Issuance Text
NPC Circular 2023-02
Date: 26 September 2023
Subject: Data Privacy Competency Program
WHEREAS, Republic Act No. 10173 or the Data Privacy Act (DPA) mandates the National Privacy Commission (NPC) to administer and implement the provisions of the law, and implement plans and policies that strengthen the protection of personal data formulate in the country;
WHEREAS, Section 9 of the Implementing Rules and Regulations of the DPA (IRR) provides that the NPC shall develop, promulgate, review, or amend rules and regulations for the effective implementation of the DPA;
WHEREAS, Section 9 of the IRR states that the NPC shall undertake the necessary or appropriate efforts to inform and educate the public on data privacy, data protection, and fair information rights and responsibilities;
WHEREAS, the NPC, through the NPC PHIL-DPO Program, initiated the DPO Accountability, Compliance, and Ethics (DPO ACE) training to capacitate Data Protection Officers with the knowledge and skills necessary to effectively manage the compliance of their respective organizations with the DPA;
WHEREAS, the NPC, through the PHIL-DPO Program, launched its Training the Trainers (T3) Program to grant provisional accreditation to Institutional Privacy Trainers (IPT) and Accredited Privacy Trainers (APT) to expand the breadth and scope of public education and training on data privacy throughout the Philippines;
WHEREAS, the DPO ACE training and T3 Program were mere ad hoc programs not covered by any formal issuances of the NPC and are being discontinued;
WHEREAS, there is a need to institutionalize the NPC’s public education and training programs on data privacy through the issuance of a Circular;
WHEREAS, the NPC seeks to enhance the accessibility and quality of data privacy and protection trainings available in the Philippines in line with the recent developments in the application and interpretation of the DPA;
WHEREAS, the NPC shall develop a Data Privacy Competency Program (Program), which shall be composed of courses on the fundamental and operational aspects of the DPA essential for anyone who seeks to have a better understanding of the DPA and its application to actual situations, and other projects geared towards data privacy education;
WHEREAS, the Program shall neither result in a specialized accreditation or certification, such as those carried out by an independent third-party body, nor as a qualification to act or perform the functions of a data privacy professional;
WHEREAS, Executive Order No. 292, s. 1987, as amended, or the Administrative Code of 1987 authorizes all agencies to charge fees as compensation for seminars or training programs rendered to other government agencies or private parties;
WHEREAS, the Republic Act No. 8293, as amended, or the Intellectual Property Code provides that while the work of a government agency or office is not protected by copyright, a government agency or office may require prior approval and impose as a condition the payment of royalties for use of such work for profit;
WHEREFORE, in consideration of the foregoing premises, and without prejudice to the application of other pertinent laws and regulations on the matter, the NPC hereby issues this Circular prescribing the guidelines for the courses, including a Data Privacy Foundational Course, under the Program.
SECTION 1. Scope and Purpose. Through the Program, the NPC shall develop uniform curricula and modules on the legal framework of privacy law and regulations (Curriculum) and learning outcomes to train and capacitate the public. The NPC shall license the use of a prescribed Curriculum to qualified Training Providers to enhance the quality of education on Philippine data privacy law. Qualified and licensed Training Providers shall design and conduct Training Courses based on the prescribed Curriculum covered by the specific License granted by the NPC.
This Circular shall apply to the Data Privacy Foundational Course, which shall cover fundamental concepts and principles of Philippine data privacy law, and other courses developed by the NPC under this Program.
SECTION 2. Definition of Terms. Terms used in the DPA and its IRR, as amended, are adopted herein. In addition, whenever used in this Circular, the following terms are defined as follows:
-
A. “Commission” refers to the Privacy Commissioner and the two (2) Deputy Privacy Commissioners;
-
B. “Curriculum” refers to the syllabus, modules, and other materials that the NPC develops to set a minimum standard for the conduct of courses under the Program;
-
C. “Enrollee” refers to a person who shall avail themselves of a Training Course offered by a licensed Training Provider;
-
D. “License” refers to the non-exclusive, non-assignable, and non-sublicensable authority granted by the NPC to a Training Provider to use a specific prescribed Curriculum under the Program;
-
E. “NPC” refers to the National Privacy Commission created under the DPA;
-
F. “Training Course” refers to the course designed by a Training Provider pursuant to a specific prescribed Curriculum under the Program;
-
G. “Training Provider” refers to any natural or juridical person that is qualified under this Circular and licensed by the NPC to conduct a Training Course to an Enrollee based on a specific prescribed Curriculum;
SECTION 3. Nature of the License. The NPC shall issue a License to a qualified Training Provider to design a Training Course based on a specific prescribed Curriculum. In all cases, the License granted to a Training Provider shall be non-exclusive, non-assignable, and non-sublicensable. The NPC shall issue the License to a qualified Training Provider after the execution of a formal written agreement prescribing the terms and conditions on the matter (Agreement).
