NPC Issuance Wiki

Amendments to Certain Provisions of the 2021 Rules of Procedure of the National Privacy Commission (Circular No. 2024-01)

Issued Rules of Procedure

Issuance Text

NPC Circular 2024-01

Date: 26 January 2024

Subject: AMENDMENTS TO CERTAIN PROVISIONS OF THE 2021 RULES OF PROCEDURE OF THE NATIONAL PRIVACY COMMISSION

Pursuant to the authority vested in the National Privacy Commission (NPC) through Section 7(b) of Republic Act No. 10173, otherwise known as the “Data Privacy Act of 2012” (DPA), to receive complaints and institute investigations on matters affecting any personal information, the following amendments are hereby prescribed and promulgated, repealing for this purpose certain provisions of the 2021 Rules of Procedure of the NPC dated 28 January 2021.

SECTION 1. Rule I, Sections 4 and 5 of the 2021 NPC Rules of Procedure are hereby amended and renumbered to read as follows:

“SECTION 4. Definition of Terms. The terms defined in the DPA, and its rules, are adopted accordingly in this Circular.

  • a. AFFIRMATIVE DEFENSES – shall refer to any defense by the respondent which, if found to be credible, will negate liability under the DPA, even if it is proven that the respondent in fact committed the alleged acts.

  • b. BREACH INVESTIGATION – shall refer to an investigation conducted by the NPC with respect to a data breach notification prompted by the applicable rules promulgated by the Commission.

  • c. COMMISSION – shall refer to the Privacy Commissioner and the two (2) Deputy Privacy Commissioners.

  • d. COMPLAINT INVESTIGATION – shall refer to an investigation conducted by the NPC with respect to a formal complaint filed by a data subject or his or her representative for violation of the DPA.

  • e. COMPLIANCE CHECK – shall refer to the systematic and impartial evaluation of a personal information controller (PIC) or personal information processor (PIP), in whole or in any part, process, or aspect thereof, to determine whether activities that involve the processing of personal data are carried out in accordance with the standards mandated by the DPA, IRR, and NPC issuances. It is an examination that includes Privacy Sweeps, Documents Submission, and On-Site Visits, which intends to determine whether a PIC or PIP is able to demonstrate organizational commitment, program controls, and review mechanisms intended to assure privacy and personal data protection in data processing systems.

  • f. COURIER – shall refer to any private mail carrier accredited by the Supreme Court, the NPC, or by international conventions of which the Philippines is a signatory.

  • g. DIGITAL SIGNATURE – shall refer to an electronic signature consisting of a transformation of an electronic document or an electronic data message using an asymmetric or public cryptosystem such that a person having the initial untransformed electronic document and the signer’s public key can accurately determine: (1) whether the transformation was created using the private key that corresponds to the signer’s public key; and (2) whether the initial electronic document had been altered after the transformation was made.1

  • h. DOCUMENTS SUBMISSION – shall refer to a mode of Compliance Check where the NPC may require the submission of documents and additional information from a PIC or PIP that has undergone a Privacy Sweep to, among others, clarify certain findings arising therefrom and to determine the level of compliance of the PIC or PIP with respect to its obligations under the DPA, IRR, and NPC issuances.

  • i. ELECTRONICALLY-STORED INFORMATION – shall refer to any information that is received, recorded, transmitted, stored, processed, retrieved, or produced electronically. It shall include any printout or output that accurately reflects the electronically stored information.2

  • j. EVALUATING OFFICER – shall refer to a member of the Compliance and Monitoring Division (CMD), a special committee, or task force (or respective members thereof) that may or may not include members from the CMD, created by order of the Commission to evaluate documents and information submitted to the CMD pertaining to compliance requirements and personal data breach notifications.

  • k. HEARING OFFICER – shall refer to a member of the Complaints and Investigation Division (CID), a special committee, or task force (or respective members thereof) that may or may not include members from the CID, created by order of the Commission to conduct hearings.

  • l. INVESTIGATING OFFICER – shall refer to a member of the CID, a special committee, or task force (or respective members thereof) that may or may not include members from the CID, created by order of the Commission to conduct investigations, hearings, and prepare related reports.

  • m. JURIDICAL PERSON – shall refer to: (1) the State and its political subdivisions, (2) corporations, institutions, and entities that are created by law for public interest or purpose, and (3) corporations, partnerships, and associations for private interest or purpose to which the law grants a juridical personality, separate and distinct from that of each shareholder, partner, or member.3

  • n. MEDIATION – shall refer to the voluntary process in which a Mediation Officer facilitates communication and negotiation and assists the parties in reaching a voluntary agreement regarding a dispute.

  • o. MEDIATION OFFICER – shall refer to a member of the Legal Division (LD), a special committee, or task force (or respective members thereof) that may or may not include members from the LD, created by order of the Commission to conduct mediation.

  • p. MEDIATION SUPPORT OFFICER – shall refer to a member of the LD, a designated person, special committee, or task force (or respective members thereof) that may or may not include members from the LD, created by order of the Commission to provide support to Mediation Officers.

  • q. NPC – shall refer to the National Privacy Commission created under the DPA.

  • r. ON-SITE VISIT – shall refer to a mode of Compliance Check if there are persistent or substantial findings of non-compliance of the PIC or PIP with the obligations indicated in the DPA, IRR, and NPC issuances.

  • s. PARTIES IN INTEREST – shall refer to a real party in interest who stands to be benefited or injured by the judgment in the suit, or the party entitled to the avails of the suit. Unless otherwise authorized by law or these Rules, every action must be prosecuted or defended in the name of the real party in interest.4

  • t. PRELIMINARY MEDIATION CONFERENCE – shall refer to the initial mediation conference after the parties mutually agree to enter into the mediation proceeding and the case is referred by the Investigating Officer to the Mediation Officer.

  • u. PRIVACY SWEEP – shall refer to the initial mode of Compliance Check where the NPC shall review a PIC or PIP’s compliance with respect to its obligations under the DPA, IRR, and NPC issuances, based on publicly available or accessible information, such as, but not limited to websites, mobile applications, raffle coupons, brochures, and privacy notices.

  • v. PRIVATE CAUCUS – shall refer to a private meeting with either party called by the Mediation Officer, with the consent of both parties, to discuss issues in private and to arrive at a mutually satisfactory agreement beneficial to all parties.

  • w. PUBLIC AUTHORITY – shall refer to any government entity created by the Constitution or law.

  • x. RULES – shall refer to the 2021 NPC Rules of Procedure, including its amendments, unless otherwise stated.

  • y. SUA SPONTE INVESTIGATION – shall refer to an investigation initiated by the NPC on its own for possible violation of the DPA.”

“SECTION 5. Enforcement Powers. The Commission may use its enforcement powers under the DPA in the course of investigations to order cooperation of the subject of the inquiries or other interested individuals or entities, including public authorities, or to compel appropriate action to protect the interests of data subjects.”

