Text
22 August 2017
Re: DATA PROCESSING SYSTEM REGISTRATION
Dear [Redacted],
This is with regard to your query received by the National Privacy Commission (NPC) on 18 April 2017 on the coverage of data processing system registration provided in the Implementing Rules and Regulation (IRR) of the Data Privacy Act of 2012 (DPA).
Specifically, you ask for clarification on processing which is “not occasional” for purpose of registration of data processing systems. You seek an interpretation of the phrase in the instance where, for example, a company having only twenty-five employees, maintains a database of those employees, and processes such employees’ information in a standard way. You ask if the company would be considered as continually processing data and thus be required to register its data processing system.
The DPA defines processing as “any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.”1 Thus, your example where “the only processing being done is the maintenance in a standard way of the files of employees” falls squarely on the above definition of processing.
The processing shall be considered occasional if it is only incidental to the mandate or the function of the PIC or PIP, or, if it only occurs under specific circumstances and is not regularly performed.2 We believe that the processing of employees’ personal data is not occasional as there is regularity and recurrence in the same, i.e. the maintenance in a standard way of employee files which contain personal data would presumably include collection and storage of resumes or some other form of biodata or curriculum vitae, organization and storage of employment contracts, the processing of the compensation and mandatory statutory deductions on a semi-monthly or monthly basis, i.e. withholding of taxes, social security contributions, etc., updating or modifications on personal data, i.e. change in name, addresses, other contact details, etc., among others.
For the limited purpose of registration, NPC Circular 17-01 includes in its Annex 1, an identification of the categories of personal information controllers and personal information processors required to register their data processing systems even if employees are less than 250, or processing includes sensitive personal information of less than 1,000 records.
A company which employs only twenty-five employees would be required to register if it falls under any of the PIC or PIP in Annex 1.
For your reference.
Sincerely,
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
RA No. 10173, §3(J) ↩
-
NPC Circular 17-01, §5(D) ↩