'Most Innovative Startup 2020' by RSA - Watch the videoLearn More
Influenced by the European Union Data Protection Directive (95/46/EC), the Philippines passed the Data Privacy Act 2012 Republic Act. No, 10173 (the "DPA") in 2012. The purpose of the DPA is to provide rights to individuals for their enhanced control over their personal information while ensuring a free flow of information to promote innovation and growth in the Philippines. The National Privacy Commission (the “NPC''), which was established under the DPA in 2016, issued Implementing Rules and Regulations of the Republic Act. No, 10173 (the “IRRs or IRR” ). The IRRs provide comprehensive details related to lawful basis of processing, data subjects’ rights, organizations’ obligations while processing the personal information of individuals, and layout penalties for organizations in case of non-compliance with the DPA and its IRRs. Under the DPA, the purpose of the collection of personal information should be ‘legitimate’, and processing must be both ‘lawful’ and ‘fair’.
The DPA is applicable to ‘the processing of all types of personal information and to any natural and juridical person involved in personal information processing’. It covers the processing of personal information in both public and private sectors with the following exemptions:
The DPA applies to any entity whether in the Philippines or outside of the Philippines if:
It includes any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information or when put together with other information would directly and certainly identify an individual.
It refers to a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.
It includes personal information about an individual’s race, ethnic origin, marital status, age, colour, and religious, philosophical or political affiliations, individual’s health, education, the genetic or sexual life of a person, or personal information related to any proceeding for any offence committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; tax returns, social security number and any other government-sanctioned classified information about a person.
Personal information processor refers to any natural or juridical person to whom a PIC may outsource the processing of personal data pertaining to a data subject.
Information: Data subjects have the right to be informed when personal information related to them is being processed by the PIC (the data controller) or PIP (the data processor).
Erasure: Data subjects can request the PIC to delete, remove, or destruct their personal data from their personal information filling system.
Object: Data subjects have the right to object to their personal information being processed by the PIC, including processing for direct marketing, automated processing, or processing for profiling.
Rectification: Data subjects have the right to request the rectification of their incomplete and/or inaccurate personal information held by the PIC.
Access: Data subjects have the right to access their personal information held by the personal information controller.
Portability: Data subjects have the right to request a copy of their personal information in an electronic or structured format from the personal informational controller.
Indemnification: Data subjects have the right to be indemnified for damages sustained due to inaccurate, incomplete, false, unlawfully obtained, or unauthorized use of personal information by the PIC.
Complain: Data subjects have the right to file a complaint against the personal information controller before the NPC.
Non-compliance with the DPA, its IRRs and any issuances of the NPC can lead to the administrative, civil and criminal liabilities. It can result in imprisonment of six months to seven years, with fines ranging from PHP 100,000 to PHP 5 million that depends on which type of personal information is involved. The DPA has provided detailed penalties for unauthorized processing of personal information and sensitive personal information, improper disposal of personal information, processing for unauthorized purposes, intentional breach, concealment of a security breach, malicious disclosure, and other offences pursuant to the DPA and its IRRs.
The DPA also prescribes that if the offender is a corporation, partnership, or any other juridical person, the penalty shall be imposed upon the responsible officers who participated in, or by their gross negligence, allowed the commission of the crime.
The multi-disciplinary practice to grow trust-equity of your brand and comply with privacy regulations.Get the Book
“By leveraging the PrivacyOps constructs from this book across our organization we were able to not only save time and money but also mitigate the risks associated with manual methods of privacy management.”
- Marty Collins, Chief Privacy and Legal Officer, QuinStreet, Inc
Given the complex obligations for the organisations to manage the disclosure, access, rectification and other requests of the data subjects, ensuring the effective security measures and other compliance requirements, complying with the DPA and its IRRs can be very labour-intensive and costly. Securiti automation helps you with swift and efficient compliance with the DPA and its IRRs as well as other data privacy regulation.
Securiti is the leader in AI-powered PrivacyOps and data governance. Similar to DevOps for software, PrivacyOps reimagines how to implement privacy management throughout an organisation efficiently.
Securiti is a recognized innovator in this market, having been awarded "Most Innovative Startup" at RSA Conference 2020, and Leader in the Forrester Wave: Privacy Management Software. Securiti PrivacyOps solution uniquely combines real-time data intelligence harnessing bot and AI technology with full workflow automation of all the major privacy compliance functions.