Text
26 April 2017
Re: SCOPE OF NPC CIRCULAR NO. 16-03 AND REQUIREMENTS FOR A DATA PROTECTION OFFICER
Dear [Redacted],
This pertains to your query received by the National Privacy Commission (NPC) on 24 January 2017, via email. Specifically, you inquired regarding the following:
- Scope of NPC Circular No. 16-03 – whether the same applies to the processing of personal data in and outside the Philippines; and
- Data Protection Officer (DPO) – whether only DPOs in the government are required to be organic employees; thus, there is no similar restriction in the private sector (i.e., DPO may be engaged on a consulting basis).
NPC Circular No. 16-03
Section 1 of the Circular states:
Scope. These Rules apply to any natural and juridical person in the government or private sector processing personal data in (sic) outside of the Philippines, subject to the relevant provisions of the Act and its Implementing Rules and Regulations.
The foregoing provision declares that the scope of the Circular includes those personal data processing activities that are conducted both within and outside the Philippines. The Commission regrets any confusion that may have been caused by the typographical error.
Furthermore, note that the Circular should be read in conjunction with the applicable provisions of Republic Act No. 10173, or the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR), particularly those pertaining to the law’s extra-territorial application.1
Data Protection Officer
On 14 March 2017, the NPC issued Advisory 2017-01, which provides for guidelines on the designation of Data Protection Officers and Compliance Officers for Privacy (COP). While the Advisory is recommendatory, by default, it shall be given considerable weight by the Commission in the course of evaluating the compliance status of a personal information controller (PIC) or personal information processor (PIP) vis-à-vis the DPA, its IRR, and other relevant NPC issuances.
The pertinent portion of the document reads:
Position of the DPO or COP
The DPO or COP should be a full-time or organic employee of the PIC or PIP.
In the private sector, the DPO or COP should ideally be a regular or permanent position. Where the employment of the DPO or COP is based on a contract, the term or duration thereof should at least be two (2) years to ensure stability. (underscoring supplied)
As can be gleaned therefrom, there is no clear prohibition on the designation of a mere consultant to be the DPO or COP of an organization in the private sector.
Note, however, that the Commission’s prescription that a DPO’s or COP’s engagement or relationship with its principal (i.e., PIC or PIP) be such that it is organic or internal to the organization is premised on the qualities and functions (see: general qualifications, and duties and responsibilities of the DPO and COP) it is expected to fulfill vis-à-vis the PIC or PIP.
Accordingly, should a PIC or PIP that has a consultant for its DPO or COP be subsequently determined to have failed to comply with the DPA, and such failure is traced to a misfeasance or nonfeasance on the part of the DPO or COP, the PIC or PIP concerned will not be allowed to interpose as a defense the fact that its DPO or COP is a mere consultant who lacks any capacity or resource that would ordinarily be available to personnel organic or internal to the organization.
For your reference.
Sincerely,
RAYMUND E. LIBORO Privacy Commissioner and Chairman
Footnotes
-
see: RA 10173, §6; IRR, §4(b) and (d). ↩