Privacy & Information Security Law Blog

This post has been updated. 

On June 17, 2016, the National Privacy Commission (the “Commission”) of the Philippines released draft guidelines entitled, Implementing Rules and Regulations of the Data Privacy Act of 2012 (“IRR”), for public consultation.

Under the IRR, the processing of personal data has to adhere to the principles of transparency, legitimate purpose and proportionality. The IRR defines personal data as personal information, sensitive information and privileged information. Sensitive information refers to personal information about an individual’s race, ethnicity, health, education, genetic or sexual life of a person, proceedings related to an offense committed by a person, health records and tax returns. According to the IRR, the personal information controller should take organizational, physical and technical security measures for data protection. Such security measures include the designation of a privacy officer, limitations on physical access and the adoption of technical and logical security measures.

The IRR stipulates general principles for data sharing. According to the IRR, in order to conduct lawful processing of personal data, the data subject must have given his or her consent prior to collection. Consent of the data subject has to be evidenced by written, electronic or recorded means. The IRR also specifies information that is not subject to the Data Privacy Act, such as information of a governmental officer that relates to his or her position or functions.

Under the IRR, the basic rights enjoyed by data subjects include rights to be informed, to object, of access, of correction, of rectification, erasure or blocking and to damages. The Commission and affected data subjects should be notified within 24 hours upon the knowledge of or reasonable belief that a security breach has occurred. The IRR also includes registration and compliance requirements, including a requirement to register data processing systems operating in the country.

The IRR stipulates penalties for unauthorized processing of personal information, improper disposal of personal information, unauthorized disclosure and other violations. Violations of the Data Privacy Act, the IRR and other orders may be subject to cease and desist orders, temporary or permanent bans on the processing of personal data and the imposition of fines.

The Data Privacy Act established the Commission earlier this year as an independent body to monitor and ensure the compliance of personal information controllers with international standards for data protection. The IRR specifies the functions, organizational structure and other details of the Commission. For example, the function of the Commission includes (1) making rules such as issuing guidelines for data protection and proposing legislation on privacy or data protection, (2) performing compliance and monitoring functions to ensure effective implementation of the Data Privacy Act, and (3) adjudicating on complaints and investigations of violations of the rights of data subjects.

The IRR also includes provisions on other issues such as data privacy and security in government, outsourcing and subcontracting of personal data.

The IRR contains some provisions that add new requirements going beyond those of the original text. These can vary from, or have potential to be more burdensome on enterprises than, the original requirements. Described below are some of the provisions:

• The IRR defines “personal data” and “personal information” as two separate terms. “Personal information” is defined as the abstract information itself, while “personal data” is personal information that has been inputted into an information and communication system (which presumably means a computer system), and therefore has presumably been digitally and electronically formatted.
• In addition to personal information that has been electronically formatted, the term “personal data” also includes “sensitive information” and “privileged information.”
• The IRR expounds upon a provision in the original requirements that says when personal information has been collected in a foreign jurisdiction for processing in the Philippines, the data privacy laws of the foreign jurisdiction will apply in relation to the collection of personal information, but the Data Privacy Act will apply to processing that takes place within the Philippines.
• The IRR requires that sharing of personal data in the private sector proceeds according to a data sharing agreement which is subject to the review of the Commission.
• The IRR imposes some potentially elaborate and time-consuming rules on internal organizational operations and structure, such as the requirements to (1) appoint a privacy officer, (2) implement capacity-building, orientation and training programs in relation to privacy and security, and (3) carry out system monitoring.
• The IRR gives the data subject an additional right to object or withhold consent to further processing. This appears to be a new right that did not appear in the original requirements.
• The IRR requires notification of a data breach within 24 hours under normal circumstances, though notification may be delayed in some circumstances.
• The IRR materially expands the circumstances under which a breach notification must be made. In effect, the IRR now requires notification for any security breach that involves personal, sensitive or privileged information.
• The IRR now requires registration of data processing operations and data processing systems, and requires that the Commission be notified of any wholly or partly automatic processing operations.
• In relation to the accountability principle, the IRR expressly establishes the potential for joint liability, along with the personal information controller, on the part of personal information processors, privacy officers, employees and agents. It also establishes the possibility of criminal liability.

Comments on the IRR should be sent by July 15, 2016, to the Commission at info@privacy.gov.ph.