ETHICS PSYCH DATA PRIVACY

The whole Act in one breath

Anyone who handles personal information must have a lawful basis, a declared purpose, and proper security. People whose data is handled (data subjects) have enforceable rights. The National Privacy Commission (NPC) enforces the Act, and violations carry prison time and fines. Sensitive personal information (health, education, and more) gets stricter rules and heavier penalties.

Sec. 2 policy

balances two goals: protecting the human right to privacy and communication, and keeping information flowing to support innovation and growth.

Data subject

the individual

Controller (PIC)

decides how and why

Processor (PIP)

outsourced handling

National Privacy Commission (NPC)

oversees, investigates, penalizes

Sec. 21 accountability of the controller

The controller stays accountable even for data a processor or third party handles (Sec. 21).

Not a "controller"

someone acting only on another's instructions, or an individual handling data for personal, family or household affairs.

Consent (Sec. 3)

Freely given, specific, informed indication of will; evidenced by written, electronic or recorded means; may be given by an agent specifically authorized by the data subject.

Personal information (Sec. 3)

Any information, recorded or not, from which identity is apparent or can be reasonably and directly ascertained by the holder, or which, combined with other information, would directly and certainly identify a person.

Processing (Sec. 3)

Any operation on personal information: collection, recording, organization, storage, updating, retrieval, consultation, use, consolidation, blocking, erasure, destruction.

Privileged information (Sec. 3)

Data that counts as privileged communication under the Rules of Court and other laws.

Filing system (Sec. 3)

Structured set (even manual) where information about a person is readily accessible.

Personal information (examples and rule)

Any information that identifies a person, such as name, contact details, photo. Lawful processing needs one ground under Sec. 12.

Sensitive personal information (SPI): Sec. 3(l) first group

Race, ethnic origin, marital status, age, color, religious, philosophical or political affiliations

Sensitive personal information (SPI): Sec. 3(l) second group

Health, education, genetic or sexual life; any offense proceeding, its disposal or sentence

Sensitive personal information (SPI): Sec. 3(l) third group

Government-issued identifiers peculiar to a person: SSS numbers, health records, licenses and their denial or revocation, tax returns

Sensitive personal information (SPI): Sec. 3(l) fourth group

Information classified by executive order or an act of Congress

Rule for processing SPI (Sec. 13)

Processing is prohibited unless an exception applies.

Scope of the Act (Secs. 4-6)

Applies to all types of personal information and to any natural or juridical person involved in processing. It reaches controllers and processors not established in the Philippines if they use equipment located here or keep an office, branch or agency here.

Sec. 4(a) — does not apply to

Government officer or employee information tied to the position or function (title, office address, salary range, responsibilities, name on documents they prepared)

Sec. 4(b) — does not apply to

Government contractors: services performed and contract terms

Sec. 4(c) — does not apply to

Discretionary financial benefits such as licenses or permits (name and nature of benefit)

Sec. 4(d) — does not apply to

Information processed for journalistic, artistic, literary or research purposes

Sec. 4(e) — does not apply to

Information needed for public authority functions (central monetary authority, law enforcement, regulators); bank secrecy and credit information laws not repealed

Sec. 4(f) — does not apply to

Bank and financial institution compliance (AMLA and related laws)

Sec. 4(g) — does not apply to

Data of foreign residents collected under foreign law and merely processed here

Extraterritorial application (Sec. 6): (a)

The data concerns a Philippine citizen or resident

Extraterritorial application (Sec. 6): (b)

The entity has a link here, such as a contract entered in the Philippines, central management and control here, or a Philippine branch whose foreign parent can access the data

Extraterritorial application (Sec. 6): (c)

Other links: it carries on business here, or the data was collected or held by an entity here.

Sec. 5

keeps the journalist-source protection of RA 53 intact.

Nature and leadership of the NPC (Secs. 7-10)

independent body attached to the DICT. Led by a Privacy Commissioner (also Chairman), assisted by two Deputy Commissioners (Data Processing Systems; Policies and Planning). Three-year terms, one reappointment, appointed by the President.

Key functions of the NPC (Sec. 7)

ensure compliance; receive complaints, investigate, mediate, adjudicate and award indemnity; issue cease and desist orders and processing bans (national security or public interest); monitor government agencies; review privacy codes; issue advisory opinions; recommend prosecution to the DOJ for Secs. 25-29 offenses.

