Data Protected - Philippines
Contributed by Ocampo & Suralvo Law Offices
Last updated July 2022
General | Data Protection Laws
National Legislation
National Supervisory Authority
Scope of Application
Personal Data
Sensitive Personal Data
Data Protection Officers
Accountability and Privacy Impact Assessments
Rights of Data Subjects
Security
Transfer of Personal Data to Third Countries
Enforcement
ePrivacy | Marketing and cookies
National Legislation
Cookies
Marketing by E-mail
Marketing by Telephone
_____________________________________________________________________
General | Data Protection Laws
____________________________________________________________
National Legislation
General data protection laws
Republic Act No. 10173, known as the Data Privacy Act of 2012 (the “Data Privacy Act”). The Implementing Rules and Regulations of the Data Privacy Act (“IRR”) were promulgated on 24 August 2016.
Entry into force
The Data Privacy Act was signed into law on 15 August 2012 and came into effect on 8 September 2012. The IRR came into effect on 9 September 2016.
_____________________________________________________________________ Top
National Supervisory Authority
Details of the competent national supervisory authority
The National Privacy Commission (the “Commission”). The Commission is attached to the Department of Information and Communications Technology.
5th Floor, Delegation Building
PICC Complex,
Roxas Boulevard, Manila
Metro Manila
Notification or registration scheme and timing
The IRR requires Personal Information Controllers and Personal Information Processors to register their data processing systems with the Commission if: (i) they employ 250 or more people; (ii) the processing includes Sensitive Personal Information of at least 1,000 individuals; (iii) the processing is likely to pose a risk to the rights and freedoms of data subjects; or (iv) the processing is not occasional.
Processing operations that pose a risk to data subjects include those that involve: (i) information that would likely affect national security, public safety, public order, or public health; (ii) information required by applicable laws or rules to be confidential; (iii) vulnerable data subjects (i.e. where an imbalance exists in the relationship between a data subject and a Personal Information Controller or a Personal Information Processor).
The Commission has determined that the following sectors are involved in (a) processing likely to pose a risk to the rights and freedoms of data subjects (b) and/or processing which is not occasional, thus subject to mandatory registration: (i) Government; (ii) banks and non-bank financial institutions; (iii) telecommunication networks and internet service providers; (iv) business process outsourcing companies; (v) educational institutions; (vi) hospitals and healthcare facilities; (vii) insurance companies; (viii) business engaged in direct marketing, reward cards and loyalty programs; (ix) pharmaceutical companies engaged in research; and (x) Personal Information Processors processing personal data for a Personal Information Controller included in the preceding items, and data processing systems involving automated decision-making.
The initial registration process is broken down into two phases: the registration of a data protection officer and the registration of data processing systems. Under the Commission’s guidelines, an entity covered by mandatory registration must register its data processing system within two months of the commencement of such system. Upon registration, Personal Information Controllers and Personal Information Processors are issued a certificate valid until 8 March the following year and which must be renewed annually.
The Commission has announced the upcoming launch of its online registration and renewal platform for both Phase I and Phase II Registrations called eRehistro. As of this writing however, registration through eRehistro has yet to be implemented.
The Commission also recently extended (up to 8 March 2023), the validity of all existing Certificates of Registration issued in the year 2021. However, for Certificates of Registration issued before 2021, Personal Information Controllers and Personal Information Processors have been directed to renew their registration with the Commission.
The IRR sets out the contents of registration or notification, which includes information such as the purposes of the processing, the categories of data subject, the security measures in place for data protection and any proposed transfers of personal data outside the Philippines.
Exemptions to notification
Under the IRR, Personal Information Controllers or Personal Information Processors that employ fewer than 250 people will not be required to register their data processing system unless: (i) the processing includes Sensitive Personal Information of at least 1,000 individuals; (ii) the processing it carries out is likely to pose a risk to the rights and freedoms of data subjects; and (iii) the processing is not occasional.
Any Personal Information Controllers and Personal Information Processors not subject to mandatory registration may voluntarily register with the Commission.
_____________________________________________________________________ Top
Scope of Application
What is the territorial scope of application?
The Data Privacy Act and the IRR apply to Controllers and Processors established in the Philippines and the processing of personal data by any natural and juridical person in the government or private sector.
