REPUBLIC of the PHILIPPINES

RA 10173
DATA PRIVACY ACT of 2012

INTRODUCTION to
DATA PRIVACY ACT
LAYERTECH SOFTWARE LABS
REV: January 2017

THIS PRESENTATION IS CREATED by LAYERTECH SOFTWARE LABS and

MAY NOT BE USED or REPRODUCED WITHOUT CONSENT OF LAYERTECH.
 DISCLAIMER
This presentation is based on Republic Act 10173 or Data Privacy Act of 2012 of the
Republic of the Philippines, created by Layertech Software Labs for its employees and is
made FREE to anyone who wish to use it for educational and awareness purposes. Layertech
used creative illustrations and diagrams to make the topic as understandable as possible.

Using this module means you fully understand these conditions and will NOT hold Layertech
liable for misinterpretations that may arise from using this module. Kindly refer to the
official RA 101 73 for a full transcript of the act.

For comments, corrections and suggestions for the improvement of these presentations,
please contact us at learning@layertechlab.com
DATA PRIVACY ACT of 2012
Republic Act 10173 is also known as Data Privacy act of 2012.

“It is the policy of the State to PROTECT THE FUNDAMENTAL

HUMAN RIGHT OF PRIVACY, of communication while ensuring free
flow of information to promote innovation and growth.
The state recognizes the vital role of information and communications
technology in nation-building and its inherent obligation to ensure that
personal information in information and communications systems in the
government and in the private sector are secured and protected.”
WHY DO WE NEED PRIVACY? DIGITAL ERA
THE LANDSCAPE
IMPLEMENTS and ADMINISTERS RA
10173

ORDERS, CONTROLS COLLECTION,

HOLDING AND PROCESSING OR USE
OF PERSONAL INFORMATION

PERSONAL INFORMATION
CONTROLLER MAY OUTSOURCE TO
PROCESS PERSONAL INFORMATION

AN INDIVIDUAL WHOSE PERSONAL

INFORMATION IS PROCESSED
PERSONAL INFORMATION
PERSONAL INFORMATION
Any information whether recorded in
a material form or not, from which
the identity of an individual is
apparent or can be reasonably and
directly ascertained by the entity
holding the information, or when put
together with other information
would directly and certainly identify
an individual.
SENSITIVE PERSONAL INFORMATION
PERSONAL INFORMATION THAT IS ABOUT AN INDIVIDUAL’s:

1 Race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations

Health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or
2 alleged to have been committed by such person, the disposal of such proceedings, or the sentence of
any court in such proceedings
Information issued by government agencies peculiar to an individual which includes, but not limited to,
3 social security numbers, previous or current health records, licenses or its denials, suspension or
revocation, and tax returns

4 Information specifically established by an executive order or an act of Congress to be kept classified

PRIVILEGED INFORMATION
Any and all forms of data which under the Rules of
Court and other pertinent laws constitute
privileged communication.

“PRIVILEGED COMMUNICATION is
interaction between two parties which the law
recognizes as PRIVATE, PROTECTED
relationship. Whatever is communicated between
these parties shall remain CONFIDENTIAL and
the law CANNOT FORCE DISCLOSURE of these
communications.”

Ex. A client confessing medical conditions to a

doctor, etc.
SCOPE: IS MY INFORMATION COVERED?
“This Act applies to the processing of ALL TYPES OF PERSONAL
INFORMATION and to any natural and juridical person involved in
personal information processing INCLUDING those personal information
controllers and processors who, although not found or established in the
Philippines, use equipment that are located in the Philippines, or those
who maintain an office, branch or agency in the Philippines subject to the
immediately succeeding paragraph: Provided, That the requirements of
Section 5 (Protection Afforded to Journalists and Their Sources) are
complied with.”
SCOPE: WHICH INFO ARE EXCLUDED?
PUBLIC OFFICERS and EMPLOYEES
GOV’T OFFICER …

Information about any individual who is or was an officer or GOV’T CONTRACT…

employee of a government institution that relates to the position DISCRETIONARY
or functions of the individual, including: FINANCIAL…

