Ra 10173

lOMoARcPSD|38482560
NCM 108 - Data Privacy Act of 2012 (RA 10173)
Health Care Ethics (Bioethics) (University of Perpetual Help System Jonelta)
Scan to open on Studocu
Studocu is not sponsored or endorsed by any college or university

Downloaded by Maria Antonnette Golo Gilos (mariaantonnettegologilos@gmail.com)
lOMoARcPSD|38482560
Data Privacy Act of 2012 (RA 10173)

"Data is more valuable than Money. If someone takes your money, that's
all they have. If you let someone take your data, they may eventually take
your money too!" In today's environment, where competitors can copy
your products, pirate your employees, and mirror your algorithms, data is
the only sustainable competitive advantage. -Deputy Privacy
Commissioner Dondi Mapa
ROOT CAUSES OF BREACH
47% - Malicious or criminal attack
29% - System Glitch
24% - Human Error
HOW DO PRIVACY BREACHES OCCUR?
Lost or stolen laptops, removable storage devices, or paper records containing personal
information
Hard disk drives and other digital storage media (integrated in other devices, for
example, multifunction printers, or otherwise) being disposed of or returned to equipment
lessors without the contents first being erased
Databases containing personal information being 'hacked' into or otherwise illegally

accessed by individuals outside of the agency or organization
Impact of data breaches on businesses:
Loss of reputation
Loss of marketing share
Legal liabilities
RIGHT TO PRIVACY
The right to be let alone.
Data Privacy Act of 2012 (RA 10173) 1

lOMoARcPSD|38482560
The most comprehensive of rights and the right most valued by civilized men.
HIPPOCRATIC OATH
“Whatever I see or hear, whether professionally or privately which ought not to be divulged, I
will keep secret and tell no one.” -Hippocrates
What is the Data Privacy Act of 2012?
SECTION 1. Short Title. — This Act shall be known as the "Data Privacy Act of 2012".
Republic Act 10173, the Data Privacy Act of 2012
An act protecting individual personal information in information and communications

systems in the government and the private sector, creating for this purpose a national
privacy commission, and for other purposes
The National Privacy Commission (NPC) is a body that is mandated to administer and
implement this law. The functions of the NPC include:
rule-making
advisory
public education
compliance and monitoring
investigations and complaints
enforcement.
Senator Edgardo J. Angara
Main Author of R.A. 10173 and the NPC Commissioners
Timeline of DPA Law and IRRS passed to Organization's Compliance
2012 — Data Privacy Act (DPA) Passed into law
March 2016 — National Privacy Commission (NPC) was formed
August 2016 — Implementing rules and Regulations (IRRs) was published
Sept. 9, 2016 — IRRs came into effect (comply with all provisions except registration
requirements)
Sept. 9, 2017 — Comply with registration requirements

lOMoARcPSD|38482560
Sept 9, 2016-2017: exactly 12 months.
Registration Requirements: All personal data processing systems (DPS) operating in the
Philippines that involve Personally Identifiable Information (PII) concerning at least 1,000
individuals/personal records must be registered with NPC
Doctor-Patient Confidentiality
Full disclosure of information on the part of the patient is a prerequisite to quality care and
better health outcomes.
Communication between doctor and patient is generally considered privileged and should
not be inquired upon even by the Courts. The provision is intended to make sure that
information obtained by physicians in the course of treatment will not be used to blacken the
reputation of a patient (Rules of Court).
Protecting Patients from Harm includes Respect for their Right to Privacy
Health information is valuable and its unauthorized use or disclosure may put patients at risk
for unwanted publicity, discrimination, identity theft and other acts prejudicial to the patient.
Right to Information Privacy
The individual's ability to control the flow of information concerning or describing him,
which however legitimate public must be overbalanced by concerns. To deprive an
individual of his power to control or determine whom to share information of his details
would deny him of his right to personal his own personhood.
Data Privacy Act