SECTION 2. Rule II, Section 1 of the 2021 NPC Rules of Procedure is hereby amended to read as follows:

“SECTION 1. Who may file complaints. Subject to Rule X of these Rules, data subjects who are affected by a privacy violation or data breach may file complaints for violations of the DPA: Provided, that a representative may file on behalf of a data subject if he or she is authorized by a special power of attorney. In the case of a minor or a person alleged to be incompetent, the pertinent provisions of the Rules of Court and its amendments shall apply. It is sufficient that proof establishing the relationship with the complainant be presented to the NPC as an attachment to the complaint. In case the minor or a person alleged to be incompetent is represented by the father or mother, the birth certificate shall be considered sufficient proof, while for the guardian, the court order designating the person as guardian shall be sufficient.

One or more data subjects may be represented by a single juridical person: Provided, that the juridical person filing the complaint must be authorized by a special power of attorney to appear and act on behalf of the data subjects: Provided further, the person representing the juridical person acting as the representative of one or more data subjects must be authorized to appear and act on behalf of the juridical person by a Board Resolution contained in a duly notarized Secretary’s Certificate or its equivalent in case of government agencies5.

In cases where the complainant is a non-resident citizen who has no authorized representative in the Philippines or is unable to appoint such a representative, such person may submit a complaint in accordance with these Rules: Provided, that the complaint must be notarized by the Philippine Embassy or Consulate, or with an apostille certificate from the country of origin.”

SECTION 3. Rule III, Section 6 of the 2021 NPC Rules of Procedure is hereby amended to read as follows:

“SECTION 6. Service of judgments, orders, or resolutions of the NPC. At the discretion of the Commission, judgments, orders, or resolutions shall be served either personally, by registered mail, by courier, by sending through user accounts and auto-generated notification of electronic systems implemented by the NPC, or by electronic mail. When a complaint, pleading, or any other submission is filed or submitted through electronic mail, the NPC may serve its judgments, orders, or resolutions by electronic mail through the same electronic mail address used in the filing of the complaint or pleading, or submission of document, unless otherwise indicated in the complaint, pleading, motion, or other submissions of parties. When the NPC has opted to serve a judgment, order, or resolution by electronic mail, it shall no longer serve its issuances in the same case or matter by any other mode of service, unless circumstances warrant otherwise.

For judgments, orders, or resolutions served by electronic mail, electronic service is considered complete at the time of electronic transmission of the document, or when available, at the time that the electronic notification of service of document is sent.

For matters coursed through the electronic systems implemented by the NPC, the service of judgments, orders, or resolutions is deemed completed at the time it is successfully uploaded to the system.”

SECTION 4. Rule IV of the 2021 NPC Rules of Procedure is hereby amended and renumbered to read as follows:

“RULE IV – PRE-INVESTIGATION PHASE

SECTION 1. Outright dismissal, when allowed. Within thirty (30) calendar days from receipt of the complaint, the Investigating Officer may give the complaint due course or dismiss the complaint without prejudice, on any of the following grounds:

  1. The complaint is insufficient in form or does not comply with Section 3, Rule II of these Rules;
  2. The complainant does not give the respondent an opportunity to address the complaint, unless failure to do so is justified;
  3. The complaint does not pertain to a violation of the DPA or does not involve a privacy violation or data breach;
  4. There is insufficient information to substantiate the allegations in the complaint; or
  5. The parties, other than the responsible officers of juridical persons, cannot be identified or traced despite diligence to determine them.

SECTION 2. Amendment of complaint, when allowed. The complainant may substantially amend the complaint once as a matter of right at any time before the respondent has filed a comment, in which case the respondent shall be provided a copy and granted a fresh period to submit his or her comment. Substantial amendments after the respondent has filed a comment may only be done upon motion and with leave of the Investigating Officer.

SECTION 3. Permissive joinder of parties. All persons in whom or against whom any right to relief in respect to or arising out of the same transaction or series of transactions is alleged to exist, whether jointly, severally, or in the alternative, may, except as otherwise provided in these Rules, join as complainants or be joined as respondents in one complaint, where any question of law or fact common to all such complainants or to all such respondents may arise in the action; but the NPC may make such orders as may be just to prevent any complainant or respondent from being embarrassed or put to expense in connection with any proceedings in which the party may have no interest.

SECTION 4. Compulsory joinder of indispensable parties. Parties in interest without whom no final determination can be had of an action shall be joined either as complainants or respondents.

SECTION 5. Necessary party. A necessary party is one who is not indispensable but who ought to be joined as a party if complete relief is to be accorded as to those already parties, or for a complete determination or settlement of the claim subject of the action.6

SECTION 6. Non-joinder of necessary parties to be pleaded. Whenever in any complaint or pleading in which a claim is asserted a necessary party is not joined, the pleader shall set forth the party’s name, if known, and shall state why the party is omitted. Should the NPC find the reason for the omission unmeritorious, it may order the inclusion of the omitted necessary party if jurisdiction over the person may be obtained.

The failure to comply with the order for a necessary party’s inclusion, without justifiable cause, shall be deemed a waiver of the claim against such party.

The non-inclusion of a necessary party does not prevent the NPC from proceeding with its investigation, and any decision rendered therein shall be without prejudice to the rights of such necessary party.

SECTION 7. Misjoinder and non-joinder of parties. Neither misjoinder nor non-joinder of parties is ground for dismissal of a complaint. Parties may be dropped or added by order of the NPC by motion of any party or on its own initiative at any stage of the action and on such terms as are just. Any claim against a misjoined party may be severed and proceeded with separately.

SECTION 8. Entity without juridical personality as respondent. When two or more persons not organized as an entity with juridical personality enter into a transaction, they may be sued under the name by which they are generally or commonly known. In the answer of such respondent, the names and addresses of the persons composing the entity must be accurately stated. The address to be used shall be the last known address of the respondent.

SECTION 9. Submission of comment. Upon finding that the complaint may be given due course, the respondent shall be required to file a verified comment within fifteen (15) calendar days from receipt of the order. A copy of the complaint, together with its supporting evidence, shall be attached to the order to comment.

A complaint may be submitted for resolution if the respondent does not file a comment within the period provided.

In case the respondent is a minor or a person alleged to be incompetent, the pertinent provisions of the Rules of Court and its amendments shall apply. It is sufficient that proof establishing the relationship with the respondent be presented to the NPC as an attachment to the comment. In case the minor or a person alleged to be incompetent is represented by the father or mother, the birth certificate shall be considered sufficient proof, while for the guardian, the court order designating the person as guardian shall be sufficient.

In case the respondent is a juridical person, the representative filing the comment must be authorized to appear and act on behalf of the juridical person by a Board Resolution contained in a duly notarized Secretary’s Certificate, or its equivalent for a government agency7.

SECTION 10. Content of the comment. The respondent shall raise all of his or her defenses in the comment. No motions to dismiss shall be entertained: Provided, the Investigating Officer, in his or her discretion, may treat a motion to dismiss as the respondent’s comment.

