Issuance Text
Circular on Data Privacy Competency Program
Questions Raised During the Public Consultation on 16 June 2023
I. DPO ACE and T3 Programs
1. Will the Data Privacy Competency Program replace the Data Protection Officers Accountability, Compliance, and Ethics (DPO ACE) and the Train the Trainers (T3) Programs?
Yes, the Data Privacy Competency Program (Program) will replace both the DPO ACE and the T3 Programs. Those two initiatives were merely ad hoc and not supported by any formal issuance by the NPC.
The NPC wants to formalize its engagement with various Training Providers. In this new Program, the NPC aims to address all gaps from the previous initiatives and to update its data privacy education efforts.
DPO ACE is not a prerequisite for the courses that will be given under this Program.
This new Program has a foundational course to equip participants with the necessary knowledge and skills they will need. This will be a “ladderized” approach where individuals can enroll depending on their needs.
They can take courses that will be launched under this Program or enroll in certification programs from local or international certifying bodies that are more aligned with what they are doing on a daily basis or what they intend to do.
2. Will the passers of the DPO ACE Level 1 Examination need to get trained again to renew their certificates?
No, they do not need to. They, however, can still claim that they passed the DPO ACE Level 1 Examination.
The NPC wants to emphasize that there is no professional certification necessary to carry out the functions of a data privacy professional in the Philippines.
Under this new Program, data privacy professionals may take other courses that are more suitable for the current or intended stage in their journey as data privacy professionals.
3. Section 13 of the Circular provides that “Any qualifications acquired under the DPO ACE training shall remain valid for a period of one (1) year from the effectivity of this Circular”.
What is the significance of the one-year period?
Considering that the DPO ACE Program was launched in December 2018 and its first batch of students was taught in January 2019, the concepts and interpretation that were taught may no longer be applicable to how the NPC is interpreting certain concepts under the Data Privacy Act (DPA).
4. Similar to the DPO ACE Program, is the certification under the Data Privacy Competency Program only valid for one (1) year?
The NPC wants to emphasize that the completion of this new Program or any of its courses will not result in any certifications. The completion may only result in a Competency Assessment that an individual may take and pass. Passing this assessment, however, will not be treated as a professional certification.
The reasons for this are: first, the NPC cannot function as a certifying body as that is not one of its functions; and second, no professional certification is necessary for an individual to fulfill the functions of a data privacy professional.
5. What will happen to existing accreditations under the Train the Trainers (T3) Program?
Any accreditation that was gained under the T3 program will no longer have any effect.
Those who are interested in continuing as Training Providers for any specific courses under this new Program may apply or enter into new agreements with the NPC.
Training Providers in this new Program will be done on a per course basis. If an individual, an entity, or an organization wants to apply as a training provider, they will need to enter into an agreement for specific courses, but not as a whole under the Program.
II. Nature of License
1. What does “non-exclusive license” mean?
Training Providers cannot monopolize the Curriculum or the courses since the objective of this new Program is to democratize access to data privacy education.
The NPC aims to have as many people as possible participating in this new Program so that there will be more Training Providers, especially outside Metro Manila.
2. Will there be a different license for each Curriculum developed by the NPC?
Yes, there will be a different one.
The License or the Agreement that the NPC and the Training Providers will enter into will be on a per course or per curriculum basis.
3. Will the Curriculum that is covered by a specific License undergo periodic review?
Yes, the draft itself says that the Licenses are for a one (1) year period. This is to ensure that all contents are updated and that the performance of the training providers in delivering the course are monitored.
The Agreement that will be entered into for each specific course will be the same across all Training Providers. Training Providers will not have a leeway to negotiate certain terms under that Agreement with the NPC to ensure that everyone is on the same level.
4. What are the penalties for Training Providers who violate the provisions of the Circular and the terms of the formal written Agreement?
If the Training Providers violate the terms of the Circular and Agreement, then their licenses will be revoked or suspended.
The considered breaches of the terms will be set out in the formal written Agreement.
5. Will the License be renewed annually?
Yes, the License will be renewed on an annual basis.
The reason for this decision is to ensure that the Training Providers are doing what they are supposed to do.
There will be regular reporting and feedback that each Training Provider will be getting during the course of the year.
III. Formal and Written Agreement
1. What will be included in the Agreement between the NPC and a Training Provider?
It should include the obligations of both the NPC and the Training Provider. It should provide the specific timelines, the qualifications of the Training Provider, and the reportorial requirements for purposes of monitoring.
In the event that there are violations, the grounds for termination and suspension of the License, as well as other penalties and parameters relating to the royalties and the fees are also included.
2. Is the Agreement coterminous with the License granted to a Training Provider?
Yes, it will be coterminous.
The suspension, revocation, or termination of the License will also have the same effect on the formal written Agreement.
IV. Consultative Body
1. Will there be a single Consultative Body for the Program?
No, there will be different consultative bodies for each specific course that will be launched under this new Program.
The NPC recognizes the value of inputs coming from the private sector especially from practitioners such as Data Protection Officers (DPOs) or lecturers.
If the NPC will launch a course that will be targeted to DPOs, for example, the NPC wants to be able to get insights from practitioners, including those in related fields, to allow the NPC to have a broader perspective on the expected characteristics and concepts that may be included in the course.
The NPC wants to provide a course that is practical and operational, so that individuals can carry those aspects with them and do well in their job as data privacy professionals, whether in the public or the private sector.
2. What are the responsibilities of the Consultative Body?
The responsibilities of the Consultative Body will be different for each particular course. In general, though, each Consultative Body may provide the NPC with insights into the operational perspective of the courses or the Curricula.
The NPC can have regular interactions with the private sector, through the Consultative Body, which can aid in developing courses that are practical and operational.
3. What is the rationale for the two-year term of members of the Consultative Body?
The period is to give some level of continuity which is important in developing the courses. To ensure that the members of the Consultative Body have enough time to see the course until its implementation.
This is also a fair length of time so as not to become too much of an imposition on the members of the Consultative Body since this would be on a voluntary basis.
4. How will the NPC ensure that the members of the Consultative Body are competent and knowledgeable in data privacy?
The Chairperson will nominate people to be members of the Consultative Body.
The Commission En Banc will then vet the nominees and appoint those individuals who are best fit to be members of the Consultative Body.
5. Who shall be the Chairperson of the Program?
The Chairperson will always be one of the members of the Commission En Banc of the NPC.
6. If the NPC will be securing the assistance of the Consultative Body in developing a prescribed Curriculum, and it intends to collect royalties for the use of the Curriculum, does this mean that the members of the Consultative Body are entitled to compensation?
No, being a member of the Consultative Body is on a voluntary basis, hence an individual can always decline to become a member of the Consultative Body.
The Consultative Body will not be responsible for developing or creating curricula. Rather, they are there to act as consultants for the NPC to aid it in coming up with courses that are practical and focused on the operational aspects of the topic.
The provision on the Consultative Body is born out of the NPC’s recognition of the importance of getting input from experts in the field to ensure that the courses it will develop are relevant and practical.
7. If members of the Consultative Body are expected to contribute pro bono, why should the NPC be allowed to profit from their collaborative work?
The NPC will consult with the Consultative Body on specific aspects of a particular Curriculum. The Consultative Body is not the one who will make the Curriculum. Further, the NPC believes that equipping people with relevant and practical data privacy education redounds to the benefit of everyone.
8. Is it possible to increase the number of volunteers for maximum representation?
Can you define the required qualifications of volunteers, i.e. adult, learner, experts, actual data privacy practitioners who are involved in day-to-day privacy functions, privacy law experts, infosec and cybersec experts, etc.?
As to increasing the number of volunteers for the Consultative Body, five (5) is already a balanced number.
As to the required qualifications, it would be different per course. A different Consultative Body would be constituted per course that the NPC is designing. Putting specific qualifications in the Circular itself may make it unduly restrictive.
The NPC wants to ensure maximum representation and that the mechanism for the selection process will be done transparently.
V. Royalties
1. Why is the NPC collecting royalties?
With this new Program, the NPC will develop a uniform Curriculum intended to make it easy for Training Providers to teach and to understand while ensuring quality data privacy education in the country.
In addition, the NPC will also have to perform other continuing responsibilities to ensure that quality data privacy education is offered. Thus, given the limited budget of the NPC, this is a way to recoup some of the cost of operationalizing this new Program.
2. Why not collect a one-time application fee instead?
A one-time application fee may be too burdensome for smaller Training Providers to expend upfront.
Through a royalty Agreement, smaller Training Providers will be given the capacity to compensate the NPC with a percentage of the fees they collect from their students. Allowing more Training Providers to participate in this new Program enhances the goal of democratizing access to privacy education.
VI. Fees
1. How will the maximum amount of the training course fee be computed?
The maximum amount will be different depending on the courses that will be offered. This amount will be provided in the different formal Agreement to be entered covering the course.
The NPC is looking to consult with the Trainings Providers from different regions to come up with a fair amount considering the prevailing market rate and other operational expenses.
The goal is to set an amount that is fair to the Training Providers yet, at the same, not too high for the enrollees to shoulder.
VII. Qualification Requirements of Training Providers and Trainers
1. Will the NPC require Training Providers and its trainers to be experts in data privacy?
Ideally, yes, but the NPC is not going to vet each and every single trainer.
The NPC will assess the competency of the Training Providers by monitoring their reportorial submissions, feedback of their students, passing rate of their students, and the like.
The NPC, however, will not examine the expertise or competency of each trainer. The NPC will put its trust on the Training Providers to engage only qualified trainers.
2. Will the NPC specify other qualification requirements for Training Providers and Trainers?
The qualifications/requirements will be provided in the specific Agreement or Contract covering that particular Training Course.
3. May a licensed Individual Training Provider act as a trainer in a licensed Institutional Training Provider?
Yes, they can, provided they apply individually.
4. How will the NPC monitor and evaluate the performance of the Training Provider?
The NPC will look at the following:
- Quality of the training course designed in terms of adherence to the uniform Curriculum and prescribed learning outcome;
- Number of successful Exam passers from their course (if an Exam is applicable for that specific course);
- Student feedback; and
- Periodic in-person observation by NPC, based on the list of training schedules to be submitted by the Training Provider.
VIII. Training Course and Materials
1. Will the NPC require a Training Provider to adhere to a specific training format?
No, the Training Provider has discretion as to the training format, based on their opinion and experience.
The NPC will only provide the uniform curriculum as the basis for Training Providers to design their respective Training Courses.
2. What are covered under Training Course Materials that are subject to the NPC’s approval?
“Training Course Materials” will include outlines, slide decks, handouts, and lesson plans. It will include essentially anything that will form part of the Training Provider’s main lesson plan to provide students the information and training they enrolled for.
3. Should a Training Provider seek the NPC’s approval whenever it changes Training Course Materials?
No, a Training Provider need not seek approval for changes so long as their course still adheres to the minimum standards in the uniform curriculum.
Should there be changes, the Training Provider may just submit a copy to the NPC.
IX. Exam / Completion
1. Will the Exam be conducted regularly for all courses under the Program?
The NPC wishes to clarify the reason of using may in Section 9. Not all courses under this new Program will have an Exam at the end.
During the preparatory activities with the Training Providers, the NPC will tell them that for a specific course, there will be an exam at the end and that exam will be conducted on a regular basis. The schedules of the exams are given in advance so that both Training Providers and students can prepare for them.
The intention to conduct several Exams over the course of a year is for the students not to wait several months or years just to take an Exam.
The number of Exams to be given is still for consideration, depending on the number of participating Training Providers.
2. If the NPC will not conduct an exam for a particular course, how will the competency of the participants of a training course be measured?
The competency of a training course participant should be ensured by the Training Provider following the standardized Curriculum and prescribed learning outcomes.
The NPC recognizes that some courses that may be offered under this new Program would not benefit from an exam, which is why it is not requiring exams for all courses under the Program.
It must be emphasized that exams are not the only way to measure competency. Ideally, the Training Provider should be able to ensure the competency of participants after going through their course.
3. Will the Training Providers and Consultative Body be involved in the preparation and design of an exam?
No, Training Providers and members of the Consultative Body will not be involved.
Designing of the exam will be done only by the NPC to avoid appearances of partiality or bias.
4. May a Training Provider conduct an exam prepared by the NPC?
No, it will only be the NPC that will conduct that exam.
5. May a Training Provider administer exams that they have developed on their own?
Yes, the Circular does not prohibit Training Providers from administering their own exams. They may do this as pre-tests or as practice exams.
It must also be clarified that the Circular also does not prohibit Training Providers from teaching other courses related to data privacy. The Circular only applies to courses under this new Program.
X. Additional Questions during the Public Consultation
1. Is there a minimum amount of enrollees that a Training Provider must maintain every year in order to have their license be renewed moving forward?
No. To put in a minimum amount may result in limiting accessibility to data privacy education. There are certain individuals who will not be doing this on a full-time basis, but that doesn’t mean they cannot go out and share what they know with other people.
This also ties in with not putting in a one-time fee, because if an individual is not doing this on a full-time basis, shouldering a one-time fee may not be sensible for them.
However, if an individual is being charged with a small percentage of the amount they are charging their students, then the cost for them to be a Training Provider is more reasonable and justifiable.
2. Are we considering partnering with IAPP in creating a certification like CIPP/E for EU and LGPD of Brazil, a CIPP/Ph?
This will not be done in partnership with International Association of Privacy Professionals (IAPP). The Certified Information Privacy Professional/Europe (CIPP/E) and the CIPP/Asia (CIPP/A) were done by IAPP on their own.
