Category Archive: Public Advisory

• Reminder on Sharing Photos and Videos Containing Personal Data

  January 11, 2024 2:27 pm Comments Off on Reminder on Sharing Photos and Videos Containing Personal Data

  The National Privacy Commission (NPC) reminds the public of the responsible sharing of photos and videos containing personal data.

  Under the Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), the processing or sharing of photos and videos containing personal information must have a lawful basis and must adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality. Unlawful processing of personal data is a violation of the DPA with corresponding administrative fines and criminal penalties as may be applicable.

  Sharing of photos and videos containing personal data on social media platforms, especially with sensitive personal information, can be exploited by malicious actors for identity theft, fraud, or other illegal activities. Furthermore, sharing sensitive content online may expose individuals to cyberbullying, harassment, or stalking.

  In this regard, the NPC emphasizes the importance of respecting data subject rights, most especially in social media platforms. As individuals engage online, they must exercise caution and be responsible in safeguarding their own and other people’s data privacy rights.

  The NPC, in its commitment to uphold the principles of the DPA, will be relentless in enforcing the law to ensure the protection of every Filipino’s data subject rights. Likewise, it is important for all individuals to adhere to the provisions of the DPA and exercise utmost diligence in sharing and reposting content on social media.

  For more information, visit our official website at www.privacy.gov.ph.

  ###

• NPC PUBLIC ADVISORY: MANDATORY DISPLAY OF THE NPC SEAL OF REGISTRATION

  November 13, 2023 8:49 pm Comments Off on NPC PUBLIC ADVISORY: MANDATORY DISPLAY OF THE NPC SEAL OF REGISTRATION

  The National Privacy Commission (NPC), in accordance with its mandate of ensuring compliance among its stakeholders, places paramount importance on safeguarding individuals' privacy and data protection rights. In line with this commitment, the NPC issues this Advisory to underscore the significance of prominently displaying the NPC Seal of Registration at your respective places of business and online platforms.

  1. Physical Presence:

  All Personal Information Controllers (PICs) and Personal Information Processors (PIPs) are required to prominently display the NPC Seal of Registration at the main entrance of your place of business, office, or at the most conspicuous place to ensure visibility to all data subjects. This emblem should be positioned in a manner that is easily noticeable to all data subjects visiting your premises. Additionally, the NPC Seal of Registration must also be posted within all your offices, including branches, sub-branches, and satellite offices where personal data processing occurs. This is especially vital for locations involved in daily interactions with data subjects.

  2. Online Presence:

  For those PICs and PIPs with an online presence, it is imperative that the NPC Seal of Registration be made visible to website visitors. You can achieve this by either embedding it as a link within your Privacy Notice or prominently displaying it on your webpage.

  The NPC is committed to ensuring strict compliance with these requirements and will not hesitate to enforce penalties and fines on organizations found in violation. We emphasize the crucial importance of adhering to these guidelines for the protection of individuals’ privacy rights. Failure to comply with this mandate will reslit in the following sanctions and penalties:

  1. Revocation of the Certificate of Registration under Section 35(A) of NPC Circular No. 2022-04 (Registration of Personal Data Processing System, Notification Regarding Automated Decision-making or Profiling, Designation of Data Protection Officer, and the Nation Privacy Commission Seal of Registration) for non-compliance with NPC's directives;
  2. Liability to pay Administrative Fines for non-compliance under Section 37 of NPC Circular No. 2022-04, as well as NPC Circular No. 2022-01 (Guidelines on Administrative Fines) for other infractions; and/or
  3. Issuance of a Cease and Desist Order from processing personal data under Section 38 of NPC Circular No. 2022-04.

  For more detailed information, please refer to NPC Circular No. 2022-04, accessible through this link. Should you have any inquiries or require further assistance, please do not hesitate to contact our Compliance and Monitoring Division (CMD) through [email protected].

  The NPC appreciates your cooperation in upholding the highest standards of data privacy and protection.

  ###

• NPC PUBLIC ADVISORY: REMINDER TO ALL DATA SUBJECTS REGARDING THE PROHIBITED PRACTICE OF REGISTERING SIM CARDS FOR THE PURPOSE OF SALE AND STEPS TO ENSURE PERSONAL DATA PROTECTION

  August 31, 2023 11:45 am Comments Off on NPC PUBLIC ADVISORY: REMINDER TO ALL DATA SUBJECTS REGARDING THE PROHIBITED PRACTICE OF REGISTERING SIM CARDS FOR THE PURPOSE OF SALE AND STEPS TO ENSURE PERSONAL DATA PROTECTION

  The National Privacy Commission (NPC), as the sole data privacy authority of the country
  mandated to enforce the provisions of the Data Privacy Act of 2012, reminds all concerned
  data subjects about the serious ramifications associated with registering Subscriber Identity
  Module (SIM) cards for the primary intention of selling them.

  Recent developments have drawn our attention to alarming instances wherein certain
  individuals, ostensibly acting as agents of malevolent entities, are enticing unsuspecting
  individuals with monetary offers (averaging Php1,000.00) in exchange for SIM cards that have
  been registered. This practice is not only prohibited under the SIM Registration Act (RA No.
  11934) but it also places data subjects in a vulnerable position, exposing them to potential legal
  repercussions, risks and harms if a SIM card, registered in their name, is misused for illicit
  activities.

  To this end, the NPC issues this public advisory on how to protect yourself as a subscriber
  and data subject by considering these steps:

  1. Awareness: Educate yourself about the legal and privacy implications of registering
     and selling SIM cards. Familiarize yourself with the Data Privacy Act of 2012 and its
     provisions.
  2. Vigilance: Be cautious of unsolicited offers to purchase your registered SIM card.
     Scrutinize the intentions behind such offers and verify the credibility of the individuals
     making them.
  3. Report Suspicious Activities: If you are approached with offers to sell your registered
     SIM card, report such incidents to your telecommunications service provider. Timely
     reporting can help prevent potential misuse of your personal data.
  4. Reporting Change of Information with the Telecommunications Companies
     (Telcos): Promptly report any changes in the information of the subscriber (end-user)
     so that the telcos can update their database in accordance with the SIM Registration
     Act.
  5. Identity Verification: Before transferring ownership of a SIM card, ensure that proper
     identity verification procedures are followed. This can help prevent unauthorized
     transfers
  6. Legal Compliance: If you decide to sell or transfer a registered SIM card, adhere to the
     legal requirements for reporting such transactions as required under the SIM
     Registration Act.

  Pursuant to the provisions of the SIM Registration Act, severe penalties shall be imposed upon
  those involved in the sale or transfer of a registered SIM without complying with required
  registration or without properly informing the telco concerned. More specifically, under
  Section 11 (g) of the SIM Registration Act, individuals found guilty of selling or transferring a
  registered SIM card without complying with the required registration under Section 6 of the
  same law may be subject to imprisonment ranging from six (6) months to six (6) years, or a
  fine of One hundred thousand pesos (₱100,000.00) to Three hundred thousand pesos
  (₱300,000.00), or both.

  The NPC earnestly urges all data subjects to take heed of this advisory and to remain vigilant
  against participating in any actions that may put at risk their personal data. The NPC remains
  committed to safeguarding the data privacy rights of every Filipino citizen, and we stand
  ready to take appropriate action against those who disregard and violate the Data Privacy Act
  of 2012 and related issuances.