NPC Issuance Wiki

NPC Advisory Opinion No. 2017-002 — Registration of Processing System Limited Only to Activities of the Human Resources Department

Issued Advisory Opinion

Text

5 January 2017

Re: REGISTRATION OF PROCESSING SYSTEM LIMITED ONLY TO ACTIVITIES OF THE HUMAN RESOURCES DEPARTMENT

Dear [Redacted],

This pertains to your query received by the National Privacy Commission on 8 November 2016 via email.

As per your representation, Ecozone Logistics Services Enterprise (ECOZONE, for brevity) is a PEZA-registered company engaged in the processing of its employees’ personal information. It wishes to clarify if it is required to register with the Commission given that its processing of personal information is “limited only to the usual processing activities of the Human Resources Department” (e.g., job application, social security, insurance, etc.).

Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing, unless the entity is able to sufficiently establish that the information being processed is exempt from the Act’s coverage.1

Given that ECOZONE is involved in the processing of job applications, social security requirements, and insurance information—all considered as personal and/or sensitive personal information under the law2—it must comply with the provisions of the DPA and its IRR, including those pertaining to the registration of personal data processing systems.

Accordingly, please refer to Section 47 of the Implementing Rules and Regulations (IRR) of the DPA, which states that personal information controllers or personal information processors that employ fewer than two hundred fifty (250) persons are not required to register their data processing system unless:

  1. The processing it carries out is likely to pose a risk to the rights and freedoms of the data subjects;
  2. The processing is not occasional; or
  3. The processing includes sensitive personal information of at least one thousand (1,000) individuals.

ECOZONE must evaluate its operations vis-à-vis the foregoing factors in order to determine if it is required to register its personal data processing system with the Commission.

For your reference.

Sincerely,

JAMAEL A. JACOB
Director, Privacy Policy Office

Approved:

IVY D. PATDU
Deputy Privacy Commissioner,
Policy and Planning

Footnotes

  1. Republic Act No. 10173, § 4. ↩

  2. Id., § 3(g) and (l). ↩

Backlinks

  • No backlinks found