General Luna Road, Baguio City 2600

Telephone No.: (074) 442-3036

Website: www.ubaguio.edu
E-mail Address: ub@e.ubaguio.edu

REPUBLIC ACT 10173

DATA PRIVACY ACT OF 2012
SPECIAL PENAL LAWS

Submitted to:

Atty. Janice Santella-Tabago

Submitted by:

Khayad, Airam Keith

Olowan, Jovel

Papio, Angelica

Talla, Cecilia

April 28, 2025

 General Luna Road, Baguio City 2600
Telephone No.: (074) 442-3036
Website: www.ubaguio.edu
E-mail Address: ub@e.ubaguio.edu

Declaration of Policy ( Sec 2)

●​ Policy of the State to protect the fundamental human right of privacy, of

communication while ensuring free flow of information to promote innovation
and growth.

●​ The State recognizes the vital role of information and communications technology
in nation-building and its inherent obligation to ensure that personal information
in information and communications systems in the government and in the private
sector are secured and protected.

Definition of terms ( Sec 3)

1.​ Personal Information Controller (PIC)

●​ a person or organization who controls the collection, holding, processing

or use of personal information, including a person or organization who
instructs another person or organization to collect, hold, process, use,
transfer or disclose personal information on his or her behalf; or

●​ The individual, corporation, or body who decides what to do with data.

The PIC is NOT the employee, CIO, or data protection officer.

A.​ Who is not a personal information controller?

-​ Personal or organization who performs such functions as

instructed by another person or organization. (PIP)

-​ Those who process information for personal, family, or

household affairs.

2.​ Personal information processor (PIP)

●​ Any natural or juridical person qualified to act as such under this Act to
whom a personal information controller may outsource the processing of
personal data pertaining to a data subject; or

●​ One who processes data for a Personal Information Controller (PIC). By

definition, the PIP does not process information for the PIP’s own
purpose.

3.​ Consent
 General Luna Road, Baguio City 2600
Telephone No.: (074) 442-3036
Website: www.ubaguio.edu
E-mail Address: ub@e.ubaguio.edu

●​ Any freely given, specific, informed indication of will, whereby the data
subject agrees to the collection and processing of personal information
about and/or relating to him or her. Consent shall be evidenced by written,
electronic or recorded means. It may also be given on behalf of the data
subject by an agent specifically authorized by the data subject to do so; or

●​ Where the data subject agrees to the collection and processing of his
personal data. The agreement must inform:

➔​ Purpose, nature, and extent of processing;

➔​ Period of consent/instruction; and

➔​ Rights as a data subject

●​ Prior to collection and processing (or as soon as practicable and

reasonable)

●​ Time bound in relation to the declared, specified and legitimate purpose

●​ May be withdrawn

4.​ Breach

A security incident that:

1.​ Leads to unlawful or unauthorized processing of personal, sensitive, or

privileged information; and
2.​ Compromises the availability, integrity, or confidentiality of personal data.

Scope ( Sec 4)

1.​ Applicability

A.​ It applies to the processing of all types of personal information; and

B.​ It covers any natural and juridical person involved in personal information
processing.

2.​ Non-applicability

A.​ Information about government employees that relate to their positions or

functions:

➔​ Fact that individual is government employee;

➔​ Title, business address and telephone number;
➔​ Classification, salary range and responsibilities; and
➔​ Name of an individual in a document prepared in the course of
employment with the government.

B.​ Information included in a service contract with the government;

C.​ Information regarding license or permit given by the government;

 General Luna Road, Baguio City 2600
Telephone No.: (074) 442-3036
Website: www.ubaguio.edu
E-mail Address: ub@e.ubaguio.edu

D.​ Personal information processed for journalistic, artistic, literary, or

research purposes;

E.​ Information necessary for investigation by central monetary authority, law

enforcement, and regulatory agencies;

F.​ Freedom of the press.

➔​ Journalists may not be compelled to reveal the source of any news
report or information appearing in said publication (Section 5)

Extraterritorial Application ( Sec 6)

RA 10173 applies to acts done in and outside the Philippines if:

1.​ Data subject is a Philippine citizen or resident

2.​ Entity has a link or is processing personal information in the Philippines

3.​ Entity carries business in or data collection in the Philippines (Section 6)

PROCESSING OF PERSONAL INFORMATION (Sec 11-13)

A.​ Personal information must be the following:

➔​ Collected for specified and legitimate purposes only

➔​ Processed fairly and lawfully;

➔​ Data must be accurate, relevant, and updated when necessary. Inaccurate

data must be corrected, restricted, or deleted.

➔​ Adequate and not excessive in relation to the purposes for which they are
collected and processed;

➔​ Retained only for as long as necessary for the fulfillment of the purposes
for which the data was obtained or for the establishment, exercise or
defense of legal claims, or for legitimate business purposes, or as provided
by law; and

➔​ Kept in a form which permits identification of data subjects for no longer

than is necessary for the purposes for which the data were collected and
processed

-​ Provided, that personal information collected for other purposes

may lie processed for historical, statistical or scientific purposes,
and in cases laid down in law may be stored for longer periods.

●​ Provided, further, that adequate safeguards are guaranteed

by said laws authorizing their processing.
 General Luna Road, Baguio City 2600
Telephone No.: (074) 442-3036
Website: www.ubaguio.edu
E-mail Address: ub@e.ubaguio.edu

B.​ Criteria for Lawful Processing of Personal Information

Personal data processing is allowed only if:

1.​ Not forbidden by law; and

2.​ At least one (1) of these conditions applies:

A.​ There is consent on the part of data subject

B.​ The processing is necessary and related to the fulfillment of a

contract with the data subject or in order to take steps at the
request of the data subject prior to entering into a contract;

C.​ Necessary for legal compliance or obligation legal duty which the
personal information controller is subject

D.​ Protect vitally important interests of the data subject, including

life and health;

E.​ Processing is for Public Interest

F.​ Processing is for legitimate interest

-​ Exception: where such interests are overridden by
fundamental rights and freedoms of the data subject which
require protection under the Philippine Constitution.