1 The fact that the individual is or was an officer or employee of the government JOURNALISTIC,
institution; ARTISTIC…
2 The title, business address and office telephone number of the individual; FUNCTIONS OF
PUBLIC AUTH…
3 The classification, salary range and responsibilities of the position held by the
individual; BANKS AND OTHER
The name of the individual on a document prepared by the individual in the course FINANCIAL…
4
of employment with the government; FOREIGN
JURISDICTIONS…
SCOPE: WHICH INFO ARE EXCLUDED?
GOVERNMENT CONTRACTORS
GOV’T OFFICER …
Information about an individual who is or was performing GOV’T CONTRACT…
service under contract for a government institution that
DISCRETIONARY
relates to the services performed, including the terms of FINANCIAL…
the contract, and the name of the individual given in the
JOURNALISTIC,
course of the performance of those services; ARTISTIC…
FUNCTIONS OF
PUBLIC AUTH…
BANKS AND OTHER
FINANCIAL…
FOREIGN
JURISDICTIONS…
SCOPE: WHICH INFO ARE EXCLUDED?
DISCRETIONARY BENEFITS
GOV’T OFFICER …

Information relating to any discretionary benefit of a GOV’T CONTRACT…

financial nature such as the granting of a license or permit DISCRETIONARY

given by the government to an individual, including the FINANCIAL…
name of the individual and the exact nature of the benefit; JOURNALISTIC,
ARTISTIC…
FUNCTIONS OF
PUBLIC AUTH…
BANKS AND OTHER
FINANCIAL…
FOREIGN
JURISDICTIONS…
SCOPE: WHICH INFO ARE EXCLUDED?
JOURNALISTIC, ARTISTIC, LITERARY and RESEARCH
GOV’T OFFICER …

GOV’T CONTRACT…
Personal information processed for journalistic, artistic,
DISCRETIONARY
literary or research purposes; FINANCIAL…

JOURNALISTIC,
ARTISTIC…
FUNCTIONS OF
PUBLIC AUTH…
BANKS AND OTHER
FINANCIAL…
FOREIGN
JURISDICTIONS…
SCOPE: WHICH INFO ARE EXCLUDED?
TO CARRY OUT FUNCTIONS OF PUBLIC AUTHORITY
GOV’T OFFICER …
Information necessary in order to carry out the functions GOV’T CONTRACT…
of public authority which includes the processing of
DISCRETIONARY
personal data for the performance by the independent, FINANCIAL…
central monetary authority and law enforcement and
JOURNALISTIC,
regulatory agencies of their constitutionally and statutorily ARTISTIC…
mandated functions. FUNCTIONS OF
PUBLIC AUTH…
BANKS AND OTHER
FINANCIAL…
FOREIGN
JURISDICTIONS…
SCOPE: WHICH INFO ARE EXCLUDED?
FOR COMPLIANCE WITH RA 9510 and 9160
GOV’T OFFICER …

Information necessary for banks and other financial GOV’T CONTRACT…

institutions under the jurisdiction of the independent, central DISCRETIONARY

monetary authority or Bangko Sentral ng Pilipinas to comply FINANCIAL…
with Republic Act No. 9510, and Republic Act No. 9160, as JOURNALISTIC,
amended, otherwise known as the Anti-Money Laundering ARTISTIC…

Act and other applicable laws FUNCTIONS OF

PUBLIC AUTH…
BANKS AND OTHER
FINANCIAL…
FOREIGN
JURISDICTIONS…
SCOPE: WHICH INFO ARE EXCLUDED?
RESIDENTS OF FOREIGN JURISDICTIONS
GOV’T OFFICER …

Personal information originally collected from residents of GOV’T CONTRACT…

foreign jurisdictions in accordance with the laws of those DISCRETIONARY

foreign jurisdictions, including any applicable data privacy FINANCIAL…
laws, which is being processed in the Philippines. JOURNALISTIC,
ARTISTIC…
FUNCTIONS OF
PUBLIC AUTH…
BANKS AND OTHER
FINANCIAL…
FOREIGN
JURISDICTIONS…
PROTECTION AFFORDED TO JOURNALISTS AND
THEIR SOURCES
“NOTHING IN THIS ACT shall be construed as to have amended or
repealed the provisions of Republic Act No. 53, which affords the
publishers, editors or duly accredited reporters of any newspaper,
magazine or periodical of general circulation protection from being
compelled to reveal the source of any news report or information
appearing in said publication which was related in any confidence to such
publisher, editor, or reporter.”
SECRECY OF BANK DEPOSITS, FOREIGN CURRENCY
DEPOSITS, CREDIT INFORMATION SYSTEM
“NOTHING IN THIS ACT shall be construed as to have amended or
repealed Republic Act No. 1405, otherwise known as the Secrecy of
Bank Deposits Act; Republic Act No. 6426, otherwise known as the
Foreign Currency Deposit Act; and Republic Act No. 9510, otherwise
known as the Credit Information System Act (CISA);”
EXTRATERRITORIAL APPLICATION
APPLIES TO A PRACTICE ENGAGED IN AND OUT OF PH IF:

The act, practice or processing relates to personal

information about a PHILIPPINE CITIZEN or a
RESIDENT;

PHILIPPINE CITIZEN
or RESIDENT…
PROCESSING IN
THE PHILIPPINES…

PHILIPPINE LINKS…
EXTRATERRITORIAL APPLICATION
APPLIES TO A PRACTICE ENGAGED IN AND OUT OF PH IF:
The entity has a link with the Philippines, and the entity is processing
personal information in the Philippines or even if the processing is
outside the Philippines as long as it is about Philippine citizens or
residents such as, but not limited to, the following:

1 A contract is entered in the Philippines;

PHILIPPINE CITIZEN
A juridical entity unincorporated in the Philippines but has central management and or RESIDENT…
2
control in the country;
PROCESSING IN
THE PHILIPPINES…
3 An entity that has a branch, agency, office or subsidiary in the Philippines and the
parent or affiliate of the Philippine entity has access to personal information; PHILIPPINE LINKS…
EXTRATERRITORIAL APPLICATION
APPLIES TO A PRACTICE ENGAGED IN AND OUT OF PH IF:

The entity has other links in the Philippines such as, but not limited to:

1 The entity carries on business in the Philippines;

2 The personal information was collected or held by an entity in the
Philippines.
PHILIPPINE CITIZEN
or RESIDENT…
PROCESSING IN
THE PHILIPPINES…

PHILIPPINE LINKS…
 NATIONAL PRIVACY COMMISSION
To administer and implement the provisions of Data Privacy Act, MONITOR and ENSURE COMPLIANCE of
the country with international standards set for data protection.
Ensure and monitor COMPLIANCE
Receive COMPLAINTS and institute INVESTIGATIONS, issue CEASE and
DESIST orders
Coordinate with other gov’t agencies and PRIVATE SECTOR to strengthen
protection of personal information in the country.
PUBLISH on a regular basis a GUIDE to all laws relating to data protection
and a compilation of agency system of records and notices including index
and finding aids
Recommend prosecution to DOJ
Assist Philippine companies doing business abroad to respond to foreign
privacy or data protection laws and regulations
Cross-border enforcement of data privacy protection
PENALTIES
What are the penalties for non-
compliance to the Data Privacy Act?
 PENALTIES
UNAUTHORIZED ACCESSING PERSONAL
PROCESSING OF PERSONAL INFORMATION AND SENSITIVE
INFORMATION and SENSITIVE PERSONAL INFORMATION DUE
PERSONAL INFORMATION: TO NEGLIGENCE:

1-3 YEARS in PRISON 1-3 YEARS in PRISON

PHP 500,000 > FINE > PHP 2,000,000 PHP 500,000 > FINE > PHP 2,000,000
and sensitive personal info:
and sensitive personal info:
3-6 YEARS in PRISON
3-6 YEARS in PRISON
PHP 500,000 > FINE > PHP 4,000,000
PHP 500,000 > FINE > PHP 4,000,000
 PENALTIES
IMPROPER DISPOSAL OF PROCESSING OF PERSONAL
PERSONAL INFORMATION AND INFORMATION and SENSITIVE
SENSITIVE PERSONAL PERSONAL INFORMATION for
INFORMATION: UNAUTHORIZED PURPOSES:

6 MONTHS -2 YEARS in PRISON 1 YR and 6 MONTHS -5 YEARS in PRISON

PHP 100,000 > FINE > PHP 500,000 PHP 500,000 > FINE > PHP 1,000,000
and sensitive personal info: and sensitive personal info:
1-3 YEARS in PRISON 2-7 YEARS in PRISON
PHP 100,000 > FINE > PHP 1,000,000 PHP 500,000 > FINE > PHP 2,000,000
 PENALTIES
UNAUTHORIZED CONCEALMENT OF
ACCESS or SECURITY BREACHES
INTENTIONAL INVOLVING SENSITIVE
BREACH: PERSONAL
INFORMATION:
1-3 YEARS in PRISON 1 YR and 6 MOS -5 YEARS in PRISON
PHP 500,000 > FINE > PHP PHP 500,000 > FINE > PHP 1,000,000
2,000,000
 PENALTIES
UNAUTHORIZED
MALICIOUS DISCLOSURE: DISCLOSURE:
1-3 YEARS in PRISON
1 YR and 6 MOS -5 YEARS in PRISON PHP 500,000 > FINE > PHP 1,000,000
If Information Controller/Processor:
PHP 500,000 > FINE > PHP 1,000,000 3-5 YEARS in PRISON
PHP 500,000 > FINE > PHP 2,000,000

COMBINATION or SERIES OF ACTS:

3-6 YEARS in PRISON AND PHP 1,000,000 > FINE > PHP 5,000,000
EXTENT OF LIABILITY
The penalty shall be imposed upon THE RESPONSIBLE OFFICERS, as the case may be,
Corporation,
who participated in, or by their gross negligence, allowed the commission of the crime. If
partnership or ANY
the offender is a juridical person, the court may suspend or revoke any of its rights under
juridical person
the Data Privacy Act.
He or she shall, in addition to the penalties prescribed, be deported without further
Alien
proceedings after serving the penalties prescribed.
Public official or he or she shall, in addition to the penalties prescribed, suffer perpetual or temporary
Employee absolute disqualification from office, as the case may be.

OFFENSE COMMITED BY PUBLIC OFFICER:

An accessory penalty consisting in the disqualification to occupy public office for a term DOUBLE
the term of criminal penalty imposed shall he applied.
ACCOUNTABILITY
Who is accountable for Personal
Information Processing?
PRINCIPLE OF ACCOUNTABILITY
Each PERSONAL INFORMATION CONTROLLER is responsible for personal
information under its control or custody, including information that have been
transferred to a third party for processing, whether domestically or
internationally, subject to cross-border arrangement and cooperation.

The personal information controller is accountable for complying with the

requirements of the Data Privacy Act and shall use contractual or other
reasonable means to provide a comparable level of protection while the
information are being processed by a third party.
APPOINTING A DATA PRIVACY OFFICER

“The personal information controller shall

designate an individual or individuals who
are accountable for the organization’s
compliance with the Data Privacy Act.
The identity of the individual(s) so
designated shall be made known to any data
subject upon request.”
RESPONSIBILITY OF HEADS OF AGENCIES
All sensitive personal information maintained by the government, its
agencies and instrumentalities shall be SECURED, as far as practicable,
with the use OF THE MOST APPROPRIATE STANDARD recognized
by the information and communications technology industry, and as
recommended by the Commission.

The head of each government agency or instrumentality shall be

responsible for complying with the security requirements mentioned herein
while the Commission shall monitor the compliance and may recommend
the necessary action in order to satisfy the minimum standards.
REQUIREMENTS TO ACCESS BY AGENCY
PERSONNEL TO SENSITIVE PERSONAL INFO
ON-SITE ACCESS
Except as may be allowed through guidelines
to be issued by the Commission, no employee
of the government shall have access to
sensitive personal information on government
property or through online facilities unless the
employee has received a security clearance
from the head of the source agency.
REQUIREMENTS TO ACCESS BY AGENCY
PERSONNEL TO SENSITIVE PERSONAL INFO
OFF SITE ACCESS:
Unless otherwise provided in guidelines to be issued by the Commission, sensitive personal information
maintained by an agency may not be transported or accessed from a location off government property unless a
request for such transportation or access is submitted and approved by the head of the agency in accordance with
the following guidelines:

1. Deadline for Approval or Disapproval – In the case of any request submitted to the head of an agency, such
head of the agency shall approve or disapprove the request within two (2) business days after the date of
submission of the request. In case there is no action by the head of the agency, then such request is considered
disapproved;
2. Limitation to One thousand (1,000) Records – If a request is approved, the head of the agency shall limit the
access to not more than one thousand (1,000) records at a time;
3. Encryption – Any technology used to store, transport or access sensitive personal information for purposes of
off-site access approved under this subsection shall be secured by the use of the most secure encryption standard
recognized by the Commission.
APPLICABILITY TO GOVERNMENT CONTRACTORS
In entering into any contract that may involve accessing or
requiring sensitive personal information from one
thousand (1,000) or more individuals, an agency
shall require a contractor and its
employees to register their personal
information processing system with the
Commission in accordance with the Data
Privacy Act and to comply with the other provisions
of this Act including the immediately preceding section, in
the same manner as agencies and government employees
comply with such requirements.
PROPER PROCESSING
OF PERSONAL INFORMATION
How to NOT violate the Data Privacy
Act?
KEYWORDS to REMEMBER

