Hrhrhjr

1. Prepared by:
Montero, Vanessa M.

2. WORD SEARCH

3. Fully titled, “An Act Protecting Individual Personal Information
in Information and Communications Systems in the
Government and the Private Sector, Creating for this Purpose
a National Privacy Commission, and for Other Purposes” the
DPA aims to protect the fundamental human right of privacy,
of communication while ensuring the free flow of information
to promote innovation and growth.
Republic Act 10173 – Data Privacy Act of 2012

4. CHAPTER I – GENERAL PROVISIONS
SECTION 1. Short Title.
SECTION 2. Declaration of Policy.
SECTION 3. Definition of Terms.
SECTION 4. Scope.
SECTION 5. Protection Afforded to Journalists and Their Sources.
SECTION 6. Extraterritorial Application.
CHAPTER II – THE NATIONAL PRIVACY COMMISSION
SECTION 7. Functions of the National Privacy Commission.
SECTION 8. Confidentiality.
SECTION 9. Organizational Structure of the Commission.
SECTION 10. The Secretariat.

5. CHAPTER III – PROCESSING OF PERSONAL INFORMATION
SECTION 11. General Data Privacy Principles.
SECTION 12. Criteria for Lawful Processing of Personal Information.
SECTION 13. Sensitive Personal Information and Privileged Information.
SECTION 14. Subcontract of Personal Information.
SECTION 15. Extension of Privileged Communication.
CHAPTER IV – RIGHTS OF THE DATA SUBJECT
SECTION 16. Rights of the Data Subject.
SECTION 17. Transmissibility of Rights of the Data Subjects.
SECTION 18. Right to Data Portability.
SECTION 19. Non-Applicability.
CHAPTER V – SECURITY OF PERSONAL INFORMATION
SECTION 20. Security of Personal Information.
CHAPTER VI – ACCOUNTABILITY FOR TRANSFER OF PERSONAL INFORMATION
SECTION 21. Principle of Accountability.
CHAPTER VII – SECURITY OF SENSITIVE PERSONAL INFORMATION IN GOVERNMENT
SECTION 22. Responsibility of Heads of Agencies.
SECTION 23. Requirements Relating to Access by Agency Personnel to Sensitive Personal Information.
SECTION 24. Applicability to Government Contractors.

6. CHAPTER VIII – PENALTIES
SECTION 25. Unauthorized Processing of Personal Information and
Sensitive Personal Information.
SECTION 26. Accessing Personal Information and Sensitive Personal
Information Due to Negligence.
SECTION 27. Improper Disposal of Personal Information and Sensitive
Personal Information.
SECTION 28. Processing of Personal Information and Sensitive
Personal Information for Unauthorized Purposes.
SECTION 29. Unauthorized Access or Intentional Breach.
SECTION 30. Concealment of Security Breaches Involving Sensitive
Personal Information.
SECTION 31. Malicious Disclosure.
SECTION 32. Unauthorized Disclosure.
SECTION 33. Combination or Series of Acts.
SECTION 34. Extent of Liability.
SECTION 35. Large-Scale.
SECTION 36. Offense Committed by Public Officer.
SECTION 37. Restitution.

7. CHAPTER IX – MISCELLANEOUS PROVISIONS
SECTION 38. Interpretation.
SECTION 39. Implementing Rules and Regulations (IRR).
SECTION 40. Reports and Information.
SECTION 41. Appropriations Clause.
SECTION 42. Transitory Provision.
SECTION 43. Separability Clause.
SECTION 44. Repealing Clause.
SECTION 45. Effectivity Clause.

9. National Privacy Commission NPC
independent body mandated to implement the DPA
Personal information controller PIC
a natural or juridical person, or any other body who controls
the processing of personal data
Personal information processor PIP
a natural or juridical person, or any other body to whom a PIC
may outsource or instruct the processing of personal data

10. PI refers to any information from which the identity of an individual
is apparent or can be reasonably and directly ascertained, or when put
together with other information would directly and certainly identify an
individual
CRITERIA FOR LAWFUL PROCESSING OF PI
• Consent
• Contract with the individual
• Vital interests/Life & health
• Legal obligation
• National emergency / public order & safety, as prescribed by law
• Constitutional or statutory mandate of a public authority
• Legitimate interests of the PIC or third parties