Sec. 8

the NPC must keep any personal information it receives confidential.

Sec. 10

Secretariat staff are mostly drawn from agencies that handle personal data (SSS, GSIS, LTO, BIR, PhilHealth, COMELEC, DFA, DOJ, Philpost).

Sec. 11 principle: Transparency

The data subject knows what is collected, why, and how it is used.

Sec. 11 principle: Legitimate purpose

Purpose is specified, declared and lawful; later use must stay compatible with it.

Sec. 11 principle: Proportionality

Data is adequate, relevant and not excessive for the purpose.

Sec. 11 requires personal information to be

(a) collected for declared, legitimate purposes; (b) processed fairly and lawfully; (c) accurate and kept up to date, with inaccurate data rectified or destroyed; (d) adequate and not excessive; (e) retained only as long as necessary (or for legal claims, legitimate business purposes, or as the law provides); (f) identifiable for no longer than necessary, except historical, statistical or scientific processing with safeguards. The controller must ensure these principles are implemented.

Sec. 12: processing ordinary personal information is allowed if at least one applies

(a) Data subject's consent; (b) Needed for a contract with the subject (or pre-contract steps they requested); (c) Legal obligation of the controller; (d) Protect vitally important interests, including life and health; (e) National emergency, public order and safety, or public authority functions; (f) Legitimate interests of the controller or a third party, unless overridden by the subject's constitutional rights and freedoms

Sec. 13(a)

Consent specific to the purpose, given before processing; for privileged information, all parties to the exchange consent

Sec. 13(b)

A law or regulation provides for it and protects the data

Sec. 13(c)

Protect life and health of the subject or another person, and the subject cannot legally or physically consent

Sec. 13(d)

Lawful, noncommercial aims of public organizations, limited to bona fide members, no transfer to third parties, consent obtained

Sec. 13(e)

Medical treatment by a medical practitioner or institution, with adequate protection

Sec. 13(f)

Legal claims, court proceedings, or provision to government or public authority

The gap between Sec. 12 and Sec. 13

ordinary data has six alternative lawful bases, including legitimate interests; sensitive data does not, and consent must be prior and purpose-specific.

Subcontracting (Sec. 14)

A controller may outsource processing but must ensure safeguards for confidentiality, prevent unauthorized use, and ensure compliance. The processor must also comply with the Act.

Privileged communication (Sec. 15)

Controllers may invoke privilege over privileged information they lawfully control or process. Subject to existing law, evidence gathered on privileged information is inadmissible.

Data subject right: Be informed

Whether data is, will be or was processed, plus what, why, scope and method, recipients, controller identity, storage period (16(a)-(b)).

Data subject right: Access

On demand: contents, sources, recipients, manner and reasons for disclosure, automated decisions, last access and modification dates (16(c)).

Data subject right: Correct

Dispute inaccuracy; controller corrects immediately unless vexatious. Third-party recipients informed on reasonable request (16(d)).

Data subject right: Suspend, withdraw, block, remove

With substantial proof data is incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes, or no longer necessary (16(e)).

Data subject right: Be indemnified

For damages from inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use (16(f)).

Data subject right: Lodge a complaint

Before the NPC (listed within 16(b)(8)).

Data portability (Sec. 18)

Obtain a copy of electronically processed data in a structured, commonly used format.

Transmissibility (Sec. 17)

Lawful heirs and assigns may invoke these rights after the subject's death or incapacity.

Limits on the 16(b) notice requirement

The notice requirement in 16(b) is relaxed for subpoenas, obvious purposes (contract or service, employer-employee context), and legal obligations.

Sec. 19

the rights do not apply where data is used only for scientific and statistical research, no activities are carried out and no decisions are taken about the subject, and the data is held under strict confidentiality for the declared purpose. They also do not apply to data gathered for criminal, administrative or tax investigations.

Security duty (Sec. 20)

reasonable and appropriate organizational, physical and technical measures against accidental or unlawful destruction, alteration, disclosure and other unlawful processing; protection from natural dangers and human dangers.

Level of security under Sec. 20 depends on

the nature of the data, risks, organization size, best practices and cost. Minimum measures: network safeguards, a security policy, a process to identify vulnerabilities and act on them, and regular breach monitoring.

Third-party processors and staff under Sec. 20

Third-party processors must apply the same measures. Staff must keep data confidential even after leaving the job or contract (20(e)).