The Data Privacy Act also applies to entities established outside of the Philippines if certain links exist to the Philippines. For example, where: (i) the processing relates to Personal Information about a Philippine citizen or a resident; (ii) the entity has a link with the Philippines (such as a contract entered into in the Philippines or a branch or agency in the Philippines) and the entity is processing Personal Information about Philippine citizens or residents; or (iii) the entity has other links such as a business in the Philippines or where it collects and holds Personal Information in the Philippines.
Is there a concept of a controller and a processor?
The Data Privacy Act places accountability on the “Personal Information Controller” for Personal Information under its control or custody, including information that has been transferred to a third party for processing.
The Data Privacy Act also applies to “Personal Information Processors” to whom a Personal Information Controller may outsource or instruct the processing of personal data.
Under a Commission circular, Personal Information Controller is defined as “a natural or juridical person, or any other body who controls the processing of personal data, or instructs another to process personal data on its behalf. The term excludes: (i) a natural or juridical person, or any other body, who performs such functions as instructed by another person or organization; or (ii) a natural person who processes personal data in connection with his or her personal, family or household affairs.
The same circular states that there is “control” if the natural or juridical person or any other body decides on what information is collected, or the purpose and extent of the processing.
Are both manual and electronic records subject to data protection legislation?
The Data Privacy Act applies to both manual and electronic records. The law and the IRR cover information whether recorded in material form or not.
Are there any national derogations?
The Data Privacy Act contains a number of exceptions. It does not apply to Personal Information originally collected from residents of foreign jurisdictions which is being processed in the Philippines. Other miscellaneous exemptions include the processing of Personal Information: (i) about government employees acting in an official capacity; (ii) about those contracting with government or obtaining government licences or benefits; (iii) for journalistic, artistic, literary or research purposes; (iv) to carry out the functions of a public authority; and (v) to comply with money laundering and other financial rules. The non-application of the rules to these cases, however, is limited only to the minimum extent of collection, access, use, disclosure or other processing necessary for the purpose, function or activity concerned.
_____________________________________________________________________ Top
Personal Data
What is personal data?
Personal data refers to all types of Personal Information specifically Personal Information, Sensitive Personal Information and Privileged Information.
Both the Data Privacy Act and the IRR define “Personal Information” as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.
Is information about legal entities personal data?
No.
What are the rules for processing personal data?
In general, the Data Privacy Act and the IRR allow the processing of personal data subject to: (i) compliance with the requirements of the Data Privacy Act and other laws allowing disclosure of information to the public; and (ii) adherence to the principles of transparency, legitimate purpose and proportionality. The IRR describes these three principles more specifically.
The general principles of the Data Privacy Act and the IRR require personal data to be: (i) collected for declared, specific and legitimate purposes and only processed in a way compatible with such purposes; (ii) processed fairly and lawfully; (iii) accurate, relevant and, where necessary, kept up to date; (iv) adequate and not excessive; (v) retained only for as long as necessary, for the fulfilment of the declared, specified and legitimate purpose or as needed for legal claims or legitimate business purposes, or as provided by law; (vi) kept in a form which permits identification of data subjects for no longer than is necessary; and (vii) disposed of securely to prevent further processing or prejudice to the interests of the data subjects.
The processing of Personal Information shall only be permitted if at least one of the following conditions exists: (i) the data subject has given consent; (ii) the processing of Personal Information is necessary for a contract with the data subject or to take steps at the request of the data subject prior to entering into a contract; (iii) the processing is necessary for compliance with a legal obligation; (iv) the processing is necessary to protect vitally important interests of the data subject, including their life and health; (v) the processing is necessary in relation to a national emergency, public order and safety, or to fulfil functions of a public authority; or (vi) the processing is necessary for the Personal Information Controller or recipient’s legitimate interests, except where overridden by the fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.
The IRR contains controls on data sharing (which does not include data sharing as part of an outsourcing). Data sharing shall be allowed: (i) when it is expressly authorized by law provided there are adequate safeguards for data privacy and security, and processing adheres to principles of transparency, legitimate purpose and proportionality; (ii) in the private sector, if the data subject consents to it and specific conditions are complied with, including executing data sharing agreements in cases of data sharing for commercial purposes, such as direct marketing. These restrictions on data sharing expressly apply to intra-group data sharing.
Are there any formalities to obtain consent to process personal data?
Consent must be a freely-given, specific, informed indication of the data subject’s will. It must be evidenced by written, electronic or recorded means.
Are there any special rules when processing personal data about children?
