Module 3: Privacy and Information Technology

P r i m e r o n t h e D a t a P r i v a c y A c t ( D PA ) o f 2 0 1 2
 Do not
COLLECT if
you cannot
PROTECT
Who stores data about
you?
SPEED
OF
INFORMATIO
N
Which is more valuable?

Data Money
“Data is more valuable than Money. If
someone takes your money, that's all
they have. If you let someone take
your data, they may eventually take
your money too!“
from: Deputy Privacy Commissioner Dondi Mapa
In today’s environment,
where competitors can copy
your products, pirate your
employees, and mirror your
algorithms,
data is the only
sustainable
competitive
advantage.

FORMER
DEPUTY PRIVACY
COMMISSIONER
DAMIAN MAPA
What is the Data Privacy Act of 2012?
• SECTION 1. Short Title. – This Act shall be known as the “Data Privacy Act of 2012”.

• Republic Act 10173, the Data Privacy Act of 2012

AN ACT PROTECTING INDIVIDUAL PERSONAL INFORMATION IN INFORMATION AND
COMMUNICATIONS SYSTEMS IN THE GOVERNMENT AND THE PRIVATE SECTOR, CREATING
FOR THIS PURPOSE A NATIONAL PRIVACY COMMISSION, AND FOR OTHER PURPOSES

• The National Privacy Commission (NPC) is a body that is mandated to administer and
implement this law. The functions of the NPC include:
– rule-making,
– advisory,
– public education,
– compliance and monitoring,
– investigations and complaints,
– and enforcement.
 Timeline of DPA Law and IRRs passed to
Organization’s Compliance

Sept. 9,
March August Sept. 9,
2012 2016 2016 2016 2017

Data National Implementin IRRs came Comply with

Privacy Privacy g rules and into effect registration
Act (DPA) Commissio Regulations (compy requirement
Passed n (NPC) (IRRs) was with all s
into law was published provisions
formed except
Registration Requirements: All personal data processing systems registratio
(DPS) operating in the Philippines that involve Personally n
Identifiable Information (PII) concerning at least 1,000 requirment
individuals/personal records must be registered with NPC s) 12 months
 KEY ROLES IN THE DATA PRIVACY ACT
• Data Subjects
– Refers to an individual whose, sensitive personal, or privileged information is processed personal

• Personal Information Controller (PIC)

– Controls the processing of personal data, or instructs another to process personal data on its behalf.

• Personal Information Processor (PIP)

– Organization or individual whom a personal information controller may outsource or instruct the
processing of personal data pertaining to a data subject

• Data Protection Officer (DPO)

– Responsible for the overall management of compliance to DPA

• National Privacy Commission

– Independent body mandated to administer and implement the DPA of 2012, and to monitor and ensure
compliance of the country with international standards set for personal data protection
Examples of Breaches and Live Cases
1. COMELeak (1 and 2) 15. Privacy notice
2. BPI – consent form 16. Use of USB
3. Hospital – unsecure storage records 17. Personal laptop stolen
4. Student transferred by her parent without her 18. Lost a CD in transit
knowledge 19. An error in viewing of student records in the
5. Clinical record of a student to disclose with her online system
parents 20. Use of re-cycled papers
6. List of top students/passers 21. Raffle stubs
7. Known Fastfood delivery – disclosing personal 22. Universities and Colleges websites with
info of clients weak authentication
8. No Data sharing agreement (DSA) between and 23. Personal Records stolen from home of an
among Schools and Universities employee
9. Cedula in malls 24. Photocopiers re-sold without wiping the
10. Security issues in buildings – logbook hard drives
11. Profiling of customers from a mall 25. Release of CCTV Footage
12. Unjustifiable collection of personal data of a 26. Hard drives sold online
school 27. Password hacked/revealed
13. No Privacy Notice 28. Unencrypted Data
14. Use of USB
 Potential Penalties listed in the Data Privacy Act
DPA Punishable Act For Personal For Sensitive Personal Fine (Pesos)
Section Information Information

JAIL TERM
25 Unauthorized processing 1-3 years 3-6 years 500 k – 4 million

26 Access due to negligence 1-3 years 3-6 years 500 k – 4 million

27 Improper disposal 6 months – 2 years 3-6 years 100 k – 1 million

28 Unauthorized purposes 18 months – 5 years 2-7 years 500 k – 2 million

29 Intentional breach 1-3 years 500 k – 2 million

30 Concealment of breach 18 months – 5 years 500 k – 1 million

31 Malicious disclosure 18 month – 5 years 500 k – 1 million

32 Unauthorized disclosure 1-3 years 3-5 years 500 k – 2 million

33 Combination of acts 1-3 years 1 million – 5 million

Top 20 Government-imposed Data Privacy Fines
W orldwide, 1999-2014 **
Amount of
Privacy principles
Rank Fined entity fines Year Country
violated
and penalties