SECTION 11. Change of physical address or electronic mail address. A party who changes physical address or electronic mail address while the complaint is pending must promptly file, within five (5) calendar days from such change, a notice of change of physical address or electronic mail address with the NPC and serve the notice on all other parties. Service through the physical address or electronic mail address of a party, on record, shall be presumed valid, unless such party notifies the NPC of any change.

SECTION 12. Prohibited pleadings and motions. The following pleadings and motions shall not be allowed in the complaint proceedings:

  1. motions to dismiss the complaint;
  2. motions for a bill of particulars;
  3. motions to declare respondent in default;
  4. dilatory motions for postponement;
  5. replies or rejoinders, except if the preceding pleading incorporates an actionable document;
  6. third-party complaints;
  7. interventions; and
  8. appeals or motions for reconsideration from any interlocutory order of the Investigating Officer.

SECTION 13. Affirmative defenses. In lieu of a motion to dismiss, the respondent may raise in the comment affirmative defenses such as but not limited to:

  1. The NPC has no jurisdiction over the subject matter;
  2. The action is barred by a prior judgment;
  3. There is another action pending between the same parties for the same cause;
  4. The complainant has no legal capacity to sue;
  5. That the pleading asserting the claim states no cause of action or is found to be frivolous, vexatious, or made in bad faith;
  6. The action has otherwise prescribed under the statute of limitations; or
  7. That the claim or demand set forth in the complaint has been paid, waived, abandoned, or otherwise extinguished.

SECTION 14. Authority of the Investigating Officer to rule on motions. The Investigating Officer may directly rule on motions that do not fully dispose of the case on the merits. No appeal or motion for reconsideration may be taken for any interlocutory order made by the Investigating Officer but these may be included as an issue once the case has reached the Commission for adjudication under Rule VIII of these Rules.“

SECTION 5. Rule VI of the 2021 NPC Rules of Procedure is hereby amended and renumbered to read as follows:

“RULE VI – ALTERNATIVE DISPUTE RESOLUTION

SECTION 1. Willingness to mediate. During the preliminary conference or at any stage of the proceedings but before endorsement of the case for decision by the Legal and Enforcement Office (LEO) Director or the Commission, as the case may be, the parties, by mutual agreement, may signify their interest to explore the possibility of settling issues by mediation.

SECTION 2. Application for mediation. The parties shall jointly file with the Investigating Officer an Application for Mediation manifesting their earnest commitment to engage in a meaningful settlement process and their willingness to abide by these Rules and the orders issued by the assigned Mediation Officer.

Parties may apply for mediation through their representatives, provided that the latter are duly authorized in accordance with Section 8 of this Rule. Otherwise, no order to mediate shall be issued by the Investigating Officer until and unless such requirements have been completed and substantiated.

No application for mediation shall be approved without payment of the mediation fee.

SECTION 3. Mediation fees. The mediation fee, in an amount prescribed by the Commission in a separate issuance, shall be paid by the parties upon the filing of the Application for Mediation.

Parties may be exempted from the payment of the mediation fee under the same grounds as Section 4, Rule II of these Rules.

SECTION 4. Order to mediate, when issued. The Investigating Officer shall issue an Order to Mediate, which shall state the following: (a) the approval of the Application for Mediation; (b) the suspension of the complaint proceedings for up to ninety (90) calendar days pending the mediation proceedings; (c) the name of the assigned or designated Mediation Officer who shall preside over the mediation proceedings; and (d) the date, time, and place when the parties shall appear before the Mediation Officer for the Preliminary Mediation Conference. Copies of the Order to Mediate shall be furnished to the Mediation Officer and the parties.

SECTION 5. Conduct of Mediation Officers. All Mediation Officers and Mediation Support Officers shall be bound by the NPC Mediation Code of Conduct.

SECTION 6. Preliminary Mediation Conference. The Mediation Officer shall receive the appearances of the parties and inform them of the mediation process and the manner by which the proceedings will be conducted. The Mediation Officer shall reiterate the benefits of an early settlement of the dispute and endeavor to achieve the fairest and most expeditious settlement possible.

Each party shall be allowed to make a brief statement of their respective position and preferred outcome. The Mediation Officer shall assist the parties in exploring common grounds for settlement while respecting party autonomy throughout the process.

When necessary, the parties shall agree on the schedule of the next mediation conference and the Mediation Officer shall issue an order therefor.

SECTION 7. Separate caucuses and subsequent conferences. The Mediation Officer may, with the consent of both parties, hold separate caucuses with each party to enable a determination of their respective real interest in the dispute: Provided, that each party shall be afforded equal time and opportunity to ventilate such interest and motivation. The Mediation Officer may call such conferences or caucuses as may be necessary to facilitate settlement.

The Mediation Officer shall hold in confidence any matter disclosed during the separate caucuses and shall exercise reasonable prudence and discretion in the safeguarding of such information.

SECTION 8. Personal appearance by the parties. Individual parties are required to personally appear during mediation conferences. Representatives may appear on behalf of individual parties: Provided, that they are authorized by a special power of attorney to appear, offer, negotiate, accept, decide, and enter into a mediated settlement agreement without additional consent or authority from the principal. If the party is a juridical person, the representative must be authorized by a Board Resolution contained in a duly notarized Secretary’s Certificate, or any equivalent written authority to offer, negotiate, accept, decide, and enter into a mediated settlement agreement.

No representative shall be allowed to appear in mediation on behalf of a party without proper authorization as verified by the Mediation Officer.

The parties shall inform the LD about changes in representation through a written statement or manifestation along with the corresponding written authority to offer, negotiate, accept, decide, and enter into a mediated settlement agreement submitted to the Mediation Officer prior to the next scheduled mediation conference. The mediation shall not proceed until and unless the representatives are duly authorized in accordance with this Section.

SECTION 9. Failure of parties to appear, effect. If any of the parties fail to appear without justifiable reason for two (2) consecutive mediation conferences at any stage of the proceedings, the Mediation Officer may order its termination and refer the same for the resumption of complaint proceedings: Provided, in case of doubt that the party’s absence is justified, the Mediation Officer may order for another caucus or conference. The Mediation Officer may require the non-appearing party to explain why said party should not be required to pay treble costs incurred by the appearing party, including attorney’s fees, in attending the mediation conferences or caucuses, and be henceforth permanently prohibited from requesting mediation at any other stage of the complaint proceedings before the NPC.

SECTION 10. Presence of lawyers in mediation. Lawyers who act as counsels, upon the discretion of the Mediation Officer, may attend the mediation conferences in the role of an adviser and consultant to their clients and shall cooperate with the Mediation Officer towards securing a settlement of the dispute. They shall help their clients comprehend the mediation process and its benefits and assist in the preparation of a mediated settlement agreement and its eventual enforcement.

Lawyers who act as duly authorized representatives of juridical persons may directly attend the mediation conference with all its concomitant rights and obligations.

