Slide 1: The importance of Data Privacy Act of 2012 Philippines, or those who maintain an office, branch or

agency in the Philippines subject to the immediately

Presented by: Rizzi, Clifford Chazz L.
succeeding paragraph: Provided, That the requirements of
BSIT 611 Section 5 are complied with.

Slide 2: What is Data Privacy Act of 2012?

RA 10173 or Data Privacy Act of Slide 4: Basically, the National Privacy Commission are
2012 is AN ACT PROTECTING responsible for the administration and implementation of RA
INDIVIDUAL PERSONAL 10173. They are the one to monitor and ensure the
INFORMATION IN compliance of the country with international standards set
INFORMATION AND for data protection.
COMMUNICATIONS SYSTEMS
IN THE GOVERNMENT AND
THE PRIVATE SECTOR, The Department of Information and
CREATING FOR THIS PURPOSE Communications Technology
A NATIONAL PRIVACY COMMISSION, AND FOR
Appointed
OTHER PURPOSES
The National Privacy Commission

Slide 3: Who is it for?

Republic Act No. 10173, otherwise known as the Data
Privacy Act is a law that seeks to protect all forms of Slide 5: Why is it needed?
information, be it private, personal, or sensitive. It is meant
to cover both natural and juridical persons involved in the The internet use of
processing of personal information. Filipino people have
increased ambiguously
and still continually
increases. Particular use
Scope Sec. 4: This Act applies to the processing of all types
are social media. People
of personal information and to any natural and juridical
are sharing more
person involved in personal information processing
personal information
including those personal information controllers and
everyday. More
processors who, although not found or established in the
so, business sectors, companies, organizations, etc. now rely
Philippines, use equipment that are located in the
on internet. They collect, process, and use personal data in
variety of means.
That’s why a comprehensive law such as Data Privacy Act
of 2012 is greatly needed to protect people, give them
personal choice, control, and the right to be left alone.
Slide 6: What is Personal Information?
Under Sec. 3(g) of the Data Privacy Act, “[p]ersonal
information refers to any information whether recorded in a
material form or not, from which the identity of an
individual is apparent or can be reasonably and directly
ascertained by the entity holding the information, or when
put together with other information would directly and
certainly identify an individual.”
In other words, personal information is any information
which can be linked to your identity, thus making you
readily identifiable.
Slide 7: What is Sensitive Personal Information
(1) race, ethnic origin, marital status, age, color, and
religious, philosophical or political affiliations; (2) health,
education, genetic or sexual life of a person, (3) civil,
criminal or administrative proceedings (4) Unique identifiers
issued by government agencies peculiar to an individual (5)
Specifically established by law as classified
Under Sec 13: The processing of sensitive personal
information and privileged information shall be prohibited,
except in the following cases:
(a) The data subject has given his or her consent, specific to
the purpose prior to the processing, or in the case of
privileged information, all parties to the exchange have
given their consent prior to processing;
(b) The processing of the same is provided for by existing
laws and regulations: Provided, That such regulatory
enactments guarantee the protection of the sensitive personal
information and the privileged information: Provided,
further, That the consent of the data subjects are not required
by law or regulation permitting the processing of the
sensitive personal information or the privileged information;
Slide 8:
(c) The processing is necessary to protect the life and health
of the data subject or another person, and the data subject is
not legally or physically able to express his or her consent
prior to the processing;
(d) The processing is necessary to achieve the lawful and
noncommercial objectives of public organizations and their
associations: Provided, That such processing is only
confined and related to the bona fide members of these
organizations or their associations: Provided, further, That
the sensitive personal information are not transferred to third
parties: Provided, finally, That consent of the data subject
was obtained prior to processing;
(e) The processing is necessary for purposes of medical
treatment, is carried out by a medical practitioner or a
medical treatment institution, and an adequate level of
protection of personal information is ensured; or
(f) The processing concerns such personal information as is
necessary for the protection of lawful rights and interests of
natural or legal persons in court proceedings, or the Slide 10: The rights of Data subjects
establishment, exercise or defense of legal claims, or when
provided to government or public authority. An individual whose personal, sensitive personal or
privileged information is processed.
Slide 9: What is processing?
 Right to be Informed
Under Sec. 3(j)  Right to Access
of the Data
Privacy Act,  Right to Object
“[p]rocessing  Right to Rectification
refers to any
operation or  Right to Erasure or Blocking
any set of  Right to Damages
operations
performed  Right to Data Portability
upon personal  Right to File A Complaint
information
including, but Slide 11: The Principles of Data Privacy
not limited to,  Transparency - A data subject must be aware of the
the collection, nature, purpose, and extent of the processing of his
recording, or her personal data, including the risks and
organization, storage, updating or modification, retrieval, safeguards involved, the identity of personal
