Issuance Text
FREQUENTLY ASKED QUESTIONS ON THE GUIDELINES ON ADMINISTRATIVE FINES
Section 1 - Scope
- The Guidelines cover all Personal Information Controllers (PICs) and Personal Information Processors (PIPs) as defined by the Data Privacy Act of 2012 (DPA). Does this cover even PICs and PIPs established outside of the Philippines?
Yes, the Circular covers PICs and PIPs established outside of the Philippines. Section 1 of the Circular provides that it covers all PICs and PIPs as defined in the DPA, whether from the public or private sector. This also covers PICs and PIPs outside of the Philippines if they fall under the requisites found under Section 4 or Section 6 of the DPA. In such instances, the gross income of the foreign PIC or PIP within the Philippines that committed the infraction will be considered to determine the imposable fine.
- Will this apply to companies not registered with the National Privacy Commission (NPC)?
Yes, the Circular applies to entities not registered with the NPC, provided that those entities are covered by the DPA.
Section 2 - Administrative Fines
- Why are percentage fines used by the Commission instead of a fixed amount of fine?
The Commission, in working together with the University of the Philippines Law Center, has determined that using percentage fines, as opposed to standard amounts, is the most effective mechanism to impose administrative fines. This allows the Commission to set effective, proportionate, and dissuasive fines regardless of the size of a violating entity.
In utilizing a percentage range, optimal deterrence will be achieved since it provides ex ante incentives for the PIC or PIP to adopt optimal or reasonable levels of data protection. To deter violations, a fine should be equal or larger than the cost of precaution at the optimal level. Thus, the percentage of fines in the Circular is intended to be equal to or larger than the possible cost of privacy security that the PICs or PIPs will put in place.
Furthermore, the Economic Study, which was prepared by the University of the Philippines Law Center with the help of their economic consultant, has determined that the use of percentage fines allows for the protection of the fundamental human right of privacy of communication while ensuring free flow of information. This mutually beneficial exchange of information leads to the promotion of innovation and growth.
- Section 2 of the Circular provides that the PIP can be held equally liable as the PIC for administrative fines. Under the Principle of Accountability in the DPA, however, the PIC is liable for any violations even those performed by its subcontractors. Thus, following Section 21 of the DPA, shouldn’t the PIC be solely responsible and liable for the administrative infractions committed by the PIP under its control, subject only to contractual agreements between them on indemnity?
No, the PIC will not be solely impleaded for purposes of administrative fines. The wording of the Circular includes both the PIC and PIP because in complaints initiated by the data subjects, the complainant may not be aware whether the entity is a PIC or PIP since he or she is not privy to these matters.
Nevertheless, the Principle of Accountability and the contractual arrangements between the PIC and PIP regarding liabilities may be invoked by the parties in their respective submitted pleadings for the evaluation of the Commission.
- In determining the total imposable fine, how will the Five Million Peso (Php 5,000,000.00) cap in Section 2 be implemented? Does it mean that the PIC or PIP’s maximum penalty for a single action will be Php 5,000,000.00 regardless of the applicable percentages under Section 2 of the Circular?
As written, Section 2 of the Circular states that “In any case, the total imposable fine for a single act of a PIC or PIP, whether resulting in single or multiple infractions, shall not exceed Five Million Pesos (Php 5,000,000.00).”
The term “single act” refers to an act of processing. A single act may give rise to several violations. Nevertheless, in determining what constitutes a “single act”, the number of the affected data subjects whose rights are violated, or the amount of personal information processed are not considered since the term pertains to a “per processing” activity.
At any given time, however, the maximum imposable penalty for a single act is Php 5,000,000.00, regardless of the applicable percentage range under Section 2 of the Circular.
This cap of Php 5,000,000.00 will be subject to periodic review by the Commission to determine if there is a need to revise the amount in the future.
- How will the type of infraction be determined? Is it by counting the number of provisions under Section 11 or Section 16 of the DPA that were violated by PIC or PIP’s single action?
Yes, the type of infraction will be determined by taking into consideration the number of (1) general data privacy principles and (2) data subject rights violated. However, the number of principles and rights violated will not be compounded with the number of data subjects affected. Thus, to be considered a Major Infraction, the total affected data subjects is one thousand or below (1-1,000), while for Grave Infractions, the number of affected data subjects exceeds one thousand (1,001 or more).