SECTION 11. Venue. Mediation proceedings may either be conducted via videoconferencing technology for the remote appearance and testimony of parties, as provided under Rule XIII, Section 7 hereof, or within the NPC premises, as agreed by both parties. Upon request of both parties, the Mediation Officer may authorize the conduct of a mediation conference at any other venue, provided that all related expenses, including transportation, food, and accommodation, shall be borne by both parties. If a change of venue is requested by one party, it must be with the other’s conformity, and they shall agree on the terms of handling the expenses.

SECTION 12. Mediation period and extension. The Mediation Officer shall endeavor to achieve a mediated settlement of the dispute within sixty (60) calendar days from the Preliminary Mediation Conference.

Upon reasonable ground to believe that settlement may yet be achieved beyond the initial mediation period of sixty (60) calendar days, the Mediation Officer may extend the mediation period for another thirty (30) calendar days for good cause shown. In all instances, the mediation period shall not exceed ninety (90) calendar days.

SECTION 13. Mediated Settlement Agreement. A mediated settlement agreement following successful mediation shall be jointly prepared and executed by the parties or their representatives, with the assistance of their respective counsels, if any. Only the parties or their authorized representatives shall have the authority to confirm the provisions of the mediated settlement agreement and execute the agreement. The execution of a mediated settlement agreement shall terminate the mediation proceedings. The Mediation Officer shall certify that the contents of the agreement have been explained, understood, and mutually agreed upon by the parties, and that the provisions are not contrary to law, public policy, morals, or good customs.

SECTION 14. Confirmation Conference. The Mediation Officer shall require the parties to attend a confirmation conference prior to the endorsement of their mediated settlement agreement to the Commission. The parties shall present to the Mediation Officer the signed mediated settlement agreement, as well as the evidence of compliance with the stipulation in the agreement, if applicable.

In case of failure of any of the parties to appear for two (2) consecutive confirmation conferences, the Mediation Officer may resolve to submit the parties’ mediated settlement agreement to the Commission for confirmation: Provided, that the appearing party has agreed to proceed, that the parties have fully complied with all the obligations arising from the provisions of the mediated settlement agreement, that the parties have submitted all the necessary documents, and the LD has duly notified the non-appearing party. In such cases, the non-appearing party’s right to amend, object, or revoke specific provisions in the mediated settlement agreement shall be deemed waived.

When the agreement involves future obligations or obligations susceptible to partial fulfillment beyond the mediation period, the party responsible shall submit proof of compliance to the Enforcement Division (EnD).

SECTION 15. Confirmation by the Commission. The Mediation Officer shall issue a resolution submitting the signed mediated settlement agreement to the Commission within thirty (30) calendar days from the date of the confirmation conference. The Commission shall issue a resolution confirming the mediated settlement agreement within thirty (30) calendar days from submission of the resolution and mediated settlement agreement. Copies of the resolution issued by the Commission shall be furnished to the parties, the Investigating Officer, and the Mediation Officer.

SECTION 16. Effect of confirmed Mediated Settlement Agreement. A confirmed mediated settlement agreement shall have the effect of a decision or judgment on the complaint but without prejudice to Rule X of these Rules and shall be enforced in accordance with the NPC’s rules and issuances.

SECTION 17. Failure to reach settlement. If the parties are unable to arrive at a settlement of their dispute, or it becomes apparent that a settlement, given the disparity of the respective positions of the parties, is not likely or achievable within the sixty (60) calendar day mediation period or the reasonable extension of such period under Section 12 of this Rule, the Mediation Officer may declare the mediation unsuccessful and terminate the proceedings by issuing a Notice of Non-Settlement of Dispute and furnishing copies to the Investigating Officer and the parties.

Parties may be allowed to re-apply for mediation despite a prior failure to reach settlement, unless otherwise permanently prohibited in accordance with Section 9 of this Rule: Provided, that the application is filed before the endorsement of the case for decision by the Commission: Provided further, that the application is done in compliance with this Rule.

SECTION 18. Resumption of complaint proceedings. Upon receipt of the Notice of Non-Settlement of Dispute issued by the Mediation Officer, the Investigating Officer shall issue an order lifting the suspension of the complaint proceedings, which shall resume as a matter of course. Copies of the order, including the notice of the next hearing date of the complaint proceedings, shall be furnished to all the parties.

SECTION 19. Confidentiality of proceedings. The mediation conferences shall be held in private. Persons other than the parties, their representatives, counsel, and the Mediation Officer may attend only with the consent of the parties and upon approval by the Mediation Officer. Anyone present during a mediation conference shall not disclose any information obtained during the conference to any other person, nor utter the same through other means.

The mediation proceedings and all related incidents shall be kept strictly confidential, and all admissions or statements shall be inadmissible for any purpose in any proceeding, unless otherwise specifically provided by law. However, evidence or information that is otherwise admissible or subject to discovery does not become inadmissible or protected from discovery solely by reason of its use in mediation.

No transcript or minutes of the mediation proceedings shall be taken, and the personal notes of the Mediation Officer, if any, shall likewise be inadmissible nor cognizable in any court, tribunal, or body for whatever purpose and shall be securely destroyed upon termination of the mediation proceedings.

SECTION 6. Rule VII, Section 3 of the 2021 NPC Rules of Procedure is hereby amended to read as follows:

“SECTION 3. Fact-Finding Report. Within thirty (30) calendar days from the last day of the reglementary period to file memoranda, the Investigating Officer shall submit to the Commission a Fact-Finding Report, including the results of the investigation, the evidence gathered, and recommendations. Within ten (10) calendar days from submission of the Fact-Finding Report to the Commission, both parties shall be furnished with a notice that the case has been submitted for decision to the Commission.

For cases recommended for outright dismissal under Rule IV, Section 1 of these Rules, the Investigating Officer shall submit to the LEO Director a Fact-Finding Report, including the basis and recommendation for outright dismissal of the complaint.”

SECTION 7. Rule VIII of the 2021 NPC Rules of Procedure is hereby amended and renumbered to read as follows:

“RULE VIII – DECISION

SECTION 1. Action on the recommendations of the Investigating Officer. The Commission shall review the evidence presented, including the Fact-Finding Report and evidence on record. On the basis of the review, the Commission may: (1) promulgate a decision; (2) issue interlocutory orders on matters affecting personal data; or (3) order the conduct of a clarificatory hearing or the submission of additional documents, if in its discretion, additional information is needed to make a decision.

No motion for clarificatory hearing shall be entertained. In case the Commission finds that a clarificatory hearing is necessary, the following shall be observed:

  • a. The parties shall be notified of the scheduled clarificatory hearing at least five (5) calendar days before the schedule;

  • b. The Commission may require additional information and compel attendance of any person involved in the complaint;

  • c. The parties shall not directly question the individuals called to testify but may submit their questions to the Commission for its consideration;

  • d. The Commission may require the parties to submit their respective memoranda containing their arguments on the facts and issues for resolution.