The NPC is working with IAPP to ensure that the DPA of 2012 will be included in any course they will give under the CIPP/A for Asia.
To have a CIPP purely for the Philippines is something that may happen in the future. If we have enough market that would make sense, but right now the goal is just to be included under the CIPP /A.
3. Is this proposed Program being practiced in other countries/ jurisdictions?
Not exactly the same, but the idea of creating foundational courses offered by the regulator is not new. There is something similar in Singapore where the Personal Data Protection Commission (PDPC) provides some kind of DPA 101 that can be used by practitioners as a jumping off point to further their growth in this field. The practitioners can take International Organization for Standardization (ISO) and IAPP.
Singapore also has programs that can be taken after getting the basic knowledge on DPA.
Not exactly the same, but not dissimilar to some of the different initiatives being done by data protection authorities.
4. Would privacy courses taught as part of degree programs be included/reviewed under this competency program as well?
When you say “degree program”, this probably refers to those taught by universities or schools like Asian Institute of Management (AIM).
No, they won’t be, unless they are offering exactly the same course that we are launching under this new Program.
This new Program does not seek to regulate all manner of privacy training and education in the Philippines. The NPC is not trying to supplant IAPP and ISO trainings, or other specialized courses. The NPC’s intention is to provide the foundational course along with the other similar courses that will be launched under this new Program with the goal of democratizing access to proper privacy education in the Country. Only those courses launched under this new Program will be subject to this Circular.
So, individuals can still teach their own version of a foundational course, but they cannot use any statement or give the impression that they are partnering with or are accredited by NPC.
5. Is NPC looking at a test run before final implementation?
This is for consideration. If the NPC does conduct a test run, we will likely partner with those interested in becoming Training Providers under this new Program.
6. Are Training Providers still allowed to offer other services like data privacy Consultancy, PIA Assistance, etc.?
Yes, because that has nothing to do with the Training Provider teaching. There is no conflict of interest that will arise there.
7. How will the NPC determine the range of royalties? Will it be based on the training fee collected? If yes, how will NPC monitor the amount collected by Training Providers and ensure that such are transparent on how much they earn?
It will most probably just be one amount instead of a range. The NPC will discuss that with the different Training Providers to see what rate, in their opinion, would be fair.
As it is based on the training fee, the NPC will ask the Training Providers to submit the list of all the students or the number of people that they train.
For the ones who will have the exams, the NPC will be able to correlate the number of people trained with the number of people who take the exam.
8. If a training institution decides to not follow the program as designed by NPC, what happens?
It depends.
Training institutions are not required to offer a course under this new Program. But if they want to partner with NPC on this new Program, we expect them to follow the Program. If they do not, then that can result to the revocation or suspension of the Licenses granted to that specific training institution.
9. Are T3 partners still allowed to provide DPO ACE training at this time because we notice that there are still former T3 Partners offering them?
The NPC is no longer conducting DPO ACE Exams. T3 partners, however, can still offer courses that are supposed to be for DPO ACE Training but they have to be upfront with their enrollees that the NPC had discontinued the DPO ACE Training and will not give any Exam relating to DPO ACE.
10. Will there be a ranking system of training institutions, like percentage of passers?
The NPC will consider the percentage of passers per Training Providers to monitor how well they are doing and whether they will be renewed or not.
The NPC, however, are not inclined to ranking them and making such information available to the public.
11. Other than a court order, is there a government agency that can stop NPC from implementing the program?
No, the new Program provides a framework for data privacy education which the NPC can do even without issuing a Circular.
12. Will this program have a specific tenure?
No, the Circular provides a framework for launching courses under the new Program. As long as the NPC exists and there is a need to continue educating the public, it will fall under this new Program.
13. Can an individual take a particular NPC Exam even if he/she did not enroll in an accredited NPC trainer?
No, an individual cannot take an Exam for a specific course without enrolling with a particular Training Provider. The Exam will test the level of understanding of different students in relation to the course being taught to them by a Training Provider.
14. Do we already have an amount for the Exam to be provided by the NPC?
The amount for the Exam fee has not been decided yet. This will be done in consultation with the different Training Providers that will be part of a specific course.
15. Are there new levels of certification for these new courses that will be coming from the partner trainers?
No, as the courses will not result in any certification.
But if referring to levels similar to DPO ACE 1 and 2, there will be because of the idea that the courses will build on top of each other.
16. How about for the public sector? Are they required to enroll to private trainers?
No, an individual, whether working in the public or private sector, is not required to enroll in any Training Provider before he/she can act as a privacy professional.