Data Privacy Act (R.A.

10173)

STATE POLICY
 to protect the fundamental human right of privacy, of communication while ensuring free flow of
information to promote innovation and growth

 The State recognizes the vital role of information and communications technology in nation-building
and its inherent obligation to ensure that personal information in information and communications
systems in the government and in the private sector are secured and protected.

DEFINITION OF TERMS

a. Consent of the data subject

 any freely given, specific, informed indication of will, whereby the data subject agrees to the
collection and processing of personal information about and/or relating to him or her

 Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf
of the data subject by an agent specifically authorized by the data subject to do so.

b. Data subject
 an individual whose personal information is processed

c. Direct marketing
 communication by whatever means of any advertising or marketing material which is directed to
particular individuals

d. Filing system
 any act of information relating to natural or juridical persons to the extent that, although the
information is not processed by equipment operating automatically in response to instructions given
for that purpose, the set is structured, either by reference to individuals or by reference to criteria
relating to individuals, in such a way that specific information relating to a particular person is readily
accessible

e. Information and Communications System

 a system for generating, sending, receiving, storing or otherwise processing electronic data messages
or electronic documents and includes the computer system or other similar device by or which data is
recorded, transmitted or stored and any procedure related to the recording, transmission or storage of
electronic data, electronic message, or electronic document

f. Personal information
 any information whether recorded in a material form or not
 from which the identity of an individual is apparent or can be reasonably and directly ascertained by
the entity holding the information, or
 when put together with other information would directly and certainly identify an individual

g. Personal information controller

 a person or organization who controls the collection, holding, processing or use of personal
information,
 includes a person or organization who instructs another person or organization to collect, hold,
process, use, transfer or disclose personal information on his or her behalf.
 The term excludes:
(1) A person or organization who performs such functions as instructed by another person or
organization; and
(2) An individual who collects, holds, processes or uses personal information in connection
with the individual’s personal, family or household affairs.

h. Personal information processor

 any natural or juridical person qualified to act as such under this Act to whom a personal information
controller may outsource the processing of personal data pertaining to a data subject

1
For the exclusive use of University of the Visayas LAW 222 students of AS1-AS2 A.Y. 2022 – 2023. Unauthorized reproduction and/or distribution is prohibited.
i. Processing
 any operation or any set of operations performed upon personal information
 including, but not limited to, the collection, recording, organization, storage, updating or
modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data

j. Privileged information
 any and all forms of data which under the Rules of Court and other pertinent laws constitute
privileged communication

k. Sensitive personal information refers to personal information:

(1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or
political affiliations;
(2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding
for any offense committed or alleged to have been committed by such person, the disposal of such
proceedings, or the sentence of any court in such proceedings;
(3) Issued by government agencies peculiar to an individual which includes, but not limited to, social
security numbers, previous or cm-rent health records, licenses or its denials, suspension or revocation,
and tax returns; and
(4) Specifically established by an executive order or an act of Congress to be kept classified.

SCOPE
Applicable to:
a. the processing of ALL types of personal information; and
b. to any natural and juridical person involved in personal information processing including:
i. those personal information controllers and processors who, although not found or established in the
Philippines, use equipment that are located in the Philippines, or
ii. those who maintain an office, branch or agency in the Philippines subject to the immediately
succeeding paragraph: provided, that the requirements of Section 5 are complied with.

Section 5. Protection Afforded to Journalists and Their Sources.

Nothing in this Act shall be construed as to have amended or repealed the provisions of Republic Act No. 53,
which affords the publishers, editors or duly accredited reporters of any newspaper, magazine or periodical of
general circulation protection from being compelled to reveal the source of any news report or information
appearing in said publication which was related in any confidence to such publisher, editor, or reporter.

