Issuance Text
NPC Circular No. 2022-01
Date: 08 August 2022
Subject: GUIDELINES ON ADMINISTRATIVE FINES
WHEREAS, it is the policy of the State to protect the fundamental human right of privacy of communication while ensuring free flow of information to promote innovation and growth;
WHEREAS, the National Privacy Commission (Commission) was created under Republic Act No. (R.A.) 10173, otherwise known as the “Data Privacy Act of 2012” (DPA), in order to discharge the duty of the State to protect individual personal information in information and communications systems in the government and the private sector;
WHEREAS, the Commission has the express mandate under R.A. 10173 and its Implementing Rules and Regulations (IRR) to: (1) ensure compliance with the provisions of R.A. 10173; (2) receive complaints, institute investigations, and adjudicate on matters affecting any personal information; (3) compel any entity, government agency or instrumentality to abide by its orders or take action on a matter affecting data privacy; and (4) generally perform such acts as may be necessary to facilitate cross-border enforcement of data privacy protection;
WHEREAS, the Commission shall perform all acts as may be necessary to implement the DPA, its IRR, and its issuances, and to enforce its Orders, Resolutions, or Decisions, including the imposition of administrative sanctions, fines, or penalties;
WHEREAS, the Commission encourages Personal Information Controllers (PICs) and Personal Information Processors (PIPs) to promote organizational accountability by initiating measures to enhance their compliance with the DPA to protect the rights of their data subjects;
WHEREAS, the Commission recognizes that it is necessary for public interest to impose administrative fines that are proportionate and dissuasive for the effective exercise of its mandate;
WHEREFORE, in consideration of these premises, the Commission hereby issues this Circular fixing the amount of administrative fines to be imposed for infractions of R.A. 10173, its IRR, and other issuances of the Commission;
Section 1. Scope. This Circular is applicable to PICs and PIPs as defined in the DPA.
Section 2. Administrative Fines. Any PIC or PIP who shall violate the following provisions of R.A. 10173, its IRR, and the issuances of the Commission shall be liable for an administrative fine for each infraction. The amount of the fine for each infraction shall fall within the ranges identified below and shall be determined in accordance with the factors enumerated in Section 3. In any case, the total imposable fine for a single act of a PIC or PIP, whether resulting in single or multiple infractions, shall not exceed Five Million Pesos (Php 5,000,000.00).
GRAVE INFRACTIONS
Any natural or juridical person processing personal data that infringes on the following provisions and implementing issuances of the Commission shall be subject to administrative fines of 0.5% to 3% of the annual gross income of the immediately preceding year when the infraction occurred:
-
a. For each infraction of any of the general privacy principles in the processing of personal data pursuant to Section 11 of the DPA, where the total number of affected data subjects exceeds one thousand (1,001 or more);
-
b. For each infraction of any of the data subject rights pursuant to Section 16 of the DPA, where the total number of affected data subjects exceeds one thousand (1,001 or more); or
-
c. Any repetition of the same infraction penalized under this Circular, regardless of the classification as Major Infractions or Other Infractions, shall be automatically considered as a Grave Infraction.
MAJOR INFRACTIONS
Any natural or juridical person processing personal data that infringes on the following provisions and implementing issuances of the Commission shall be subject to administrative fines of 0.25% to 2% of the annual gross income of the immediately preceding year when the infraction occurred:
-
a. For each infraction of any of the general privacy principles in the processing of personal data pursuant to Section 11 of the DPA, where the total number of affected data subjects is one thousand or below (1-1,000);
-
b. For each infraction of any of the data subject rights pursuant to Section 16 of the DPA, where the total number of affected data subjects is one thousand or below (1-1,000);
-
c. Any failure by a PIC to implement reasonable and appropriate measures to protect the security of personal information pursuant to Section 20 (a), (b), (c), or (e) of the DPA;
-
d. Any failure by a PIC to ensure that third parties processing personal information on its behalf shall implement security measures pursuant to Section 20 (c) or (d) of the DPA; or
-
e. Any failure by a PIC to notify the Commission and affected data subjects of personal data breaches pursuant to Section 20 (f) of the DPA, unless otherwise punishable by Section 30 of the DPA.
OTHER INFRACTIONS
-
a. Any natural or juridical person processing personal data that commits any of the omissions provided hereunder shall be subject to an administrative fine of not less than Fifty Thousand Pesos (Php 50,000) but not exceeding Two Hundred Thousand Pesos (Php 200,000):
-
i. The failure to register the true identity or contact details of the PIC, the data processing system, or information on automated decision making, pursuant to Section 7(a), Section 16, and Section 24 of the DPA and its corresponding implementing issuances; or
-
ii. The failure to provide updated information as to the identity or contact details of the PIC, the data processing system, or information on automated decision making, pursuant to Section 7(a), Section 16, and Section 24 of the DPA and its corresponding implementing issuances.
-
-
b. Any natural or juridical person processing personal data that fails to comply with any Order, Resolution, or Decision of the Commission, or of any of its duly authorized officers, pursuant to Section 7 of the DPA and its corresponding implementing issuances, shall be subject to an administrative fine not exceeding Fifty Thousand Pesos (Php 50,000).
The fine to be imposed as a result of this infraction shall be in addition to the fine imposed for the original infraction subject of the Order, Resolution, or Decision of the Commission.
