NPC Issuance Wiki

NPC Advisory Opinion No. 2017-004 — Right to Access, Right to Data Portability and Use of Data Collected for Organizational Improvement

Issued Advisory Opinion

Text

5 January 2017

Re: RIGHT TO ACCESS, RIGHT TO DATA PORTABILITY AND USE OF DATA COLLECTED FOR THE IMPROVEMENT OF THE ORGANIZATION

Dear [Redacted],

This pertains to your query received by the National Privacy Commission (NPC) on 7 November 2016 via email. In particular, you inquired regarding the following topics:

  1. whether the Right to Access is related to the Right to Data Portability
  2. Sec. 37 of the IRR, vis-à-vis the practice of industrial engineers practicing the Lean Sigma approach in an organization.

Right to Access vis-à-vis Right to Data Portability

The right of a data subject to access his or her personal data is related to the right to data portability. The right to access is enshrined in Section 16(c) of Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), which states that a data subject, if he or she so demands, is entitled to reasonable access to the following:

  1. Contents of his or her personal information that were processed;
  2. Sources from which personal information were obtained;
  3. Names and addresses of recipients of the personal information;
  4. Manner by which such data were processed;
  5. Reasons for the disclosure of the personal information to recipients;
  6. Information on automated processes where the data will or likely to be made as the sole basis for any decision significantly affecting or will affect the data subject;
  7. Date when his or her personal information concerning the data subject were last accessed and modified; and
  8. The designation or name or identity and address of the personal information controller.

The right to data portability, on the other hand, is found in Section 18 of the statute. It refers to the right of the data subject to obtain from a personal information controller a copy of his or her personal data that is being or was processed by the latter, in an electronic or structured format (i.e., commonly used and allows for further use by the data subject). It primarily takes into account the right of the data subject to exercise control over his or her personal data that is being processed based on consent or contract, for commercial purpose, or through automated means.1

The right to data portability is based on the EU General Data Protection Regulation, which lets a data subject secure his or her personal data in an electronic format, allowing further use of the said data. In the United Kingdom (UK), the Information Commissioner’s Office describes the right as allowing individuals “to obtain and reuse their personal data for their own purposes across different services. It allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability”.2 An example would be to “provide personal current account customers access to their transactional data for their account(s), which they can then upload to a third party price comparison website to compare and identify best value. A price comparison website displays alternative current account providers based on their own calculations”.3

Based on the foregoing discussion, a person is entitled to have reasonable access to his or her personal data. He or she can also insist that, in being given such access, he be given a copy of the data in a portable format, where the said personal data is being or was processed in an electronic or structured format.

In the example you have provided, if you accomplish bank forms requiring the disclosure of personal and sensitive personal information and you would like to obtain a copy thereof, the right being invoked is the Right to Access. If the bank refuses to grant the same, you may file a complaint with the NPC. One of its functions is to enforce and effectively implement the provisions of the DPA, including those pertaining to the rights of data subjects.

Sec. 37 of the IRR, vis-à-vis the Lean Sigma approach

With regard to your second inquiry, we need additional information (i.e., facts and circumstances relative to your operations using the Lean Sigma approach), in order for us to provide you with an appropriate and accurate response.

For your reference.

Sincerely,

JAMAEL A. JACOB
Director, Privacy Policy Office

Approved:

IVY D. PATDU
Deputy Privacy Commissioner,
Policy and Planning

Footnotes

  1. IRR of RA 10173, § 36. ↩

  2. Available at https://ico.org.uk/for-organisations/data-protection-reform/overview-of-the-gdpr/individuals-rights/the-right-to-data-portability/ (last accessed Dec. 1, 2016). ↩

  3. Ibid. ↩

Backlinks

  • No backlinks found