General Data Privacy Principles | R.A. No.10173 or the Data Privacy Act | OTHER SPECIAL LAWS AND RULES

Under Republic Act No. 10173, known as the Data Privacy Act of 2012 (DPA), the Philippines has established a comprehensive framework for the protection of personal data. Enforced by the National Privacy Commission (NPC), the Act mandates adherence to specific principles to secure and manage personal information in both the public and private sectors. Here is a detailed breakdown of the General Data Privacy Principles as set out in the DPA:

1. Principle of Transparency

• Definition: Transparency requires that data subjects (individuals whose data is collected) are fully informed of how their personal information will be processed, including the purpose, nature, and extent of the data collection, use, retention, and sharing.
• Key Requirements:
  • Notice to Data Subjects: Organizations must notify individuals when their data is collected, explaining the purposes and conditions of the collection and use. This notice should be written in a clear, accessible manner.
  • Consent: Consent must be given freely by the data subject, with sufficient knowledge of the purpose, extent, and risks involved.
  • Accessibility of Information: Information on how data is handled must be accessible, allowing individuals to understand and inquire about data processing activities.

2. Principle of Legitimate Purpose

• Definition: Legitimate purpose mandates that the processing of personal data must be for a purpose that is declared, specified, and lawful.
• Key Requirements:
  • Purpose Specification: The specific purpose of data collection and processing should be explicitly stated to the data subject before or at the point of collection.
  • Lawfulness: Data collection and processing must not only meet business or organizational needs but also comply with legal standards. The purpose must align with the laws and regulations applicable to the data subject and the organization.

3. Principle of Proportionality

• Definition: The principle of proportionality ensures that the collection and processing of personal data are relevant, suitable, and limited to what is necessary for the purpose specified.
• Key Requirements:
  • Data Minimization: Only the data necessary to fulfill the specific, legitimate purpose should be collected. This principle discourages the excessive or unnecessary collection of data.
  • Limitation of Processing: Data should be processed only within the bounds of necessity and reasonableness for achieving the intended purpose.
  • Retention Period: Personal data should not be retained longer than necessary. The organization should have policies on data retention and disposal to enforce this principle.

4. Data Privacy Rights of Data Subjects

The Act grants several rights to data subjects, empowering them to have control over their personal information:

• Right to Be Informed: Individuals have the right to know if their personal information is being processed, the extent of processing, and any possible recipients of their data.
• Right to Object: Data subjects may object to the processing of their data in certain circumstances, such as for direct marketing purposes.
• Right to Access: Individuals have the right to access their personal information held by the data controller, and to receive copies if requested.
• Right to Rectification: Data subjects can request corrections to inaccurate or incomplete data.
• Right to Erasure or Blocking: Individuals can request the deletion or blocking of data in cases where it is unlawfully processed or no longer needed.
• Right to Data Portability: This right allows data subjects to obtain a copy of their data in an electronic or structured format, facilitating the transfer to another service provider.
• Right to Lodge a Complaint: Data subjects may file a complaint with the NPC if they believe their data privacy rights have been violated.

5. Obligations of Data Controllers and Data Processors

• Data Controllers (the entities deciding on data processing) and Data Processors (those processing on behalf of data controllers) have legal responsibilities to implement measures to protect data privacy.
• Organizational, Physical, and Technical Measures: The DPA requires organizations to adopt appropriate safeguards against unauthorized access, use, and disclosure of data.
  • Organizational: Policies, procedures, and staff training.
  • Physical: Secure storage facilities and controlled access.
  • Technical: Encryption, firewalls, and other data security technologies.

6. Data Protection Officers (DPOs)

Organizations handling significant volumes of personal data must appoint a Data Protection Officer (DPO). The DPO is responsible for overseeing data protection strategy, ensuring compliance, and acting as the primary point of contact with the NPC.

7. NPC Oversight and Regulatory Framework

• Role of the NPC: The National Privacy Commission is tasked with enforcing the Data Privacy Act, promoting awareness, issuing advisories, conducting compliance checks, and addressing complaints. It also provides guidelines on the implementation of the DPA.
• Sanctions and Penalties: Violations of the DPA can lead to fines and penalties, ranging from monetary penalties to imprisonment. Examples of violations include unauthorized processing, negligence in securing data, and intentional breaches of confidentiality.

8. Data Breach Notification

Under the DPA, organizations must notify both the data subject and the NPC of data breaches within 72 hours of detection. This requirement is essential for breaches involving sensitive personal information that could harm the rights and interests of the data subjects.

Notification Requirements:

• Content: The notification should detail the breach, the potential impact, and remedial actions taken.
• Security Measures: Organizations should have incident response and breach management plans to swiftly address data breaches.

9. International Data Transfer

The transfer of data outside the Philippines is restricted under the DPA. Data controllers must ensure that data transferred internationally is handled with adequate protection measures in accordance with the Act.

Conditions for International Transfers:

• Adequate Safeguards: Transfers are permissible if the recipient country has adequate data protection laws, or if the organization has binding corporate rules or standard contractual clauses ensuring data protection.
• Data Subject’s Consent: In cases where adequate safeguards cannot be established, consent from the data subject may be obtained, provided they are fully informed of the associated risks.

Summary

The Data Privacy Act of 2012 mandates that all organizations handling personal data in the Philippines adhere to strict principles of transparency, legitimate purpose, and proportionality, along with robust safeguards to protect data subjects’ rights. Compliance with these principles is essential, and organizations must appoint Data Protection Officers, report data breaches, and adhere to both local and international data transfer standards.