NPC Issuance Wiki

NPC Advisory Opinion No. 2017-037 — Queries on Data Privacy Act of 2012

Issued Advisory Opinion

Text

27 July 2017

Re: QUERIES ON DATA PRIVACY ACT OF 2012

Dear [Redacted],

This pertains to your query received by the National Privacy Commission (NPC) on 05 April 2017, via email, regarding Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), particularly on the designation of a data protection officer (DPO) and the registration of data processing systems.

We confirm that as a general rule, the designation of a DPO is mandatory for all personal information controllers (PICs) and personal information processors (PIPs).1 In certain instances2, the PIC or PIP may designate a Compliance Officer for Privacy (COP).3

On the other hand, the registration of data processing systems is required under Section 47 of the IRR, which states that “the personal information controller or personal information processor that employs fewer than two hundred fifty (250) persons shall not be required to register unless the processing it carries out is likely to pose a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes sensitive personal information of at least one thousand (1,000) individuals.”4

Thus, the general rule is that every personal information controller or personal information processor which employs at least two hundred fifty (250) employees will be required to register its data processing system/s.

For those with less than two hundred fifty employees, they will only be required to register if any of the following circumstances is present:

  1. Processing poses a risk to the rights and freedoms of data subjects;
  2. Processing is regular; or
  3. Processing includes sensitive personal information of at least one thousand (1,000) individuals

The form you have on hand is part of the Phase One of the Registration of Data Processing Systems. Thus, it will be used only by those PICs or PIPs who are required to register their data processing system/s, pursuant to the circumstances enumerated above.

The appointment or designation of the DPO or COP of those PICs or PIPs who are not required to register their data processing system/s need not formally file any designation document with the NPC. The DPA and its IRR did not specify the need to formally inform or register with the NPC of the designation or appointment of DPO/COP of each PIC or PIP.

Scenario 1

Company A (which employs less than 250 employees and does not process sensitive personal information of at least 1,000 individuals) has organic employees with access to Company B’s system like Company B’s system application and products and data processing (SAP), which contains sensitive personal information of more than 1,000 individuals. Is Company A required to register?

There may be a need to further clarify the meaning of “access” of the organic employees of Company A to the data processing system of Company B.

Where Company A’s employees have access to the data processing system of Company B because Company A uses the said system in order to process the personal data contained therein for its own purpose, then we believe that Company A is required to register as it processes sensitive personal information of more than 1,000 individuals. Company A and B are both PICs engaged in data sharing.

Similarly, if Company A’s employees’ access to the data processing system of Company B is pursuant to instructions of Company B, in order for the former to use the said system and process the personal data as instructed by the latter, we believe that Company A is also required to register as it processes sensitive personal information of more than 1,000 individuals. In this case, there is an outsourcing or subcontracting agreement between Company B as the PIC and Company A as the PIP.

Scenario 2

Company C (which employs less than 250 employees and does not process sensitive personal information of at least 1,000 individuals) contracted Company D to perform all of Company C’s finance and accounting functions. Company D (which processes sensitive personal information of at least 1,000 individuals) uses SAP system. Meaning, Company C’s Finance and Accounting function is shared with Company D, although said shared personnel uses Company C’s SAP system for Company C transactions and Company D SAP system for Company D transactions. Is company C required to register its data processing systems?

Company C will only be required to register if any of the following is present:

  1. Processing poses a risk to the rights and freedoms of data subjects;
  2. Processing is regular; or
  3. Processing includes sensitive personal information of at least one thousand (1,000) individuals

Even if Company C has outsourced the processing of its personal data, it may still be subject to registration requirements, as a personal information controller.

For your reference.

Sincerely,

RAYMUND E. LIBRO Privacy Commissioner and Chairman

Footnotes

  1. See RA No. 10173, §21(h) and 14; Implementing Rules and Regulations (IRR) of RA No. 10173, §26(a) ↩

  2. In certain cases, a PIC or PIP is allowed to designate a compliance officer for privacy (COP): a. Local Government Units (LGUs). Each LGU shall designate a DPO. However, a component city, municipality, or barangay is allowed to designate a COP, provided that the latter shall be under the supervision of the DPO of the corresponding province, city, or municipality that part of. b. Government Agencies. Each government agency shall designate a DPO. Where a government agency has regional, provincial, district offices, or any other similar sub-units, it may also appoint or designate a COP for each sub unit. Subject to the approval of the NPC, a group of related companies may appoint or designate the DPO or its members to be primarily accountable for ensuring the compliance of the entire group with all data protection policies. Where such common DPO is allowed by the NPC, the other members of the group must still have a COP as defined in this Advisory. c. Private Sector. Where a private entity that previously had its own officers, or any other component units, it may also appoint or designate a COP for each component unit. Subject to the approval of the NPC, a group of related companies may appoint or designate the DPO or its members to be primarily accountable for ensuring the compliance of the entire group with all data protection policies. Where such common DPO is allowed by the NPC, the other members of the group must still have a COP as defined in this Advisory. d. Other Analogous Cases. PICs or PIPs that are under similar or analogous circumstances may also seek the approval of the NPC for the appointment or designation of a COP, in lieu of a DPO. ↩

  3. NPC Advisory No. 2017-01, Definition of Terms, “Compliance Officer for Privacy” or “COP” refers to an individual or individuals who shall perform some of the functions of a DPO, as provided in this Advisory ↩

  4. IRR of RA No. 10173, §47 ↩

Backlinks

  • No backlinks found