CONSENT,
COMPLIANCE
and GOOD FAITH
Keeping these three keywords in mind can
help you to NOT violate the Data Privacy Act!
CONSENT
Consent of the data subject refers to any freely
given, specific, informed indication of will,
whereby the data subject agrees to the
collection and processing of personal
information about and/or relating to him or her.
Consent shall be evidenced by
written, electronic or recorded
means.
It may also be given on behalf of the data
subject by an agent specifically authorized by
the data subject to do so.
GENERAL PRINCIPLES
Personal information MAY BE PROCESSED, BUT must, be:
1. Purpose of collection is legitimate, properly specified and declare BEFORE or AS SOON AS REASONABLY
PRACTICAL AFTER collection.
2. Processed FAILRY and LAWFULLY;
3. ACCURATE, RELEVANT and, where necessary for purposes for which it is to be used the processing of personal
information, kept UP TO DATE;
4. ADEQUATE and NOT EXCESSIVE in relation to the purposes for which they are collected and processed;
5. Retained only FOR AS LONG AS NECESSARY for the fulfillment of the purposes for which the data was obtained
6. Kept in a form which PERMITS IDENTIFICATION OF DATA SUBJECTS for no longer than is necessary for the
purposes for which the data were collected and processed: Provided, That personal information collected for other
purposes may lie processed for historical, statistical or scientific purposes, and in cases laid down in law may be
stored for longer periods: Provided, further, That ADEQUATE SAFEGUARDS are guaranteed by said laws
authorizing their processing.
7. Personal information controller must ENSURE IMPLEMENTATION of personal information processing principles
in Data Privacy Act.
WHAT IS LAWFUL PROCESSING
OF PERSONAL INFORMATION?
1. The data subject has given his or her CONSENT;
2. The processing of personal information is necessary and is related to the FULLFILMENT OF A
CONTRACT with the data subject or in order to take steps at the request of the data subject prior to entering
into a contract;
3. The processing is necessary for COMPLIANCE WITH A LEGAL OBLIGATION to which the personal
information controller is subject;
4. The processing is necessary to PROTECT VITALLY IMPORTANT INTERESTS OF THE DATA
SUBJECT, including life and health;
5. The processing is necessary in order to RESPOND TO NATIONAL EMERGENCY, to comply with the
requirements of public order and safety, or to fulfill functions of public authority which necessarily includes
the processing of personal data for the fulfillment of its mandate; or
6. The processing is necessary FOR THE PURPOSES OF THE LEGITIMATE INTERESTS PURSUED BY
THE PERSONAL INFORMATION CONTROLLER or by a third party or parties to whom the data is
disclosed, EXCEPT where such interests are overridden by fundamental rights and freedoms of the data
subject which require protection under the Philippine Constitution.
WHEN CAN I PROCESS SENSITIVE PERSONAL
INFORMATION and PRIVILEDGED INFORMATION?
The processing of sensitive personal information and privileged information shall be PROHIBITED, EXCEPT in the following cases:
1. With CONSENT of data subject (or parties to exchange, for privileged information), SPECIFIC TO THE PURPOSE PRIOR TO THE
PROCESSING
2. The processing is PROVIDED FOR BY EXITSING LAWS and regulations: Provided, That such regulatory enactments GUARANTEE
THE PROTECTION of the sensitive personal information and the privileged information: Provided, further, That the CONSENT OF
DATA SUBJECTS ARE NOT REQUIRED by law or regulation permitting the processing of the sensitive personal information or the
privileged information;
3. The processing is NECESSARY TO PROTECT THE LIFE AND HEALTH of the data subject or another person, and the data subject is
NOT LEGALLY OR PHYSICALLY ABLE TO EXPRESS CONSENT prior to the processing;
4. Processing is NECESSARY TO ACHIEVE LAWFUL AND NONCOMMERCIAL OBJECTIVES PUBLIC ORGANIZATIONS AND
THEIR ASSOCIATIONS: Provided, That such processing is ONLY confined and related to the bona fide members of these
organizations or their associations: Provided, further, That the sensitive personal information are NOT TRANSFERRED TO THIRD
PARTIES: Provided, finally, That CONSENT OF THE DATA SUBJECT was obtained prior to processing;
5. Processing is NECESSARY FOR PURPOSES OF MEDICAL TREATMENT, is carried out by a medical practitioner or a medical
treatment institution, and an adequate level of protection of personal information is ensured;
6. Processing concerns such personal information as is NECESSARY FOR THE PROTECTION OF LAWFUL RIGHTS AND
INTERESTS OF NATURAL AND LEGAL PERSONS IN COURT PROCEEDINGS, or the establishment, exercise or defense of legal
claims, or when provided to government or public authority.
SUBCONTRACT OF PERSONAL INFORMATION
A personal information controller may subcontract the processing of
personal information: Provided, That the personal information
controller shall be responsible for ensuring that proper safeguards are
in place to ensure the confidentiality of the personal information
processed, prevent its use for unauthorized purposes, and generally,
comply with the requirements of this Act and other laws for processing
of personal information. The personal information processor shall
comply with all the requirements of this Act and other applicable laws.
EXTENSION OF PRIVILEGED INFORMATION

