NPC Issuance Wiki

Considerations on the Use of Privacy Enhancing Technologies (PETs) in the Insurance Industry (Joint Advisory No. 2025-001)

Issued Joint Advisory

Issuance Text

Republic of the Philippines
INSURANCE COMMISSION
NATIONAL PRIVACY COMMISSION

Joint Advisory No.: 2025-001
Classification: Joint Advisory
Date: 11 March 2025

JOINT ADVISORY

TO: ALL REGULATED ENTITIES

SUBJECT: CONSIDERATIONS ON THE USE OF PRIVACY ENHANCING TECHNOLOGIES (PETs) IN THE INSURANCE INDUSTRY

WHEREAS, Article II, Section 11 of the 1987 Constitution declares that the State values the dignity of every human person and guarantees full respect for human rights, and Article XIII, Section 1 states that Congress shall give the highest priority to the enactment of measures that protect and enhance the right of the people to human dignity. At the same time, enshrined in jurisprudence is the recognition of the right to privacy as a right fully deserving of constitutional protection;

WHEREAS, Section 2 of Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), provides that it is the policy of the State to protect the fundamental human right of privacy of communication while ensuring the free flow of information to promote innovation and growth. The State also recognizes its inherent obligation to ensure that personal information in information and communications systems in the government and the private sector are secured and protected;

WHEREAS, Section 437 of the Amended Insurance Code of the Philippines (Republic Act No. 10607) grants the Insurance Commissioner the authority to issue circular letters and promulgate rules and procedures to effectively implement the provisions of the Insurance Code and to ensure proper regulation of the insurance industry;

WHEREAS, the Insurance Commission (IC) is mandated to regulate and supervise the insurance, pre-need, and health maintenance organization (HMO) industries in accordance with the provisions of the Insurance Code, as amended, Pre-Need Code of the Philippines, and Executive Order No. 192 (s. 2015);

WHEREAS, pursuant to Section 7 of the DPA, the National Privacy Commission (NPC) is mandated to administer and implement the provisions of the DPA, monitor and ensure compliance of the country with international standards set for data protection, and coordinate with government agencies and the private sector on efforts to formulate and implement plans and policies that strengthen the protection of personal information in the country;

WHEREAS, Section 9 of the Implementing Rules and Regulations (IRR) of the DPA provides that the NPC shall, among its other functions, develop, promulgate, review, or amend rules and regulations for the effective implementation of the law;

WHEREAS, Insurance Commission Circular Letter No. 2019-13 requires all entities under the regulatory control and supervision of the IC to comply with the provisions of the DPA;

WHEREAS, Section 20 (a) of the DPA provides that the personal information controller (PIC) must implement reasonable and appropriate organizational, physical, and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration, and disclosure, as well as against any other unlawful processing;

WHEREAS, PICs shall designate Data Protection Officers (DPOs) whose responsibilities include upholding privacy-preserving practices within their organizations, and ensuring the PICs’ compliance with data privacy laws and regulations;1

WHEREAS, to supplement existing privacy-preserving practices, DPOs may consider the adoption of Privacy Enhancing Technologies (PETs) as a means to mitigate data privacy risks and maintain the confidentiality, integrity, and availability of data against breaches and unauthorized processing;

WHEREFORE, in consideration of the foregoing premises, and without prejudice to the application of pertinent laws and regulations, the NPC and the IC hereby issue this Joint Advisory to provide considerations on the use of PETs in the insurance industry.

SECTION 1. Scope. These Guidelines shall apply to insurance providers, insurance and pre-need companies, health maintenance organizations (HMO), mutual benefit associations (MBA), their respective agents, brokers, adjusters, intermediaries, all other entities under the regulatory control and supervision of the IC, and personal information processors (PIP) of the foregoing entities (collectively, Covered Entities). These Covered Entities are subject to the provisions of the DPA, the Insurance Code, their respective IRRs, and other relevant issuances of the NPC and the IC.

SECTION 2. Definition of Terms. The terms used in the DPA, the Insurance Code, their IRRs, and other NPC and IC issuances, as amended, are adopted herein.

SECTION 3. Privacy-Enhancing Technologies (PETs).