Minors (i.e. those below 18 years old) are considered vulnerable data subjects. The processing of their information is considered likely to pose a risk to their rights and freedoms. Consequently, Personal Information Controllers and Personal Information Processors that process minors’ personal data are subject to mandatory registration.
Are there any special rules when processing personal data about employees?
The collection and processing of personal data of employees of private entities are governed by the same rules as other data subjects. Personal data about government employees that relate to his position or functions form an exemption under the Data Privacy Act.
_____________________________________________________________________ Top
Sensitive Personal Data
What is sensitive personal data?
The Data Privacy Act and the IRR define "Sensitive Personal Information" as Personal Information: (i) about an individual’s race, ethnic origin, marital status, age, colour, religious, philosophical or political affiliations, health, education, genes or sexual life, or offences or alleged offences relating to that individual; and (ii) issued by government agencies peculiar to an individual which includes social security numbers, health records, licences and tax returns.
Specific protection is also given to “Privileged Information”, being information that is subject to legal privilege.
Further classes of sensitive Personal Information can be identified by an executive order or an act of Congress.
Are there additional rules for processing sensitive personal data?
In general, the processing of Sensitive Personal Information and Privileged Information is prohibited except where: (i) the data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of Privileged Information, all parties to the exchange have given their consent prior to processing; (ii) the processing is provided for by existing laws and regulations; (iii) the processing is necessary to protect the life and health of the data subject or another person, and the data subject is not able to give consent; (iv) the processing is carried out for limited non-commercial purposes by public organisations and their associations; (v) the processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of Personal Information is ensured; or (vi) the processing is necessary for court proceedings or legal claims, or is provided to the government or a public authority.
Are there additional rules for processing information about criminal offences?
The rules for processing information about criminal offences are the same as for Sensitive Personal Information.
In addition, the processing of Personal Information involving criminal offences is considered likely to pose a risk to a data subject’s rights and freedoms. Hence, Personal Information Controllers and Personal Information Processors that process such personal data are subject to mandatory registration.
Are there any formalities to obtain consent to process sensitive personal data?
The same formalities as those required for the processing of Personal Information apply. However, consent must be specific to the purpose and given by the data subject prior to the processing of the Sensitive Personal Information. In the case of Privileged Information, the consent must come from all the parties to the exchange of Privileged Information.
_____________________________________________________________________ Top
Data Protection Officers
When must a data protection officer be appointed?
The Personal Information Controller must designate an individual or individuals who are accountable for the organisation’s compliance with the Data Privacy Act. The identity of the individual(s) so designated must be made known to any data subject upon request.
The data protection officer must: (i) possess specialised knowledge and demonstrate reliability necessary for the performance of his or her duties and responsibilities; (ii) have expertise in relevant privacy or data protection policies and practices; (iii) have sufficient understanding of the processing operations being carried out by the Personal Information Controller/Personal Information Processor, including its internal structure, policies and processes, information systems, data security and/or data protection needs; and (iv) be a full-time or organic employee of the Personal Information Controller/Personal Information Processor and ideally be a regular or permanent employee.
If the data protection officer’s employment is based on a contract, the term or duration of the contract should be at least two years to ensure stability. Consultants and project, seasonal, probationary, or casual employees should not be designated as a data protection officer.
The data protection officer may hold other positions in the organisation only if it does not give rise to any “conflict of interest” which arises where tasks, duties and responsibilities may be opposed to or could affect the performance of the data protection officer. This includes, inter alia, holding a position within the organisation that leads him or her to determine the purposes and the means of the processing of personal data.
The initial deadline for the registration of a data protection officer was 11 September 2017.
What are the duties of a data protection officer?
The data protection officer is responsible for, among others, the following activities: (i) monitoring compliance with relevant applicable legislation and policies; (ii) conducting privacy impact assessments; (iii) advising the Personal Information Controller/Personal Information Processor regarding complaints and/or the exercise by data subjects of their rights; (iv) ensuring proper data breach and security incident management; (v) informing and cultivating awareness on privacy and data protection within the organisation; advocating for the development, review and/or revision of policies, guidelines, projects and/or programs relating to privacy and data protection; (vi) serving as the contact person vis-à-vis data subjects, the Commission and other authorities in all matters concerning data privacy or security issues or concern and the company; (vii) cooperating, coordinating and seeking advice of the Commission regarding matters concerning data privacy and security; and (viii) performing other duties and tasks that may be assigned by the Personal Information Controller/Personal Information Processor that will further the interest of data privacy and security and uphold the rights of the data subjects.
