1 of 64

LAYERTECH SOFTWARE LABS�REV: January 2017

�THIS PRESENTATION IS CREATED by LAYERTECH SOFTWARE LABS and MAY NOT BE REPRODUCED WITHOUT WRITTEN CONSENT OF LAYERTECH.

NATIONAL PRIVACY COMMISSION’s� IMPLEMENTING RULES AND REGULATIONS

FOR INFORMATION CONTROLLERS AND PROCESSORS

REPUBLIC of the PHILIPPINES�RA 10173�DATA PRIVACY ACT of 2012

MODULE 2 of 3

2 of 64

DISCLAIMER

This presentation is based on Implementing Rules and Regulations of Republic Act 10173 by the National Privacy Commission, created by Layertech Software Labs for its employees and is made FREE to anyone who wish to use it for educational and awareness purposes. Layertech used creative illustrations and diagrams to make the topic as understandable as possible.

​

Using this module means you fully understand these conditions and will NOT hold Layertech liable for misinterpretations that may arise from using this module. Kindly refer to the official RA 101 73 for a full transcript of the act, and the Implementing Rules Document for the full details of the Rules.

​

For comments, corrections and suggestions for the improvement of these presentations, please contact us at learning@layertechlab.com

3 of 64

DATA PRIVACY ACT of 2012

Republic Act 10173 is also known as Data Privacy act of 2012.

​

“It is the policy of the State to PROTECT THE FUNDAMENTAL HUMAN RIGHT OF PRIVACY, of communication while ensuring free flow of information to promote innovation and growth.

The state recognizes the vital role of information and communications technology in nation-building and its inherent obligation to ensure that personal information in information and communications systems in the government and in the private sector are secured and protected.”

4 of 64

IMPLEMENTING RULES AND REGULATIONS�of Data Privacy Act by National Privacy Commission

“Pursuant to the mandate of the National Privacy Commission to ADMINISTER and IMPLEMENT the provisions of DATA PRIVACY ACT of 2012, and to monitor and ensure compliance of the country with international standards set for data protection, the following rules and regulations are hereby promulgated to effectively implement the provisions of the Act.”

5 of 64

THE RULES

These rules further enforce the Data Privacy Act and adopt a generally accepted international principles and standards for personal data protection.

6 of 64

RULE 5: LAWFUL PROCESSING of PERSONAL DATA

Processing of personal information IS ALLOWED, unless prohibited by law. For processing to be lawful, ANY of the following conditions under the criteria (next slides) MUST BE COMPLIED WITH.

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

7 of 64

RULE 5: CRITERIA FOR LAWFUL PROCESSING of� PERSONAL INFORMATION

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

1

Data subject must have given his/her CONSENT prior to the collection, or as soon as practicable or reasonable

2

The processing involves the personal information of a data subject who is a party to a contractual agreement, or in order to fulfil obligations under the contract or to take steps at the request of a data subject prior to entering the said agreement

3

The processing is necessary for compliance with a legal obligation to which the personal information controller is subject

4

The processing is necessary to protect vitally important interests of the data subject, including his/her life and health

8 of 64

RULE 5: LAWFUL PROCESSING of PERSONAL DATA

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

5

The processing of personal information is necessary for the fulfillment of the constitutional or statutory mandate of a public authority

6

The processing of personal information is necessary to respond to national emergency or to comply with the requirements of public order and safety, as prescribed by law

7

The processing is necessary to pursue the legitimate interests of the personal information controller, or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject, which require protection under the Philippine Constitution

9 of 64

RULE 5: PROCESSING SENSITIVE PERSONAL INFORMATION and PRIVILEGED INFORMATION

In general, the processing of SENSITIVE PERSONAL INFORMATION and PRIVILEDGED INFORMATION is PROHIBITED, EXCEPT in ANY of the following cases that will be tackled (next slide).

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

10 of 64

RULE 5: WHEN CAN I PROCESS SENSITIVE PERSONAL INFORMATION or PRIVILEDGED INFORMATION?

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

1

CONSENT is given by data subject, or by the parties to the exchange of privileged information, prior to the processing of the sensitive personal information or privileged information, which shall be undertaken pursuant to a declared, specified, and legitimate purpose.

2

The processing of the information is provided for by existing laws and regulations: Provided, that said laws and regulations DO NOT REQUIRE the consent of the data subject for the processing, and GUARANTEE THE PROTECTION of personal data

3

The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his/her consent prior to the processing

4

The processing is necessary for the purpose of medical treatment: Provided, that it is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal data is ensured

11 of 64

RULE 5: WHEN CAN I PROCESS SENSITIVE PERSONAL INFORMATION or PRIVILEDGED INFORMATION?

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

5

The processing concerns sensitive personal information or privileged information necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise, or defense of legal claims, or when provided to government or public authority pursuant to a constitutional or statutory mandate.

6

The processing is necessary to achieve the lawful and NON-COMMERCIAL objectives of public organizations and their associations provided that:

6.1

Processing is CONFINED and related to the bona fide members of these organizations or their associations

6.2

The sensitive personal info are NOT TRANSFERRED to third parties

6.3

CONSENT of the data subject was obtained PRIOR to the processing

12 of 64

The big “C”:�CONSENT

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

SOMETHING TO REMEMBER

13 of 64

RULE 5: EXTENSION OF PRIVILEDGED COMMUNICATION

Personal Information Controllers may invoke the principle of privileged communication over privileged information that they lawfully control or process.

Subject to existing laws and regulations, any evidence gathered from privileged information is INADMISSIBLE.

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

14 of 64

RULE 5: EXTENSION OF PRIVILEDGED COMMUNICATION

When the Commission (NPC) inquires upon communication claimed to be privileged, the personal information controller concerned shall prove the nature of the communication in an EXECUTIVE SESSION.

Should the communication be determined as privileged, it shall be excluded from evidence, and the contents thereof shall not form part of the records of the case–

​

Provided, that where the privileged communication itself is the subject of breach, or a privacy concern or investigation, it may be disclosed to the Commission but only to the extent necessary for the purpose of investigation WITHOUT including the contents thereof in the records.

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

15 of 64

RULE 5: Surveillance of Suspects and Interception of Recording of Communications

Section 7 of RA 9372 (Human Security Act of 2007) is HEREBY AMMENDED to include the condition that the processing of personal data for the purpose of surveillance, interception or recording of communications shall comply with the Data Privacy Act, including adherence to principles of transparency, proportionality, and legitimate purpose.

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

16 of 64

RULE 6: Security Measures for the Protection of Personal Data

Personal information controllers �and processors MUST:

implement reasonable and appropriate organizational, physical, and technical security measures for the protection of personal data.

​

Ex. Industry standard measures such as technical measures and cybersecurity policies.

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

17 of 64

RULE 6: Security Measures for the Protection of Personal Data

Personal information controllers �and processors MUST:

Take steps to ensure that any natural person acting under their authority and who has access to personal data, does NOT process them except upon their instructions, or as required by law.

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

18 of 64

RULE 6: Security Measures for the Protection of Personal Data

The security measures shall aim to maintain the availability, integrity and confidentiality of personal data and are intended for the protection of personal data against any accidental or unlawful destruction, alteration, and disclosure, as well as against any other unlawful processing.

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

19 of 64

NO! TO�NEGLIGENCE!�Negligence is a FAILURE TO TAKE REASONABLE CARE to avoid causing injury or loss to another person.

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

SOMETHING TO REMEMBER

20 of 64

RULE 6: SECURITY MEASURES! What must be done?

ORGANIZATIONAL SECURITY MEASURES

​

​

  1. COMPLIANCE OFFICERS

Designate (an) individual(s) who shall function as DATA PROTECTION OFFICER, COMPLIANCE OFFICER or otherwise be ACCOUNTABLE for ensuring compliance with applicable laws and regulations for the protection of data privacy and security.

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

21 of 64

RULE 6: SECURITY MEASURES! What must be done?

ORGANIZATIONAL SECURITY MEASURES

​

​

2. DATA PROTECTION POLICIES

IMPLEMENT appropriate data protection policies that provide for organization, physical, and technical security measures, and, for such purpose, take into account the nature, scope, context and purposes of the processing, as well as the risks posed to the rights and freedoms of data subjects.

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

22 of 64

RULE 6: SECURITY MEASURES! What must be done?

ORGANIZATIONAL SECURITY MEASURES

​

​

3. RECORDS OF PROCESSING ACTIVITIES

MAINTAIN RECORDS that SUFFICIENTLY DESCRIBE its DATA PROCESSING SYSTEM, and identify the duties and responsibilities of those individuals who will have access to personal data.

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

23 of 64

RULE 6: SECURITY MEASURES! What must be done?

