DATA PRIVACY ACT OF 2012 •The law creating the DICT, REPUBLIC ACT NO.

10844 or
WHAT IS THE DATA PRIVACY ACT OF 2012 (DPA)?
•REPUBLIC ACT NO. 10173: This act shall be known as
the “Data Privacy Act of 2012”.
“An Act Creating the Department of Information and
Communications Technology”, was signed on May 20,
2016 under the administration of Pres. Benigno Aquino
III.

•LONG TITLE: “An act protecting individual personal •Secretaries of DICT:

information in information and communications
Gregorio Honasan –July 1, 2019-present
systems in the government and the private sector,
creating for this purpose a National Privacy Eliseo M. Rio, Jr. –Oct. 12, 2017-July 1, 2019 (OIC)
Commission, and for other purposes.”
Rodolfo A. Salalima–June 30, 2016-Sept. 22, 2017
•Approved on Aug. 15, 2012

NATIONAL PRIVACY COMMISSION

PHILIPPINE DATA PRIVACY ACT OF 2012
•Provides that consent must be documented and given
prior to the collection of all forms of personal data and
the collection must be declared, specified and used for
legitimate purpose.
•The subject must be notified about the purpose and
extent of data processing, with details specifying the
need for automated processing, profiling and
marketing, or sharing.
•The commission exists to ensure compliance of the
country with international standards set for data
protection.
•The commission is the government’s arm to make sure
that we, the citizens, remain in full control of our
personal information in this digital age.
•The commission safeguard our rights as a data subject
while ensuring the free flow of information for
innovation, growth and national development.

BACKGROUND:
CURRENT COMMISSIONERS
•Total IT spending reached $4.4 billion in 2016 and
expected to more than double in 2020.

•Filipinos are heavy social media users (42.1M-FB; 13M-

Twitter)

•Philippines is in the process of enabling free public

wifi.

•FB users reached 30 M in 2013 to 67 M in 2017

RESPONSIBLE AGENCIES

DEPARTMENT OF INFORMATION AND

COMMUNICATIONS TECHNOLOGY (DICT)

