NPC Issuance Wiki

NPC Advisory Opinion No. 2018-022 — Scope and Coverage of the Data Privacy Act

Issued Advisory Opinion

Text

30 April 2018

Re: SCOPE AND COVERAGE OF THE DATA PRIVACY ACT

Dear [Redacted],

This refers to your request for advisory opinion received by the National Privacy Commission (NPC) on 16 April 2018, which sought to clarify the coverage and applicability of Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA),1 its Implementing Rules and Regulations (IRR),2 and relevant issuances. Specifically, you have inquired about the following:

  1. Applicability of the DPA to all private employers operating in the Philippines with respect to the personal data of their employees, regardless of the number of the employees;
  2. Inclusion of records of past employees in determining the threshold of processing sensitive personal information of at least one thousand (1,000) individuals;
  3. Compliance of the organization with the other provisions of the DPA even though the employer is not required to register its personal data processing system; and
  4. Applicability of the DPA to a BPO company that processes personal data of data subjects based in the United States.

Discussion

Scope of the DPA

The DPA applies to any natural and juridical person involved in the personal information in the personal information3 including those personal information controllers (PICs)4 and processors (PIPs)5 who, although not found or established in the Philippines, use equipment that are located in the Philippines, or those who maintain an office of agency in the Philippines.6

Thus, the DPA shall apply to any private or government entity regardless of the number of employees, as long as they are processing personal data in the Philippines. The number of employees is only material in determining whether the organization is required to register their data processing systems.7

The provisions under the Act, IRR, and other relevant orders issued by the NPC must be complied with by the PICs and PIPs, whether they meet the prescribed threshold set by the NPC for registration or not.

Registration of the Data Processing System

The DPA and its IRR requires the registration of the personal data processing systems of PICs and PIPs under any of conditions set by the NPC in Circular 2017-01.8

One of the conditions provided for by the issuance is processing which includes sensitive personal information of at least one thousand (1,000) individuals.9 This threshold pertains to sensitive personal information not just of the employees of the organization but also includes its customers or clients, current or past.

It is important to remember that storage of personal data is considered as a processing activity.10 Hence, if combined and it reaches one thousand (1,000) individuals, registration is mandatory.

Data subjects outside of the Philippines

Section 4 of the IRR clearly states that the DPA and its rules and issuances apply to entities involved in the processing of personal data that are found established or in the Philippines and when such processing is done in the country. Accordingly, the nationality and/or residence of the data subjects are immaterial in this scenario. The BPO company in the Philippines is required to comply with the law.

This opinion is being rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. AN ACT PROTECTING INDIVIDUAL PERSONAL INFORMATION IN INFORMATION AND COMMUNICATIONS SYSTEMS IN THE GOVERNMENT AND THE PRIVATE SECTOR, CREATING FOR THIS PURPOSE A NATIONAL PRIVACY COMMISSION, AND FOR OTHER PURPOSES, “Data Privacy Act of 2012” (15 August 2012). ↩

  2. Implementing Rules and Regulations of the Data Privacy Act (24 August 2016). ↩

  3. Supra note 1, §3(g). ↩

  4. Id., §3(h). ↩

  5. Id., §3(i). ↩

  6. Id., §4. ↩

  7. NPC Circular 17-01: REGISTRATION OF DATA PROCESSING SYSTEMS AND NOTIFICATIONS REGARDING AUTOMATED DECISION-MAKING (31 July 2017), §5. ↩

  8. Id. ↩

  9. Id. ↩

  10. Supra note 1, §3(j). ↩

Backlinks

  • No backlinks found