1 Apple $32.5M 2014 U.S. Cho ice and Consent

2 Goo gle $22.5M 2012 U.S. Collection
3 Goo gle $17M 2013 U.S. Collection and Notice
4 ChoicePoint $15M 2006 U.S. Security
5 Hewlitt-Packard $14,5M 2006 U.S. Collection
6 LifeLock $12M 2010 U.S. Accuracy, Security
7 TJ Maxx $9.8M 2009 U.S. Security
8 Dish Netwo rk $6M 2009 U.S. Cho ice and Consent
9 DirecTV $5.3M 2005 U.S. Cho ice and Consent
10 HSBC $5M 2009 UK Security
1999-
11 US Bancorp $5M U.S. Disclosure
2000
12 Craftmatic $4.3 2007 U.S. Cho ice and Consent
13 Cignet Health $4.3M 2011 U.S. Access
14 Barclays Bank $3.8M 2013 U.S. Use and Retention
15 Certegy Check Services $3.5M 2013 U.S. Accuracy
16 Playdo m $3M 2011 U.S. Collection and Notice
17 The Broadcast Team $2.8M 2007 U.S. Collection
Equifax, TransUnion and
18 $2.5M 2000 U.S. Access
Experian
19 CVS Caremark $2.3M 2009 U.S. Security and Disposal
20 Norwich Union Life $1.8M 2007 UK Disclosure

**SOURCE IAPP 17 FEB 2014

 Rights of the Data Subject
• Right to be informed - IRR, Section 34.a
• Right to object - IRR, Section 34.b
• Right to access - IRR, Section 34.c
• Right to data portability - IRR, Section 36
• Right to correct (rectification) - IRR, Section 34.d
• Right to erasure or blocking - IRR, Section 34.e
• Right to file a complaint - IRR, Section 34.a.2
• Right to damages - IRR, Section 34.f
• Transmissibility of Rights - IRR, Section 35
CLASSIFICATION OF PERSONAL DATA

Personal Information:
Personal information refers to any
information whether recorded in a
material form or not, from which the
identity of an individual is apparent
or can be reasonably and directly
ascertained by the entity holding the
information, or when put together
with other information would directly
and certainly identify an individual.
Sensitive Personal Information.
Refers to personal information about an
individual’s:
race, ethnic origin, marital status,
age, color, religious, philosophical or
political affiliations, health, education,
genetics, sexual life, any proceeding
for any offense committed or alleged
to have been committed, the disposal
of such proceedings, the sentence of
any court in such proceedings;

Also includes information issued by

government agencies peculiar to an
individual which includes, but not limited
to:
social security numbers, previous
or current health records, licenses or
its denials, suspension or revocation,
and tax returns;
and specifically established by an
executive order or an act of Congress to be
kept classified.
Personal Data Lifecycle
Acquisitio
Storage USE
n

• Key considerations when listing your

Destructi personal data:
Transfer – What personal data do you collect?
on
– In what form and through which channels?
– For what purpose you collect personal data
– How is it used?
Retention/Disposal – Who is this data shared with internally and
externally?
should be based on: – Who is authorized to access this data?
1. Law – Where do you keep your data?
2. Industry Best Practice – How long do you keep your data?
3. Business Needs – How do you dispose this data?
 TRANSPARENCY – “the CONSENT Regime”

Principle of Transparency
A data subject must be aware of the nature, purpose, and extent
of the processing of his or her personal data, including the risks
and safeguards involved, the identity of personal information
controller, his or her rights as a data subject, and how these can
be exercised. Any information and communication relating to the
processing of personal data should be easy to access and
understand, using clear and plain language.
LEGITIMATE PURPOSE

Principle of Legitimate Purpose

The processing of information
shall be compatible with a
declared and specified purpose,
which must not be contrary to
law, morals, or public policy.
 PROPORTIONALITY

Principle of Proportionality
The processing of information shall be adequate, relevant,
suitable, necessary, and not excessive in relation to a declared
and specified purpose. Personal data shall be processed only if
the purpose of the processing could not reasonably be fulfilled
by other means.

