Philippine Data Privacy Law: What Business Owners Need To Know?

The Republic Act No. 10173, often known as the Data Privacy Act, is a Philippine law that aims to safeguard all types of information, whether private, sensitive, or personal. Both natural and legal persons engaged in processing information are intended to be included.

The right to be informed

Personal data is protected the same way as your personal property under the law. Therefore, unless otherwise permitted by law, it should never be collected, processed, or stored by any organization without your explicit consent. Information controllers typically request your consent via a consent form.

The right to access

According to the Data Privacy Act of 2012, you have the right to get a copy of any personal information about you that a company may keep on file in a computer database or manual filing system. It should be made available in a simple format and come with a thorough explanation written in everyday language.

The right to object

If your personal data is being processed with your consent or because it is in your best interest, you have the right to object. The PIC shall stop processing your data when you object to or withdraw your consent unless the processing is necessary to comply with a court order, is essential for obvious reasons (such as a contract or an employer-employee relationship), or is required by law.

The right to erasure or blocking

Under the law, you have the right to suspend, withdraw or order the blocking, removal or destruction of your data.

The right to damages

If your rights and freedoms as a data subject have been violated by using personal data that was inaccurate, incomplete, out-of-date, false, illegally obtained, or unauthorized, you may be entitled to compensation.

The right to file a complaint with the National Privacy Commission

You have the right to complain to the NPC if you believe that your personal information has been mishandled, maliciously disclosed, or inappropriately disposed of or that any of your data privacy rights have been infringed.

What does this mean for business owners?

Business owners must be careful about how and where they process their personal information. They should not make it a habit of retaining and sharing such data with third parties unless they have provided your explicit consent. 

This means that you should pay attention to the terms and conditions before uploading your personal information or browsing a site. Be sure to read them thoroughly. The fact is, many businesses will require you to assign certain rights to them if you wish to upload or use certain information on their sites or mobile apps. 

For more information, read this blog. It contains the general provisions to penalties in the Act.