the Commission. The head of each government agency or instrumentality shall be responsible for complying with the security requirements mentioned herein while the Commission shall monitor the compliance and may recommend the necessary action in order to satisfy the minimum standards.

SEC. 23. Requirements Relating to Access by Agency Personnel to Sensitive Personal Information. – (a) On-site and Online Access – Except as may be allowed through guidelines to be issued by the Commission, no employee of the government shall have access to sensitive personal information on government property or through online facilities unless the employee has received a security clearance from the head of the source agency.

(b) Off-site Access – Unless otherwise provided in guidelines to be issued by the Commission, sensitive personal information maintained by an agency may not be transported or accessed from a location off government property unless a request for such transportation or access is submitted and approved by the head of the agency in accordance with the following guidelines:

(1) Deadline for Approval or Disapproval – In the case of any request submitted to the head of an agency, such head of the agency shall approve or disapprove the request within two (2) business days after the date of submission of the request. In case there is no action by the head of the agency, then such request is considered disapproved;

(2) Limitation to One thousand (1,000) Records – If a request is approved, the head of the agency shall limit the access to not more than one thousand (1,000) records at a time; and

(3) Encryption – Any technology used to store, transport or access sensitive personal information for purposes of off-site access approved under this subsection shall be secured by the use of the most secure encryption standard recognized by the Commission.

The requirements of this subsection shall be implemented not later than six (6) months after the date of the enactment of this Act.

SEC. 24. Applicability to Government Contractors. – In entering into any contract that may involve accessing or requiring sensitive personal information from one thousand (1,000) or more individuals, an agency shall require a contractor and its employees to register their personal information processing system with the Commission in accordance with this Act and to comply with the other provisions of this Act including the immediately preceding section, in the same manner as agencies and government employees comply with such requirements.

 

CHAPTER VIII PENALTIES

SEC. 25. Unauthorized Processing of Personal Information and Sensitive Personal Information. –

• (a) The unauthorized processing of personal information without consent shall get
  • 1-3 years imprisonment
  • Php500k to Php2m

(b) The unauthorized processing of personal sensitive information shall be penalized by imprisonment ranging from three (3) years to six (6) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Four million pesos (Php4,000,000.00) shall be imposed on persons who process personal information without the consent of the data subject, or without being authorized under this Act or any existing law.

SEC. 26. Accessing Personal Information and Sensitive Personal Information Due to Negligence. – (a) Accessing personal information due to negligence shall be penalized by imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00) shall be imposed on persons who, due to negligence, provided access to personal information without being authorized under this Act or any existing law.

(b) Accessing sensitive personal information due to negligence shall be penalized by imprisonment ranging from three (3) years to six (6) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Four million pesos (Php4,000,000.00) shall be imposed on persons who, due to negligence, provided access to personal information without being authorized under this Act or any existing law.

SEC. 27. Improper Disposal of Personal Information and Sensitive Personal Information. – (a) The improper disposal of personal information shall be penalized by imprisonment ranging from six (6) months to two (2) years and a fine of not less than One hundred thousand pesos (Php100,000.00) but not more than Five hundred thousand pesos (Php500,000.00) shall be imposed on persons who knowingly or negligently dispose, discard or abandon the personal information of an individual in an area accessible to the public or has otherwise placed the personal information of an individual in its container for trash collection.

(b) The improper disposal of sensitive personal information shall be penalized by imprisonment ranging from one (1) year to three (3) years and a fine of not less than One hundred thousand pesos (Php100,000.00) but not more than One million pesos (Php1,000,000.00) shall be imposed on persons who knowingly or negligently dispose, discard or abandon the personal information of an individual in an area accessible to the public or has otherwise placed the personal information of an individual in its container for trash collection.

SEC. 28. Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes. –

• The processing of personal information for unauthorized purposes shall be penalized by imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00) shall be imposed on persons processing personal information for purposes not authorized by the data subject, or otherwise authorized under this Act or under existing laws.