lOMoARcPSD|38482560
It is the policy of the State to protect the fundamental human right of privacy, of
communication while ensuring free flow of information to promote innovation and growth.
SCOPE OF THE DATA PRIVACY ACT
Processing of Personal Data
Data Subjects
National Privacy Commission
Those who process Personal Data
Data Privacy Act applies to the processing of personal data by any natural and juridical
person in the government or private sector.
Personal Data
Any information from which the identity of an individual is apparent
Any information that can be put together with other information to reasonably and directly
identify an individual
Includes sensitive personal information such as your health, education, genetic or sexual life
Includes information that is classified or privileged
CLASSIFICATION OF PERSONAL DATA
1. Personal Information

lOMoARcPSD|38482560
Personal information refers to any information whether recorded in a material form or not,
from which the identity of an individual is apparent or can be reasonably and directly
ascertained by the entity holding the information, or when put together with other
information would directly and certainly identify an individual.
2. Sensitive Personal Information.
Refers to personal information about an individual's: race, ethnic origin, marital status, age,
color, religious, philosophical or political affiliations, health, education, genetics, sexual life,
any proceeding for any offense committed or alleged to have been committed, the disposal
of such proceedings, the sentence of any court in such proceedings;
Also includes information issued by government agencies peculiar to an individual which

includes, but not limited to: social security numbers, previous or current health records,
licenses or its denials, suspension or revocation, and tax returns; and specifically established
by an executive order or an act of Congress to be kept classified.
PERSONAL DATA
Personal Information
Name
Address
Place of work
Telephone number
Gender
Location of an individual at a particular time
IP address
Birth date
Birth place
Country of citizenship
Citizenship status
Payroll & benefits information
Contact information

lOMoARcPSD|38482560
Sensitive Personal Information (List based on IRR - Internal Rate Of Return)
Race
Ethnic origin
Marital status
Age
Color
Religious affiliation
Philosophical affiliation
Political affiliation
Health
Education
Genetics
Sexual life
Proceeding for any offense committed or alleged to have been committed, the disposal of
such proceeding, the sentence of any court in such proceedings
Social security number
Licenses or its denials, suspension or revocation
Tax returns
Other personal info issued by government agencies
Bank and credit/debit card numbers
Websites visited
Materials downloaded
Any other information reflecting preferences and behaviors of an individual
Grievance information
Discipline information
Leave of absence reason

lOMoARcPSD|38482560
Licenses or its denials, suspension or revocation
Privileged Information (List based on Rules of Court)
Data received within the context of a protected relationship - husband and wife
Data received within the context of a protected relationship - attorney and client
Data received within the context of a protected relationship - priest and penitent
Data received within the context of a protected relationship - doctor and patient
Personal Data Lifecycle Acquisition
1. Acquisition
2. Storage
3. Use
4. Transfer
5. Destruction
Retention/Disposal should be based on:
1. Law
2. Industry Best Practice
3. Business Needs
Key considerations when listing your personal data:
What personal data do you collect?
In what form and through which channels? For what purpose do you collect personal data?

lOMoARcPSD|38482560
How is it used?
Who is this data shared with internally and externally?
Who is authorized to access this data?
Where do you keep your data?
How long do you keep your data?
How do you dispose of this data?
Are these personal data?
1. Man born on June 19, 1861
2. Philippine national hero born on June 19, 1861
3. Jose Protacio Rizal
4. Basta picture ni Rizal
DE-IDENTIFICATION
Geographic subdivisions smaller than a state, including street address, city, county, precinct,
ZIP Code, equivalent geocodes, except for the initial three digits of the ZIP code if more
than 20,000 people
All elements of dates except years (ages over 89 → age 90 or older)
Telephone numbers
Fax numbers
Email addresses
Social security numbers
Medical record numbers
Health plan beneficiary
Account numbers
Certificate/license numbers
Vehicle identifiers and serial numbers including license plates
Device identifiers and serial numbers