(e.g., If the Order, Resolution, or Decision imposes a fine that pertains to the implementation of security measures, a maximum of Php 50,000 shall be added to the fine for that infraction.)
This Circular shall also apply to infractions to be provided in future issuances of the Commission. In those instances, the range of applicable fines shall be set out in such issuance.
Section 3. Factors Affecting Fines. The Commission shall consider the following factors in determining the amount of the fine within the range provided in Section 2:
- a. Whether the infraction occurred due to negligence or through intentional infraction on the part of the PIC or PIP;
- b. Whether the infraction resulted in damage to the data subject, taking into account the degree of damage to the data subject, if any;
- c. The nature or duration of the infraction, in relation to the nature, scope, and purpose of the processing;
- d. The action or measure taken prior to the infraction to protect the personal data being processed as well as the rights of the data subject under Section 16 of the DPA;
- e. Any previous infractions determined by the Commission as contained in its Orders, Resolutions or Decisions, whether these infractions have led to the imposition of fines, and the length of time that has passed since those infractions;
- f. The categories of personal data affected;
- g. The manner in which the PIC or PIP discovered the infraction, and whether it informed the Commission;
- h. Any mitigating action adopted by the PIC or PIP to reduce the harm to the data subject; and
- i. Any other aggravating or mitigating circumstances as appreciated by the Commission, including financial benefits incurred or losses avoided by the PIC or PIP.
For the purpose of ascertaining the annual gross income of the PIC or PIP that committed the infraction, the Commission may evaluate and require the submission of the PIC’s or PIP’s audited financial statements filed with the appropriate tax authorities for the immediately preceding year when the infraction occurred, the last regularly prepared balance sheet or annual statement of income and expenses, and such other financial documents as may be deemed relevant and appropriate.
In cases where a PIC or PIP has not been operating for more than one year, the base to be used for the computation of the administrative fine shall be its gross income at the time the infraction was committed.
Section 4. Due Process. The administrative fine shall only be imposed after notice and hearing are afforded to the PICs or PIPs, in accordance with the NPC Rules of Procedure.
In case the PIC or PIP fails to appear or submit its comment or pleading, despite due notice, the Commission shall decide on the alleged infraction based on the evidence on record.
If the complaint alleges a violation of the DPA that incurs criminal liability, but the facts proven only constitute one or some of the infractions subject to administrative fines, the PIC or PIP shall be fined for the infraction proven, provided it is included in the violation alleged.
A violation charged includes the infraction proven when some of the essential elements of the former, as alleged in the complaint, constitute the latter.
A PIC or PIP may be held liable for an infraction, even if it is different from the infraction impleaded, provided that (1) the essential requisites of the infraction for which the PIC or PIP is found liable are alleged in the complaint, and (2) such infraction is proven based on substantial evidence.
Section 5. Appeal. The Decision or Resolution of the Commission shall be immediately executory unless otherwise restrained by the Court of Appeals or the Supreme Court.
Section 6. Posting of Bond on Imposed Administrative Fines. In any or all actions assailing the Decisions or Resolutions of the Commission pertaining to the administrative fine imposed, a cash or surety bond equivalent to the total amount of fine imposed shall be posted, exclusive of the damages, attorney’s fees, and other monetary awards, upon such filing of any action with the appropriate courts. Non-posting of a cash or surety bond shall result in the immediate execution of the administrative fine imposed.
The cash or surety bond shall be valid and effective from the date of deposit or posting until the case is finally decided, resolved, or terminated, or the administrative fine imposed is satisfied.
In case of a surety bond, the PIC or PIP must (1) post the bond through a bonding company included in the latest list of bonding companies accredited by the Supreme Court for Civil Cases and Special Proceedings, and (2) comply with the requirements of such bonding company.
No motion to reduce bond shall be entertained by the Commission.
Section 7. Refusal to Comply. In case of refusal to pay the adjudged administrative fine under this Circular, the PIC or PIP may be subject to a Cease and Desist Order (CDO), other processes or reliefs as the Commission may be authorized to initiate pursuant to Section 7 of the DPA, and appropriate contempt proceedings under the Rules of Court.
Notwithstanding the provisions of NPC Circular No. 20-02 or the Rules on the Issuance of Cease and Desist Orders, the failure to comply with the Order, Resolution, or Decision of the Commission may, after notice and hearing, result in the issuance of a CDO.
Section 8. Periodic Review and Modification. This Circular may be modified, amended, supplemented, or repealed as may be deemed necessary and proper by the Commission.
Section 9. Separability Clause. In the event that any provision of this Circular be declared invalid or unconstitutional, the remaining provisions shall remain effective and in full force and effect.
Section 10. Applicability Clause. These rules apply to PICs and PIPs for the above infractions prospectively. All issuances inconsistent with the provisions of this Circular shall be deemed repealed, amended, or modified accordingly.
Section 11. Effectivity. This Circular shall take effect fifteen (15) days following its publication in a newspaper of general circulation.
Approved:
Sgd.
ATTY. JOHN HENRY D. NAGA
Privacy Commissioner
Sgd.
ATTY. LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner
Sgd.
ATTY. DUG CHRISTOPER B. MAH
Deputy Privacy Commissioner