Personal information controllers may invoke the principle of

privileged communication over privileged information that they
lawfully control or process. Subject to existing laws and regulations,
any evidence gathered on privileged information is inadmissible.
RIGHTS OF DATA SUBJECTS
What are the rights of Data Subjects?
SUBJECT NEEDS TO BE INFORMED!

Data subjects have to be informed whether

personal information pertaining to him or her
shall be, are being or have been processed;
 THE SUBJECT NEEDS TO KNOW THE FF:
1. DESCRIPTION of the personal information to be entered into the system;
2. PURPOSES which they are being or are to be processed;
3. SCOPE and METHOD of personal information processing
4. RECEPIENTS of data to be disclosed;
5. METHODS USED FOR AUTOMATED ACCESSES, extent of authorized
access
6. IDENTITY and CONTACT DETAILS of personal information controller or
representative;
7. PERIOD for which the information will be STORED
8. EXISTENCE OF DATA SUBJECT RIGHTS, including right to lodge a
complaint before NPC
 NOTIFYING THE DATA SUBJECT
Any information supplied or declaration made to the data subject on these
matters shall NOT be amended without prior notification of data
subject: Provided, That the notification shall NOT apply should:
1. The personal information be needed pursuant to a subpoena, 
2. When the collection and processing are for obvious purposes, including
when it is necessary for the performance of or in relation to a contract
or service or when necessary or desirable in the context of an employer-
employee relationship, between the collector and the data subject,
3. When the information is being collected and processed as a result of
legal obligation;
FF MUST BE GIVEN TO SUBJECT UPON DEMAND:
1. CONTENTS of his or her personal information that were processed;
2. SOURCES from which personal information were obtained;
3. Names and addresses of RECIPIENTS of the personal information;
4. MANNER OF DATA PROCESSING;
5. REASONS FOR DISCLOSURE of the personal information to recipients;
6. Information on AUTOMATED PROCESSES where the data will or likely to be made
as the sole basis for any decision significantly affecting or will affect the data subject;
7. DATE of LAST ACCESS/MODIFIED of his or her personal information;
8. The designation, or name or IDENTITY and address of the personal information
controller;
RIGHT TO DISPUTE INACURACY
Subjects can DISPUTE THE INACCURACY or ERROR in the personal information and have
the personal information controller correct it immediately and accordingly, UNLESS the request
is vexatious or otherwise unreasonable.

If the personal information have been corrected, the personal information controller shall
ENSURE THE ACCESSIBILITY OF BOTH THE NEW AND RETRACTED INFORMATION
and the simultaneous receipt of the new and the retracted information by recipients.

The THIRD PARTIES who have previously received such processed personal information shall
be INFORMED of its inaccuracy and its rectification upon reasonable request of the data subject;
RIGHT TO WITHDRAW REMOVAL
Data subjects have the right to suspend, withdraw or order the blocking,
removal or destruction of his or her personal information from the personal
information controller’s filing system upon discovery and substantial proof
that the personal information are incomplete, outdated, false, unlawfully
obtained, used for unauthorized purposes or are no longer necessary for the
purposes for which they were collected.