lOMoARcPSD|38482560
Web URLs
Internet protocol addresses
Biometric identifiers (i.e. retinal scans, fingerprints)
Photos
Any unique identifying number, characteristic or code
Those who process Personal Data:
Personal Information Controller (PIC)
Individual, Corporation, other body the one who controls the processing of personal
data, the one who decides
There is control if the natural or juridical person or any other body decides on what
information is collected, or the purpose or extent of its processing.
Personal Information Processor (PIP)
Individual, Corporation or other body who processes the personal data for a Personal
Information Controller
Personal information processor should not make use of personal data for its own
purpose
KEY ROLES IN THE DATA PRIVACY ACT
Data Subjects
Refers to an individual whose, sensitive personal, or privileged information is processed

personal
Personal Information Controller (PIC)
Controls the processing of personal data, or instructs another to process personal data on
its behalf.
Personal Information Processor (PIP)
Organization or individual whom a personal information controller may outsource or

instruct the processing of personal data pertaining to a data subject
Data Protection Officer (DPO)
Responsible for the overall management of compliance to DPA

lOMoARcPSD|38482560
National Privacy Commission
Independent body mandated to administer and implement the DPA of 2012, and to
monitor and ensure compliance of the country with international standards set for
personal data protection
DATA PRIVACY PRINCIPLE
Principles of DPA
Transparency
Legitimacy
Proportionality
A. GENERAL DATA PRIVACY PRINCIPLES: TRANSPARENCY
The data subject must be aware of the nature, purpose, and extent of the processing of his or
her personal data, including the risks and safeguards involved, the identity of the personal
information controller, his or her rights as a data subject, and how these can be exercised.
Any information and communication relating to the processing of personal data should be
easy to access and understand, using clear and plain language.

lOMoARcPSD|38482560
PRIVACY NOTICE
WHAT personal data will be collected
WHY personal data is processed
Purposes of collection and processing, including direct marketing, profiling or research;
Basis of processing not based on the consent of the data subject;
HOW personal data will be collected, used, accessed and stored, including security measures
in place
Automated processing that will be basis of making decisions that would affect data
subject
The period for which the information will be stored
WHO will process personal data
The identity and contact details of the personal data controller or its representative
The recipients or classes of recipients to whom the personal data are or may be
disclosed
Transfer of personal data outside the country
RIGHTS OF DATA SUBJECTS, including the right to file a complaint before the National
Privacy Commission.
RIGHTS OF DATA SUBJECTS - IRR
Right to Information
Right to Object
Right to Access
Right to Correct
Right to Erase
Right to Damages
Right to Data Portability
Right to File a Complaint
Right to be Informed

lOMoARcPSD|38482560
IRR, Section 34. a
Under R.A. 10173, your personal data is treated almost literally in the same way as your
own personal property. Thus, it should never be collected, processed and stored by any
organization without your explicit consent, unless otherwise provided by law. Information
controllers usually solicit your consent through a privacy notice. Aside from protecting you
against unfair means of personal data collection, this right also requires personal information
controllers (PICS) to notify you if your data have been compromised, in a timely manner.
As a data subject, you have the right to be informed that your personal data will be, are
being, or were, collected and processed.
The Right to be Informed is a most basic right as it empowers you as a data subject to
consider other actions to protect your data privacy and assert your other privacy rights.
Right to Object
IRR, Section 34. b
Your consent is necessary before any organization can LAWFULLY collect and process your
personal data. If without your consent, any such collection and processing of personal
information by any organization can be contested as unlawful or ILLEGAL, and would
therefore be answerable to the Data Privacy Act of 2012.
In case you already gave your consent by agreeing to an organization's privacy notice, you
can withdraw consent if the personal information processor decided to amend said notice. In
fact, the personal information processor has the obligation to notify you of changes to their
privacy notice and must explicitly solicit your consent once again.
Right to Access
IRR, Section 34. c
This is your right to find out whether an organization holds any personal data about you and
if so, gain "reasonable access” to them. Through this right, you may also ask them to provide
you with a written description of the kind of information they have about you as well as their
purpose/s for holding them.
Under the Data Privacy Act of 2012, you have a right to obtain from an organization a copy
of any information relating to you that they have on their computer database and/or manual
filing system. It should be provided in an easy-to-access format, accompanied with a full
explanation executed in plain language.