The data protection officer must have due regard for the risk associated with the processing operations of the Personal Information Controller/Personal Information Processor, taking into account the nature, scope, content, and purposes of processing. This means that he or she must prioritise his or her data protection officer activities and focus on efforts on addressing any issues that present higher data protection risks.
_____________________________________________________________________ Top
Accountability and Privacy Impact Assessments
Is there a general accountability obligation?
Personal information Controllers and Personal Information Processors must implement reasonable and appropriate organisational, physical, and technical security measures for the protection of personal data.
Organisational measures include the: (i) appointment of a data protection officer who shall also be accountable for ensuring compliance with the laws; (ii) implementation of data protection policies; (iii) keeping of data processing records; (iv) management of employees who have access to personal data (e.g. conduct of capacity building, orientation or training programs for such employees regarding privacy or security policies).
Physical and technical security measures include: (i) monitoring and limiting of access to personal data; and (ii) implementation of policies for the protection of data such as procedure for the removal, disposal, transfer of personal data.
Are privacy impact assessments mandatory?
Under Commission guidelines, in general, a privacy impact assessment must be undertaken for each processing system of a Personal Information Controller or Personal Information Processor. A privacy impact assessment will be required for both new and existing systems, programs, projects, procedures, measures, or technology products that involve or impact processing personal data. For new processing systems, the assessment should be undertaken prior to their adoption, use, or implementation.
A Personal Information Controller or Personal Information Processor may forego the conduct of a privacy impact assessment only if it determines that the processing involves minimal risks to the rights and freedoms of individuals, taking into account recommendations from the data protection officer. In making this determination, the size and sensitivity of the personal data being processed, the duration and extent of processing, the likely impact of the processing to the life of data subject and possible harm in case of a personal data breach should be considered.
_____________________________________________________________________ Top
Rights of Data Subjects
The Commission issued in 2021 an advisory on the adoption of ISO/IEC 29184 in conducting privacy impact assessments.
Privacy notices
Data subjects should be provided with the following information prior to their personal data being added to a processing system or at the next practical opportunity: (i) a description of the personal data to be entered into the system; (ii) the purposes of processing; (iii) the scope and method of the personal data processing; (iv) the recipients; (v) automatic means to access the personal data; (vi) the identity and contact details of the Personal Information Controller or its representative; (vii) the period for which the information will be stored; (viii) the existence of their rights; and (ix) the basis of processing, when the processing is not based on the consent of the data subject.
When a data subject objects or withholds consent, the Personal Information Controller shall no longer process the personal data unless it is needed pursuant to a subpoena, where the collection and processing are for obvious purposes, or where the information is being collected and processed as a result of a legal obligation.
Finally, the data sharing principles require that the data subject is provided with certain information prior to collection or before data is shared, including the identity of the Personal Information Controllers or Processors that will be given access to the personal data, the purpose of data sharing and other related information.
Rights to access information
The data subject is entitled to reasonable access to: (i) the contents of the Personal Information that was processed; (ii) the sources of the Personal Information; (iii) the names and addresses of recipients; (iv) the manner by which the Personal Information was processed; (v) the reasons for the disclosure of the Personal Information to recipients; (vi) information on automated decision processes; (vii) the date when his or her Personal Information concerning the data subject was last accessed and modified; and (viii) the designation, name or identity and address of the Personal Information Controller.
Rights to data portability
There are also rights to data portability. Where Personal Information is processed by electronic means and in a structured and commonly used format, the data subject has a right to obtain the Personal Information in that format.
Right to be forgotten
Under the Data Privacy Act and the IRR, data subjects have the right to erasure and blocking. A data subject has the right to suspend, withdraw, order the blocking, removal or destruction of his or her Personal Information from a Personal Information Controller’s filing system.
This right may be exercised upon discovery and substantial proof of any of the following: (i) the personal data is incomplete, outdated, false, or unlawfully obtained; (ii) the personal data is being used for unauthorised purpose; (ii) the personal data is no longer necessary for the purposes for which they were collected; (iv) the data subject withdraws consent or objects to the processing, and there is no other legal ground or overriding legitimate interest for the processing; (v) the personal data concerns private information that is prejudicial to data subject, unless justified by freedom of speech, of expression, or of the press or otherwise authorised; (vi) the processing is unlawful; or (vii) the Personal Information Controller or Personal Information Processor violated the rights of the data subject.