• The executive department of the Philippine

government responsible for the planning, development
and promotion of the country's information and
communications technology agenda in support of
national development.
PROVISION OF THE DPA
CHAPTER 1: General Provisions
CHAPTER II: The National Privacy Commission
CHAPTER III: Processing of Personal Information
CHAPTER IV: Rights of the Data Subject
CHAPTER V: Security of Personal Information
CHAPTER VI: Accountability for Transfer of Personal
Information
CHAPTER VII: Security of Sensitive Personal
Information in Government
CHAPTER VIII: Penalties
CHAPTER IX: Miscellaneous Provisions
SCOPE
•DATA PROCESSING –any operation or any set of
operations performed upon personal information
including, but not limited to, the collection, recording,
organization, storage, updating or modification,
retrieval, consultation, use, consolidation, blocking,
erasure or destruction of data
•PERSONAL INFORMATION -any information whether
recorded in a material form or not, from which the
identity of an individual is apparent or can be
reasonably and directly ascertained by the entity
holding the information, or when put together with
other information would directly and certainly identify
an individual.
•INFORMATION AND COMMUNICATIONS SYSTEMS -a
system for generating, sending, receiving, storing or
otherwise processing electronic data messages or
electronic documents and includes the computer
system or other similar device by or which data is
recorded, transmitted or stored and any procedure
related to the recording, transmission or storage of
electronic data, electronic message, or electronic
document.
•DATA SUBJECT –an individual whose personal
information is processed
•Applies to the processing of all types of personal
information and to any entity involved in personal
information processing including those personal
information controllers and processors who, although
not found or established in the Philippines, use
equipment that are located in the Philippines, or those
who maintain an office, branch or agency in the
Philippines
•Applies even to acts done outside the Philippines if
they relate to personal information about a Philippine
citizen or resident Alien and if the doer of the act has a
recognized link in the Philippines.
FUNCTIONS OF THE NATIONAL PRIVACY COMMISSION
•Ensure compliance of personal information controllers
with the provisions of this Act.
•Receive complaints, institute investigations, facilitate
or enable settlement of complaints.
•Isssue cease and desist orders, impose a temporary or
permanent ban on the processing of personal
information.
•Compel or petition any entity, government agency or
instrumentality to abide by its orders or take action on a
matter affecting data privacy.
•Monitor the compliance of other government agencies
on their security and technical measures.
•Coordinate with other government agencies and the
private sector to formulate and implement plans and
policies.
•Publish on a regular basis a guide to all laws relating to
data protection.
•Publish a compilation of agency system of records and
notices, including index and other finding aids.
•Recommend to DOJ the prosecution and imposition of
penalties specified in Section 25 to 29 of this Act.
•Review, approve, reject or require modification of
privacy codes
•Provide assistance relating to privacy or data
protection
•Issue advisory opinions and interpret the provisions of
this Act.
•Propose legislation, amendments or modifications to
Philippine laws on privacy or data protection
•Ensure proper and effective coordination with data
privacy regulators in other countries
•Negotiate and contract with other data privacy
authorities of other countries
•Assist Philippine companies doing business abroad to
respond to foreign privacy or data protection laws and
regulations
CHAPTER III: PROCESSING OF PERSONAL
INFORMATION
•GENERAL DATA PRIVACY PRINCIPLES: the processing of
personal information shall be allowed, subject to
compliance with the requirements of this Act and other
laws allowing disclosure of information.
•PERSONAL INFORMATION must be:
 Collected for specified and legitimate purposes
 Processed fairly and lawfully
 Accurate and relevant
 Adequate and not excessive
 Retained only for as long as necessary for the
fulfillment of the purposes
 Kept in a form which permits identification of
data subjects
CHAPTER IV: RIGHTS OF THE DATA SUBJECT
•Right to be informed
•Right to access
•Right to object
•Right to erasure or blocking
•Right to rectify
•Right to data portability
•Right to file a complaint
•Right to damages
CHAPTER V: SECURITY OF PERSONAL INFORMATION
•The personal information controller must implement
reasonable and appropriate organizational, physical and
technical measures intended for the protection of
personal information against any accidental or unlawful
destruction, alteration and disclosure, natural dangers
such as accidental loss or destruction and human
dangers such as unlawful access and fraudulent misuse.
CHAPTER VI: ACCOUNTABILITY FOR
TRANSFER OF PERSONAL INFORMATION
• PRINCIPLE OF ACCOUNTABILITY: Each personal
information controller is responsible for personal
information under its control or custody, including
information that have been transferred to a third party
for processing, whether domestically or internationally,
subject to cross-border arrangement and cooperation.
CHAPTER VII: SECURITY OF SENSITIVE PERSONAL
INFORMATION IN THE GOVERNMENT
• Heads of agencies are made primarily responsible for
compliance with the security requirements set by the
Data Privacy Act
• The NPC has the authority to monitor compliance and
recommend to the agency the necessary action to
comply with the minimum standards.
• Sensitive personal information with the government is
required to be maintained as strictly CONFIDENTIAL and
only for those authorized to access them.
• SECURITY CLEARANCE is required before a
government employee may be able to access these
sensitive personal information.
• Transportation or access of off-site personal
information with the government requires an approved
request by the head of agency (1,000 records at a time)
• Government contractors and employees are required
to register their personal information processing system
with the Commission.
CHAPTER VIII: PENALTIES Laboratory Requisition Flow

Requisition: any form of formal order requesting any

equipment or services

GENERAL WORK FLOW

Receipt of Request from a Laboratory

Laboratory

o Check the correctness and

completeness of the information
o Fasting time
o Time variation

Encoding Patient Information

In-patient Out-patient
 Admitted  Walk-in
 Nurse station  Laboratory
 Doctor’s office
 OPD
 ER

Production of Statement of Account

CHAPTER IX: MISCELLANEOUS PROVISIONS

•IRR was put into effect on September 9, 2016, o In-patient – SOA are for filing
mandating all companies to comply o Out-patient – for charging/billing
•The Commission shall annually report to the President
and Congress on its activities

Collection of Specimen

o Medical Technologist
o Nurse
o Doctor
 Laboratory Result Form

1. Patient Information
 Complete Name
Create/Produce specimen bar codes  Age
or unique control number  Sex
(automation)
2. Specimen Information
 Specimen type

3. Date and Time of Request and Specimen

Encode specimen and patient Received (Turn around time = <30 minutes)
information
4. Date and Time of release of result (<1hr)

5. Laboratory Name/ Diagnostic Center

Passing of the sectionalized request 6. Corresponding results

form or specimen to the different lab
section 7. Normal values/ Reference Ranges

8. Signatures
Laboratory Request Form
 Chief MedTech
1. Patient Information  MedTech
a. Complete name  Pathologist
b. Age
c. Birthday
d. Sex
e. Diagnosis
f. Other patient info

2. Specimen Information
a. Specimen type
b. Date and time of collection
c. Special considerations (Time variation,
Fasting time)

3. Physician’s Information
a. Physician’s name
b. Physician’s signature
c. Address
d. Contact number

4. Laboratory Request(s)
5. Signatures
 Phlebotomist
 Physician