lOMoARcPSD|38482560
You may demand to access the following:
The contents of your personal data that were processed.
The sources from which they were obtained.
Names and addresses of the recipients of your data.
Manner by which they were processed.
Reasons for disclosure to recipients, if there were any.
Information on automated systems where your data is or may be available, and how it
may affect you.
Date when your data was last accessed and modified
The identity and address of the personal information controller.
Right to Erasure or Blocking
IRR, Section 34. e
Under the law, you have the right to suspend, withdraw or order the blocking, removal or
destruction of your personal data. You can exercise this right upon discovery and substantial
proof of the following:
Your personal data is incomplete, outdated, false, or unlawfully obtained.
It is being used for purposes you did not authorize.
The data is no longer necessary for the purposes for which they were collected.
You decided to withdraw consent, or you object to its processing and there is no overriding
legal ground for its processing.
The data concerns information prejudicial to the data subject - unless justified by freedom of
speech, of expression, or of the press; or otherwise authorized (by court of law)
The processing is unlawful.
The personal information controller, or the personal information processor, violated your
rights as a data subject.
Right to Damages
IRR, Section 34. f

lOMoARcPSD|38482560
You may claim compensation if you suffered damages due to inaccurate, incomplete,
outdated, false, unlawfully obtained or unauthorized use of personal data, considering any
violation of your rights and freedoms as data subject.
Right to Correct (Rectification)
IRR, Section 34. d
You have the right to dispute and have corrected any inaccuracy or error in the data a
personal information controller (PIC) holds about you. The PIC should act on it immediately
and accordingly, unless the request is vexatious or unreasonable. Once corrected, the PIC
should ensure that your access and receipt of both new and retracted information. PICs
should also furnish third parties with said information, should you request it.
Right to Data Portability
IRR, Section 36
This right assures that YOU remain in full control of YOUR data. Data portability allows
you to obtain and electronically move, copy or transfer your data in a secure manner, for
further use. It enables the free flow of your personal information across the internet and
organizations, according to your preference. This is important especially now that several
organizations and services can reuse the same data.
Data portability allows you to manage your personal data in your private device, and to
transmit your data from one personal information controller to another. As such, it promotes
competition that fosters better services for the public.
Transmissibility of Rights
IRR, Section 35
Just like any physical property, such as real estate, you can assign your rights as a data
subject to your legal assignee or lawful heir. Similarly, you may assert another person's
rights as a data subject, provided he or she authorized you as a "legal assignee".
You may also invoke another person's data privacy rights after his or her death if you are his
or her legal heir. This same principle applies to parents of minors, or their legal guardian,
who are responsible for asserting their rights on their behalf.
This right, however, is not applicable in case the processed personal data being contested are
used only for scientific and statistical research.

lOMoARcPSD|38482560
Limitations on Rights
The provisions of the law regarding transmissibility of rights and the right to data portability
will not apply if the processed personal data are used only for the needs of scientific and
statistical research and, based on such, no activities are carried out and no decisions are
taken regarding the data subject. There should also be an assurance that the personal data
will be held under strict confidentiality and used only for the declared purpose.
They will not also apply to the processing of personal data gathered for investigations in
relation to any criminal, administrative or tax liabilities of a data subject. Any limitations on
the rights of the data subject should only be to the minimum extent necessary to achieve the
purpose of said research or investigation.
B. GENERAL DATA PRIVACY PRINCIPLES: LEGITIMATE PURPOSE
Legitimate purpose — The processing of information shall be compatible with a declared