Breach notification trigger (Sec. 20(f))

SPI or information usable for identity fraud is reasonably believed acquired by an unauthorized person AND the controller or the NPC believes it is likely to give rise to a real risk of serious harm

Breach notification duty (Sec. 20(f))

Promptly notify the NPC and affected data subjects. Describe the nature of the breach, the SPI possibly involved, and the measures taken.

When notification may be delayed (Sec. 20(f))

Delay only as needed to determine scope, prevent further disclosure, or restore system integrity

NPC discretion over breach notification

May weigh controller compliance and good faith; may exempt notification if not in the public interest or the subjects' interests; may postpone it if it would hinder a criminal investigation.

Hiding a breach

Intentional or by-omission concealment of a breach you must report is its own offense (Sec. 30).

Sec. 21

the controller is responsible for data under its control or custody, including data transferred to a third party domestically or internationally. It must use contractual or other reasonable means for comparable protection and designate an accountable individual (identity disclosed to a data subject on request).

Secs. 22-23

government SPI is secured to the most appropriate industry standard. Agency staff need security clearance; off-site access needs approval by the agency head (decision within 2 business days; silence means disapproval), is limited to 1,000 records at a time, and requires the strongest recognized encryption.

Sec. 24

government contractors accessing SPI of 1,000 or more individuals must register their processing system with the NPC and comply.

Sec. 25(a)

Processing without consent, PI — 3 yrs max | 1-3 yrs; 500k-2M

Sec. 25(b)

Processing without consent, SPI — 6 yrs max | 3-6 yrs; 500k-4M

Sec. 26(a)

Negligent access, PI — 3 yrs max | 1-3 yrs; 500k-2M

Sec. 26(b)

Negligent access, SPI — 6 yrs max | 3-6 yrs; 500k-4M

Sec. 27(a)

Improper disposal, PI — 2 yrs max | 6 mos-2 yrs; 100k-500k

Sec. 27(b)

Improper disposal, SPI — 3 yrs max | 1-3 yrs; 100k-1M

Sec. 28 (PI)

Unauthorized purpose, PI — 5 yrs max | 1.5-5 yrs; 500k-1M

Sec. 28 (SPI)

Unauthorized purpose, SPI — 7 yrs max | 2-7 yrs; 500k-2M

Sec. 29

Unauthorized access / breach-in — 3 yrs max | 1-3 yrs; 500k-2M

Sec. 30

Concealing a breach (SPI) — 5 yrs max | 1.5-5 yrs; 500k-1M

Sec. 31

Malicious disclosure — 5 yrs max | 1.5-5 yrs; 500k-1M

Sec. 32(a)

Unauthorized disclosure, PI — 3 yrs max | 1-3 yrs; 500k-1M

Sec. 32(b)

Unauthorized disclosure, SPI — 5 yrs max | 3-5 yrs; 500k-2M

Sec. 33

Combination or series of acts — 6 yrs max | 3-6 yrs; 1M-5M

Sec. 35

maximum penalty when data of at least 100 persons is affected.

Sec. 34

for organizations, liability falls on responsible officers who took part in, or by gross negligence allowed, the crime; the court may suspend or revoke the entity's rights under the Act; alien offenders are deported after serving the sentence; public officials guilty under Secs. 27-28 also face disqualification from office.

Sec. 36

public officer offenders get an added disqualification from public office for double the criminal term.

Sec. 37

restitution follows the New Civil Code.

Offense cheat sheet: 25

processing without consent or authority

Offense cheat sheet: 26

giving access through negligence

Offense cheat sheet: 27

improper disposal (trash, public areas)

Offense cheat sheet: 28

processing for unauthorized purposes

Offense cheat sheet: 29

unauthorized access or intentional breach

Offense cheat sheet: 30

concealing a breach

Offense cheat sheet: 31

malicious disclosure (false or unwarranted information, with malice or bad faith)

Offense cheat sheet: 32

unauthorized disclosure to a third party

Sec. 38

doubts are interpreted liberally in favor of the individual whose data is processed.

Secs. 39-42

Sec. 39: IRR within 90 days. Sec. 42: one-year transition from IRR effectivity (or as the NPC decides). Sec. 40: annual report to the President and Congress and public education. Sec. 41: Php20M initial appropriation plus Php10M a year for five years.

Sec. 44

amends Sec. 7 of the Human Security Act of 2007.

Sec. 45

effective 15 days after publication in at least two national newspapers.