The processing of sensitive personal information for unauthorized purposes shall be penalized by imprisonment ranging from two (2) years to seven (7) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00) shall be imposed on persons processing sensitive personal information for purposes not authorized by the data subject, or otherwise authorized under this Act or under existing laws.

SEC. 29. Unauthorized Access or Intentional Breach. –

• The penalty of imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00) shall be imposed on persons who knowingly and unlawfully, or violating data confidentiality and security data systems, breaks in any way into any system where personal and sensitive personal information is stored.

SEC. 30. Concealment of Security Breaches Involving Sensitive Personal Information. –

• 1.5 years to 5 years imprisonment
• P500k to P1m fine on persons who fails to notify the Commission of a security breach Section 20(f) or intentionally or by omission conceals such security breach.

SEC. 31. Malicious Disclosure. – Any personal information controller or personal information processor or any of its officials, employees or agents, who, with malice or in bad faith, discloses unwarranted or false information relative to any personal information or personal sensitive information obtained by him or her, shall be subject to imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).

SEC. 32. Unauthorized Disclosure. – (a) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party personal information not covered by the immediately preceding section without the consent of the data subject, shall he subject to imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).

(b) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party sensitive personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from three (3) years to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00).

SEC. 33. Combination or Series of Acts. – Any combination or series of acts as defined in Sections 25 to 32 shall make the person subject to imprisonment ranging from three (3) years to six (6) years and a fine of not less than One million pesos (Php1,000,000.00) but not more than Five million pesos (Php5,000,000.00).

SEC. 34. Extent of Liability. – If the offender is a corporation, partnership or any juridical person, the penalty shall be imposed upon the responsible officers who were negligent.

• If the offender is a juridical person, the court may suspend or revoke any of its rights under this Act.
• If the offender is an alien, he or she shall, in addition to the penalties herein prescribed, be deported without further proceedings after serving the penalties prescribed.
• If the offender is a public official or employee and lie or she is found guilty of acts penalized under Sections 27 and 28 of this Act, he or she shall, in addition to the penalties prescribed herein, suffer perpetual or temporary absolute disqualification from office, as the case may be.

SEC. 35. Large-Scale. – The maximum penalty in the scale of penalties respectively provided for the preceding offenses shall be imposed when the personal information of at least one hundred (100) persons is harmed, affected or involved as the result of the above mentioned actions.

SEC. 36. Offense Committed by Public Officer. – When the offender is a public officer, he will be disqualified from public office for double the term of criminal penalty imposed

SEC. 37. Restitution. – Restitution for any aggrieved party shall be governed by the provisions of the New Civil Code.

CHAPTER 9: MISCELLANEOUS PROVISIONS

SEC. 38. Interpretation. – Any doubt in the interpretation of any provision of this Act shall be liberally interpreted in a manner mindful of the rights and interests of the individual about whom personal information is processed.

SEC. 39. Implementing Rules and Regulations (IRR). – Within ninety (90) days from the effectivity of this Act, the Commission shall promulgate the rules and regulations to effectively implement the provisions of this Act.

SEC. 40. Reports and Information. – The Commission shall annually report to the President and Congress on its activities in carrying out the provisions of this Act.

• The Commission shall undertake whatever efforts it may determine to be necessary or appropriate to inform and educate the public of data privacy, data protection and fair information rights and responsibilities.

SEC. 41. Appropriations Clause. – The Commission shall have P20m from the national government, afterwards will get money from the budget.

• It shall receive P10m /year  for  5 years from the national government.

SEC. 42. Transitory Provision. – Everyone affected by this will have 1 year from the effectivity of the IRR to comply

SEC. 43. Separability Clause

SEC. 44. Repealing Clause. – This amends Section 7 of Republic Act No. 9372 or the “Human Security Act of 2007”

SEC. 45. Effectivity Clause