- Under Other Infractions, it states that “any natural or juridical person processing personal data that fails to comply with any Order, Resolution or Decision of the Commission, or of any of its duly authorized officers, pursuant to Section 7 of the DPA and its corresponding implementing issuances shall be subject to an administrative fine not exceeding Fifty Thousand Pesos (Php 50,000.00)”. How will this be determined and computed?
Section 2 of the Circular, under Other Infractions (b) provides “the fine to be imposed as a result of this infraction shall be in addition to the fine imposed for the original infraction subject of the Order, Resolution or Decision of the Commission”.
For instance, if a PIC or PIP fails to comply with the Order, Resolution or Decision imposing fine a for a Grave Infraction amounting to Php 1,000,000.00, it shall be liable for Other Infraction and subject to a Php 50,000.00 fine. Thus, the total amount payable will be Php 1,050,000.00 which represents the Grave Infraction and Other Infraction committed.
Another instance is when a PIC or PIP fails to abide by an Order to furnish documents issued by authorized officers of the Commission, the PIC or PIP is still required to comply with the Order. Thus, it should submit the documents and pay the fine in an amount not exceeding Php 50,000.00.
The amount of the fine to be imposed, not exceeding Php 50,000.00, shall be determined by the Commission, taking into consideration Section 3 of the Circular on factors affecting fines.
- Will a company be fined for acts of employees when the company has shown proof that it has implemented appropriate measures?
Yes, a company will be fined for the acts of its employees following the Accountability Principle. Pursuant to this, the Circular specifically covers only PICs or PIPs. Nevertheless, the company is not precluded from impleading or going after the concerned employee in a separate action or proceeding wherein it may show proof that it has implemented appropriate measures.
- The Grave and Major Infractions penalizing the violation of Section 11 or Section 16 of the DPA are too broad and subject to different interpretations. Will the Commission issue further guidelines on these violations?
No, the Commission has issuances on the interpretation of these general privacy principles under Section 11 and data subject rights under Section 16 of the DPA, which will guide the PICs and PIPs in determining whether an infraction may have been committed. All parties will be given the opportunity to be heard, and due process will be observed in accordance with the NPC Rules of Procedure.
- Would there be guidelines released per sector just to have a view of what are reasonable and appropriate for the Commission?
No, there will be no guidelines released per sector. The DPA, IRR and NPC issuances are deemed sufficient to inform the public of the appropriate and reasonable security measures expected of all PICs and PIPs.
The Commission shall evaluate PICs and PIPs based on the pleadings and evidence submitted to it. Thus, the compliance of the PICs and PIPs on appropriate and reasonable security measures shall be decided on a case-to-case basis.
- Will the Commission consider a reasonable graduation per year in the imposition of maximum penalty to allow companies to adopt, make changes, and put in measures and processes to avoid a violation of the DPA and its implementing rules and regulations? This is still a relatively new law and not all companies have the expertise and/or system to fully comply with the applicable provisions.
No, the DPA was enacted in 2012 and the Commission was constituted in 2016. Since then, the Commission has been actively promoting, educating, and assisting the stakeholders, such as the PICs and PIPs. Hence, there is no need to allow additional time for PICs and PIPs to adjust and prepare as the Commission has given these PICs and PIPs sufficient time and support to make the necessary changes, adjustments in processes and implement measures to comply with the law.
Section 3 - Factors Affecting Fines
- How will the Commission define the standard for determining the factors that affect fines? Will the Commission provide examples or specific circumstances that may be considered as aggravating or mitigating factors?
No, the Commission will evaluate these factors on a case-to-case basis. The aggravating or mitigating factors will be decided on each case individually, according to the facts and circumstances presented before the Commission. Nevertheless, the Circular provides for a list of factors affecting fines to be imposed by the Commission. All circumstances that the PIC or PIP thinks should be considered for evaluation should be included in the pleadings submitted to the Commission.
- Does the term “annual gross income” pertain to domestic income of the immediately preceding year of the infraction?
Yes, for natural and juridical entities established in foreign jurisdictions that committed the infraction, the annual gross income only applies to the domestic income of the immediately preceding year of the infraction or only the income derived from sources within the Philippines.
On the other hand, for natural and juridical entities established in the Philippines, the “gross annual income” includes the income derived from all sources within and without the Philippines, in adherence to the definition of “gross annual income” under the Philippine laws on Taxation.
Section 4 – Due Process
- Will the 2021 Rules of Procedure of the NPC apply?
Yes, as stated in Section 4 of the Circular, the Rules of Procedure of the NPC will apply. The applicable Rules of Procedure shall depend on whichever set of Rules of Procedure is in effect at the time the infraction is committed.