Objection to direct marketing and profiling
The Data Privacy Act defines direct marketing as communication by whatever means of any advertising or marketing material which is directed to particular individuals. The IRR explicitly states that the data subject has the right to object to the processing of his or her personal data, including processing for direct marketing, automated processing or profiling. The data subject shall be notified and given an opportunity to withhold consent to the processing in case of changes or any amendment to the information supplied or declared data.
Other rights
The data subject is also entitled to object to unauthorised use of their Personal Information and to have inaccurate or incorrect Personal Information corrected in some cases.
The rights of the data subject are transmissible to their heirs and assigns at any time after the death of the data subject or when the data subject is incapacitated or incapable of exercising his rights.
_____________________________________________________________________ Top
Security
Security requirements in order to protect personal data
The Personal Information Controller must implement reasonable and appropriate organisational, physical and technical measures intended for the protection of Personal Information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing. This should protect against natural dangers and human dangers.
The determination of the appropriate level of security must take into account: (i) the nature of the Personal Information to be protected; (ii) the risks represented by the processing; (iii) the size of the organisation and complexity of its operations; (iv) current data privacy best practices; and (v) the cost of security implementation.
The IRR set out specific security requirements in three areas: (i) organisational measures, including the appointment of compliance officers, adoption of suitable policies and use of suitable contracts with Personal Information Processors; (ii) physical measures, including physical access controls, building design and destruction policies; and (iii) technical security measures, including encryption and intrusion detection.
Specific rules governing processing by third party agents (processors)
The Personal Information Controller must ensure that third parties processing Personal Information on its behalf shall also implement these security measures.
The IRR require a contract or other legal act to be in place that requires the Personal Information Processor to: (i) only process personal data on the instructions of the Personal Information Controller; (ii) ensure those accessing personal data keep it confidential; (iii) implement appropriate security measures; (iv) not engage another Processor without the Personal Information Controller’s prior instruction; (v) assist the Personal Information Controller when data subjects exercise their rights; (vi) assist the Personal Information Controller to comply with the Data Privacy Act and the IRR; (vii) at the choice of the Personal Information Controller, return or destroy personal data at the end of the contract; (viii) demonstrate compliance to the Personal Information Controller and submit to audits; and (ix) inform the Personal Information Controller if their instructions conflict with the Data Privacy Act and the IRR.
The employees, agents or representatives of a Personal Information Controller who are involved in the processing of Personal Information must keep it confidential unless it is intended for public disclosure.
The Commission has also issued advisories on the adoption of the following:(i) ISO/IEC 29151 as a guide in implementing controls for data protection; (ii) ISO/IEC 24760-series for Personal Information Controllers and Processors that carry out management of identity information in management systems; and (iii) ISO/IEC 29100 in implementing the privacy framework in any information and communication technology systems or services where privacy controls are required for personal data processing.
Notice of breach laws
Under the Data Privacy Act and its IRR, the Commission and affected data subjects must be notified of a personal data breach where: (i) it is reasonably believed that an unauthorized person has acquired Sensitive Personal Information or any other information that enables identity fraud; and (ii) the unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.
The notification must be made within 72 hours. Notification may be delayed where necessary to determine the scope of the breach, prevent further data breaches and secure the underlying system. The Commission may also authorise the postponement of notification where it may hinder criminal investigations related to a serious breach. The Commission may exempt the Personal Information Controller from notifying data subjects where: (i) it would not be in the public interest or in the interests of data subjects; or (ii) the Controller has complied with the security requirements and acquired the Personal Information in good faith.
The notification shall describe the nature of the breach, the personal data possibly involved, and the measures taken by the entity to address the breach.
Depending on the nature of the incident, or if there is delay or failure to notify, the Commission may investigate the circumstances surrounding the personal data breach. Investigations may include on-site examination of systems and procedures.
Under the IRR, a report summarising documented security incidents and personal data breaches shall be provided to the Commission annually.
For this purpose, the Commission launched last 20 April 2022 the Data Breach Notification Management System online platform. The website may be accessed at https://dbnms.privacy.gov.ph/login. Personal Data Breach Notifications and Annual Security Incident Reports are required to be submitted only through this online platform, and submissions through email, personal filing, ordinary mail, licensed courier service and any other mode of physical submission will not be considered valid.
