Republic

 Act    10173  
also  known  as    
“The  DATA  PRIVACY  ACT  
of  2012”  
 DATA  PRIVACY  ACT    
*An  act  protecting  individual  
personal  information  in  
information  and  communications  
systems  in  the  government  and  
the  private  sector,  creating  for    
this  purpose  a  national  privacy  
commission,  and  for  other  
purposes  
 Declara-on  of  Policy  
•  It  is  the  policy  of  the  State  to  
protect  the  fundamental  
human  right  of  privacy,  of  
communica-on  while  ensuring  
free  flow  of  informa-on  to  
promote  innova-on  and  
growth.    
 • The  State  recognizes  the  vital    
role  of  informa-on  and  
communica-ons  technology  in  
na-on-­‐building  and  its  inherent  
obliga-on  to  ensure  that  personal  
informa-on  in  informa-on  and  
communica-ons  systems  in  the  
government  and  in  the  private  
sector  are  secured  and  protected.  
• There  are  9  chapters  in  the  DPA  
• It  is  a  consolida-on  of  Senate  Bill  
No.  2965  and  House  Bill  No.  4115  
was  finally  passed  by  the  Senate  
and  the  House  of  Representa-ves  
on  June  6,  2012.  
 

     Approved:  AUG  15  2012  

 
 • Approved  by:  

FELICIANO  BELMONTE  JR.    

Speaker  of  the  House  of  Representa1ves  
 

JUAN  PONCE  ENRILE    

President  of  the  Senate  
 MARILYN  B.  BARUA-­‐YAP    
 Secretary  General  House  of  Representa1ves  
 

EMMA  LIRIO-­‐REYES    
Secretary  of  the  Senate  

 BENIGNO  S.  AQUINO  III    

   President  of  the  Philippines  
 SCOPE  
Applies  to  the  processing  of  all  types  of  
personal  informa-on  and  to  any  natural  
and  juridical  person  involved  in  
personal  informa-on  processing  
including  those  personal  informa-on  
controllers  and  processors  who,  
although  not  found  or  established  in  
the  Philippines,    
• This  ACT  Does  Not  Apply    
         to  the  following:  
1.    Informa-on  about  any  
individual  who  is  or  was  an  officer  
or  employee  of  a  government  
ins-tu-on  that  relates  to  the  
posi-on  or  func-ons  of  the  
individual,  including:  
-­‐ The  fact  that  the  individual  is  or  
was  an  officer  or  employee  of  
the  government  ins-tu-on.  
     -­‐    The  -tle,  business  address  
and  office  telephone  number  of  
the  individual.  
-­‐ The  classifica-on,  salary  range  and  
responsibili-es  of  the  posi-on  held  
by  the  individual  
 -­‐    The  name  of  the  individual  on  a  
document  prepared  by  the  individual  
in  the  course  of  employment  with  the  
government;  
2.    Informa-on  about  an  individual  
who  is  or  was  performing  service  
under  contract  for  a  government  
ins-tu-on  that  relates  to  the  
services  performed,  including  the  
terms  of  the  contract,  and  the  
name  of  the  individual  given  in  the  
course  of  the  performance  of  
those  services  
3.    Informa-on  rela-ng  to  any  
discre-onary  benefit  of  a  financial  
nature  such  as  the  gran-ng  of  a  
license  or  permit  given  by  the  
government  to  an  individual,  
including  the  name  of  the  
individual  and  the  exact  nature  of  
the  benefit  
 
4.    Personal  informa-on  
processed  for  journalis-c,  
ar-s-c,  literary  or  research  
purposes.  
5.    Informa-on  necessary  in  order  
to  carry  out  the  func-ons  of  public  
authority  which  includes  the  
processing  of  personal  data  for  the  
performance  by  the  independent,  
central  monetary  authority  and  law  
enforcement  and  regulatory  
agencies  of  their  cons-tu-onally  
and  statutorily  mandated  func-ons.    
6.      Informa-on  necessary  for  
banks  and  other  financial  
ins-tu-ons  under  the  
jurisdic-on  of  the  independent,  
central  monetary  authority  or  
Bangko  Sentral  ng  Pilipinas  to  
comply  with  the  An--­‐Money  
Laundering  Act  and  other  
applicable  laws  
7.      Personal  informa-on  
originally  collected  from  
residents  of  foreign  jurisdic-ons  
in  accordance  with  the  laws  of  
those  foreign  jurisdic-ons,  
including  any  applicable  data  
privacy  laws,  which  is  being  
processed  in  the  Philippines.  
 
