Advisory on Guidelines on Child-Oriented Transparency

Issuance Text

Advisory on Guidelines on Child-Oriented Transparency

Questions Raised During the Call for Public Input as of 17 December 2024

General Questions

Question	Answer
1. What is the purpose of the Advisory?	The Advisory is intended to be the first of many advisories that will be released on children’s privacy to ensure that children are protected while they create and interact within a protective environment. The Advisory focuses on child-oriented transparency. It clarifies how the Principle of Transparency and existing obligations of Personal Information Controllers (PIC) and Personal Information Processors (PIP) apply when processing children’s personal data.
2. Who is considered a “child” under the Advisory?	A ‘child’ refers to a person below eighteen (18) years of age or those eighteen (18) or over but are unable to fully take care of themselves or protect themselves from abuse, neglect, cruelty, exploitation, or discrimination because of a physical or mental disability or condition.
3. Why does the Advisory directly address children, even though they lack the legal capacity to act?	The NPC recognizes children as data subjects and rights holders. Their lack of legal capacity to act does not diminish the rights as data subjects under Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).
4. When does the Advisory apply? Does it apply only when the processing is done within the Philippines?	The Advisory applies when PICs and PIPs are engaged in the processing of children’s personal data, whether in a digital or physical environment. It covers products or services specifically intended for children or likely to be accessed by children. The Advisory also applies when the processing is done outside the Philippines pursuant to the extraterritorial application of the DPA. As provided in Section 6 of the DPA and Section 4, Rule II of its Implementing Rules and Regulations (IRR), the DPA, its IRR, and issuances of the Commission apply to acts of processing personal data performed in and outside the Philippines in the following instances: 1. The natural or juridical person involved in the processing of personal data is found or established in the Philippines; 2. The processing relates to personal data about a Philippine citizen or resident; 3. The entity has a link with the Philippines. As the Advisory provides guidelines on how the DPA and its IRR applies in relation to the processing of children’s personal data, it will apply even when the processing is done outside the Philippines.
5. Does the lack of explicit guidance on parental consent mean that this Advisory does not apply if parental consent is obtained?	No. The Advisory applies regardless of the basis for processing. Section 1 does not limit the applicability of the Advisory to processing based on consent. In addition, this Advisory focuses on the Principle of Transparency.
6. Why isn’t there a specific “age of digital consent” in the Advisory?	An advisory is not the proper issuance to establish an age of digital consent. Advisories provide guidance on understanding existing legal principles concerning specific issues related to safeguarding personal data. Establishing an age of digital consent will require legislative action through a law passed by Congress. This is because setting such an age would impact legal provisions related to a person’s capacity to act, which are governed by the New Civil Code and related legislation.
7. What are the enforcement mechanisms and penalties for non-compliance with the Advisory?	Due to the nature of an advisory, this Advisory does not introduce new obligations or penalties. It is based on existing obligations under the DPA, its IRR, and other issuances of the Commission. Enforcement mechanisms established under the DPA, its IRR, and relevant issuances apply in relation to the Advisory.
8. Will a PIC be given a period to ensure compliance with the provisions of the Advisory?	No. The Advisory provides clarification on existing obligations imposed under the DPA, its IRR, and other issuances of the Commission. The Advisory only seeks to provide further guidance when processing children’s personal data.