ORGANIZATIONAL SECURITY MEASURES

​

​

RECORDS OF PROCESSING ACTIVITIES SHOULD INCLUDE:

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

1

Information about the PURPOSE of the PROCESSING of PERSONAL DATA, including any intended future processing or data sharing;

2

A description of all categories of data subjects, personal data, and recipients of such personal data that will be involved in the processing;

3

GENERAL INFORMATION about the data flow within the organization, from time of collection, processing, and retention, including the time limits for disposal or erasure of personal data;

4

A general description of the organizational, physical, and technical security measures in place;

5

The name and contact details of the personal information controller and, where applicable, the joint controller, its representative, and the compliance officer or Data protection Officer, or any individual accountable for ensuring compliance with the applicable laws and regulations.

24 of 64

RULE 6: SECURITY MEASURES! What must be done?

ORGANIZATIONAL SECURITY MEASURES

​

​

4. MANAGEMENT OF �HUMAN RESOURCES

BE RESPONSIBLE IN SELECTING and SUPERVISING its employees, agents or representatives, particularly those who will have access to personal data.

The said employees shall operate and hold personal data under STRICT CONFIDENTIALITY if the personal data is NOT intended for public disclosure.

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

25 of 64

RULE 6: SECURITY MEASURES! What must be done?

ORGANIZATIONAL SECURITY MEASURES

​

​

5. PROCESSING OF PERSONAL DATA

DEVELOP, IMPLEMENT and REVIEW:

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

1.

A procedure for collection of personal data, including procedures for obtaining consent, when applicable;

2.

Procedures that limit the processing of data, to ensure that it is only to the extent necessary for the declared, specified and legitimate purpose;

3.

Policies for access management, system monitoring, and protocols to follow during security incidents or technical problems;

4.

Policies and procedures for data subjects to exercise their rights under this act;

5.

Data retention schedule, including timeline or conditions for erasure or disposal of records

26 of 64

RULE 6: SECURITY MEASURES! What must be done?

ORGANIZATIONAL SECURITY MEASURES

​

​

6. CONTRACTS WITH PERSONAL INFORMATION PROCESSORS

The personal information controller, through appropriate contractual agreements, shall ensure that its personal information processors, where applicable, shall also implement the security measures required by this act and these rules.

​

It shall ONLY ENGAGE those personal information processors that provide sufficient guarantees to implement appropriate security measures specified in this act and rules and ensure protection of the rights of data subjects.

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

27 of 64

RULE 6: SECURITY MEASURES! What must be done?

PHYSICAL SECURITY MEASURES

​

​

  1. MONITOR ACCESS

Policies and procedures shall be implemented to MONITOR and LIMIT ACCESS to and activities in the room, workstation, or facility, including guidelines that specify the proper use of and access to electronic media;

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

28 of 64

RULE 6: SECURITY MEASURES! What must be done?

PHYSICAL SECURITY MEASURES

​

​

2. OFFICE SPACE ARRANGEMENT

Design of office space and work stations, including the physical arrangement of furniture and equipment, shall provide privacy to anyone processing personal data, taking into consideration the environment and accessibility to the public

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

29 of 64

RULE 6: SECURITY MEASURES! What must be done?

PHYSICAL SECURITY MEASURES

​

​

3. DUTIES and SCHEDULES

The duties, responsibilities and schedules of individuals in the processing of personal data shall be clearly defined to ensure that only the individuals actually performing official duties shall be in the room or work station at any given time.

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

30 of 64

RULE 6: SECURITY MEASURES! What must be done?

PHYSICAL SECURITY MEASURES

​

​

4. PROPER DISPOSAL OF E-MEDIA

Any natural or juridical person or other body involved in the processing of personal data shall implement Policies and procedures regarding the transfer, removal, disposal, and re-use of electronic media, to ensure appropriate protection of personal data;

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

31 of 64

RULE 6: SECURITY MEASURES! What must be done?

PHYSICAL SECURITY MEASURES

​

​

5. PREVENTING MECHANICAL DESTRUCTION of FILES and EQUIPMENT

Policies and procedures that prevent the mechanical destruction of files and equipment shall be established. The room and workstation used in the processing of personal data shall, as far as practicable, be secured against natural disasters, power disturbances, external access, and other similar threats.

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

32 of 64

RULE 6: SECURITY MEASURES! What must be done?

GUIDELINES for TECHNICAL SECURITY MEASURES

​

​

1. IMPLEMENT A SECURITY POLICY with respect to the processing of personal data.

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

33 of 64

RULE 6: SECURITY MEASURES! What must be done?

GUIDELINES for TECHNICAL SECURITY MEASURES

​

​

2. Have SAFEGUARDS to protect their computer network against accidental, unlawful or unauthorized usage, any interference which will affect data integrity or hinder the functioning or availability of the system, and unauthorized access through an electronic network;

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

34 of 64

RULE 6: SECURITY MEASURES! What must be done?

GUIDELINES for TECHNICAL SECURITY MEASURES

​

​

3. The ability to ensure and maintain the confidentiality, integrity, availability and resilience of their processing systems and services;

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

35 of 64

RULE 6: SECURITY MEASURES! What must be done?

GUIDELINES for TECHNICAL SECURITY MEASURES

​

​

4. REGULAR MONITORING for security breaches, and a process both for identifying and accessing reasonably foreseeable vulnerabilities in their computer networks, and for taking preventive, corrective, and mitigating action against security incidents that can lead to a personal data breach;

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

36 of 64

RULE 6: SECURITY MEASURES! What must be done?

GUIDELINES for TECHNICAL SECURITY MEASURES

​

​

5. The ability to RESTORE the AVAILABILITY and ACCESS to personal data in a timely manner in the event of a physical or technical incident;

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

37 of 64

RULE 6: SECURITY MEASURES! What must be done?

GUIDELINES for TECHNICAL SECURITY MEASURES

​

​

6. A process for regularly testing, assessing, and evaluating the effectiveness of security measures;

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

38 of 64

RULE 6: SECURITY MEASURES! What must be done?

GUIDELINES for TECHNICAL SECURITY MEASURES

​

​

7. ENCRYPTION of personal data during storage and while in transit, authentication process, and other technical security measures that CONTROL and LIMIT ACCESS.

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

39 of 64

RULE 7: SECURITY OF SENSITIVE PERSONAL INFORMATION in GOVERNMENT

RESPONSIBILITIES of HEADS OF AGENCIES

​

​

THE HEAD of EACH GOVERNMENT AGENCY or instrumentality shall be responsible for complying with the security requirements mentioned herein (IRR). �

The Commission (NPC) shall monitor government agency compliance and may recommend the necessary action in order to satisfy the MINIMUM STANDARDS.

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

40 of 64

RULE 7: SECURITY OF SENSITIVE PERSONAL INFORMATION in GOVERNMENT

​

SOURCE AGENCY

The source agency is the government agency who ORIGINALLY COLLECTED the data.

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

41 of 64

RULE 7: REQUIREMENTS RELATING TO ACCESS BY AGENCY PERSONNEL TO SENSITIVE PERSONAL INFORMATION

ON-SITE and ONLINE ACCESS

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

1

NO EMPLOYEE of the government shall have access to sensitive personal information on GOVERNMENT PROPERTY or through online facilities unless he/she received a security clearance from the head of the source agency.

2

A source agency shall strictly regulate access to sensitive personal information under its custody or control, particularly when it allows online access.

42 of 64

RULE 7: WHO CAN GET A SECURITY CLEARANCE?

An employee of the government shall only be granted a security clearance when the performance of his or her official functions or the provision of a public service directly depends on and cannot otherwise be performed unless access to personal data is allowed.

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

43 of 64

RULE 7: REQUIREMENTS RELATING TO ACCESS BY AGENCY PERSONNEL TO SENSITIVE PERSONAL INFORMATION

ON-SITE and ONLINE ACCESS

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

3

Where allowed under the next preceding sections, online access to sensitive personal information shall be subject to the following conditions:

1

An information technology governance framework has been designed and implemented;

2

Sufficient organizational, physical and technical security measures have been established;

3

The agency is capable of protecting sensitive personal information in accordance with the data privacy practices and standards recognized by the information and communications technology industry;

4

The employee of the government is only given online access to sensitive personal information necessary for the performance of official functions or the provision of a public service.

44 of 64

RULE 7: REQUIREMENTS RELATING TO ACCESS BY AGENCY PERSONNEL TO SENSITIVE PERSONAL INFORMATION

OFF-SITE ACCESS

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

1

Sensitive personal information maintained by any agency may NOT be transported or accessed from a location off or outside of government property, whether by its agent or employee, unless the head of agency has ensured the implementation of privacy policies and appropriate security measures. A request for such transportation or access shall be submitted to and approved by the head of the agency. The request must include proper accountability mechanisms in the processing of data.