and specified purpose which must not be contrary to law, morals, or public policy.
Processing of personal data should have the individual's consent, or must be authorized
by the Constitution or by law.
“IF IT'S NOT CLEAR CLEAR, IT'S NOT CONSENT”
CONSENT — refers to any freely given, specific, informed indication of will, whereby the
data subject agrees to the collection and processing of personal information about and/or
relating to him or her
The consent shall be evidenced by written, electronic or recorded means.
CASE STUDY (1/97)
The complainant attended the accident and emergency department of a public hospital. A
few months later, she was contacted by an organization carrying out research. The
researchers knew when she had attended the hospital and why, and they asked her to answer
some questions.
The Hospital was in fact aware of its obligations under the Data Protection Act, but it
contended that it had met these in two ways:
It listed "personnel engaged in medical research" as disclosed in its entry in the Public
Register of Data Controllers.

lOMoARcPSD|38482560
It made patients aware of the research project by putting a NOTICE in the waiting area
of the accident and emergency department. This notice told patients that the hospital
intended to disclose their information to the researchers, and invited them to let
the receptionist know if they objected.
On the Noticed Placed in the waiting area: The issue to be decided was whether this was
an adequate way of informing patients that their information would be disclosed to the
researchers.
In different circumstances, it might have been. In this case, however, accounts ought to
have been taken of the particular environment in which patients' data were obtained.
Many patients presenting themselves at the casualty department of a hospital may be
expected to be in a state of some anxiety or discomfort. Consequently, they may not be
expected to be alert to matters not relating directly to their condition. In such
circumstances there is a special need for the data controller to satisfy itself that any uses
of the data which are unlikely to be anticipated by the data subject are fully explained.
“SOMETIMES, CONSENT IS NOT NECESSARY”

Personal Information (NOT SENSITIVE)
Contractual or Legal Obligation
To protect life, health, vitally important interests
Legitimate interests
National Emergency, public order, public safety
Personal Information (SENSITIVE)
Law/Regulation
Provided to government under legal mandate
Protection of rights in court
To protect life and health
When is consent NOT required?
Processing is necessary to protect the life and health of the data subject or another person,
and the data subject is not legally or physically able to express his or her consent prior to the
processing (Emergency, Public Health Emergency)

lOMoARcPSD|38482560
Processing is necessary for purposes of medical treatment, is carried out by a medical

practitioner or a medical treatment institution, and an adequate level of protection of
personal information is ensured
Sample Violations Medical Treatment?
Johns Hopkins Hospital to pay $190M settlement after gynecologist secretly recorded
patients.
GENERAL DATA PRIVACY PRINCIPLES: PROPORTIONALITY
Proportionality — The processing of information shall be adequate, relevant, suitable,

necessary, and not excessive in relation to a declared and specified purpose. Personal data
shall be processed only if the purpose of the processing could not reasonably be fulfilled by
other means.

lOMoARcPSD|38482560
SECURITY MEASURES
ORGANIZATIONAL SECURITY MEASURES
Data Protection Officer (DPO)
Relevant privacy or data protection policies and practices
Processing operations
Sector or Industry

lOMoARcPSD|38482560
The DPO should possess specialized knowledge and demonstrate reliability necessary for
the performance of his or her duties and responsibilities.
Privacy Impact Assessment
Personal Data Flow
Source and Collection
Accountable and responsible persons
Purpose of processing Personal Data Processing
Security measures
Transfer outside country
Identify and Assess Privacy Risks
Privacy Risk Identification Privacy Risk Analysis
Privacy Risk Evaluation (Level of Impact and Likelihood of Risks)
Address risks
Privacy Manual
Overview
Scope and Limitations
Records of Processing Activities
Data Protection Policies and Security Measures
Policies and procedures for data subjects to exercise their rights under the Act
Regular review and monitoring of privacy and security policies
PROCEDURE FOR COLLECTION, USE OR DISCLOSURE, STORAGE AND

