Text
16 January 2017
Re: DATA SHARING AGREEMENTS IN THE PRIVATE SECTOR
Dear [Redacted],
This pertains to your query received by the National Privacy Commission (NPC) on 8 November 2016, via email, regarding the Implementing Rules and Regulations (IRR) of Republic Act No. 10173, otherwise known as the Data Privacy Act (DPA) of 2012. Specifically, you inquired regarding the following:
- Whether or not the intention of the data sharing agreement requirement under the IRR is to go beyond the EU requirements, or does it correspond to the data processing agreement requirements by the EU?
- Whether or not it is now mandatory to comply with data sharing agreement requirement, given that the IRR does not provide for a period within which existing agreements should be covered and there are no applicable implementing regulations for the private sector?
- Whether or not 1-year compliance period under Sec. 67 of the IRR applies to the data sharing agreement requirement, and, if so, how does it operate?
Data Sharing Agreements vis-à-vis EU Regulations
The requirement pertaining to data sharing agreements, as provided in the IRR, emphasizes the second of the twin state policies that constitute the NPC’s mandate, which are to: (1) protect the fundamental human right of privacy; and (2) ensure free flow of information to promote innovation and growth.1 How such requirement measures up against the provisions of the Directive 95/46/EC (EU Directive), or its successor, EU 2016/679 (General Data Protection Regulation or GDPR), is immaterial, since the Philippines is not a member of the Union and therefore not bound by its policies. Neither is the DPA nor its IRR meant to directly enforce the said EU regulations.
Compliance Period for Data Sharing Agreements
The provisions of the IRR became effective on 9 September 2016, fifteen (15) days after the latter was published in the Official Gazette.2 Thus, the need to comply therewith, including those governing data sharing arrangements, also became mandatory on that date.
The one (1)-year period for compliance provided in the IRR relates only to the registration of data processing systems or automated processing operations by personal information controllers (PIC) and personal information processors (PIP).3
NPC Circular No. 16-02, while specifically directed at data sharing agreements involving government agencies, may also be used by the private sector for additional guidance on this matter.
For your reference.
Sincerely,
JAMAEL A. JACOB Director, Privacy Policy Office
Approved:
IVY D. PATDU Deputy Privacy Commissioner, Policy and Planning