Securiti launches Gencore AI, a holistic solution to build Safe Enterprise AI with proprietary data - easily

View
Contact Us See a demo

Overview of Philippines Republic Act 10173

Philippines DPA banner
By Anas Baig | Reviewed By Muhammad Faisal Sattar
Published February 22, 2021 / Updated May 10, 2024

Listen to the content

Influenced by the European Union Data Protection Directive (95/46/EC), the Philippines passed the Data Privacy Act 2012 Republic Act. No, 10173 (the "DPA") in 2012. The purpose of the DPA is to provide rights to individuals for their enhanced control over their personal information while ensuring a free flow of information to promote innovation and growth in the Philippines. The National Privacy Commission (the “NPC''), which was established under the DPA in 2016, issued Implementing Rules and Regulations of the Republic Act. No, 10173 (the “IRRs or IRR” ). The IRRs provide comprehensive details related to lawful basis of processing, data subjects’ rights, organizations’ obligations while processing the personal information of individuals, and layout penalties for organizations in case of non-compliance with the DPA and its IRRs. Under the Philippines DPA, the purpose of the collection of personal information should be ‘legitimate’, and processing must be both ‘lawful’ and ‘fair’.

Scope and Application

The Philippines Data Protection Act is applicable to ‘the processing of all types of personal information and to any natural and juridical person involved in personal information processing’. It covers the processing of personal information in both public and private sectors with the following exemptions:

  • Processing of information in connection with an individual’s personal, family, or household affairs
  • Information about a person’s position or functions as a government employee, and similar information about the performance of government contracts, and information ‘relating to any discretionary benefit of a financial nature such as the granting of a [government] license or permit’
  • Personal information processed for journalistic, artistic, literary, or research purposes
  • Personal information used only for the needs of scientific and statistical research and, on the basis of such, no activities are carried out and no decisions are taken regarding the data subject.’
  • Personal information necessary in order to carry out the functions of public authority
  • Personal information necessary for banks to carry out obligations under various money-laundering laws

The DPA applies to any entity whether in the Philippines or outside of the Philippines if:

  • The entity deals with personal information about a Philippine citizen or resident; and
  • The entity ‘has a link with the Philippines’ including a contract entered into in the Philippines, or a business not incorporated in the Philippines but with its central management there, or where overseas parents or affiliate of Philippines business entities have ‘access to personal information’ (presumably about Filipinos); and
  • The entity has other links in the Philippines’ (including carrying on business in the Philippines or the personal information was collected in the Philippines).
Philippines DPA Scope

Definition of Key Terms

What is CCPA

Personal Information

It includes any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information or when put together with other information would directly and certainly identify an individual.

What is CCPA

Personal Information Controller (the “PIC”)

It refers to a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.

What is CCPA

Sensitive Personal Information

It includes personal information about an individual’s race, ethnic origin, marital status, age, colour, and religious, philosophical or political affiliations, individual’s health, education, the genetic or sexual life of a person, or personal information related to any proceeding for any offence committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; tax returns, social security number and any other government-sanctioned classified information about a person.

What is CCPA

Personal information Processor (the “PIP”)

Personal information processor refers to any natural or juridical person to whom a PIC may outsource the processing of personal data pertaining to a data subject.

Data Subject Rights under the DPA

Information: Data subjects have the right to be informed when personal information related to them is being processed by the PIC (the data controller) or PIP (the data processor).

Erasure: Data subjects can request the PIC to delete, remove, or destruct their personal data from their personal information filling system.

Object: Data subjects have the right to object to their personal information being processed by the PIC,  including processing for direct marketing, automated processing, or processing for profiling.

Rectification: Data subjects have the right to request the rectification of their incomplete and/or inaccurate personal information held by the PIC.

Access: Data subjects have the right to access their personal information held by the personal information controller.

Portability: Data subjects have the right to request a copy of their personal information in an electronic or structured format from the personal informational controller.

Indemnification: Data subjects have the right to be indemnified for damages sustained due to inaccurate, incomplete, false, unlawfully obtained, or unauthorized use of personal information by the PIC.

Complain: Data subjects have the right to file a complaint against the personal information controller before the NPC.