_____________________________________________________________________ Top
Transfer of Personal Data to Third Countries
Restrictions on transfers to third countries
Transfers to third countries are permissible under the Data Privacy Act.
However, each Personal Information Controller is responsible for Personal Information under its control or custody, including information that has been transferred to a third party for processing overseas. The Personal Information Controller must use contractual or other reasonable means to provide a comparable level of protection for Personal Information processed by a third party.
Notification and approval of national regulator (including notification of use of Model Contracts)
A Personal Information Controller or Personal Information Processor required to register its data processing systems must provide certain details about its data processing system(s) including whether the personal data it processes would be transferred outside of the Philippines.
Use of binding corporate rules
The Data Privacy Act does not contain the concept of binding corporate rules.
It must be noted that the Commission issued in 2021 an advisory promoting the use of the ASEAN Model Contract Clauses (“ASEAN MCCs”) and the ASEAN Data Management Framework (“ASEAN DMF”). The Commission stated in the advisory that the ASEAN MCCs and the ASEAN DMF are developed for voluntary adoption and do not create additional rights or obligations under domestic or international law, therefore the Commission does not obligate entities to adopt them. The advisory further emphasized that the ASEAN MCCs and the ASEAN DMF do not amend the Data Privacy Act, its implementing rules and regulations and other issuances of the Commission.
_____________________________________________________________________ Top
Enforcement
Fines
Breach of the law is punishable by monetary penalties ranging from 100,000 to five million pesos (approximately €1,700 to €84,000). If the offender is a legal person, the penalty shall also be imposed upon responsible officers if the breach is as a result of their participation or gross negligence.
Note that the Commission’s draft Guidelines on Administrative Fines is undergoing public consultation. The Guidelines are set to prescribe the latest amount of administrative fines to be imposed for violations of the Data Privacy Act of 2012, its Implementing Rules and Regulations, and other related issuances and orders of the Commission.
Imprisonment
Offenders shall also be liable to imprisonment ranging from six months to seven years. If the offender is a legal person, the penalty shall also be imposed upon its responsible officers if the breach is as a result of their participation or gross negligence.
Any breach of personal data involving, harming or affecting at least 100 people will be subject to the maximum penalty.
Compensation
Data subjects are entitled to an indemnity for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of personal data. Pursuant to the exercise of its quasi-judicial functions, the Commission shall award an indemnity to an aggrieved party on the basis of the provisions of the Philippine Civil Code.
Other powers
If the offender is an alien, he or she shall be deported without further proceedings after serving the penalties prescribed.
The Commission has the authority to perform all acts necessary to enforce its orders, resolutions or decisions, including the imposition of administrative sanctions, fines or penalties.
The Commission may: (i) issue compliance or enforcement orders; (ii) award indemnity on matters affecting any personal data or rights of data subjects; (iii) issue cease and desist orders or impose a temporary or permanent ban on the processing of personal data upon finding that the processing will be detrimental to national security or public interest, or if it is necessary to preserve and protect the rights of data subjects; (iv) recommend to the Department of Justice the prosecution of crimes and imposition of penalties; (v) compel or petition any entity, government agency or instrumentality to abide by its orders or take action on a matter affecting data privacy; and (vi) impose administrative fines for violations of the Data Privacy Act, the IRR and its other issuances.
Practice
In previous years, the Commission had issued compliance orders directing entities to implement corrective measures to comply with the law.
The Commission also conducts privacy compliance checks to evaluate the existing governance, organisational, physical and technical measures of Personal Information Controllers and Personal Information Processors, with the aim of preventing or mitigating similar incidents in the future.
During the 5th National Data Privacy Conference of the Commission held last 25 May 2022, the Privacy Commissioner reported that it conducted 895 compliance checks in 2021, which included 685 privacy sweeps, 50 notices of documentary submission and 160 warning letters.
Temporary bans were also imposed against several online lending applications that were found to be violating the Data Privacy Act.
The Complaints and Handling Investigation Division of the Commission also reported that it issued 147 notices to explain, handled 363 complaints, conducted 24 sua sponte investigations and addressed 8,487 data privacy concerns during the same period.
As of 25 May 2022, it was reported by the Privacy Commissioner that the Commission has conducted 28 adjudication meetings which led to the issuance of 129 decisions, resolutions, and orders.