11. • Race • Ethnic origin
• Marital status • Age
• Color • Religious, philosophical or political affiliations
• Health, education, genetic or sexual life
• Proceeding for any offense committed or alleged to have been committed by an
individual
• Government-issued IDs
• Those established by an executive order or an act of Congress to be kept classified
CRITERIA FOR LAWFUL PROCESSING OF SPI
• Consent • Existing laws & regulations
• Life & health • Processing by non-stock, non-profit orgs
• Medical treatment • Lawful rights & interests in court proceedings/legal claims

15. STATEMENT OF PRIVACY COMMISSIONER JOHN HENRY NAGA
ON SELFIE VERIFICATION IN SIM CARD REGISTRATION
December 29, 2022 | 4:40 PM GMT+0800 Last Edit: December 29, 2022
In performing their responsibilities under the Subscriber Identity Module (SIM) Card
Registration Act, Public Telecommunications Entities (PTEs) are reminded of their obligation
to process our citizens’ personal data in accordance with the Data Privacy Act of 2012.
Thus, as an additional layer of protection against fraud and identity theft, the processing
involved in selfie verification should pass the general data privacy principles of transparency,
legitimate purpose, proportionality, and all other data privacy safeguards in the law.
Ensuring the privacy of our registrants is paramount to instilling trust in the full
implementation of the SIM Card Registration Act. This will be bolstered if PTEs can
guarantee that all the data in their possession are protected against misuse, unauthorized
processing, data breaches, and all other security incidents.
ATTY. JOHN HENRY D. NAGA
Privacy Commissioner

16. Malicious third parties may infiltrate data and documents
that you and your employees create, access, store, or share
across your organization. When third parties gain access to your
private information, you’re at risk of data loss, reputational
damage, and regulatory fines.
#1 Insufficient Data Privacy Plans
#2 Data Trading
#3 Location Tracking
#4 Dangers of Additional Devices
#5 Insufficient Standard Operating Procedures
#6 Data Hoarding

17. Data privacy issues can be addressed with various solutions, some of which we’ve already briefly explored.
These include:
Bolster data privacy plans – To protect your digital assets thoroughly, review your current procedures
and software, identify coverage gaps, and build a system that can scale as you create more data.
Monitor data trading – Prevent data trading by reducing the likelihood of third-party data access—
consider software-based solutions and internal procedures.
Disable location tracking – Disable location services on devices company-wide to prevent data leaks and
competitor access.
Reduce devices – Limit the number of devices that can access your data and restrict employee access to
company assets via personal devices.
Create sufficient SOPs – Determine the vulnerabilities in your internal procedures, create new SOPs, and
train your employees to follow them.
Avoid data hoarding – Perform regular purges of outdated digital documents, opting for hard copies in
secure storage when necessary.

18. Student privacy is not the most discussed topic on education boards and forums. Parents and students
themselves are taking action to protect their data and encourage all school communities to take this matter
more seriously.
While students are using school computers and networks for educational purposes, it can often leave their
data exposed to security risks. The educational system must include rules and regulations for proper
student data management. Avoiding personal data exploitation is essential in all school grades.
Digital devices and similar tools can enhance students’ experience during their educational journey.
However, the use of smart devices in classrooms and on school premises can have negative consequences.
While most teachers are concerned about students being distracted by phones and laptops, few think about
data privacy. Students are exposed to common security risks each time they log into school computers or
use the school’s public WiFi.

19. Principles for the Protection of Student Privacy
There are five crucial principles to improve student privacy protections in schools and allow parents to
control their children’s data. These principles include the following:
Transparency – According to this principle, parents must be notified if their child’s data is leaked or
exposed to any person or organization outside the school system. Each student data disclosure should be
properly labeled and announced.
No Commercial Uses – This principle ensures that the student’s data cannot be sold in any way or used
for marketing purposes. The students must not receive any advertising or targeted ads based on the data
revealed to the educational facility.
Security Protection – Educational facilities must implement security protocols to ensure full encryption
of all personal data as the minimum measure. These protection protocols must prioritize students’
personal data and passwords.
Parental Rights – The students’ parents must be allowed to see the school’s data collected from their
child. They also must have the right to delete it at any time or opt-out of further data collection.
Enforcement – Lastly, there should be laws that specify fines for schools and educational facilities that
fail to protect student’s data.