Avoid this mentality:

“just in case we need it”
“this is what we always do”
THE
THE
FIVE
FIVE
PILLARS
PILLARS
OF
OF
COMPLIANCE
COMPLIANCE
 Know Your Be
Commit to
Risk: Conduct Accountable:
Comply:
a Privacy Create your
Appoint a Data
Impact Privacy
Protection
Assessment Management
Officer (DPO)
(PIA) Program and
Privacy
Manual
Demonstrate
Be Prepared for
Your
Breach:
Compliance:
Regularly
Implement
exercise your
your privacy
Breach
and data
Reporting
protection
Procedures
(PDP)
(BRP).
measures.
Other • Privacy
Notice
Requir • Data Privacy notice
Sharing
ement
 What information is being
Agreeme collected?

nt (DSA),
s
 Who is collecting it?

if  How is it collected?

• Annual applicabl  Why is it being collected?

Breach e
 How will it be used?
Drill • Sub-
 Notification contractin  Who will it be shared with?
to NPC
within 72
g
hours Agreeme
 (in the event of nt /
a personal data
breach) Outsourci
• Annual ng
Breach Agreeme
Report nt
• Security
Clearance
 The Data Privacy Principles
• Personal data shall be:
1. processed fairly and lawfully
2. processed only for specified, lawful and compatible
purposes
3. adequate, relevant and not excessive
4. accurate and up to date
5. kept for no longer than necessary
6. processed in accordance with the rights of data subjects
7. kept secure
8. shared to other PICs only if there is a DSA.
Self-help checklist on data protection policy
Remember: you should be able to answer YES to all of the questions below. If you can, your business is in good
shape from a data protection viewpoint. If you don't have a clean sheet, the checklist can help you identify the
areas where you need to improve.

Rule 1: Fair obtaining: Rule 2: Purpose specification

• At the time when we collect information • Are we clear about the purpose (or
about individuals, are they made aware of purposes) for which we keep personal
the uses for that information? information?
• Are people made aware of any disclosures • Are the individuals on our database also
of their data to third parties? clear about this purpose?
• Have we obtained people's consent for • If we are required to register with NPC, does
any secondary uses of their personal data, our register entry include a proper,
which might not be obvious to them comprehensive statement of our
purpose? [Remember, if you are using personal
• Can we describe our data-collection data for a purpose not listed on your register
practices as open, transparent and up- entry, you may be committing an offence.]
front? • Has responsibility been assigned for
maintaining a list of all data sets and the
purpose associated with each?
Self-help checklist on data protection policy
Remember: you should be able to answer YES to all of the questions below. If you can, your business is in good
shape from a data protection viewpoint. If you don't have a clean sheet, the checklist can help you identify the
areas where you need to improve.

Rule 3: Use and disclosure of information Rule 4: Security

• Are there defined rules about the use and • Is there a list of security provisions in place for
disclosure of information? each data set?
• Are all staff aware of these rules? • Is someone responsible for the development
• Are the individuals aware of the uses and and review of these provisions?
disclosures of their personal data? Would they • Are these provisions appropriate to the
be surprised if they learned about them? sensitivity of the personal data we keep?
Consider whether the consent of the individuals
• Are our computers and our databases
should be obtained for these uses and
disclosures.
password-protected, and encrypted if
appropriate?
• If we are required to register with NPC, does our
register entry include a full list of persons to • Are our computers, servers, and files securely
whom we may need to disclose personal locked away from unauthorized people?
data? [Remember, if you disclose personal data to
someone not listed on your register entry, you may
be committing an offence.]
Self-help checklist on data protection policy
Remember: you should be able to answer YES to all of the questions below. If you can, your business is in
good shape from a data protection viewpoint. If you don't have a clean sheet, the checklist can help you identify
the areas where you need to improve.

Rule 5: Adequate, relevant and not Rule 6: Accurate and up-to-date

excessive
• Do we check our data for
• Do we collect all the information we need
to serve our purpose effectively, and to accuracy?
deal with individuals in a fair and • Do we know how much of our
comprehensive manner? personal data is time-sensitive,
• Have we checked to make sure that all i.e. likely to become inaccurate
the information we collect is relevant,
and not excessive, for our specified
over time unless it is updated?
purpose? • Do we take steps to ensure our
• If an individual asked us to justify every databases are kept up-to-date?
piece of information we hold about him or
her, could we do so?
• Does a policy exist in this regard?
Self-help checklist on data protection policy
Remember: you should be able to answer YES to all of the questions below. If you can, your business is in
good shape from a data protection viewpoint. If you don't have a clean sheet, the checklist can help you identify
the areas where you need to improve.

