NPC Issuance Wiki

NPC Advisory Opinion No. 2018-043 — Registration of Data Processing Systems

Issued Advisory Opinion

Text

7 August 2018

Re: REGISTRATION OF DATA PROCESSING SYSTEMS

Dear [Redacted],

We write in response to your request for advisory opinion received by the National Privacy Commission (NPC) which sought to clarify matters regarding Republic Act No. 10173,1 also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR)2 and relevant issuances, particularly NPC Circular No. 17-01.

You requested for clarification on whether the processing of personal information in Microsoft Office 365 (Office 365) is considered as a data processing system. If in the affirmative, whether the following entities are required to register with the NPC:

  1. A corporation (Foreign Parent) registered outside of the Philippines, engaged in manufacturing and distribution of control equipment, factory automation systems and electronic components, having no employees in the Philippines and not processing sensitive personal information of at least one thousand (1,000) individuals who are located in the Philippines or are Philippine citizens; and
  2. A subsidiary of the Foreign Parent (Asia Affiliate), also engaged in the same business of the Foreign Parent, and its representative office registered in the Philippines (Rep Office), where the latter has twenty (20) employees.

Discussion

Data processing system

We understand that the Foreign Parent plans to introduce Office 365 globally to its branches and affiliates (Group). The same will be used to achieve operational efficiency within the Group. Personal information of the employees such as names, email addresses, and other information voluntarily provided by said employees may be processed and shared with the Group.

We confirm that Office 365 and its allied applications may be considered as a data processing system, defined as a structure and procedure by which personal data is collected and further processed in an information and communications system or relevant filing system, including the purpose and intended output of the processing.3

Registration

For the registration requirement, NPC Circular No. 17-01 and its Appendix 1 must be read together with the law and its IRR. Section 3 of the DPA provides for the definition of processing of personal data which refers to any operation or any set of operations performed upon personal information, including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.

In connection with this, the natural or juridical person who may be required to register are those operating and doing business in the Philippines. Doing business is understood as it is defined under Executive Order No. 226, as amended, or the Omnibus Investment Code of 1987, the Foreign Investments Act of 1991, as amended, the respective IRRs, as amended, and other applicable laws, rules, regulations and jurisprudence on the matter.

This is read in conjunction with Section 46 (a) of the IRR, which provides as follows:

Section 46. Enforcement of the Data Privacy Act. Pursuant to the mandate of the Commission to administer and implement the Act, and to ensure the compliance of personal information controllers with its obligations under the law, the Commission requires the following:

a. Registration of personal data processing systems operating in the country that involves accessing or requiring sensitive personal information of at least one thousand (1,000) individuals, including the personal data processing system of contractors, and their personnel, entering into contracts with government agencies;

From the foregoing, the registration requirement is interpreted to apply to those natural or juridical persons operating and doing business in the Philippines and where such business activity involves the processing of personal data through data processing systems operating in the Philippines.

A foreign corporation that does not operate or do business in the Philippines and does not process personal data through data processing systems operating in the Philippines are not covered by the mandatory registration requirement.

Nevertheless, the Foreign Parent and Asia Affiliate, through its Rep Office may always opt to avail of the voluntary registration provided under Section 6 of NPC Circular No. 17-01.

This opinion is being rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission and for other Purposes [DATA PRIVACY ACT OF 2012], Republic Act No. 10173 (2012). ↩

  2. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173. ↩

  3. NPC Circular No. 17-01 - Registration of Data Processing Systems and Notifications Regarding Automated Decision-Making, 31 July 2017, §3(F). ↩

Backlinks

  • No backlinks found