C.​ Sensitive Personal Information and Privileged Information

Sensitive data (e.g., health, race, religion) cannot be processed unless:

➔​ Explicit consent was given by all the parties.

➔​ Required by law, provided that:

1.​ The law ensures protection of the sensitive/privileged
information; and
2.​ No consent is needed if the law explicitly permits processing
without the data subject's authorization.

➔​ Life/Health Emergency – If a person can’t consent.

➔​ Non-profit organizations for their legitimate activities, but only if:

1.​ Limited to members

2.​ No sharing outside the organization.
3.​ Consent must be given by each member

➔​ Medical Treatment – By doctors/hospitals with privacy protection.

➔​ Legal Claims – For court cases or legal rights.

 General Luna Road, Baguio City 2600
Telephone No.: (074) 442-3036
Website: www.ubaguio.edu
E-mail Address: ub@e.ubaguio.edu

Rights of the Subject (Sec 16)

●​ Right to Be Informed – Transparency in collection (e.g., privacy notice)

●​ Right to Access – Obtain a copy of personal data.

●​ Right to Correct – Rectify inaccuracies.

●​ Right to Erasure ("Right to Be Forgotten") – Request deletion if:

1.​ Data is no longer necessary.
2.​ Consent is withdrawn.

●​ Right to Object – Stop processing for marketing, research, or automated

decisions.

●​ Right to Data Portability – Transfer data to another service provider.

●​ Right to file a complaint.

Prohibited Acts

A.​ Unauthorized Processing of Personal Information and Sensitive Personal

Information ( Sec 25).
Elements.
1.​ The accused processed the information of the data subject
2.​ The information processed was personal information and sensitive
personal information
3.​ That the processing was done without the consent of the data subject, or
without being authorized under this act or any existing law. (JBD v. JI and
VW, CID Case No. 18-D-012, January 21, 2021)
B.​ Accessing Personal Information and Sensitive Personal Information Due to
Negligence. (Sec 26)

Elements:
1.​ Accused provided access to personal information
2.​ It is due to negligence
3.​ Access was unauthorized under the Data Privacy Act or any existing law

C.​ Improper Disposal of Personal Information and Sensitive Personal

Information. (Sec 27)
Acts prohibited:
1.​ Accused negligently dispose, discard or abandon the personal information
of an individual in an area accessible to the public
 General Luna Road, Baguio City 2600
Telephone No.: (074) 442-3036
Website: www.ubaguio.edu
E-mail Address: ub@e.ubaguio.edu

2.​ Placed the personal information of an individual in a container for trash

D.​ Processing of Personal Information and Sensitive Personal Information for
Unauthorized Purposes. (Sec 28)
Elements:
1.​ A person processed information of the data subject;
2.​ The information processed is classified as personal information or
sensitive personal information; and
3.​ The processing of personal information is for purposes not authorized by
the data subject, or otherwise authorized under this Act or under existing
laws. (In re: FLI Operating ABC Online Lending Application, NPC
19.910, December 17, 2020)

E.​ Unauthorized Access or Intentional Breach. (Sec 29)

Elements:
1.​ The data system stores personal or sensitive personal information;
2.​ The accused breaks into the system; and
3.​ The accused knowingly and unlawfully broke into the system in a manner
which violates data confidentiality and security of the same. (ACN v. DT,
NPC 18-109, 01 June 2021)

F.​ Concealment of Security Breaches Involving Sensitive Personal Information.

(SEC. 30)
Elements:
1.​ Accused after having knowledge of a security breach and of the obligation
to notify the National Privacy Commission
2.​ Either intentionally or by omission conceals the fact of such breach.

G.​ Malicious Disclosure. (SEC. 31)

Elements
1.​ The accused is a personal information controller or a personal information
processor or any of its officials, employees or agents:
2.​ The accused made a disclosure of information;
3.​ The information disclosed was unwarranted or false information;
4.​ The information relates to any personal information or sensitive personal
information:
5.​ The information [disclosed] was [relative to the personal or sensitive
personal information] obtained by the accused; and
 General Luna Road, Baguio City 2600
Telephone No.: (074) 442-3036
Website: www.ubaguio.edu
E-mail Address: ub@e.ubaguio.edu

6.​ The disclosure was made with malice or in bad faith. (ACN v. DT. NPC
18-109. 01 June 2021)

H.​ Unauthorized Disclosure (SEC. 32. )

Elements:

1.​ A PIC or PIP, or any of its employees or its agents disclosed to a third
party
2.​ Personal information not covered by Malicious Disclosure obtained by
such
3.​ Without the consent of the subject data.

Liabilities ( Art 34)

●​ Penalty imposed upon responsible officers who participated in, or who by their
gross negligence, allowed the commission of the crime.

●​ Aliens may be deported

●​ Juridical persons may have licenses revoked

●​ Public officers shall have perpetual or temporary absolute disqualification from

office.

Names Contribution

Khayad, Airam Actor, director, narrative report, edited the video, provided
the tripod

Papio, Angelica Actor, director, narrative report, edited the video, provided
the camera

Olowa, Jovel Actor, director

Talla, Cecilia Actor, director, script writer, provided the venue, edited the
video, provided the script viewer.