Risk-Based Assessment

Question	Answer
9. Who will conduct the risk-based assessment and determine the need for a Child Privacy Impact Assessment (CPIA)?	As provided in Section 2 (A) of the Advisory, PICs must incorporate Child Privacy Impact Assessments (CPIA) as part of their Privacy Impact Assessments (PIA) before launching products or services intended or likely to be accessed by children and thereafter as may be necessary.
10. Is there a prescribed form or procedure for the conduct of a CPIA?	No. There is no prescribed form for the CPIA. A CPIA forms part of the PIA, which is a continuing obligation on the part of PICs. Section 5 of NPC Circular 2023-06 (Security of Personal Data in the Government and the Private Sector) provides guidelines on the conduct of a PIA. Section 2 (A) of the Advisory further clarifies this requirement when PICs process personal data for products or services intended or likely to be accessed by children. As such, PICs may use any method, structure, or form, provided PICs comply with Section 5 of NPC Circular 2023-06 and take into consideration the factors listed under Section 2 (A) of the Advisory.
11. Is the list of factors provided under Section 2(A) exhaustive?	No. The factors enumerated under Section 2(A) of the Advisory is not exhaustive. PICs may consider other factors when conducting their CPIAs.
12. How often should a CPIA be conducted?	PICs should regularly conduct CPIAs if their products or services are intended or likely to be accessed by children. A CPIA forms part of the PIA, which is a continuing obligation on the part of PICs. Section 4 of NPC Circular 2023-06 (Security of Personal Data in the Government and the Private Sector) provides that it should be regularly reviewed and updated to account for changes in products, services, processes, or regulations. The degree of regularity, however, depends on the circumstances which PICs are in the best position to determine.
13. Does the inclusion of parental involvement in Section 2 (A)(12) mean parental consent is mandatory?	The Advisory focuses on child-oriented transparency. The factors enumerated under Section (A) only serve as a guide on what factors PICs may consider when conducting their CPIAs. This is to ensure that the CPIAs take into account the different risks that may arise with the processing of children’s personal data.
14. Will the NPC release a list of expected tools or mechanisms for age assurance?	No. The NPC will not release a list of suggested age assurance mechanisms. PICs are in the best position to determine the need for age assurance mechanisms and the proper solutions to implement based on their purpose and risk-based assessment.
15. Can PICs rely solely on users’ self-declaration for age verification?	While not expressly prohibited, PICs should recognize that relying solely on users’ self-declaration may be inadequate for high-risk processing activities.

Privacy Notice

Question	Answer
16. Is there a prescribed form for the child-friendly privacy notice? Are there minimum standards that must be met?	No. There is no prescribed form for the child-friendly privacy notice. Following the Principle of Transparency, PICs shall ensure that children are aware of the nature, purpose, and extent of the processing of personal data. Section 3 of the Advisory further clarifies this requirement where the PICs’ products or services are specifically intended for children or are likely to be accessed by children.
17. Can PICs opt to have a singular Privacy Notice for both adults and children?	No. A singular notice is not sufficient. The information presented in a standard version of the Privacy Notice may be too complicated for children. On the other hand, the information provided may not be detailed enough to give sufficient information to adults.
18. Can PICs employ age-tiered privacy notices?	PICs are in the best position to determine the suitability of employing age-tiered privacy notices based on their risk-based assessment of their processing activities Following its continuing obligation to conduct PIAs, PICs shall adopt a risk-based and child-oriented approach when informing children whose personal data they are processing, taking into account their age and the risks involved in the specific processing activity.

Data Breach Notification

Question	Answer
19. Is the PIC required to notify both the parent or guardian and the child?	Yes. By notifying both the parent or guardian and the child, the child is better equipped to take the necessary precautions or other measures to protect themselves against the possible effects of the breach. Section 20 (f) of the DPA requires PICs to notify their affected data subjects of breaches in cases that fall under mandatory breach notification. NPC Circular 16-03 (Personal Data Breach Management) provides the procedure for breach notification. Section 4 of the Advisory further clarifies breach notification where the affected data subjects are children. It provides, “[i]n cases where the affected data subjects are children, PICs shall notify both the children and their parents or guardians.”
20. Is there a prescribed form and language for data breach notifications?	Yes. Section 18 of NPC Circular 16-03 (Personal Data Breach Management) provides guidelines on the notification of affected data subjects, including contents and form. Section 4 of the Advisory further clarifies that when notifying children, PICs must use the appropriate language that is readily understandable to the children.

Question

Answer

19. Is the PIC required to notify both the parent or guardian and the child?

Yes. By notifying both the parent or guardian and the child, the child is better equipped to take the necessary precautions or other measures to protect themselves against the possible effects of the breach.

Section 20 (f) of the DPA requires PICs to notify their affected data subjects of breaches in cases that fall under mandatory breach notification. NPC Circular 16-03 (Personal Data Breach Management) provides the procedure for breach notification.

Section 4 of the Advisory further clarifies breach notification where the affected data subjects are children. It provides, “[i]n cases where the affected data subjects are children, PICs shall notify both the children and their parents or guardians.”

20. Is there a prescribed form and language for data breach notifications?

Yes. Section 18 of NPC Circular 16-03 (Personal Data Breach Management) provides guidelines on the notification of affected data subjects, including contents and form.

Section 4 of the Advisory further clarifies that when notifying children, PICs must use the appropriate language that is readily understandable to the children.

Accountability

Question	Answer
21. Who is accountable?	PICs are responsible for processing children’s personal data, including personal data that has been subcontracted or outsourced to their PIPs, in accordance with the Principle of Accountability.

NPC Issuance Wiki

Corpus