PhilippinesData Privacy Act of 2012, scope and exclusions
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- none
As of .
What it requires
- Do not treat information as outside the Act unless it falls within a Section 4 exclusion (government officer or employee information relating to the position or functions, contractor service information, discretionary financial benefits such as licenses and permits, journalistic, artistic, literary or research processing, information necessary for public authority functions, information banks need for Credit Information System Act and anti-money-laundering compliance, and personal information originally collected from residents of foreign jurisdictions under their own laws), and treat an exclusion as covering only the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function or activity concerned (Section 4; Rules, Rule II, Section 5).
- Where you rely on the research exclusion, show that the research is intended for a public benefit and that it meets the applicable laws, regulations or ethical standards (Rules, Rule II, Section 5(c)).
- Where you rely on an exclusion, keep upholding data subjects' rights and the general data privacy principles and lawful-processing requirements wherever they are not directly incompatible with the exclusion's purpose, and be ready to prove the exclusion applies, since the burden of proof falls on you (Rules, Rule II, Section 6(a) and (b)).
- Where you rely on the exclusion for personal information originally collected from residents of foreign jurisdictions, be ready to prove the law of the foreign jurisdiction under which it was collected (Rules, Rule II, Section 5(f)).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Logging duty
Section 4 of the Act and Sections 5 and 6 of Rule II of the Rules set no duty to keep a log or record. Section 6(b) of Rule II places the burden of proving that the Act does not apply on the party claiming the non-applicability, which is a rule of proof and not a recordkeeping duty.
- Kind
- None
- As of
What this law does
The Act applies to the processing of all types of personal information by any natural or juridical person, including a controller or processor not found or established in the Philippines that uses equipment located in the Philippines or maintains an office, branch or agency there.
Section 4 excludes seven kinds of information: information about a government officer or employee that relates to the position or functions; information about an individual performing service under contract for a government institution that relates to the services performed; information about a discretionary financial benefit such as a license or permit; personal information processed for journalistic, artistic, literary or research purposes; information necessary to carry out the functions of public authority; information that banks and other financial institutions under the central monetary authority need to comply with the Credit Information System Act and the Anti-Money Laundering Act; and personal information originally collected from residents of foreign jurisdictions under their own laws and processed in the Philippines.
The Implementing Rules and Regulations apply the exclusions only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function or activity concerned, and limit the research exclusion to research intended for a public benefit.
The Rules put the burden of proving that the Act does not apply on the party claiming the non-applicability, have the controller or processor keep upholding data subjects' rights and the general data privacy principles where they are not incompatible with the exclusion, and have any exemption read liberally in favor of the data subject.
When LexLint raises it
When your app profile says your app processes personal data.