Text
09 October 2017
Re: NPC CIRCULAR 17-01: REGISTRATION OF DATA PROCESSING SYSTEMS AND NOTIFICATIONS REGARDING AUTOMATED DECISION-MAKING
Dear [Redacted],
This pertains to your request for advisory opinion received by the National Privacy Commission (NPC) on 26 September 2017, which sought to clarify matters regarding Republic Act No. 10173,1 also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR)2 and relevant issuances, and particularly respond to the following questions on NPC Circular No. 17-01:
-
Section 1 in relation to Section 5 of NPC Circular 17-01 provides that registration of processing systems is required for “any natural or juridical person in the government or private sector processing personal data and operating in the Philippines”. Could you define the phrase “processing personal data and operating in the Philippines”?; and
-
Is registration required for international affiliates or subsidiaries of Philippine corporations that process personal information even if said international affiliates or subsidiaries do not directly process personal data in the Philippines (i.e, they engage the services of Philippine entities for processing), and they do not do business nor are registered/organized in the Philippines?
NPC Circular No. 17-01 must be read together with the law and its IRR. Section 3 of the DPA clearly provides for the definition of processing of personal data which refers to any operation or any set of operations performed upon personal information, including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.
In connection with this, the natural or juridical person who may be required to register are those operating and doing business in the Philippines. Doing business is understood as it is defined under Executive Order No. 226, as amended, or the Omnibus Investment Code of 1987, the Foreign Investments Act of 1991, as amended, the respective IRRs, as amended, and other applicable laws, rules, regulations and jurisprudence on the matter.
This is read in conjunction with Section 46 (a) of the IRR, which provides as follows:
Section 46. Enforcement of the Data Privacy Act. Pursuant to the mandate of the Commission to administer and implement the Act, and to ensure the compliance of personal information controllers with its obligations under the law, the Commission requires the following:
a. Registration of personal data processing systems operating in the country that involves accessing or requiring sensitive personal information of at least one thousand (1,000) individuals, including the personal data processing system of contractors, and their personnel, entering into contracts with government agencies;
From the foregoing, the registration requirement is interpreted to apply to those natural or juridical persons operating and doing business in the Philippines and where such business activity involves the processing of personal data through data processing systems operating in the Philippines.
International affiliates or subsidiaries of Philippine corporations that do not operate or do business in the Philippines and do not process personal data through data processing systems operating in the Philippines are not covered by the mandatory registration requirement.
For your reference.
Very truly yours,
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
AN ACT PROTECTING INDIVIDUAL PERSONAL INFORMATION IN INFORMATION AND COMMUNICATIONS SYSTEMS IN THE GOVERNMENT AND THE PRIVATE SECTOR, CREATING FOR THIS PURPOSE A NATIONAL PRIVACY COMMISSION, AND FOR OTHER PURPOSES, “Data Privacy Act of 2012” (15 August 2012). ↩
-
Implementing Rules and Regulations of the Data Privacy Act (24 August 2016). ↩