In this case, the personal information controller may notify third parties
who have previously received such processed personal information;
RIGHT TO INDEMNIFICATION
Data subjects have the right to be
indemnified for any damages sustained due
to such inaccurate, incomplete, outdated,
false, unlawfully obtained or unauthorized
use of personal information.
TRANSMISSIBILITY OF RIGHTS
The lawful heirs and assigns of the data subject may invoke the rights of
the data subject for, which he or she is an heir or assignee at any time
after the death of the data subject or when the data subject is
incapacitated or incapable of exercising the rights as enumerated in the
immediately preceding section.
RIGHT TO DATA PORTABILITY
Data subjects have the right, where personal information is processed by
electronic means and in a structured and commonly used format, to
obtain from the personal information controller a copy of data
undergoing processing in an electronic or structured format, which is
commonly used and allows for further use by the data subject. The
Commission may specify the electronic format referred to above, as
well as the technical standards, modalities and procedures for their
transfer.
NON-APPLICABILITY and EXCEPTIONS
The immediately preceding sections are NOT APPLICABLE if the processed personal
information are used only for the needs of:

1. SCIENTIFIC AND STATISTICAL RESEARCH

2. INVESTIGATIONS in relation to any criminal, administrative or tax liabilities of a data
subject.

and, on the basis of such, NO ACTIVITIES are carried out and NO DECISIONS are taken
regarding the data subject: Provided, That the personal information shall be held under
STRICT CONFIDENTIALITY and shall be USED ONLY FOR THE DECLARED PURPOSE.
SECURITY OF PERSONAL INFORMATION
How can we secure personal
information?
WHAT DO WE NEED TO DO?
The personal information controller must implement reasonable and
appropriate organizational, physical and technical measures intended for
the protection of personal information against:

1 Any accidental or unlawful destruction, alteration and disclosure, as well as against

any other unlawful processing.

Natural dangers such as accidental loss or destruction, and human dangers such as
2 unlawful access, fraudulent misuse, unlawful destruction, alteration and
contamination.
ASSESSMENT OF PROCESSES USED
The determination of the appropriate level of security under this section
must take into account the:
NATURE of the personal information to be protected,
RISKS represented by the processing,
SIZE of the organization,
COMPLEXITY of its operations,
CURRENT DATA PRIVACY BEST PRACTICES,
COST of security implementation.
REQUIRED MEASURES
Subject to guidelines as the Commission may issue from time to time, the
measures implemented must include:
Safeguards to protect its computer network against accidental, unlawful or unauthorized usage or
1 interference with or hindering of their functioning or availability;

2 A security policy with respect to the processing of personal information;

A process for identifying and accessing reasonably foreseeable vulnerabilities in its computer
3 networks, and for taking preventive, corrective and mitigating action against security incidents
that can lead to a security breach;
Regular monitoring for security breaches and a process for taking preventive, corrective and
4 mitigating action against security incidents that can lead to a security breach.
CONFIDENTIALITY REMINDER!
The employees, agents or representatives of a personal information
controller who are involved in the processing of personal information
shall operate and hold personal information under strict confidentiality
if the personal information are not intended for public disclosure. This
obligation shall continue even after leaving the public service, transfer
to another position or upon termination of employment or contractual
relations.
 NPC MUST BE NOTIFIED!
The personal information controller shall promptly notify the Commission
and affected data subjects when sensitive personal information.
The Notification MUST AT LEAST DESCRIBE THE FF:
1 NATURE of breach
2 SENSITIVE PERSONAL INFORMATION POSSIBLY INVOLVED
3 Measures taken to address the breach

Notification may be delayed ONLY to the extent necessary to determine the scope of the breach, to prevent
further disclosures, or to restore reasonable integrity to the information and communications system.
 DELAYED BREACH NOTIFICATIONS
1. In evaluating if notification is unwarranted, the Commission may take
into account compliance by the personal information controller and
existence of good faith in the acquisition of personal information.
2. The Commission may exempt a personal information controller from
notification where, in its reasonable judgment, such notification would
not be in the public interest or in the interests of the affected data
subjects.
3. The Commission may authorize postponement of notification where it
may hinder the progress of a criminal investigation related to a
serious breach.
ALL PARTIES INVOLVED MUST COMPLY!

The personal information controller must further ensure that third parties
processing personal information on its behalf shall implement the
required security measures.
“Security is always excessive until
it’s not enough.”
– Robbie Sinclair, Head of Security, NSW Australia 
THANK YOU VERY MUCH!
www. LAYERTECHLAB.com
Special thanks to PIXABAY.com for the CC0 images 

For comments, corrections and suggestions for the improvement of these presentations,
please contact us at learning@layertechlab.com