SECTION 4. Term and Renewal of License. The License shall be valid for one (1) year and may be renewed within thirty (30) days prior to its expiration, subject to continuing compliance with Section 5 of this Circular and the terms of the Agreement stated in Section 3 of this Circular.
Upon termination of a License for any reason as may be provided in the Agreement or in any provision of law, a Training Provider is prohibited from conducting a Training Course, using the applicable prescribed Curriculum covered by the specific License granted by the NPC, and representing itself as licensed by the NPC, in any way, to provide courses on data privacy.
SECTION 5. General Qualifications of a Training Provider. A Training Provider must be duly organized, validly existing, and in good standing with the Department of Trade and Industry for sole proprietorships, or the Securities and Exchange Commission for partnerships and corporations. A Training Provider must have no pending civil, criminal, or administrative action, investigation, or suit nor conviction of any offense before any courts or other quasi-judicial agencies.
SECTION 6. Training Course. A Training Provider shall design a Training Course based on the applicable prescribed Curriculum covered by the specific License granted by the NPC. Before a Training Course is offered to the public, a Training Provider shall submit the Training Course materials to the NPC for approval. The NPC shall determine if the Training Course is consistent with the applicable prescribed Curriculum covered by the specific License and prescribed learning outcomes.
SECTION 7. Training Course Fee. A Training Provider may charge a fee when offering the Training Course. The fee, however, shall not exceed the maximum amount set out in the Agreement stated in Section 3 of this Circular. The maximum amount of the fee shall be subject to periodic adjustments by the NPC.
SECTION 8. Royalties. The NPC may collect royalties from a Training Provider who shall use the prescribed Curriculum under the Program. The amount of royalties, if any, and the use and management of the prescribed Curriculum for a specific course shall be set out in the respective terms of the Agreement stated in Section 3 of this Circular.
SECTION 9. Examination. For specific Training Courses, the NPC may conduct an examination to determine the competency of an Enrollee who has completed that Training Course with a licensed Training Provider. The successful completion of the Training Course for which the examination is administered with a licensed Training Provider shall be a requisite to take the examination.
The NPC may collect a fee when administering an examination. A Training Provider shall not collect additional fees from an Enrollee to take an examination administered by the NPC.
SECTION 10. Completion; Effects. Completion of a Training Course or successful passing of an examination administered by the NPC shall only measure the competency proficiency of an Enrollee. It shall in no case be construed as a professional certification on Philippine data privacy law.
In this regard, no certification is necessary for a person to act as or perform the functions of a data privacy professional, including a Data Protection Officer or Compliance Officer for Privacy.
A Training Provider may issue a Certificate of Attendance, Completion, or its equivalent, to Enrollees who have successfully completed a Training Course.
SECTION 11. Monitoring and Reporting. The NPC shall, in the manner provided in the Agreement, periodically monitor and determine if a Training Course designed by the Training Provider is in line with the prescribed Curriculum covered by the specific License granted by the NPC.
SECTION 12. Consultative Body. The NPC may form a Consultative Body to assist in formulating the prescribed Curriculum and learning outcomes for a specific course, including the Data Privacy Foundational Course, under the Program.
A Consultative Body for a specific course shall be composed of five (5) member-volunteers from outside the NPC. The member-volunteers shall be appointed by the Commission for a term of two (2) years, based on a favorable endorsement by the Chairperson of the Program, who concurrently serves as a member of the Commission.
No person shall be appointed as a member of a Consultative Body, unless they are a citizen of the Philippines, of good moral character, of proven integrity and competence, and with at least five (5) years of experience in the field of data privacy or such other fields relevant to the specific course for which that particular Consultative Body was formed.
SECTION 13. Qualification under the DPO ACE Program. Any qualifications acquired under the DPO ACE training shall remain valid for a period of one (1) year from the effectivity of this Circular.
SECTION 14. Separability Clause. If any portion of this Circular is declared null and void, or unconstitutional, the other portions not affected thereby shall continue to be in force and effect.
SECTION 15. Repealing Clause. All other rules, regulations, and issuances contrary to or inconsistent with the provisions of this Circular are deemed repealed or modified accordingly.
SECTION 16. Effectivity. This Circular shall take effect fifteen (15) days after its publication in the Official Gazette or a newspaper of general circulation.
Approved:
Sgd.
ATTY. JOHN HENRY D. NAGA
Privacy Commissioner
Sgd.
ATTY. LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner
Sgd.
ATTY. NERISSA N. DE JESUS
Deputy Privacy Commissioner