Rule 7: Retention time

• Is there a clear statement on how long Rule 8: The Right of Access
personal data are to be retained?
• Is a named individual responsible
• Are we clear about any legal
requirements on us to retain data for a
for handling access requests?
certain period? • Are there clear procedures in
• Do we regularly purge our databases of place for dealing with such
data which we no longer need, such as requests?
data relating to former customers or • Do these procedures guarantee
staff members?
compliance with the RA 10173
• Do we have a policy on deleting
personal data as soon as the purpose requirements?
for which we obtained the data has
been completed?
Self-help checklist on data protection policy
Remember: you should be able to answer YES to all of the questions below. If you can, your business is in
good shape from a data protection viewpoint. If you don't have a clean sheet, the checklist can help you identify
the areas where you need to improve.

Registration Training & Education

• Are we clear about whether or not • Do we know about the levels of
we need to be registered with the awareness of data protection in our
NPC? organization?
• Are our staff aware of their data
• If registration is required, is the
protection responsibilities - including
registration kept up to date? Does
the need for confidentiality?
the registration accurately reflect
• Is data protection included as part of
our practices for handling personal
the training program for our staff?
data? [Remember, if your data-handling
practices are out of line with the details set out in
your register entry, you may be committing an
offence.]
Self-help checklist on data protection policy
Remember: you should be able to answer YES to all of the questions below. If you can, your business is in
good shape from a data protection viewpoint. If you don't have a clean sheet, the checklist can help you identify
the areas where you need to improve.

Co-ordination and Compliance

Other Requirements
• Has a Data Protection Officer (DPO) /
• Annual Breach Drill
Compliance Officer for Privacy (COP)
been appointed? – Notification to NPC within 72 hours
(in the event of a personal data breach)
• Are all staff aware of his or her role?
• Annual Breach Report
• Are there mechanisms in place for formal
• Security Clearance
review by DPO activities within our
organization? • Privacy Notice
• Is the Privacy Impact Assessment (PIA) • Data Sharing Agreement (DSA), if
carefully planned and executed applicable
according to its purpose? • Sub-contracting Agreement / Outsourcing
• Is there a Breach Management Program Agreement
(BMP) in place?
1 Technical

2 Organisational –
other measures
Technical

Encryption Backup
To what standard? (cost Vs benefit)
s
Secure: encrypted tapes | cloud-provider

All devices or just some? Auditable process

Passwords Access control

Enforced strength and updates?
Who decides permissions and privileges
(‘need to know’)?
Sharing data
Technical solutions – e.g. via email; portals
Remote
System testing & maintenance access
How delivered securely?

Permit Bring Your Own Device?

Who has access, to what (System Administrators)

Live or dummy data? Firewalls / Anti-virus / Spam

filters
Organisational – physical security

Secure Office Storage Remote working

For removable devices and hardcopy information Secure both hardcopies and devices when in
transit.

Kept out of sight: in transit | at home.

Identifying marks? Locked print?

Kensington locks? Lockable pedestals | Kensington locks?

Offsite?

Building access control Secure disposal

Secure premises – CCTV | locked windows | perimeter
Shredding of hardcopies

Locked CCTV room | server room

Beyond use | Reuse | Resale

ID badges, supervised visitors | contractors
Organisational – other measures

Policy, procedures, guidance & training

Eliminate ambiguities Clearly communicated, readily accessible and understood

Procurement (and contracts)

Human Resources
i.e. outsourced services like IT and software
Explicit roles and responsibilities in Job
Descriptions and Terms of Reference
Due diligence

Terms and Conditions: confidentiality clauses

Compliant contract Terms and Conditions:
• Act on your instructions
Clear expectations | reporting lines • Equivalent security