SECTION 2. Additional issues to be raised before the Commission. Upon motion, both parties may raise as an issue during adjudication any interlocutory order or decision issued by the Investigating Officer, Evaluating Officer, special committee, or task force, as the case may be. The Commission, in its discretion, may resolve the issues separately or jointly with the merits of the case.

Once a given case has reached the Commission for adjudication, the Investigating Officer, Evaluating Officer, special committee, or task force shall transmit to the Commission any pleadings, motions, and other submissions erroneously filed subsequent to the endorsement of the main case to the Commission. Subject to the discretion of the Commission, these pleadings, motions, and other submissions may form part of the main case.

SECTION 3. Decision for Cases Dismissed Outright. The LEO Director shall review the evidence presented, including the Fact-Finding Report and the evidence on record. Based on the review, the LEO Director may: (1) promulgate a decision dismissing the case outright based on the grounds in Rule IV, Section 1 of these Rules; or (2) remand the complaint for investigation and require the respondent to file a verified comment to the complaint and appear for preliminary conference. Provided, the dismissal shall be without prejudice to the refiling with the NPC in accordance with the Rules, or filing of appropriate civil, criminal, or administrative cases against the respondent before any other forum or tribunal, if any.

SECTION 4. Decision for Cases where Complainant files an Affidavit of Desistance. The LEO Director shall review the evidence presented, including the Fact-Finding Report, evidence on record, and any other supporting documents. Based on the review, the LEO Director shall promulgate a decision. The dismissal shall be with prejudice to the refiling with the NPC, but without prejudice to the filing of appropriate civil, criminal, or administrative cases against the respondent before any other forum or tribunal, if any.

SECTION 5. Refiling of complaint or motion for reconsideration on the decision issued by the Legal and Enforcement Office. The complainant may refile the complaint with the NPC or file with the LEO a motion for reconsideration of the decision dismissing the case outright. Otherwise, the decision of the LEO Director shall become final and executory within fifteen (15) calendar days from notice thereof with proof of service on the adverse party. If the complainant files a motion for reconsideration, the motion for reconsideration shall be endorsed to the Commission for its resolution within fifteen (15) calendar days from the LEO Director’s receipt of such motion.

SECTION 6. Rendition of decision. The decision of the Commission shall resolve the issues on the basis of all the evidence on record and its own consideration of the law. The decision may include enforcement orders on the following:

  • a. an award of indemnity on matters affecting personal data protection, or rights of the data subject, where the indemnity amount to be awarded shall be determined based on the provisions of the Civil Code;

  • b. a permanent ban on the processing of personal data;

  • c. a recommendation to the Department of Justice for the prosecution and imposition of penalties specified in the DPA;

  • d. an order to conduct a sua sponte investigation under Rule X such as in cases when the responsible officer of a juridical entity must be determined for recommendation to the Department of Justice for prosecution;

  • e. an order to compel or petition any entity, government agency, or instrumentality to abide by its orders or take action on a matter affecting data privacy;

  • f. an imposition of fines for violations of the DPA or NPC issuances; or

  • g. any other order to enforce compliance with the DPA.

SECTION 7. Motion for reconsideration on the decision issued by the Commission. The decision of the Commission shall become final and executory fifteen (15) calendar days from notice thereof with proof of service to the adverse party. One motion for reconsideration may be filed, which shall suspend the running of the period. Any appeal from the decision shall be to the proper courts, in accordance with law and the rules.

SECTION 8. Entry of judgments and final orders. If no appeal or motion for reconsideration is filed within the time provided in these Rules, the judgment shall attain finality, and an entry of judgment shall be issued to the parties. The date when the judgment becomes executory shall be deemed as the date of its entry. The entry of judgment shall contain the dispositive portion of the judgment with a certificate that such judgment has become final and executory.”

SECTION 8. Rule X of the 2021 NPC Rules of Procedure is hereby amended and renumbered to read as follows:

“RULE X – SUA SPONTE INVESTIGATION

SECTION 1. Commencement. The NPC, through the CID or a special committee or task force assigned for such purpose, may initiate an investigation on the circumstances surrounding a possible data privacy violation or data breach in cases of, but not exclusive to, matters that arose from pending cases before the NPC, including those that have resulted in a confirmed mediated settlement agreement, reports from the daily news, trends or academic studies, information gathered from corroborated and substantiated anonymous tips, or reports from other offices of the NPC or government agencies.

SECTION 2. Temporary and permanent ban on processing of personal data. A temporary or permanent ban on processing of personal data may be imposed on the subject of a sua sponte investigation in order to protect national security or public interest, or if it is necessary to preserve and protect the rights of data subjects, in accordance with Rule IX of these Rules.

SECTION 3. Assignment of Investigating Officer or special committee or task force. The Commission may, when it deems proper, assign an Investigating Officer or create a special committee or task force which shall be specifically assigned to conduct the investigation.

SECTION 4. Conduct of sua sponte investigation. The Investigating Officer or special committee or task force shall investigate the circumstances surrounding the privacy violation or data breach, subject to due process requirements under the law. Investigations may include on-site examination of systems and procedures. In the course of the investigation, the parties subject of the investigation may be required to furnish additional information, document, or evidence, or to produce additional witnesses, or to appear for an investigation hearing or clarificatory conference before the Investigating Officer, special committee, or taskforce, or the Commission, in accordance with Rule VIII, Section 1.

SECTION 5. Request for case files during the conduct of a sua sponte investigation. Within fifteen (15) calendar days upon receipt of a request for case files by the parties-in-interest subject of the investigation, or their representative, legal heirs and assigns, or successors-in-interest, the CID shall release the requested case files to the requesting party. The representative shall be authorized by a special power of attorney. In case a party is a juridical person, the representative shall be authorized to appear and act on behalf of the juridical person by a Board Resolution contained in a duly notarized Secretary’s Certificate or its equivalent for a government agency8.

The requested case files may be in the form of a physical copy or an electronic copy. For physical copies, the same be in the form of a copy only or a certified true copy, at the option and cost of the requesting party. For electronic copies, the same be issued to the requesting party and duly protected by a password.

The requested case files shall include documents and communications between the requesting party and the NPC, together with its attachments. Documents that are internal in nature, such as, but not limited to, Technical Reports, Minutes of the Meeting, and Memorandum within the NPC, shall be excluded. Third-party reports and submissions shall also be excluded.

SECTION 6. Sua Sponte Fact-Finding Report. Within thirty (30) calendar days from the termination of the investigation, the Investigating Officer or special committee or task force shall submit to the Commission a Fact-Finding Report, which shall include the results of the investigation, the evidence gathered, and any recommendations. In a sua sponte investigation, the Fact-Finding Report serves as the complaint, with the CID as the nominal complainant.

SECTION 7. Order to comment. Upon receipt by the Commission of the Fact-Finding Report, the respondent identified after the conduct of the preceding investigation shall be provided a copy of the Fact-Finding Report and its annexes and given an opportunity to submit a comment or other pleadings, if necessary. In cases where the respondent or respondents fail without justification to submit a comment or appear before the NPC when so ordered, the Commission shall render its decision on the basis of available information under Rule VIII of these Rules.