_____________________________________________________________________ Top
ePrivacy | Marketing and cookies
_____________________________________________________________
National Legislation
ePrivacy laws
Online privacy is dealt with mainly by Republic Act No. 10175, known as the Cybercrime Prevention Act of 2012 (“Cybercrime Prevention Act”). The Cybercrime Prevention Act protects computer data and systems, including prohibiting violations of an individual’s rights to online privacy.
Certain administrative rules also cover electronic privacy issues, particularly direct marketing and cookies. This includes: (i) the Insurance Commission Circular Letter No. 2014-47 of the 2014 Guidelines on Electronic Commerce of Insurance Products (“Insurance E-Commerce Guidelines”); (ii) NTC Memorandum Circular No. 03-03-2005A, as amended by Memorandum Circular No. 04-07-2009 (“Broadcast Messaging Service Rules”); and (iii) the “Consumer Act” and the Department of Trade and Industry Administrative Order No. 2-93 of Rules and Regulations Implementing Republic Act No. 7394 on the Consumer Act (“Consumer Act Rules”).
_____________________________________________________________________ Top
Cookies
Conditions for use of cookies
The Cybercrime Prevention Act and the Data Privacy Act do not specifically regulate the use of cookies.
Specific rules apply to insurance providers under the Insurance E-Commerce Guidelines who must include their privacy policy on their website. The privacy policy must include details of: (i) when the website uses cookies; (ii) how and why they are used; and (iii) the consequences, if any, of consumers’ refusal to accept a cookie.
Regulatory guidance on the use of cookies
None.
_____________________________________________________________________ Top
Marketing by E-mail
Conditions for direct marketing by e-mail to individual subscribers
Under the Insurance E-Commerce Guidelines, insurance providers shall not transmit marketing e-mails to consumers without their consent, except when insurance providers have an existing relationship with them. An existing relationship is not established by consumers simply visiting the insurance providers' website. Any marketing e-mail messages that insurance providers send shall prominently display a return e-mail address and shall provide in plain language a simple procedure by which consumers can notify insurance providers that they do not wish to receive such messages.
The Broadcast Messaging Service Rules cover commercial and promotional advertisements, surveys and other messages sent via broadcast/push messaging service. Under the Broadcast Messaging Service Rules, content and/or information service providers are not allowed to send and/or initiate push messages unless the subscriber asks for them by communicating with the provider through written correspondence, text messaging, internet, or other similar means of communication. Moreover, commercial and promotional advertisements, surveys and other broadcast messages shall be allowed only upon prior written consent by the subscribers.
Conditions for direct marketing by e-mail to corporate subscribers
The Insurance E-Commerce Guidelines protect consumers which they define as individuals or legal persons engaged in commercial activity. The Broadcast Messaging Service Rules apply to both individual and corporate subscribers.
Exemptions and other issues
The Consumer Act Rules contain specific rules on the contents of any direct marketing, including requiring the disclosure of details of the seller, relevant terms and conditions and payment information. These rules only apply when dealing with consumers who are natural persons.
The Cybercrime Prevention Act makes unsolicited commercial electronic marketing communications a cybercrime, unless: (i) there is a prior affirmative consent from the recipient; (ii) the primary intent of the communication is to provide a service and/or administrative announcements to existing customers; or (iii) the communication does not disguise the sender, does not include misleading information and allows the recipient to opt out. However, in 2014, the Philippine Supreme Court, while upholding other provisions of the Cybercrime Prevention Act, struck down as unconstitutional the provision on unsolicited commercial communications for violating a person’s right to freedom of expression.
_____________________________________________________________________ Top
Marketing by Telephone
Conditions for direct marketing by telephone to individual subscribers (excludes automated calls)
The Consumer Act also deals with home solicitation sales which include solicitation by telephone.
Business entities conducting home solicitation sales of any consumer product or service must obtain a permit from the Department of Trade and Industry. In addition: (i) home solicitation sales may be conducted only between 9am and 7pm unless otherwise agreed; (ii) home solicitation sales shall only be conducted by a person who has the proper identification and authority from his principal; (iii) sales generated from home solicitation sales shall be properly receipted; and (iv) there must be no misrepresentation, for example that the consumer has been specially selected or that the purpose of the call is for a survey or research.
Conditions for direct marketing by telephone to corporate subscribers (excludes automated calls)
These conditions do not apply to corporate subscribers.
Exemptions and other issues
The Consumer Act Rules contain specific rules on the contents of any direct marketing (see above).
_____________________________________________________________________ Top