Disciplinary process Training records Auditing and monitoring

 Other Security Measures
• Shredding all confidential waste.
• Using strong passwords.
• Installing a firewall and virus checker on your
computers.
• Encrypting any personal information held
electronically.
• Disabling any ‘auto-complete’ settings.
• Holding telephone calls in private areas.
• Checking the security of storage systems.
• Keeping devices under lock and key when not in
12 offline measures to keep your physical data
secure
• Lock rooms containing confidential information when not in use.
• Make sure employees don’t write their passwords down.
• Use swipe cards or keypads to access the office.
• Use CCTV cameras to monitor your office space.
• Shield keyboards when inputting passwords.
• Shred confidential waste.
• Use forensic property marking equipment and spray systems to mark
assets.
• Use anti-climb paint on exterior walls and drains.
• Install an alarm system.
• Place bars on ground floor windows.
• Hide valuable equipment from view when not in the office.
• Assign a limited number of trustworthy employees as key safe holders.
 Holding Data and Keeping it Up-
to-Date
• Carry out an information audit at least annually.
– Write a letter at the start of each school year asking parents and
students to check that their details are correct. This also helps prevent
emergency risks, e.g. if an old address or phone number is on record.
– Check that ‘live’ files are accurate and up to date.
– Any time you become aware that information needs amending, do so
immediately
– Any personal data that is out of date or no longer needed should be
‘destroyed’. This may involve shredding documents or deleting
computer files securely so that they cannot be retrieved.
– Schools must follow the disposal of records schedule. This schedule
states how long certain types of personal data can be held for until it
must be destroyed. Some stipulations are legal obligations while others
are best practice.
are violating the Data Privacy Act if you keep any data for longer than it is need
 Designating a DPO is the first
essential step. You cannot
register with the NPC unless you
have a DPO.
 General Qualifications
• The Data Protection Officer (DPO) should possess
specialized knowledge and demonstrate reliability
necessary for the performance of his or her duties and
responsibilities. As such, the DPO should have expertise in
relevant privacy or data protection policies and practices.
He or she should have sufficient understanding of the
processing operations being carried out by the Personal
Information Controller (PIC) or the Personal Information
Processor (PIP), including the latter’s information systems,
data security and/or data protection needs.  

• Knowledge by the DPO of the sector or field of the PIC or

PIP, and the latter’s internal structure, policies, and
processes is also useful.  
 Duties and Responsibilities Of
the
a. monitor the PIC’s DPO
or PIP’s compliance with the
DPA, its IRR, issuances by the NPC and other
applicable laws and policies. For this purpose, he
or she may: 
1. collect information to identify the processing operations,
activities, measures, projects, programs, or systems of
the PIC or PIP, and maintain a record thereof;
2. analyze and check the compliance of processing
activities, including the issuance of security clearances to
and compliance by third-party service providers;
3. inform, advise, and issue recommendations to the PIC or
PIP;
4. ascertain renewal of accreditations or certifications
necessary to maintain the required standards in personal
data processing; and
5. advice the PIP or PIP as regards the necessity of executing
a Data Sharing Agreement with third parties, and ensure
b. ensure the conduct of Privacy Impact
Assessments relative to activities, measures,
projects, programs, or systems of the PIC or
PIP;  
c. advice the PIC or PIP regarding complaints
and/or the exercise by data subjects of their
rights (e.g., requests for information,
clarifications, rectification or deletion of personal
data);  
d. ensure proper data breach and security incident
management by the PIC or PIP, including the
latter’s preparation and submission to the NPC
of reports and other documentation concerning
security incidents or data breaches within the
prescribed period; 
e. inform and cultivate awareness on privacy and
data protection within the organization of the
f. advocate for the development, review and/or
revision of policies, guidelines, projects
and/or programs of the PIC or PIP relating to
privacy and data protection, by adopting a
privacy by design approach;  
g. serve as the contact person of the PIC or PIP
vis-à-vis data subjects, the NPC and other
authorities in all matters concerning data
privacy or security issues or concerns and
the PIC or PIP;  
h. cooperate, coordinate and seek advice of the
NPC regarding matters concerning data
privacy and security; and  
i. perform other duties and tasks that may be
assigned by the PIC or PIP that will further
the interest of data privacy and security and
uphold the rights of the data subjects. 
Additional functions of a Data Protection Officer
(DPO):

1. ensuring that controllers and data subjects are

informed of their rights and obligations;
2. ensuring in an independent manner the internal
application of the Regulation;
3. carrying out inquiries where necessary;
4. keeping a register of the processing operations carried
out by the controller;
5. notifying the NPC of processing operations which may
present specific risks;
6. responding to requests from NPC and cooperating with
What support is needed from the rest of the org’n?
What support is needed from the rest of the org’n?
What support is needed from the rest of the org’n?
What support is needed from the rest of the org’n?
What support is needed from the rest of the org’n?
In Closing: How the NPC can help

Help in - Generic
delivering the guidance and
message to top frameworks
management (www.privacy.gov.ph)

- Updates on - When
new standards requested,
advice on
and/or circulars
(www.privacy.gov.ph) specific matters
([email protected])
 “Compliance to Data Privacy
Act is not a one-shot initiative.
It is a discipline and culture
that must be embedded on a
continuous basis within the
organization.”
CULTURE OF PRIVACY in the
PHILIPPINES
Thank you! Any questions?
[email protected]