DISPOSAL OF PERSONAL DATA
Revised Rules of Evidence, Rules of Court, Section 24 (c), Rule 128: Disqualification by
(March 14, 1989) reason of privileged communication. The
following persons cannot testify as to matters
learned in confidence in the following cases:
A person authorized to practice medicine,
surgery or obstetrics cannot in a civil case,

lOMoARcPSD|38482560
without the consent of the patient, be

examined as to any advice or treatment given
by him or any information which he may have
acquired in attending such patient in a
professional capacity, which information was
necessary to enable him to act in capacity, and
which would blacken the reputation of the
patient.
Section 44. Confidentiality. All records

pertaining to cases of violence against women
and their children including those in the
barangay shall be confidential and all public
officers and employees and public or private
clinics to hospitals shall respect the right to
An Act Defining Violence Against Women privacy of the victim. Whoever publishes or
and Their Children, Providing for Protective causes to be published, in any format, the
Measures for Victims, Prescribing Penalties name, address, telephone number, school,
Therefore, and for Other Purposes, "Anti- business address, employer, or other
Violence Against Women and Their Children identifying information of a victim or an
Act of 2004", Republic Act No. 9262, (March immediate family member, without the latter's
8, 2004) consent, shall be liable to the contempt power
of the court.
Any person who violates this provision shall

suffer the penalty of one (1) year
imprisonment and a fine of not more than Five
Hundred Thousand pesos (P500,000.00).
Philippine National AIDS Council Sec. 41. Medical Confidentiality. Medical

Resolution No. 1, Rules and Regulations confidentiality shall protect and uphold the
Implementing the Philippine AIDS right to privacy of an individual who
Prevention and Control Act of 1994 (RA undergoes HIV testing or is diagnosed to have
8504). (April 13, 1999) HIV. It includes safeguarding all medical
records obtained by health professionals,
health instructors, co-workers, employers,
recruitment agencies, insurance companies,
data encoders, and other custodians of said
record, file, or data.
Confidentiality shall encompass all forms of

communication that directly or indirectly lead

lOMoARcPSD|38482560
to the disclosure of information on the identity

or health status of any person who undergoes
HIV testing or is diagnosed to have HIV. This
information may include but is not limited to
the name, address, picture, physical
description or any other characteristic of a
person which may lead to his/her
identification.
To safeguard the confidentiality of a person's

HIV/AIDS record, protocols and policies shall
be adopted by concerned officials, agencies
and institutions.
SOCIAL MEDIA POLICY
Recommendations for Social Media Use in Hospitals and Health Care Facilities
Social Media is the new avenue for creating connections and sharing of information.
Through social media, one can reach a global community. In recent years, we have seen how
social media has changed the way we do things. Social Media has been extensively utilized
for health education and promotion, proving itself to be an invaluable tool for public health,
professional networking and patient care benefit.
PHYSICAL SECURITY MEASURES
Design of office space and workstations, including the physical arrangement of furniture and
equipment, shall provide privacy to anyone processing personal data, taking into
consideration the environment and accessibility to the public
The room and workstation used in the processing of personal data shall, as far as practicable,
be secured against natural disasters, power disturbances, external access. and other similar
threats.
Record rooms, work stations, and data centers should have limited access.
TECHNICAL SECURITY MEASURES
security policy system monitoring
safeguards: encryption, authentication process
incident response, correct and mitigate breach, restore system

lOMoARcPSD|38482560
National Privacy Commission Issuances
16-01 — security of personal data in government agencies
16-02 — data sharing agreements involving government agencies
16-03 — personal data breach management
circular 17-01 — registration of data processing systems
advisory 17-01 — designation of data protection officers
16-04 — rules of procedure of the national privacy commission
WHY SHOULD PERSONAL DATA BE PROTECTED? (Accountability)
CRIME PENALTIES
Processing information when not authorized (purpose other than

