Text
25 July 2017
Re: REGISTRATION OF DATA PROCESSING SYSTEMS
Dear [Redacted],
This pertains to your query received by the National Privacy Commission (NPC) on 6 June 2017 with regard to data processing systems registration as provided in the Implementing Rules and Regulation (IRR) of the Data Privacy Act of 2012 (DPA).
Specifically, you ask for clarification on what is considered as processing that is “not occasional”, and whether there is a threshold as to the number of times personal data processing is carried out in order to qualify as someone who processes data in a manner that is “not occasional”.
For the purpose of data processing systems registration, processing will be considered occasional only if the processing is incidental, occurring only under specific circumstances and not regularly performed. In addition, any processing integral to the core activities of the PIC will not be considered occasional.
There is no particular threshold as to the number of times of processing of personal data to be considered as not occasional. As mentioned above, we may consider whether the processing is integral to the core activities of the personal information controller to determine whether such processing is to be considered occasional or not.
Please note, however, that these are general principles, subject to further evaluation, on a case to case basis.
For your reference.
Sincerely,
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman