Professional Documents
Culture Documents
RA 10173 Data Privacy Act
RA 10173 Data Privacy Act
Brief background:
Where it all started: With the advances in information technology, privacy in personal data has
become illusory. For the right price or with good connections, private information disclosed in
confidence to companies or government offices can be made available to or accessed by interested
parties.
This is the problem that is sought to be minimized, if not eliminated by Republic Act 10173, otherwise
known as the Data Privacy Act of 2012, which President Aquino signed into law.
In its declaration of policy, the law states that, although the free flow of information promotes
innovation and growth, it is essential that personal information in the government’s and private
sector’s information and communications systems are secured and protected.
Personal information is defined as “any information whether recorded in material form or not, from
which the identity of the individual is apparent or can be reasonably and directly ascertained by the
entity holding the information.
It includes facts and figures about a person’s race, ethnic origin, marital status, age, color and
religious, philosophical and political affiliations. Or practically his life story.
Legal basis:
The right to privacy is well-entrenched in the 1987 Constitution, particularly in the Bill of Rights and
safeguarded by several provisions of the Civil Code, the Revised Penal Code, and certain laws which
provide penalties for their violation in the form of imprisonment, fines, or damages.
“Sec. 2. The right of the people to be secure in their persons, houses papers, and effects against
unreasonable searches and seizures of whatever nature and for any purpose shall be inviolable, and
no search warrant or warrant of arrest shall issue except upon probable cause to be determined
personally by the judge after examination under oath or affirmation of the complainant and the
witnesses he may produce, and particularly describing the place to be searched and the persons or
things to be seized.”
“Sec. 3. (1) The privacy of communication and correspondence shall be inviolable except upon lawful
order of the court, or when public safety or order requires otherwise as prescribed by law.”
“Sec. 8. The right of the people, including those employed in the public and private sectors, to form
unions, associations, or societies for purposes not contrary to law shall not be abridged.”
Sec. 17. No person shall be compelled to be a witness against himself.”
Similarly, the Civil Code provides that “[e]very person shall respect the dignity, personality, privacy
and peace of mind of his neighbors and other persons” and punishes as actionable torts several acts
by a person of meddling and prying into the privacy of another.1 It also holds a public officer or
employee or any private individual liable for damages for any violation of the rights and liberties of
another person, 2 and recognizes the privacy of letters and other private communications.3
In like manner, the Revised Penal Code makes a crime the violation of secrets by an officer,4 the
revelation of trade and industrial secrets,5 and trespass to dwelling.6 Invasion of privacy is an
offense in special laws like the Anti-Wiretapping Law,7 the Secrecy of Bank Deposits Act8 and the
Intellectual Property Code.9
Also, the Rules of Court on privileged communication likewise recognize the privacy of certain
information.
EXCLUSIONS:
The Data Privacy Act does not apply to the following types of personal information:
1. Relating to officers or employees of a government institution relating to the position and function of
said individual.
2. Relating to those performing service under contract for a government institution;
3. Relating to any discretionary benefit of a financial nature such as the granting of a license given by
the government to an individual.
4. Those processed for journalistic, artistic, literary or research purpose;
5. Those necessary for carrying out the functions of public authority;
6. Those necessary for banks and other financial institutions; and
7. Those originally collected from nonresidents in accordance with the laws of their residence,
including any applicable data privacy laws, which is processed in the Philippines.
Criteria for Lawful Processing of Personal Information- The processing of personal information
shall be permitted only if not otherwise rpohibited by law, and when at least one of the following
conditions exist;
PRIVILEGED INFORMATION: Refers to any and all forms of data which under the Rules of Court
and other pertinent laws constitute privileged communication.
GENERAL RULE: The processing of sensitive information and privilege information shall be
prohibited.
EXCEPTIONS
A. The data subject has given his or her consent, specific to the purpose prior to the processing, or in
the case of privileged information, all parties to the exchange have given their consent prior to
processing
B. The processing of the same is provided for by existing ;aws and regulations
C. The processing is necessary to protect the life and health of the data subject or another person,
and the data subject is not legally or physically able to express his or her consent prior to the
processing;
D. The processing is necessary to achieve the lawful and noncommercial objectives of public
organizations and their associations.
E. The processing is necessary for PURPOSES OF MEDICAL TREATMENT
F. The processing concerns such personal information as is necessarynfor the protection of lawful
rightsand interests of natural or legal persons incourt proceedings, or the establishment, exercise or
defense of legal claims, or when provided to government or public authority.
SECURITY OF SENSITIVE PERSONAL INFORMATION GOVERNMENT
Responsibility of Heads of Agencies- information shall be secured with the most appropriate
standards as recommended by the NPC. Heads of agencies are responsible for complying with
the security requirements.
Requirements of access by Agency Personnel
A. Online/Onsite- no employee of the govdrnment shall have access unless the employee has
received a security clearance;
B. Offsite- information shall not be transported or accessed offsite unless a request is approved
Personal information controller refers to a person or organization who controls the collection,
holding, processing or use of personal information, including a person or organization who instructs
another person or organization to collect, hold, process, use, transfer or disclosepersonal information
on his/her behalf.
OBLIGATIONS:
1. Implement reasonable and appropriate organizational, physical and technical measures intended
for the protection of personal information against any accidental or unlawful destruction, alteration
and disclosure, as well as against any other unlawful processing.
2. Implement reasonable and appropriate measures to protect personal information against natural
dangers such as accidental loss or destruction, and human dangers such as unlawful access,
fraudulent misuse. Unlawful destruction, alteration and contamination.
3. Ensure that third parties processing personal information on its behalf shall implement the security
measures required.
4. Ensure that employees, agents or representatives of a personal information controller who are
involved in the processing of personal information under strict confidentiality if the personal
information are not intended for public disclosure. This obligation shall continue even after leaving the
public service, transfer to another position or upon termination of employment or contractual relation.
5. Promptly notify the Commission and affected databsubjects when sensitive personal information or
other information that may, under the circumstances, be used to enable to identify fraud are
reasonably believed to have been acquired by an unauthorized person, and the personal information
controller or the Commission believesthat such unauthorized acquisition is likelt to give rise to a real
risk of serious harm to any affected data subject.
Personal information processor refers to any natural or juridical person qualified to act as such to
whom a personal information controller may outsource the processing of personal data pertaining to a
data subject.
OBLIGATIONS:
6. Implement reasonable and appropriate organizational, physical and technical measures intended
for the protection of personal information against any accidental or unlawful destruction, alteration
and disclosure, as well as against any other unlawful processing.
7. Implement reasonable and appropriate measures to protect personal information against natural
dangers such as accidental loss or destruction, and human dangers such as unlawful access,
fraudulent misuse. Unlawful destruction, alteration and contamination.
PENAL PROVISIONS
1. Unauthorized Processing
2. Accessing and Providing Access Through Negligence
3. Improper Disposal
4. Processing for Unauthorized Purpose
5. Unauthorized access or Intentional Breach
6. Concealment of Security Breaches
7. Malicious Disclosure
8. Unauthorized Disclosure
OTHER RULES:
1.Combination or series of crimes enumerated above increases penalty
2. Committed by juridical person; penalty imposed on responsibe officers who committed or allowed
the crime to be committed through negligence
3. Committed by alien: to be deported after serving sentence
4. Public Official or Employee committing Improper Disposal or Processing for Unauthorized
Purposes:include perpetual or temporary disqualification from office
5. 100 or kore records affected: maximum penalty
6. Offender is a public officer; disqualification for a term double the term of the criminal penalty
7. No prejudice to restitution as per Civil Code