SECTION 8. Existence of a complaint during sua sponte investigation and vice versa, effect. If, during the proceedings of a sua sponte investigation, a formal complaint relating to the same act or omission for violation of the DPA is filed against the respondent, the complaint proceedings shall follow the normal procedure under these Rules: Provided, that the complaint proceedings shall not suspend the sua sponte proceedings, or vice versa: Provided further, that discovery and mediation proceedings under Rule V shall be available to the parties of the complaint proceedings: Provided finally, that a mediated settlement agreement shall only terminate the complaint proceedings but not the sua sponte investigation.

The preceding paragraph shall likewise apply if the complaint proceedings occurred first, and the NPC wishes to initiate a sua sponte investigation thereafter.”

SECTION 9. Rule XI of the 2021 NPC Rules of Procedure is hereby amended to read as follows:

“RULE XI – BREACH INVESTIGATION

SECTION 1. Procedure for data breach notification. The procedure for data breach notification and other requirements shall be governed by the DPA, its IRR, and NPC issuances pertaining to data breach management. These Rules shall apply in a suppletory character.

SECTION 2. Receipt of data breach notifications. The CMD shall be the initial recipient of data breach notifications and shall immediately assign an Evaluating Officer to review the data breach notification.

SECTION 3. Preliminary requests that shall be resolved by CMD. Upon receipt of the data breach notification, the Evaluating Officer shall recommend to resolve preliminary requests from the PIC or PIP for (a) extensions to notify data subjects or (b) extensions to file full breach report. The preliminary requests for extensions granted by the CMD shall be for a period of twenty (20) calendar days counted from the date of the request.

SECTION 4. Preliminary requests and related Motions that must be endorsed to the Commission. The CMD shall endorse to the Commission the following requests from the PIC or PIP:

  • a. On notification of data subjects:

    • i Request for exemption;
    • ii Request for postponement;
    • iii Request for extension beyond twenty (20) calendar days; or
    • iv Request for use of alternative modes of notification.

  • b. On submission of full report:

    • i Request for extension beyond twenty (20) calendar days; or
    • ii Subsequent request for extension.

  • c. Other preliminary requests not covered by the preceding Section.

  • d. Motion for Reconsideration filed by the PIC or PIP on their preliminary request and other related pleadings.

The Commission may delegate to the CMD the resolution of Section 4 (a)(iii) and (b) as deemed necessary.

SECTION 5. Initial breach notification evaluation and monitoring. The Evaluating Officer shall review the completeness of the data breach notification and determine the other documents needed to assess the PIC or PIP’s breach management. The PIC or PIP may be directed to submit additional documents through an order.

Further, the CMD shall monitor the compliance of the PIC or PIP with the periods provided in the NPC issuances on data breach and the subsequent extensions allowed under the preceding sections.

In case of non-compliance, the CMD may apply for a Cease-and-Desist Order in accordance with the NPC issuances pertaining to the matter.

SECTION 6. Final breach notification evaluation. Upon receipt of all the documents required to assess the PIC or PIP’s breach management, the Evaluating Officer shall prepare a Breach Notification Evaluation Report based on information available on record.

The report may contain a recommendation of a possible violation of the DPA arising from the breach matter and a recommendation for the imposition of administrative fines on other infractions.

Upon the finding of a possible data privacy violation that requires further investigation, the CMD shall endorse the Final Breach Notification Evaluation Report to the Commission for the resolution of the breach case while endorsing the matter to the CID for further investigation for a possible data privacy violation.

SECTION 7. Conduct of breach investigation. Upon receipt of the Final Breach Notification Evaluation Report, an Investigating Officer shall determine if there is a necessity to conduct an on-site or technical investigation. The Investigating Officer shall request proper authority from the NPC before conducting any on-site or technical investigation. The Investigating Officer may also request assistance from the technical personnel of the NPC. In the course of the investigation, the complainant and respondent may be required to furnish additional information, document, or evidence, or to produce additional witnesses.

SECTION 8. Fact-Finding Report The Investigating Officer shall submit to the Commission a Fact-Finding Report within thirty (30) calendar days from the termination of the on-site or technical investigation or receipt of the Final Breach Notification Evaluation Report, whichever is applicable.

SECTION 9. Order to comment. Upon receipt by the Commission of the Fact-Finding Report, the respondent identified after the conduct of the preceding investigation shall be provided with a copy of the Fact-Finding Report and its annexes and given an opportunity to submit a comment or other pleadings, if necessary. In cases where the respondent fails without justification to submit a comment or other pleadings, or appear before the NPC when so ordered, the Commission shall render its decision on the basis of available information under Rule VIII of these Rules.

SECTION 10. Failure to submit breach notification. Should the NPC receive information that a possible data breach occurred but the PIC or PIP did not submit any notification to the NPC, the CID may use this information to initiate a sua sponte investigation under Rule X.

During the sua sponte investigation, if a breach notification is submitted by the PIC or PIP, the CID shall continue with its sua sponte investigation on violations of the DPA and NPC issuances for possible recommendations for prosecution with the Department of Justice or imposition of administrative fines. The CMD shall, for its part, evaluate the breach matter submitted and recommend the imposition of administrative fines, if warranted.

SECTION 11. Post-breach monitoring and compliance. The CMD shall monitor compliance of PICs or PIPs with the orders and resolutions issued by the Commission during its evaluation of the data breach matter.

The EnD shall ensure the enforcement and monitoring of compliance of all other judgments, resolutions, decisions, or orders issued by the Commission.

SECTION 10. This Rule has been included to read as follows:

“RULE XII – COMPLIANCE CHECKS

SECTION 1. Procedure for Compliance Checks. The procedure for Compliance Checks and other requirements shall be governed by the DPA, its IRR, and NPC issuances pertaining to Compliance Checks. These Rules shall apply in a suppletory character.

SECTION 2. Conduct of Privacy Sweep. The CMD shall conduct a Privacy Sweep of all publicly available or accessible information, including, but not limited to websites, mobile applications, raffle coupons, brochures, privacy notices, social media pages or accounts, and physical or digital forms of a PIC or PIP.

SECTION 3. On-the-spot Privacy Sweep. The CMD may also conduct on-the-spot Privacy Sweep on the premises, pop-up stores, kiosks, or stalls of a PIC or PIP where personal data is processed. The Privacy Sweep shall be limited to public areas and publicly available or accessible information. The CMD may verify the PIC or PIP’s compliance by examining all physical or digital forms, including, but not limited to data processing systems, logbooks, raffle coupons, brochures, and posters used in the PIC or PIP’s operations.

SECTION 4. Issuance of Warning Letter or Notice of Documents Submission.