45 of 64

RULE 7: REQUIREMENTS RELATING TO ACCESS BY AGENCY PERSONNEL TO SENSITIVE PERSONAL INFORMATION

OFF-SITE ACCESS

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

2

2.1

Deadline for Approval or Disapproval. The head of agency shall approve or disapprove the request within (2) business days after the date of submission of the request. Where no action is taken by the head of agency, the request is considered disapproved.

2.2

Limitation to (1000) records. Where a request is approved, the head of the agency shall limit the access to not more than (1000) records at a time, subject to the next succeeding paragraph.

2.3

Encryption. Any technology used to store, transport or access sensitive personal information for purposes of off-site access approved under this subsection shall be secured by the use of the most secure encryption standardized by the Commission.

46 of 64

RULE 7: IMPLEMENTATION of SECURITY REQUIREMENTS

THE REQUIREMENTS DISCUSSED in the previous slides SHALL BE IMPLEMENTED BEFORE ANY OFF-SITE or ONLINE ACCESS REQUEST IS APPROVED. Any data sharing agreement between a source agency and another government agency shall be subject to review of the Commission on its own initiative or upon complaint of data subject.

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

47 of 64

RULE 7: APPLICABILITY to GOV’T CONTRACTORS

In entering into any contract with a private service provider that may involve accessing or requiring sensitive personal information from 1000 or more individuals, a government agency shall require such service provider and its employees to register their personal data processing system with the Commission in accordance with the Act and these Rules.

​

The service provider, as personal information processor, shall comply with the other provisions of the Act and these Rules.

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

48 of 64

RULE 8: RIGHTS of the DATA SUBJECT

The Data Subject is entitled to the following rights. As Information Processors and Controllers, it is our obligation to know, respect, and let their rights be exercised accordingly.

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

49 of 64

RULE 8: RIGHT TO BE INFORMED

Data subject has the right to be informed whether personal data pertaining to him/her shall be, are being, or have been processed, including the existence of automated decision-making and profiling.

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

50 of 64

RULE 8: RIGHT TO BE INFORMED

Data subject shall be notified and FURNISHED with information indicated hereunder before the entry of his or her personal data into the processing system of the personal information controller, or at the next practical opportunity:

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

1

DESCRIPTION of the personal data to be entered into the system

2

PURPOSES for which they are being or will be processed, including processing for direct marketing, profiling or historical, statistical or scientific purpose;

3

BASIS OF PROCESSING, when processing is NOT based on the consent of the data subject;

4

SCOPE and METHOD of the personal processing;

5

The RECIPIENTS or classes of recipients to whom the personal data are or may be disclosed;

51 of 64

RULE 8: RIGHT TO BE INFORMED

Data subject shall be notified and FURNISHED with information indicated hereunder before the entry of his or her personal data into the processing system of the personal information controller, or at the next practical opportunity:

​

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

6

METHODS UTILIZED FOR AUTOMATED ACCESS, if the same is allowed by the data subject, and the extent to which such access is authorized, including meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject;

7

The IDENTITY and CONTACT DETAILS of the personal data controller or its representative

8

The PERIOD for which the information will be stored;

9

The EXISTENCE OF THEIR RIGHTS as data subjects, including right to access, correction, and object to processing, as well as right to lodge a complaint before the Commission.

52 of 64

RULE 8: RIGHT TO OBJECT

Data subject shall have the right to OBJECT to the processing of his/her personal data, including processing for direct marketing, automated processing or profiling.

​

Data subject will also be notified and given opportunity to withhold consent to the processing in case of changes or any amendment to the information supplied or declared to the data subject.

​

​

I OBJECT!!!

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

53 of 64

RULE 8: RIGHT TO OBJECT (EXCEPTIONS)

When a data subject objects or withholds consent, the personal information controller shall no longer process the personal data UNLESS:

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

1

The personal data is needed pursuant to a subpoena;

2

The collection and processing are for obvious purposes, including, when it is necessary for the performance of or in relation to a contract or service to which the data subject is a party, or when necessary or desirable in the context of an employer-employee relationship between the collector and the data subject;

3

The information being collected and processed as a result of legal obligation.

54 of 64

RULE 8: RIGHT TO ACCESS

The data subject has the right to reasonable access to, �upon demand, the following:

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

1

Contents of his or her personal data that were processed;

2

Sources from which the personal data were obtained;

3

Names and addresses of recipients of the personal data;

4

Manner by which such data were processed;

5

Reasons for the disclosure of the personal data to recipients, if any;

6

Information on automated processes where the data will, or is likely to, be made as the sole basis for any decision that significantly affects or will affect the data subject;

7

Date when his or her personal data concerning the data subject were last accessed and modified;

8

The designation, name or identity, and address of the personal information controller.

