Philippines

Franchette M. Acosta

Automated Decision-Making Operations, Institutions Likely to Pose Threats to Data Subjects and Phase 1 and Phase 2 of Registration with the NPC

By Franchette M. Acosta, Senior Partner, Villaraza & Angangco

Email: fm.acosta@thefirmva.com

On 31 July 2017 the National Privacy Commission (NPC) issued a Circular to further clarify the implementing rules and regulations of the Data Privacy Act. The Circular will take effect upon full compliance with publication requirements.

Under the Data Privacy Act and its rules, all Personal Information Controllers (PIC) and Personal Information Processors (PIP) with fewer than 250 employees are not required to register their data processing systems unless the processing carried out is likely to pose a risk to the rights and freedoms of data subjects, is not occasional, or includes sensitive personal information of at least 1,000 individuals. Processing of personal data will not be considered occasional if processing constitutes a core activity of the PIC or PIP. Processing operations that pose a risk to data subjects are those involving information that would likely affect national security, public safety, public order or public health, information required by applicable laws or rules to be confidential, vulnerable data subjects (such as minors, the mentally ill, asylum seekers, elderly patients), automated-decision making, or profiling. The Circular identifies the processing of personal data by the following sectors or institutions as either likely to pose a risk to the rights and freedoms of data subjects or not occasional:

  • Telecommunications networks, internet services providers and other entities or organizations providing similar services;

  • Business process outsourcing companies;

  • Universities, colleges and other institutions of higher learning, all other schools and training institutions;

  • Hospitals including primary care facilities, multi-specialty clinics, custodial care facilities, diagnostic or therapeutic facilities, specialized out-patient facilities and other organizations processing genetic data;

  • Providers of insurance undertaking, including life and non-life companies, pre-need companies and insurance brokers;

  • Bank and non-bank financial institutions;

  • Businesses involved mainly in direct marketing, networking and companies providing reward cards and royalty programs;

  • Pharmaceutical companies engaged in research;

  • PIPs processing personal data for a PIC included in the preceding items and data processing systems involving automated decision-making; and

  • Government branches, bodies or entities, including the national government, agencies, bureaus or offices, constitutional commissions, local government units, government –owned and controlled corporations.

Automated decision making refers to a wholly or partially automated decision-making processes that significantly affect the data subject. It includes profiling based on economic situation, political or religious beliefs, behavioral or marketing activities, electronic communication data and financial data.

PIC and PIP registration with the NPC is completed in 2 phases:

Phase I: Submission of prescribed application form of a PIC or PIP through its Data Protection Officer (DPO).

Phase II: DPO shall provide all relevant information regarding its data processing systems through the NPC online registration system, such as:

  • Purpose and mandate of the entity;

  • All existing policies relating to data governance, data privacy and information security;

  • Data processing certifications attained by the PIC or PIP including personnel;

  • Description of the data processing systems, including: name of the system, purposes or purposes of processing, whether processing is done as PIC, PIP or both, whether the system is outsourced or subcontracted, categories of data subjects and their personal data or categories thereof; recipients or categories of recipients to whom the personal data might be disclosed; and whether personal data is transferred outside the Philippines; and

  • Notification regarding any automated decision-making operation.

Phase 1 must be completed by 9 September 2017. Phase II shall be completed on or before 8 March 2018. The NPC will issue a certificate of registration in favor of the PIC or PIP after successful registration. The certificate of registration shall be valid only until 8 March of the next following year. An application for renewal may be filed within 2 months prior to but not later than the 8th of March of every year. A PIC or PIP who has failed to comply with the registration requirements shall be subject to cease and desist orders or payment of fines in accordance with a schedule to be issued by the NPC.

The above summary of NPC Circular 17-01 is for information purposes only and is not intended to constitute legal advice.

http://www.thefirmva.com

Tags: Compliance, Cyber Security, Data Privacy, The Philippines
Articles by Lawyer
Law Passed Strengthening Consumer Protection in the Philippines
On December 19, 2017, the Gift Check Act of 2017 (Republic Act No. 10962) was signed into law ...
Philippines: Timing for Notification under the PCC Rules on Merger Procedure
The Philippine Competition Commission published its Rules on Merger Procedure ...
Joint Venture Agreements with Philippine Local Government Units as Public-Private Partnership Modality
The Duterte Administration is poised to fund its aggressive infrastructure program internally and through official development assistance ...
Philippine Competition Commission Merger Review Guidelines
On 23 March 2017 the The Philippine Competition Commission (PCC) released the Merger Review Guidelines ...
Related Articles by Firm
Philippines: Bureau of Internal Revenue Clarifies Taxes on Offshore Gaming
The Bureau of Internal Revenue (BIR) issued Revenue Circular No. 102-2017 clarifying the tax imposed on entities engaged in Philippine offshore gaming operations ...
Law Passed Strengthening Consumer Protection in the Philippines
On December 19, 2017, the Gift Check Act of 2017 (Republic Act No. 10962) was signed into law ...
Casino Covered by Philippine Anti-Money Laundering Laws
The Philippine government has expanded anti-money laundering laws to include casinos, including internet and ship-based casinos ...
Philippine rules on merger procedure
The Philippine Competition Commission issued the Rules on Merger Procedure which explain the timing for the filing of a notice for covered transactions, the procedure for notification, Phase 1 and Phase 2 review and other matters, including confidentiality claims ...
Philippines: Timing for Notification under the PCC Rules on Merger Procedure
The Philippine Competition Commission published its Rules on Merger Procedure ...
Joint Venture Agreements with Philippine Local Government Units as Public-Private Partnership Modality
The Duterte Administration is poised to fund its aggressive infrastructure program internally and through official development assistance ...
Philippine Competition Commission Merger Review Guidelines
On 23 March 2017 the The Philippine Competition Commission (PCC) released the Merger Review Guidelines ...
Related Articles
India: Valuation by Registered Valuer
“Price is what you pay, Value is what you get” ...
Data Protection and Cyber Security Law in Thailand
It is perceived that Thailand does not have adequate protection covering this very fast developing environment ...
Related Articles by Jurisdiction
Virtual currency in the Philippines: Recognition and regulation
Bitcoin is essentially a virtual currency (VC), which is any type of digital unit that is used as a medium of exchange — a veritable currency that exists in the digital world. Since it is electronic currency, VC is easily transferable ...
Philippines: Psychological disorders in the workplace
The problem of mental health presents a particular conundrum under labour relations and standards ...
M&A
Our M&A Report includes SyCip Salazar Hernandez & Gatmaitan's article 'Further liberalisation and consolidation of the banking sector' and Phoenix Legal's contribution 'M&A Booster – New Companies Act has it all easy and ...
Latest Articles
India: Valuation by Registered Valuer
“Price is what you pay, Value is what you get” ...
Data Protection and Cyber Security Law in Thailand
It is perceived that Thailand does not have adequate protection covering this very fast developing environment ...