  • a. Warning Letter: when applicable – The CMD shall issue a Warning Letter in the following instances:
    • i. If after a Privacy Sweep, the CMD discovers data privacy issues involving a PIC or PIP who has not yet registered or whose registration has expired in accordance with the relevant NPC Circular on Registration; or
    • ii. If the CMD determines that the risk to the rights and freedoms of a data subject is present, and requires the PIC or PIP’s urgent and immediate action.
  • b. Notice of Documents Submission: when applicable – The CMD shall issue a Notice of Document Submission in the following instances:
    • i. If after a Privacy Sweep, the CMD discovers that the PIC or PIP has failed to demonstrate substantial compliance with the DPA, its IRR, and other NPC issuances;
    • ii. If the CMD requires additional information to fully determine the PIC or PIP’s level of compliance; or
    • iii. If the CMD requires further verification to determine if the PIC or PIP has embedded data privacy policies and data protection measures in its operations.

SECTION 5. Review and assessment of documents submitted by the PIC or PIP. The Evaluating Officer shall review the sufficiency of the documents submitted by the PIC or PIP and determine other documents necessary to assess the PIC or PIP’s compliance. The PIC or PIP may be directed to submit additional documents.

The CMD shall monitor all compliance of the PIC or PIP, including the submission within the periods provided in the NPC’s issuances on compliance checks and the subsequent extensions allowed under Section 6 of this Rule.

SECTION 6. Request for extension that shall be resolved by CMD. If the PIC or the PIP requests for additional time to comply with the Warning Letter, Notice of Documents Submission, Deficiency Report, or other orders issued by the CMD, the CMD may grant the request: Provided, that the PIC or PIP shall submit a formal letter with a justification for the extension, signed by the Data Protection Officer (DPO) or head of the organization, requesting for additional time which shall not exceed a cumulative period of thirty (30) calendar days counted from the date of the initial request. In case of refusal of the request for extension, the CMD shall send the denial of the request for extension and order the PIC or PIP to submit the same immediately.

SECTION 7. Failure of the PIC or PIP to comply with the Warning Letter. If the PIC or PIP fails to comply within seven (7) calendar days from receipt of the Warning Letter, the CMD shall order the PIC or PIP to show valid cause why it should not be subject to the NPC’s issuance on administrative fines and other actions that the Commission may deem proper to ensure compliance with the law.

SECTION 8. Failure of the PIC or PIP to comply with the Notice of Documents Submission. If the PIC or PIP fails to comply within fifteen (15) calendar days from receipt of the Notice of Documents Submission, the CMD shall order the PIC or PIP to show valid cause why it should not be subject to the NPC’s issuance on administrative fines and other actions the Commission may deem proper to ensure compliance with the law.

SECTION 9. Show cause order for non-compliance with the mandatory registration requirement of the NPC. If based on the findings in the Privacy Sweep conducted by the CMD, the PIC or PIP is subject to mandatory registration but has failed to register, the CMD shall issue a show cause order for non-registration directing the PIC or PIP to register its DPO and Data Processing Systems within five (5) calendar days from receipt of the order. Non-compliance with the show cause order may subject the PIC or PIP to administrative fines and other actions the Commission may deem proper to ensure compliance with the law.

SECTION 10. Conduct of On-Site Visit (OSV). The CMD shall conduct an OSV to the PIC or PIP’s principal place of business or where personal data is processed in cases where there are persistent issues9 or substantial findings of non-compliance with the obligations indicated in the DPA and NPC issuances.

Authorized personnel of the NPC shall conduct a focused inspection on the relevant issues within the premises of a PIC or PIP that may include presentation of documents or records, visits to selected departments or units wherein processing of personal information are undertaken, taking of photos and videos for monitoring purposes, and interviews of relevant personnel tasked to handle personal information processed by the PIC or PIP subject to the Compliance Check.

The CMD may, in its discretion, directly conduct an OSV if it determines that the totality of circumstances warrant such action, taking into account the succeeding provision.

SECTION 11. Considerations for the conduct of Compliance Checks. A PIC or PIP may be subject to a Compliance Check based on any of the following considerations:

  • a) Level of risk to the rights and freedoms of data subjects posed by personal data processing by a PIC or PIP;
  • b) Reports received by the NPC against the PIC or PIP, or its sector;
  • c) Non-registration of a PIC or PIP that is subject to the mandatory registration requirement as provided under NPC Circular on Registration of Data Processing System;
  • d) Unsecured or publicly available personal data found on the premises and on the internet that may be traced to a PIC or PIP;
  • e) Other considerations that indicate non-compliance with the DPA, IRR, or NPC issuances; and
  • f) When, in the discretion of the CMD, there is an urgent need to ensure the protection of voluminous personal data records and the same can only be done by actual physical inspection of said records within the PIC’s or PIP’s office premises.

In cases where the CID is investigating or commencing an investigation against a PIC or PIP undergoing or scheduled for a Compliance Check, the Compliance Check shall be held in abeyance and the investigation shall be given precedence until such investigation has been concluded or submitted further for adjudication.

SECTION 12. Service of orders. The CMD shall send an order to a PIC or PIP on the conduct of a Compliance Check through the electronic mail address used at the time it registered with the NPC. Such order shall be deemed received on the next business day: Provided, for unregistered organizations, the order shall be sent to any publicly available email address that may be found on websites or other social media pages or accounts and it shall be addressed to the head of the organization.

A PIC or PIP shall take the necessary steps to ensure that its registered e-mail address is working and able to receive the order promptly.

SECTION 13. Notice of On-Site Visit. A notice of OSV shall be issued by the CMD to the PIC or PIP at least five (5) days before such visit. The notice shall include a list of required documents to be submitted by the PIC or PIP at least three (3) days prior to the OSV.

The CMD shall present the physical copy of the notice and provide the list of authorized personnel of the NPC to conduct the OSV. The authorized NPC personnel shall wear their identification cards at all times.

SECTION 14. Issuance of Deficiency Report. The CMD shall issue a Deficiency Report based on the determination from the OSV that there are existing gaps in the PIC or PIP’s compliance with the DPA, its IRR, and NPC issuances.

SECTION 15. Issuance of Notice of Deficiencies. If the PIC or PIP fails to address the issues raised in a Deficiency Report or is determined to be non-compliant with the DPA, its IRR, and other issuances of the NPC after being subjected to any of the modes of Compliance Checks, the CMD shall issue the Notice of Deficiencies indicating the period of time within which to correct the identified deficiencies, which shall not be less than ten (10) days from receipt of the Notice.

SECTION 16. Issuance of Compliance Order. The Commission shall issue a Compliance Order in any of the following instances:

  • a) After the lapse of the period provided in the Notice of Deficiencies and no action was taken by the PIC or PIP to correct the identified deficiencies;

  • b) After the lapse of the period provided in the Notice of Deficiencies and such identified deficiencies persist.

    If the persistence of the deficiencies is due to the considerable period of time or resources needed to implement the necessary remediation measures, the timeline to complete such measures, as approved by the Commission, shall be embodied in a Compliance Order;

  • c) In the course of the conduct of an OSV, the PIC or PIP refuses or fails to provide access to premises, records or prevents the conduct of the inspection; or

  • d) In the course of the conduct of the on-the-spot Privacy Sweep, the PIC or PIP refuses or prevents the conduct of the inspection on otherwise publicly available areas or information.