  • A. PETs are a “collection of digital technologies, approaches and tools that permit data processing and analysis while protecting the confidentiality, and in some cases also the integrity and availability, of the data and thus the privacy of the data subjects and commercial interests of [PICs].”2

    Categories of PETs3 include:

    1. Data Obfuscation Tools. Some examples of data obfuscation tools are anonymization, pseudonymization, synthetic data, differential privacy, and zero-knowledge proofs.
    2. Encrypted Data Processing Tools. Some examples of encrypted data processing tools are homomorphic encryption, multi-party computation, and trusted execution environments.
    3. Federated and Distributed Analytics. Some examples of federated and distributed analytics are federated learning, and distributed analytics.
    4. Data Accountability Tools. Some examples of data accountability tools are threshold secret sharing, and personal data stores.

  • B. The Organisation for Economic Co-operation and Development (OECD) published a report on PETs. The report discusses the nature and various categories of PETs, and developments surrounding PETs. The report is available on the OECD website through the following link:

    Emerging Privacy-Enhancing Technologies: Current Regulatory and Policy Approaches4

SECTION 4. Selection and Implementation of PETs; Factors. Covered Entities may adopt PETs to analyze data and develop insights from such data while upholding privacy and maintaining an appropriate level of security. PETs are privacy-preserving mechanisms that may support adherence to general privacy principles and compliance with other obligations provided under the relevant data privacy laws and regulations.

  • A. Covered Entities shall be responsible for any processing of personal data through the adoption of PETs, including when the processing is outsourced or subcontracted to a PIP, following the Principle of Accountability.5 As such, Covered Entities must ensure that their use of PETs is compliant with data privacy laws and regulations;

  • B. Notwithstanding the adoption of PETs, Covered Entities shall ensure their continuous compliance with their obligations under the DPA, its IRR, and other issuances of the NPC, including but not limited to:

    1. Implement reasonable and appropriate organizational, physical, and technical measures for the protection of personal data against any accidental or unlawful processing;6
    2. Register data processing systems with the NPC pursuant to the relevant NPC regulations on registration;7 and
    3. Comply with breach notification requirements in accordance with guidelines on data breach management.8

  • C. Covered Entities shall conduct Privacy Impact Assessments (PIA) for every processing system that involves personal data before the adoption of PETs and thereafter as may be necessary.9 A PIA is a continuing requirement, regularly reviewed and updated to account for changes in products, services, processes, or regulations.10 Covered Entities may utilize PIA results to assess which specific PETs are most suitable for their processing activities and identified risks.

  • D. In assessing which PETs are most suitable for their business purpose, Covered Entities can consider industry standards and best practices. Covered Entities may also consider factors such as technical compatibility, costs, and efficiency. They may utilize more than one PET taking into consideration each PET’s specific benefit and purpose and their specific needs.

Approved:

INSURANCE COMMISSION

SGD.
REYNALDO A. REGALADO
Commissioner

NATIONAL PRIVACY COMMISSION

SGD.
JOHN HENRY D. NAGA
Privacy Commissioner

SGD.
LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner

SGD.
NERISSA N. DE JESUS
Deputy Privacy Commissioner

Footnotes

  1. See National Privacy Commission, Registration of Personal Data Processing System, Notification Regarding Automated Decision-Making Or Profiling, Designation of Data Protection Officer, And the National Privacy Commission Seal Of Registration, Circular No. 04, Series of 2022 [NPC Circ. No. 22-04] (05 December 2022). ↩

  2. Organisation for Economic Co-operation and Development (OECD), Emerging Privacy-Enhancing Technologies: Current Regulatory and Policy Approaches, OECD Digital Economy Papers No. 351, at 4 (2023), available at https://doi.org/10.1787/bf121be4-en (last accessed: November 2024). ↩

  3. Id. at 13. ↩

  4. See Organisation for Economic Co-operation and Development (OECD), Emerging Privacy-Enhancing Technologies: Current Regulatory and Policy Approaches, OECD Digital Economy Papers No. 351 (2023), available at https://doi.org/10.1787/bf121be4-en (last accessed: November 2024). ↩

  5. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 § 21 (2012). ↩

  6. Id. § 20. ↩

  7. See NPC Circ. No. 22-04. ↩

  8. See National Privacy Commission, Personal Data Breach Management, Circular No. 03, Series of 2016 [NPC Circ. No. 16-03], (15 December 2016). ↩

  9. See National Privacy Commission, Security of Personal Data in the Government and the Private Sector, Circular No. 06, Series of 2023 [NPC Circ. No. 23-06], (01 December 2023). ↩

  10. See National Privacy Commission, Security of Personal Data in the Government and the Private Sector, Circular No. 06, Series of 2023 [NPC Circ. No. 23-06], (01 December 2023). ↩

Backlinks