Text
19 March 2019
Re: ASSIGNMENT OF A NON-RESIDENT DPO AND REQUIREMENTS FOR THE CONTACT DETAILS OF A DPO
Dear [Redacted],
We write in response to your inquiry received by the National Privacy Commission (NPC) via e-mail, which sought to clarify matters regarding the Data Privacy Act of 20121 (DPA), specifically the appointment of a non-resident individual as Data Protection Officer (DPO).
You are inquiring whether it is acceptable to assign a new DPO who is based in the United States, in order to align with company policies and direction. You likewise ask for confirmation on the special requirement to have a local Philippine number to be assigned to the DPO.
Assignment of a non-resident individual as DPO
We had a chance to touch upon on the same matter in our NPC Advisory Opinion No. 2017-018,2 to wit:
Given its definition, a DPO need not be a resident of the Philippines. However, he or she must be able to fulfill the functions laid out in NPC Advisory No. 2017-01 (Designation of Data Protection Officers). It is worth noting that such functions would require, as a minimum, being familiar with Philippine laws and regulations on data protection and data security.
Considering that DPOs are accountable for ensuring compliance of the personal information controller (PIC) with the DPA, its Implementing Rules and Regulations (IRR), issuances of the NPC and other applicable laws and regulations relating to privacy and data protection, a DPO must be familiar with the DPA, IRR, and other pertinent Philippine laws and regulations on personal data processing in the Philippines, in order to lessen the risks of violations of the DPA and other applicable laws and policies.
This is vital since one of the primary duties and responsibilities of a DPO is to inform and cultivate awareness on privacy and data protection within the organization as well as serve as the contact person of the NPC and other authorities in all matters concerning data privacy or security issues.
In addition, the assignment of a DPO familiar with Philippine laws and regulations is critical considering that liability for any violation of the DPA will extend to officers who participated in the commission of the crime and those who, by their gross negligence, allowed the commission of the crime. Thus, if a non-resident individual is assigned as DPO, he cannot interpose as a defense that he does not have any knowledge of Philippine laws and regulations on privacy and data protection.
Requirement of a local contact number for a non-resident DPO
The IRR provides for minimum contents of registration of a PIC, among which is the name and contact details of the compliance or data protection officer which shall be immediately updated in case of changes.3 The registration form for DPOs likewise incorporates the minimum information required to be submitted to NPC, among which is the DPO’s title or designation, postal address, dedicated telephone number, mobile number, dedicated email address, and the industry to which the DPO belongs to.
The requirement for the Philippine local mobile number is primarily in connection with the Phase II registration provided in NPC Circular No. 17-01, to wit:
SECTION 9. Registration Process. A PIC or PIP shall register through the Commission’s official website in two (2) phases: xxx
B. Phase II. Using the access code provided by the Commission, a PIC or PIP shall proceed to the online registration platform and provide all relevant information regarding its data processing systems. The Commission shall notify the PIC or PIP via email to confirm the latter’s successful completion of the registration process
The online registration necessitated the use of a valid email address where a verification email with an activation link will be sent, and upon clicking such link, the access code will be sent to the mobile number, which has to be a Philippine mobile number, otherwise, the access code will not be received.
Considering also that the DPO is the contact person of the NPC, having a local mobile number is advisable as it will enable the NPC to communicate with the DPO directly in case there is a personal data breach which will necessitate immediate action and response.
Assignment of DPO where there are offices inside and outside the Philippines
While a non-resident individual may be assigned as a DPO, note that each entity that forms part of a group of companies is treated separately and is considered as a PIC or PIP in its own right.4 Thus, each PIC or PIP must designate a DPO as prescribed by law.
In addition, while a group of related companies may appoint or designate the DPO of one of its members to be primarily accountable for ensuring the compliance of the entire group with all data protection policies, such appointment is still subject to the approval of the NPC and, if so allowed, the other members of the group must still designate a Compliance Officer for Privacy (COP).
This opinion is based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
NPC Advisory 2017-01. ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 47 (a) (10) (2016). ↩
-
National Privacy Commission, Designation of Data Protection Officers, Advisory No. 17-01 [NPC Advisory 17-01] (March 14, 2017). ↩