Compliance Orders shall state the deficiencies remaining or actions to be taken, the period within which to undertake the corrections ordered by the Commission, and the period to report such actions.

SECTION 17. Issuance of other orders. The Commission, through the CMD, may issue pertinent orders in connection with the conduct or furtherance of a Compliance Check or the assessment of any PIC or PIP’s compliance with any orders in relation thereto.

SECTION 18. Refusal to undergo Compliance Check. A PIC or PIP who, without good reason and despite due notice, refuses or prevents the CMD from performing a Compliance Check may be subject to appropriate penalties and sanctions as may be allowed by law. In case of refusal, the following provisions shall govern:

  • A. Action to be taken upon refusal or failure to comply with documents submission. Refusal or failure to submit the requested documents or policies within the period stated in the notice or order shall subject a PIC or PIP to an OSV from the CMD, enforcement actions, and imposition of fines in accordance with the NPC’s issuance on administrative fines and other actions the Commission may deem proper to ensure compliance with the law.

  • B. Action to be taken upon refusal or failure to provide access to premises or records during an OSV and on-the-spot Privacy Sweep. Refusal or failure to provide access to premises or records during an OSV and on-the-spot Privacy Sweep shall subject a PIC or PIP to a Compliance Order, enforcement actions, and imposition of fines in accordance with the NPC’s issuance on administrative fines and other actions the Commission may deem proper to ensure compliance with the law.

  • C. Failure or refusal to provide an explanation to Compliance Orders. Refusal or failure to submit an explanation to the order cited in the preceding paragraphs, or if the explanation does not present a compelling reason to justify such refusal or failure, may subject a PIC or PIP to contempt proceedings, as may be permitted by law, before the appropriate court, or such other actions as may be available to the Commission.

SECTION 19. Certificate of No Significant Findings. The CMD shall issue a Certificate of No Significant Findings to a PIC or PIP that has undergone document submission or an OSV, where no substantial deficiencies were found, or the deficiencies identified in the Deficiency Report or Notice of Deficiencies have already been addressed to the satisfaction of the NPC.

The issuance of this certificate is without prejudice to any other recommendation being made by the CMD for the improvement of the PIC or PIP’s compliance with the DPA, IRR, and NPC issuances. The issuance of this certificate does not bar an investigation for any possible liability arising from complaints and/or personal data breaches filed before the NPC.”

SECTION 11. Rule XII of the 2021 NPC Rules of Procedure is hereby amended and renumbered to read as follows:

“RULE XIII – MISCELLANEOUS PROVISIONS

SECTION 1. Transitory provision. These Rules shall apply to all complaints filed after its effectivity. It shall also apply to pending proceedings, except to the extent that their application would not be feasible or would work injustice.

SECTION 2. Procedure for Cease-and-Desist Orders. Procedure for the issuance of Cease-and-Desist Orders shall be governed by NPC issuances pertaining to the matter.

SECTION 3. Procedure for breach notification. Procedure for data breach notification to the Commission shall be governed by the NPC issuances pertaining to the matter.

SECTION 4. Request for case files. Copies of the case files may be requested by any party to the complaint or their authorized representative, lawful heirs, and assigns, in accordance with Section 17 of the DPA, or successors-in-interest, by filling-out the request form before the General Records Unit of the NPC. The request for case files may be in the form of a physical copy or an electronic copy, at the option and cost of the requesting party. Provided, that the representative is authorized by a special power of attorney. Provided further, that in case where a party is a juridical person, the representative is authorized by a Board Resolution contained in a duly notarized Secretary’s Certificate or its equivalent for a government agency10. Provided finally, that in case where the files are requested by the heirs, assigns, or successors-in-interest, proof of authority or relationship must be presented.

SECTION 5. Procedure for requests for advisory opinion. Procedure for requests for advisory opinion shall be governed by NPC issuances pertaining to the matter.

SECTION 6. Procedure for enforcement of administrative fines. Procedure for the enforcement of administrative fines shall be governed by NPC issuances pertaining to the matter.

SECTION 7. Procedure for videoconferencing technology. Procedure for the use of videoconferencing technology for the remote appearance and testimony of parties before the NPC shall be governed by NPC issuances pertaining to the matter.

Notwithstanding any provision of these Rules, the conduct of preliminary conferences, summary hearings, mediation conferences, investigations, clarificatory hearings, and all other hearings may be conducted through videoconferencing technology at the discretion of the concerned division or Commission.

SECTION 8. Repealing clause. NPC Circulars No. 2016-04 and 2018-03 are hereby repealed. All other issuances by the Commission which are contrary to the provisions of these Rules are also hereby repealed or amended accordingly.

SECTION 9. Amendments. These Rules or any of its portion may be amended or supplemented by the Commission.

SECTION 10. Application of Rules of Court. The Rules of Court shall apply in a suppletory character and whenever practicable and convenient.

SECTION 11. Effectivity. These Rules shall take effect fifteen (15) days after publication in a newspaper of general circulation.”

SECTION 12. Repealing Clause. The Rules not included herein and amended accordingly shall remain in force and full effect. If any part of this issuance is declared unconstitutional or invalid, such provision/s thereof not so declared shall remain valid and subsisting.

SECTION 13. Effectivity. These amendments shall take effect fifteen (15) days after its publication in a newspaper of general circulation.

Approved:

SGD.
ATTY. JOHN HENRY D. NAGA
Privacy Commissioner

SGD.
ATTY. LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner

SGD.
ATTY. NERISSA N. DE JESUS
Deputy Privacy Commissioner

Footnotes

  1. Rules on Electronic Evidence, A.M. No. 01-7-01-SC, Rule 2, § 1(e) [July 17, 2001]. ↩

  2. Id. Rule 2, § 1(h). ↩

  3. An Act to Ordain and Institute the Civil Code of the Philippines, [CIVIL CODE OF THE PHILIPPINES], Republic Act No. 386, Art. 44 (1949). ↩

  4. 2019 Amendments to the 1997 Rules of Civil Procedure (A.M. No. 19-10-20-SC), [RULES OF COURT], Rule 3, § 2 (May 1, 2020). ↩

  5. This includes a department, bureau, office, instrumentality, government-owned or controlled corporation, local government, state university and college, or a distinct unit in it. ↩

  6. RULES OF COURT, Rule 3, § 8. ↩

  7. This includes a department, bureau, office, instrumentality, government-owned or controlled corporation, local government, state university and college, or a distinct unit in it. ↩

  8. This includes a department, bureau, office, instrumentality, government-owned or controlled corporation, local government, state university and college, or a distinct unit in it. ↩

  9. Persistent issues pertain to the inadequate implementation of security measures to address the heightened risk to the rights and freedoms of data subjects. ↩

  10. This includes a department, bureau, office, instrumentality, government-owned or controlled corporation, local government, state university and college, or a distinct unit in it. ↩

Backlinks