55 of 64

RULE 8: RIGHT TO RECTIFICATION

The data subject has the right to DISPUTE INACCURACY or ERROR in the personal data and have the personal information controller CORRECT IT IMMEDIATELY and ACCORDINGLY, unless the request is vexatious or otherwise unreasonable.

YOUR INFO OF ME IS WRONG!

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

56 of 64

RULE 8: RIGHT TO RECTIFICATION

If personal data has been corrected, the personal information controller shall ensure the accessibility of both new and the retracted information and the simultaneous receipt of the new and the retracted information by the intended recipients thereof:

Provided, that recipients or third parties who have previously received such processed personal data shall be informed of its inaccuracy and its rectification, upon reasonable request of the data subject.

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

57 of 64

RULE 8: RIGHT TO ERASURE or BLOCKING

The data subject shall have the right to suspend, withdraw or order the blocking, removal or destruction of his/her personal data from personal information controller’s filing system. This right may be exercised upon discovery and SUBSTANTIAL PROOF of ANY of the following:

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

1

Personal data is incomplete, outdated, false, or unlawfully obtained;

2

Personal data is being used for purpose NOT authorized by data subject;

3

Personal data is no longer necessary for the purposes for which they were collected;

4

Data subject withdraws consent or objects to the processing, and there is no other legal ground or overriding legitimate interest for the processing;

5

The personal data concerns private information that is prejudicial to data subject, unless justified by freedom of speech, of expression, or of the press or otherwise authorized;

6

The process is unlawful;

7

The personal information controller or personal information processor violated rights of the data subject.

58 of 64

RULE 8: RIGHT TO ERASURE or BLOCKING

The personal information controller may notify third parties who have previously received such processed personal information.

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

59 of 64

RULE 8: RIGHT TO DAMAGES

Data subject shall be INDEMNIFIED for any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal data, taking into account any violation of his/her rights and freedoms as data subject.

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

60 of 64

RULE 8: TRANSMISSIBILITY OF RIGHTS

The LAWFUL HEIRS and assigns of the data subject may invoke the rights of the data subject to which he/she is an heir or an assignee, at any time after the death of the data subject, or when the data subject is incapacitated or incapable of exercising his/her rights.

MY WIFE WILL DECIDE WHAT TO DO WITH MY INFO WHEN I’M NOT ABLE TO…

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

61 of 64

RULE 8: RIGHT TO DATA PORTABILITY

Where his/her personal data is processed by electronic means and in a structured and commonly used format, the data subject shall have the right to obtain from the personal information controller a copy of such data in an electronic or structured format that is commonly used and allows further use by the data subject.

​

The exercise of this right shall primarily take into account the right of the data subject to have control over his/her personal data being processed based on consent or contract, for commercial purpose, or through automated means.

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

The commission (NPC) may specify the electronic format referred to above, as well as the technical standards, modalities, procedures and other rules for their transfer.

62 of 64

RULE 8: LIMITATION on RIGHTS

The subject rights discussed shall NOT BE APPLICABLE if the processed personal data are used only for the needs of SCIENTIFIC and STATISTICAL RESEARCH and, on the basis of such, no activities are carried out and no decisions are taken regarding the data subject.

​

RULE I

RULE II

RULE III

RULE IV

RULE V

RULE VI

RULE VII

RULE VIII

RULE IX

RULE X

RULE XI

RULE XII

RULE XIII

RULE XIV

PROVIDED, that the personal data shall be held under STRICT CONFIDENTIALITY AND SHALL BE USED ONLY FOR THE DECLARED PURPOSE. The said sections are also NOT APPLICABLE to the processing of personal data gathered for the purpose of investigations in relation to any criminal, administrative or tax liabilities of a data subject.

63 of 64

END OF MODULE 2

For the continuation of this presentation, please check parts 1 and 3 of the “Implementing Rules and Regulations for Information Controllers and Processors”

​

​

​

downloadable for FREE in Layertech’s DOWNLOADS page.

www.layertechlab.com

​

​

MODULE 1

RULES 1-4

MODULE 3

RULES 9-14

64 of 64

THANK YOU VERY MUCH!

www. LAYERTECHLAB.com

​

Special thanks to PIXABAY.com for the CC0 images ☺

​

For comments, corrections and suggestions for the improvement of these presentations, �please contact us at learning@layertechlab.com

​

​