Research Exception under the Data Privacy Act

by Chrissete Agustin

The Data Privacy Act of 2012 (herein after referred to as the “Act” or “DPA”) was enacted to bring
the Philippines in line with international data protection standards to encourage investment and
reinforce the Philippines’ position as a leading Information Technology and Business Process
Outsourcing destination.1

The Act aims to reconcile the right of privacy with the efficient utilization of information. Under the
policy statement of the Act, it is understood that even as the law guarantees the protection of an
individual’s to their fundamental right to privacy, it also ensures the free flow of information for
innovation, growth, and national development.2 The DPA, while upholding the rights of the data
subject – a person whose personal information is collected, stored, and processed – does not impede
access to information, which may hinder progress and advancement. It assures that data protection
and privacy does not preclude impede the benefits from the processing of personal data for research.
In fact, Tthe Act supports initiatives for data sharing, and freedom of information and , yet entrenches
the responsible use and processing of personal data.

Scope and Application

As a general rule, thethe DPA applies to the processing of all types of personal data – both personal
and sensitive information. It does not distinguish between the private and the government sector, as
long as the act, practice or processing relates to personal data about a Philippine citizen or Philippine
residence, or the processing of personal data is being done in the Philippines or engaged in by an entity
with links to the Philippines.3

Research Exception

The Act ennumerates specifies categories of information where it will not apply – such as information
that fall within matters of public concern.4 One such category is that of research purpose. The Rules
explicitly excludes the processing of personal information for journalistic, artistic, literary or research
purposes from the scope of application of the Act.5 The Act and its Rules are not applicable to personal
information that will be processed for research purposes, intended for a public benefit; subject to the
requirements of applicable laws, regulations, or ethical standards. 6

Data collected from parties other than the data subject for purpose of research shall be allowed when
the personal data is publicly available, or has the consent of the data subject for purpose of research.
It must be ensured that adequate safeguards are in place, and no decision directly affecting the data

1 http://www.senate.gov.ph/press_release/2012/0308_angara2.asp
2 Section 2, IRR of Republic Act No. 10173
3 Section 5(a) to 5(d), IRR of Republic Act No. 10173
4 Section 5, IRR of Republic Act No. 10173
5 Section 4(d), RA 10173
6 Section 5 (1)(a), IRR of Republic Act No. 10173
subject shall be made on the basis of the data collected or processed. Through the whole process, the
rights of the data subject shall be upheld without compromising research integrity.7

Under the DPA, the data subject also has the right to data portability. Where a data subject’s personal
data is processed by electronic means and in a structured and commonly used format, the data subject
shall have the right to obtain from the personal information controller a copy of such data. for his
further use. The exercise of this right to data portability shall primarily take into account the right of Commented [CA1]: Previous sentence: The exercise of this
the data subject to have control over his or her personal data being processed based on consent or for right to data portability shall primarily take into account the
right of the data subject to have control over his or her
the performance of a contract, for a commercial purpose, or through automated means. This means personal data being processed based on consent or contract,
that if the data subject requests for the data, the data subject has the right to compel the data processor for commercial purpose, or through automated means
to transfer such data directly to another the other organization, if such is technically plausible. The Commented [rapangala2]: Please clarify
Commission may specify the electronic format referred to above, as well as the technical standards,
modalities, procedures and other rules for their transfer shall subsequently be specified by the National
Privacy Commission (hereinafter referred to as the “Commission”)..8

However, tThis right to data portability does not apply if the processed personal data are used only for
the needs of scientific and statistical research, provided that no activities are carried out and no
decisions are taken regarding the data subject. However, Further, it should be assured that the personal
data shall be held under strict confidentiality and shall be used only for the declared purpose. Any
limitations on the rights of the data subject shall only be to the minimum extent necessary to achieve
the purpose of said research or investigation. 9

Review by the National Privacy Commission

Although processing of personal data for research purposes is exempted from the scope of the DPA,
the National Privacy Commission (hereafter referred to as “Commission”) is authorized by the Act to
review, upon its own initiative or upon the filing of the complaint by a data subject, the processing of
personal data for research purposes. As an exception to the general rule, the exemption of processing
of personal and sensitive data from the scope of the DPA should be construed strictly. As
aforementioned, any limitations on the rights of the data subject shall only be to the least extent
necessary to accomplish the purpose of said research. The non-applicability of the Act or its Rules
does not extend to personal information controllers or personal information processors, who remain
subject to the requirements of implementing security measures for personal data protection. Any doubt
in the interpretation of any provision of the DPA shall be liberally interpreted in favor of a manner
mindful of the rights and interests of the individual whose about whom personal information is being
processed.10

The rights of a data subject must, at all times, be of the highest importance. Any person, natural or
juridical, or any other body that deals with a data subjects’ personal details, whereabouts, and
preferences, are duty-bound to observe and respect the data subject’s privacy rights. The Commission
remains empowered to compel compliance of the parties concerned and to enable the data subject to

7 Section 20, IRR of Republic Act No. 10173

8 Section 36, IRR of Republic Act No. 10173
9 Section 37, IRR of RA 10173.
10 Section 69, IRR of Republic Act No. 10173; Section 38, Republic Act No. 10173
remain in full control of his or her information. Should any natural or juridical person, or other body
involved in the processing of personal data, violate the provisions of the Act, its Implementing Rules,
and other issuances of the Commission, it said shall be liable for such violation, and shall be subject to
the corresponding sanctions, penaltyies, or fines, in addition to without prejudice to any civil or
criminal liability, as may be applicable. 11

11 Section 51, IRR of Republic Act No. 10173