consultation, use, consolidation, blocking, erasure or information controller, his or her rights as a data
destruction of data.” subject, and how these can be exercised. Any
information and communication relating to the
In other words, processing of personal information is any processing of personal data should be easy to access
operation where personal information is involved. Whenever and understand, using clear and plain language.
your information is, among other things, collected, modified,  Legitimate Purpose - The processing of information
or used for some purpose, processing already takes place. shall be compatible with a declared and specified
purpose, which must not be contrary to law, morals,
or public policy.
 The processing of information shall be adequate,
relevant, suitable, necessary, and not excessive in
 relation to a declared and specified purpose.
Personal data shall be processed only if the purpose
of the processing could not reasonably be fulfilled
by other means.
Slide 12: Consent of Data Subject
Refers to any freely given, specific, informed indication of
will, whereby the data subject agrees to the collection and
processing of personal information about and/or relating to
him or her. Consent shall be evidenced by written, electronic
or recorded means. It may also be given on behalf of the data
subject by an agent specifically authorized by the data
subject to do so.
Sliide 13: Penalty
 Unauthorized Processing of Personal Information
and Sensitive Personal Information
o Personal Information - Imprisonment
ranging from one (1) year to three (3) years
AND Fine of not less than Five hundred
thousand pesos (Php500,000.00) but not
more than Two million pesos
(Php2,000,000.00)
o Sensitive Personal Information -
Imprisonment ranging from three (3) years
to six (6) years AND Fine of not less than
Five hundred thousand pesos
(Php500,000.00) but not more than Four
million pesos (Php4,000,000.00)
 Accessing Personal Information and Sensitive
Personal Information Due to Negligence
o Personal Information - Imprisonment
ranging from one (1) year to three (3) years
and A fine of not less than Five hundred
thousand pesos (Php500,000.00) but not
more than Two million pesos
(Php2,000,000.00)
o Sensitive Personal Information -
Imprisonment ranging from three (3) years
to six (6) years and A fine of not less than
Five hundred thousand pesos
(Php500,000.00) but not more than Four
million pesos (Php4,000,000.00)
 Improper Disposal of Personal Information and
Sensitive Personal Information
o Personal Information - Imprisonment
ranging from six (6) months to two (2) years
and A fine of not less than One hundred
thousand pesos (Php100,000.00) but not
more than Five hundred thousand pesos
(Php500,000.00)
o Sensitive Personal Information -
Imprisonment ranging from one (1) year to
three (3) years and A fine of not less than
One hundred thousand pesos
(Php100,000.00) but not more than One
million pesos PROPERTY
(Php1,000,000.00)
 Processing of Personal Information and Sensitive
Personal Information for Unauthorized Purposes
o Personal Information - Imprisonment
ranging from one (1) year and six (6)
months to five (5) years and A fine of not
less than Five hundred thousand pesos
 (Php500,000.00) but not more than One
million pesos (Php1,000,000.00)
o Sensitive Personal Information -
Imprisonment ranging from two (2) years to
seven (7) years and A fine of not less than
Five hundred thousand pesos
(Php500,000.00) but not more than Two
million pesos PROPERTY
(Php2,000,000.00)
 Unauthorized Access or Intentional Breach
o The penalty of Imprisonment ranging from
one (1) year to three (3) years and a fine of
not less than Five hundred thousand pesos
(Php500,000.00) but not more than Two
million pesos (Php2,000,000.00).
 Concealment of Security Breaches Involving
Sensitive Personal Information
o The penalty of Imprisonment of one (1) year
and six (6) months to five (5) years and a
fine of not less than Five hundred thousand
pesos (Php500,000.00) but not more than
One million pesos (Php1,000,000.00)
 Unauthorized Disclosure
o Imprisonment ranging from one (1) year to
three (3) years and a fine of not less than
Five hundred thousand pesos
(Php500,000.00) but not more than One
million pesos (Php1,000,000.00).
 Combination or Series of Acts
o Any combination or series of acts as defined
in Sections 25 to 32 shall make the person
subject to imprisonment ranging from three
(3) years to six (6) years and a fine of not
less than One million pesos
(Php1,000,000.00) but not more than Five
million pesos (Php5,000,000.00).
Slide 14: Importance
 With the phenomenal rise of internet use around the
world, and with almost everything today found in
the cloud, data protection laws have become
important tools in protecting the privacy of
individuals and consumers everywhere. Without
these laws, personal information is vulnerable to
misuse, which can not only lead to a breach of
privacy but to cybercrimes like identity theft and
transaction fraud, as well.
 The DPA brings the Philippines up-to-date with
international standards on data protection. As one of
the world’s largest users of the internet, the country
needs to ensure that its citizens’ fundamental right to
privacy is protected and preserved.
 By safeguarding the privacy rights of Filipinos, the
DPA paves the way for a sustainable free flow of
information where consumers feel safe to give out
their personal data, and government and businesses
are accountable for the responsible use of the
information they collect.
 Moreover, the Philippines has a fast-growing
business outsourcing industry where data is
transmitted and processed in large volumes every
day. The DPA provides BPO clients – local and
international – with the assurance that the data
involved in their day-to-day operations are protected
and secure.