medical treatment)
Processing of Personal/Sensitive
Information for Unauthorized
1 year 6 months - 7 years
Purpose
Php500,000 - Php2,000,000
Persons who provide access due to negligence shall be liable
Access to Personal/Sensitive
1-6 years
Information due to Negligence
Php500,000 - Php4,000,000
Duty to notify Privacy Commission in case of breach
Concealment of Security Breach 1 year 6 months - 5 years
Php500,000 - Php1,000,000
Negligently dispose, discard or abandon personal data of an in

an area accessible to the public or placed in its container for
trash collection.
Improper Disposal
6 months - 3 years
Php 100,000 - Php 1,000,000

lOMoARcPSD|38482560
"In this digital era, information is the currency of power - valuable,

coveted, but at a very high risk.” -Sénator Edgardo Angara, sponsorship
speech for the Data Privacy Act
What can you buy with your personal data?

Ra 10173

Uploaded by

Copyright:

Available Formats

You might also like

Ra 10173

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Ra 10173

Uploaded by

Copyright:

Available Formats

lOMoARcPSD|38482560

NCM 108 - Data Privacy Act of 2012 (RA 10173)

Health Care Ethics (Bioethics) (University of Perpetual Help System Jonelta)

Scan to open on Studocu

Studocu is not sponsored or endorsed by any college or university

Data Privacy Act of 2012 (RA 10173)

ROOT CAUSES OF BREACH

47% - Malicious or criminal attack

29% - System Glitch

24% - Human Error

HOW DO PRIVACY BREACHES OCCUR?

Databases containing personal information being 'hacked' into or otherwise illegally

Impact of data breaches on businesses:

Loss of marketing share

The right to be let alone.

Data Privacy Act of 2012 (RA 10173) 1

Downloaded by Maria Antonnette Golo Gilos (mariaantonnettegologilos@gmail.com)

What is the Data Privacy Act of 2012?

Republic Act 10173, the Data Privacy Act of 2012

An act protecting individual personal information in information and communications

compliance and monitoring

investigations and complaints

Senator Edgardo J. Angara

Main Author of R.A. 10173 and the NPC Commissioners

Timeline of DPA Law and IRRS passed to Organization's Compliance

2012 — Data Privacy Act (DPA) Passed into law

March 2016 — National Privacy Commission (NPC) was formed

August 2016 — Implementing rules and Regulations (IRRs) was published

Sept. 9, 2017 — Comply with registration requirements

Data Privacy Act of 2012 (RA 10173) 2

Downloaded by Maria Antonnette Golo Gilos (mariaantonnettegologilos@gmail.com)

Sept 9, 2016-2017: exactly 12 months.

Right to Information Privacy

Data Privacy Act

Data Privacy Act of 2012 (RA 10173) 3

Downloaded by Maria Antonnette Golo Gilos (mariaantonnettegologilos@gmail.com)

SCOPE OF THE DATA PRIVACY ACT

Processing of Personal Data

National Privacy Commission

Those who process Personal Data

Any information from which the identity of an individual is apparent

Includes information that is classified or privileged

CLASSIFICATION OF PERSONAL DATA

Data Privacy Act of 2012 (RA 10173) 4

Downloaded by Maria Antonnette Golo Gilos (mariaantonnettegologilos@gmail.com)

2. Sensitive Personal Information.

Also includes information issued by government agencies peculiar to an individual which

Location of an individual at a particular time

Payroll & benefits information

Data Privacy Act of 2012 (RA 10173) 5

Downloaded by Maria Antonnette Golo Gilos (mariaantonnettegologilos@gmail.com)

Sensitive Personal Information (List based on IRR - Internal Rate Of Return)

Social security number

Licenses or its denials, suspension or revocation

Other personal info issued by government agencies

Bank and credit/debit card numbers

Any other information reflecting preferences and behaviors of an individual

Leave of absence reason