NPC Issuance Wiki

NPC Advisory Opinion No. 2017-064 — Registration of Data Processing Systems

Issued Advisory Opinion

Text

30 October 2017

Re: REGISTRATION OF DATA PROCESSING SYSTEMS

Dear [Redacted],

This pertains to your query received by the National Privacy Commission (NPC) on 03 April 2017, via email, regarding certain clarifications on matters discussed during the Focused Group Discussion. The questions you have raised and the response of the NPC are summarized as follows:

  1. Will the data Globe will be submitting to the NPC be considered as public data? Will the Senate and/or Congress be able to subpoena these data? Are these now considered as public documents?

    The information submitted by Globe to the Commission for purposes of registration of data processing systems may be considered as official records.1

    The Senate and the House of Representatives pursuant to their respective Rules of Procedure Governing Inquiries in Aid of Legislation2 may issue subpoena ad testificandum and subpoena duces tecum. Thus, it is possible that if and when either house of Congress deems it necessary to issue a subpoena requiring the Commission to produce documents for an inquiry in aid of legislation that Globe’s data may be included in the same. This being said, the Commission is also mandated to ensure at all times the confidentiality of any personal information that comes to its knowledge and possession.

    Note further, under Circular 17-01 on Registration of Data Processing Systems and Notifications Regarding Automated Decision-Making:

    RULE III.
    REGISTRY OF DATA PROCESSING SYSTEMS

    SECTION 19. Maintenance of Registry. The Commission shall maintain a registry of data processing systems in electronic format.

    SECTION 20. Public Access to Registry. Any person may inspect the registry during regular office hours: Provided, that the Commission shall regulate such access to protect the legitimate interests of PICs and PIPs. Subject to reasonable fees and regulations that may be prescribed by the Commission, any person may also secure a duly certified copy of any entry from the registry relating to a particular PIC or PIP.

  2. Who will take responsibility in case of Data Breach of the NPC database? What remedies are available to Globe in such a case? Will the NPC be accountable?

    In case the data breach constitutes a commission of a crime, a complaint against NPC officials or employees may be acted upon by either the Department of Justice or the Ombudsman, in accordance with existing law and regulations. The NPC officials and those acting on their behalf or under their direction, shall be liable for willful or negligent acts done by him or her which are contrary to law, morals, public policy and good customs Please note further that the Commission is a statutory body, and its officials are not immune from criminal prosecution.

  3. Please clarify also that the data we are using cannot be used against us per your initial statement as this conflicts with the statement of the Commissioner that the data can be used as evidence against non-complying firm. If so, this case falls within the ambit of self-incrimination.

    A corporation, being a juridical body, does not have a right against self-incrimination. The submission of information on data processing systems should not be considered as an issue of self-incrimination but as a submission to a regulatory body tasked with administering and implementing the law. The Commission has been granted the function of ensuring compliance with the Data Privacy Act of PICs or PIPs processing personal data. The data submitted to the Commission for purposes of registration will be examined in case of any complaint against the PIC or PIP and will serve as an affirmation on the part of the PIC or PIP of its existing safeguards for the protection of personal data. The fact of non-registration is a failure on the part of the PIC or PIP to abide by an order of the Commission on a matter affecting data privacy, and is one of the evidence that could counter a claim of good faith or due diligence.

  4. Will the systems outsourced by Information Processors to a third party be part of the declaration? For example, Globe contracts with Company A and then Company A subcontracts a process with Company B. Should Globe still declare the system of Company B?

    To clarify, Globe as a personal information controller, is required to register its data processing systems with the NPC. If it outsources its processing systems, the respective personal information processor/s would have their own registration of their data processing systems with the NPC, which is separate and distinct from Globe’s registration. Globe should however indicate which of its processes have been outsourced, and to whom.

  5. Does the processing of personal information of foreign nationals living the Philippines fall under the Data Privacy Act?

    Yes, processing of personal information of foreign nationals living in the Philippines falls under the scope of the DPA.

    Section 4 of the DPA states that the law “applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing including those personal information controllers and processors who, although not found or established in the Philippines, use equipment that are located in the Philippines, or those who maintain an office, branch or agency in the Philippines.”

    Based on such provision, it is clear that personal information controllers and processors processing information in the Philippines are covered by the law, regardless of the nationality of the data subjects.

  6. As discussed, please release a sample submission of a data processing system, the description of the system which is not too general but also not too specific.

    Please refer to NPC Circular 17-01 on Registration of Data Processing Systems and Notifications regarding automated decision-making.

  7. Given that there are no subsequent update yet on the Registration of the systems, is the September deadline still the hard deadline?

    Please refer to NPC Circular 17-01 on Registration of Data Processing Systems and Notifications regarding automated decision-making.

    The Commission has decided to process the registrations in two (2) phases. Phase One registration deadline was September 9, 2017. The deadline for Phase II registration will be on March 8, 2018.

  8. For an organization the size of Globe, what is the prescribed form of the Privacy Impact Assessment (PIA) report?

    Based on Section 20 of the DPA in determining the appropriate level of security to be implemented by the personal information controller, the following should be considered: nature of the personal information to be protected, the risks represented by the processing, size of the organization and complexity of operations, current data privacy best practices and the cost of security implementation.

    Due to such considerations which vary from entity to entity, sector to sector, the Commission is not prescribing a particular format for the PIA report. The NPC will not restrict and limit the evaluation and assessment of the entities by requiring a specific format depending on the size of the organization, given that the organizational structure is only one of the factors to be considered the assessment.

    You may wish to check the PIA template which the Commission has provided in its website. Lastly, you may also refer to ISO/IEC 29134 – Information technology — Security techniques — Guidelines for privacy impact assessment for further guidance. Furthermore, a copy of NPC Advisory 2017-01 on the Designation of Data Protection Officers is currently available and may be downloaded in the website of the NPC, www.privacy.gov.ph.

For your reference.

Sincerely,

RAYMUND E. LIBORO Privacy Commissioner and Chairman

Footnotes

  1. Executive Order No. 2, s. 2016, §1(b) - “Official record/records” shall refer to information produced or received by a public officer or employee, or by a government office in an official capacity or pursuant to a public function or duty. ↩

  2. Senate Resolution No. 5, adopted on 9 August 2010, as amended by Resolution No. 9 and 145; and House of Representatives 15th Congress - Rules of Procedure Governing Inquiries in Aid of Legislation, adopted on 3 August 2010 ↩

Backlinks