Section 5 - Appeal
- Will an appeal stay the execution and imposition of administrative fines?
No, an appeal will not stay the execution and imposition of administrative fines. Section 5 of the Circular provides that a Decision or Resolution of the Commission shall be immediately executory.
In any or all actions assailing the Decision or Resolution of the Commission pertaining to the imposition or execution of an administrative fine, the PIC or PIP may post a cash or surety bond equivalent to the total amount of fine imposed, exclusive of the damages, attorney’s fees, and other monetary awards, which shall result in the staying of the execution as provided in Section 6 of the Circular.
- How will the PICs or PIPs pay for the fine imposed by the Commission?
The PICs or PIPs shall pay the fine imposed, in cash or manager’s check, through the Finance and Administrative Office (FAO) of the Commission.
Section 6 - Posting of Bond on Imposed Administrative Fines
- What will be the effect of the failure to post the cash or surety bond?
The non-posting of bond shall result in the immediate execution of the imposed administrative fine.
- Are parties allowed to file a Motion to Reduce bond due to valid reasons?
No, the Commission will not entertain a Motion to Reduce bond for whatever reason.
Section 7 - Refusal to Comply
- Section 7 of the DPA and Section 4 of NPC Circular No. 20-02 on the Rules on the Issuance of Cease-and-Desist Orders (CDO) identify the specific parameters within which to issue a CDO. Refusal to pay is not a ground for the issuance of a CDO. How can the foregoing provision be reconciled with Section 7 of the Circular on Administrative Fines?
As worded, Section 7 of the Circular used the word “may” which highlights the Commission’s discretion to issue a CDO depending on the circumstances of each case. The Commission’s power to issue a CDO is rooted in the DPA. Following this, NPC Circular No. 20-02 provides for an initial list of the grounds for the issuance of a CDO. The Commission, through this Circular, provides an additional ground for the issuance of a CDO.
Section 10 - Applicability Clause
- Section 10 states that: “These rules apply to covered PICs and PIPs for the above infractions prospectively.” Does this mean that the Circular would not apply to pending cases?
Yes, the Circular does not apply to pending cases because it applies prospectively. Infractions committed before the issuance of the Circular shall not be covered by its provisions. Continuing infractions or those committed prior to the issuance of the Circular that exists even after its effectivity, however, are covered.
Administrative fines imposed on a PIC or PIP may arise not only from complaints filed against a PIC or PIP but also from a PIC or PIP’s failure to comply with Commission orders, directives, or issuances.
Other Matters
- Is the Commission authorized to impose administrative fines under the DPA?
Yes, the Commission is authorized to impose administrative fines. Section 7 of the DPA mandates the Commission to: (1) to ensure compliance of the PICs and PIPs with the DPA; (2) compel or petition any entity, government agency or instrumentality to abide by its orders or take action on a matter affecting data privacy; and (3) monitor compliance and recommend necessary action to meet minimum standards for protection of personal information.
First, taken together with the authority of the Commission to receive complaints, institute investigations, adjudicate, and award indemnity on matters affecting any personal information, these powers establish the Commission as a quasi-judicial authority with all the necessary and implied powers that come with it, such as the power to impose administrative fines.
Second, the authority of the Commission to impose administrative fines is explicitly provided under Section 9(f)(6) of the IRR.
Third, the authority of the Commission to impose administrative fines stems from long-standing doctrines in administrative law. Under the “doctrine of necessary implication,” what is implied in a statute is as much as part thereof as that which is expressed. Every statutory grant of power, right or privilege is deemed to include all incidental powers, rights, or privileges. This includes all such collateral and subsidiary consequences as may be fairly and logically inferred from its terms.
Considering that the Commission exercises quasi-judicial functions as mandated by law, and that such function is integral to the overall authority to administer and implement the DPA, the Commission has the power to impose administrative fines.
- Do the administrative fines supersede the penalties enumerated under Sections 25 to 33 of the DPA?
No, the administrative fines do not supersede the penalties enumerated under the DPA. On one hand, the penalties under Sections 25 to 33 of the DPA are criminal in nature, punishable by imprisonment or a fine, imposed by judicial courts, and only applicable to natural persons. The Commission may recommend prosecution to the Department of Justice but may not impose the criminal penalties itself.
On the other hand, the penalties found under the Circular are administrative in nature, not punishable by imprisonment, imposed by the Commission after due notice and hearing, and imposed on PICs or PIPs whether they are juridical or natural persons.