Processing  of  Personal  Informa-on  
-­‐ Must  be  collected  for  specified  and  
legi-mate  purposes  
-­‐ Processed  fairly  and  lawfully  
-­‐ Accurate,  Relevant  and  where  necessary,  
up  to  date  
-­‐ Adequate  and  not  excessive  
-­‐ Retained  only  for  as  long  as  necessary  
 Criteria  for  Lawful  Processing  
• The  data  subject  has  given  his/
her  consent  
• Necessary  
• DATA  SUBJECT  
 –    Individual  whose  personal  
informa-on  is  processed  
 Rights  of  the  Data  Subject  
• Be  informed  whether  personal  
informa-on  pertaining  to  him  or  her  
shall  be,  are  being  or  have  been  
processed;  
• Be  furnished  the  informa-on  indicated  
hereunder  before  the  entry  of  his  or  her  
personal  informa-on  
 SECURITY  of  PERSONAL  INFORMATION  
• The  personal  informa-on  controller  
must  implement  reasonable  and  
appropriate  organiza-onal,  physical  
and  technical  measures  intended  for  
the  protec-on  of  personal  informa-on  
against  any  accidental  or  unlawful  
destruc-on,  altera-on  and  disclosure,  
as  well  as  against  any  other  unlawful  
processing.  
• Personal  informa1on  controller-­‐    
refers  to  a  person  or  organiza-on  who  
controls  the  collec-on,  holding,  
processing  or  use  of  personal  
informa-on,  including  a  person  or  
organiza-on  who  instructs  another  
person  or  organiza-on  to  collect,  hold,  
process,  use,  transfer  or  disclose  
personal  informa-on  on  his  or  her  
behalf.    
•  The  personal  informa-on  controller  
shall  implement  reasonable  and  
appropriate  measures  to  protect  
personal  informa-on  against  natural  
dangers  such  as  accidental  loss  or  
destruc-on,  and  human  dangers  
such  as  unlawful  access,  fraudulent  
misuse,  unlawful  destruc-on,  
altera-on  and  contamina-on.  
  
ACCOUNTABILITY  FOR  TRANSFER  OF  
PERSONAL  INFORMATION  
 
•  Each  personal  informa-on   controller  
is  responsible  for  personal  
informa-on  under  its  control  or  
custody,  including  informa-on  that  
have  been  transferred  to  a  third  
party  for  processing,  whether  
domes-cally  or  interna-onally,  
subject  to  cross-­‐border  arrangement  
and  coopera-on.  
 PENALTIES  
 
• Unauthorized  Processing  of  
Personal  Informa1on  and  Sensi1ve  
Personal  Informa1on.  –  (a)  shall  be  
penalized  by  imprisonment  from  
one  1-­‐3  years  and  a  fine  of  not  less  
than  (Php500,000.00  but  not  more  
than  Php2,000,000.00  
 The  unauthorized  processing  of  
personal  sensi-ve  informa-on    
-­‐    shall  be  penalized  by  
imprisonment  ranging  from    3-­‐6    
years  and  a  fine  of  not  less  than  
Php500,000.00  but  not  more  
than  Four  million  pesos  
 Accessing  Personal  Informa1on  
and  Sensi1ve  Personal  
Informa1on  Due  to  Negligence  
 –    imprisonment  ranging  from  
one  1-­‐3  years  and  a  fine  of  not  
less  than  5  hundred  thousand  
pesos  but  not  more  than  2  million  
pesos  
 Improper  Disposal  of  Personal  
Informa1on  and  Sensi1ve    
Personal  Informa1on    
-­‐      imprisonment  ranging  from  6  
months  to  2  years  and  a  fine  of  
not  less  than  One  hundred  
thousand  pesos  but  not  more  than  
Five  hundred  thousand  pesos  
 Processing  of  Personal  InformaSon  
and  SensiSve  Personal  InformaSon  
for  Unauthorized  Purposes  
•  –  imprisonment  from  1  year  and    
6  months  to  5  years  and  a  fine  of  not  
less  than  Five  hundred  thousand  
pesos  but  not  more  than  One  million  
pesos  
 Unauthorized  Access  or  
Inten1onal  Breach    
–  Penalty  of  imprisonment    
from  1  to  3  years  and  a  fine  of  
not  less  than  5  hundred  
thousand  pesos  but  not  more  
than  2  million  pesos  
 Malicious  Disclosure.    
 

 –  imprisonment  ranging  from  

1and  6  months  to  5  years  and  a  
fine  of  not  less  than  Five  
hundred  thousand  but  not  more  
than  One  million  pesos  
 Unauthorized  Disclosure  
 –  imprisonment  ranging  from  1  
to  3  years  and  a  fine  of  not  less  
than  Five  hundred  thousand  
pesos  but  not  more  than  One  
million  pesos  
 Extent  of  Liability    
• –  If  the  offender  is  a  corpora-on,  
partnership  or  any  juridical  person,  
the  penalty  shall  be  imposed  upon  
the  responsible  officers,  as  the  case  
may  be,  who  par-cipated  in,  or  by  
their  gross  negligence,  allowed  the  
commission  of  the  crime.  
•  If  the  offender  is  a  juridical  
person,  the  court  may  
suspend  or  revoke  any  of  
its  rights  under  this  Act.    
• If  the  offender  is  an  alien,  he  or  
she  shall,  in  addi-on  to  the  
penal-es  herein  prescribed,  be  
deported  without  further  
proceedings  afer  serving  the  
penal-es  prescribed.  
•  If  the  offender  is  a  public  official  or  
employee  and  lie  or  she  is  found  
guilty  of  acts  penalized  under  
Sec-ons  27  and  28  of  this  Act,  he  or  
she  shall,  in  addi-on  to  the  penal-es  
prescribed  herein,  suffer  perpetual  
or  temporary  absolute  
disqualifica-on  from  office,  as  the  
case  may  be.  
  Offense  CommiIed  by  Public  Officer  
–  When  the  offender  is  a  public  officer  
as  defined  in  the  Administra-ve  Code  of  
the  Philippines  in  the  exercise  of  his  or  
her  du-es,  an  accessory  penalty  
consis-ng  in  the  disqualifica-on  to  
occupy  public  office  for  a  term  double  
the  term  of  criminal  penalty  imposed  
shall  he  applied.