Organizations’ Obligations under the DPA

 

  • Organizations that process personal information under the DPA are required to adhere to the principles of transparency, legitimate purpose and proportionality. The PIC is obliged to comply with the DPA, its IRRs and any guidelines issued by the NPC.
  • Organisations are required to collect the consent of data subjects prior to the processing of personal information.
  • The PIC must implement reasonable and appropriate organizational, physical and technical measures for the protection of personal information against any accidental, natural or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.
  • The PIC is also required to ensure that third parties processing personal information on their behalf should also implement security measures.
  • The PIC is responsible for personal information under its control or custody, including information that has been transferred to a third party for processing, whether domestically or internationally, subject to cross-border arrangement and cooperation.
  • The DPA necessitates that organisations should have a personal information privacy program in place to implement and review procedures for the collection of personal data and consent, fulfilling data subject requests, data access management, and data retention policies.

Non Compliance Risks and Penalties

Non-compliance with the DPA, its IRRs and any issuances of the NPC can lead to the administrative, civil and criminal liabilities. It can result in imprisonment of six months to seven years, with fines ranging from PHP 100,000 to PHP 5 million that depends on which type of personal information is involved.  The DPA has provided detailed penalties for unauthorized processing of personal information and sensitive personal information, improper disposal of personal information, processing for unauthorized purposes, intentional breach, concealment of a security breach, malicious disclosure, and other offences pursuant to the DPA and its IRRs.

The DPA also prescribes that if the offender is a corporation, partnership, or any other juridical person, the penalty shall be imposed upon the responsible officers who participated in, or by their gross negligence, allowed the commission of the crime.

Privacy ops blue ebook banner

Automating privacy operations across your organization

The multi-disciplinary practice to grow trust-equity of your brand and comply with privacy regulations.

Get the Book

“By leveraging the PrivacyOps constructs from this book across our organization we were able to not only save time and money but also mitigate the risks associated with manual methods of privacy management.”

- Marty Collins, Chief Privacy and Legal Officer, QuinStreet, Inc

How Securiti Can help?

Given the complex obligations for the organisations to manage the disclosure, access, rectification and other requests of the data subjects, ensuring the effective security measures and other compliance requirements, complying with the DPA and its IRRs can be very labor-intensive and costly. Securiti automation helps you with swift and efficient compliance with the DPA and its IRRs as well as other data privacy regulation.

Securiti is the leader in AI-powered PrivacyOps and data governance. Similar to DevOps for software, PrivacyOps reimagines how to implement privacy management throughout an organisation efficiently.

Securiti is a recognized innovator in this market, having been awarded "Most Innovative Startup" at RSA Conference 2020, and Leader in the Forrester Wave: Privacy Management Software. Securiti PrivacyOps solution uniquely combines real-time data intelligence harnessing bot and AI technology with full workflow automation of all the major privacy compliance functions.

Frequently Asked Questions (FAQs)

DPA stands for the Data Privacy Act of 2012, a law in the Philippines that governs the protection of personal data and the privacy rights of individuals.

The Data Privacy Act of the Philippines specifies penalties for violations, including fines and imprisonment, depending on the nature and severity of the breach.

PDPA stands for the Personal Data Protection Act. It's a term used in various countries to refer to laws that regulate the processing and protection of personal data.

Data Protection Act (DPA) regulations are laws that establish rules and principles for the collection, use, processing, and protection of personal data, intending to safeguard individuals' privacy rights.

The Data Protection Act establishes guidelines for how organizations handle personal data, including how it's collected, processed, stored, and shared. It grants individuals certain rights and sets out obligations for data controllers and processors.

Join Our Newsletter

Get all the latest information, law updates and more delivered to your inbox

Share

More Stories that May Interest You

china CSL banner View More

October 30, 2024

What is China’s Cybersecurity Law

Learn What is China's Cybersecurity Law (CSL) and what are the key requirements for drafting comprehensive legal frameworks that protect individuals' personal data online.

An Overview of Australia’s Privacy and Other Legislation Amendment Bill 2024 View More

October 25, 2024

An Overview of Australia’s Privacy and Other Legislation Amendment Bill 2024

Explore the major reforms to the Privacy Act 1988 brought by the Australian Government’s Privacy and Other Legislation Amendment Bill 2024.

Overview of Austria’s DSB View More

October 24, 2024

An Overview of Austria’s DSB FAQs Addressing AI and Data Protection

Gain insights into the recently released frequently asked questions (FAQs) on AI and data protection by Austria’s data protection authority (Datenschutzbehörde, DSB).

What's
New