This Act does NOT apply to the following:

(a) Information about any individual who is or was an officer or employee of a government institution that
relates to the position or functions of the individual, including:
(1) The fact that the individual is or was an officer or employee of the government institution;
(2) The title, business address and office telephone number of the individual;
(3) The classification, salary range and responsibilities of the position held by the individual; and
(4) The name of the individual on a document prepared by the individual in the course of employment
with the government;

(b) Information about an individual who is or was performing service under contract for a government
institution that relates to the services performed.
This includes: The terms of the contract, and the name of the individual given in the course of the
performance of those services;

(c) Information relating to any discretionary benefit of a financial nature.

Such as the granting of a license or permit given by the government to an individual, including the name of
the individual and the exact nature of the benefit;

(d) Personal information processed for journalistic, artistic, literary or research purposes;

(e) Information necessary in order to carry out the functions of public authority.
This includes: the processing of personal data for the performance by the independent, central monetary
authority and law enforcement and regulatory agencies of their constitutionally and statutorily mandated
functions.
Note: Nothing in this Act shall be construed as to have amended or repealed Republic Act No. 1405,
otherwise known as the Secrecy of Bank Deposits Act; Republic Act No. 6426, otherwise known as the
Foreign Currency Deposit Act; and Republic Act No. 9510, otherwise known as the Credit Information
System Act (CISA);

2
For the exclusive use of University of the Visayas LAW 222 students of AS1-AS2 A.Y. 2022 – 2023. Unauthorized reproduction and/or distribution is prohibited.
(f) Information necessary for banks and other financial institutions under the jurisdiction of the independent,
central monetary authority or Bangko Sentral ng Pilipinas to comply with Republic Act No. 9510, and
Republic Act No. 9160, as amended, otherwise known as the Anti-Money Laundering Act and other
applicable laws.
(g) Personal information originally collected from residents of foreign jurisdictions in accordance with the
laws of those foreign jurisdictions, including any applicable data privacy laws, which is being processed in
the Philippines.

Extraterritorial Application.
This Act applies to an act done or practice engaged in and outside of the Philippines by an entity if:
(a) The act, practice or processing relates to personal information about a Philippine citizen or a resident;

(b) The entity has a link with the Philippines, and the entity is processing personal information in the
Philippines or even if the processing is outside the Philippines as long as it is about Philippine citizens or
residents such as, but not limited to, the following:
(1) A contract is entered in the Philippines;
(2) A juridical entity unincorporated in the Philippines but has central management and control in the
country; and
(3) An entity that has a branch, agency, office or subsidiary in the Philippines and the parent or affiliate of
the Philippine entity has access to personal information; and

(c) The entity has other links in the Philippines such as, but not limited to:

(1) The entity carries on business in the Philippines; and

(2) The personal information was collected or held by an entity in the Philippines.

DATA PRIVACY PRINCIPLES

General Data Privacy Principles

The processing of personal information shall be allowed, subject to
1. compliance with the requirements of the Data Privacy Act and other laws allowing disclosure of
information to the public and
2. adherence to the following principles
a. Principle of transparency
The data subject must be aware of the nature, purpose and extent of the processing of his or her personal
data by the company, including risks and safeguards involved, the identity of persons and entities involved in
processing his or her personal legitimate purpose and proportionality.

PROCESSING OF PERSONAL INFORMATION

Personal information must, be:

(a) Collected for specified and legitimate purposes determined and declared before, or as soon as reasonably
practicable after collection, and later processed in a way compatible with such declared, specified and
legitimate purposes only;

(b) Processed fairly and lawfully;

(c) Accurate, relevant and, where necessary for purposes for which it is to be used the processing of personal
information, kept up to date; inaccurate or incomplete data must be rectified, supplemented, destroyed or
their further processing restricted;

(d) Adequate and not excessive in relation to the purposes for which they are collected and processed;

(e) Retained only for as long as necessary for the fulfillment of the purposes for which the data was obtained
or for the establishment, exercise or defense of legal claims, or for legitimate business purposes, or as
provided by law; and

(f) Kept in a form which permits identification of data subjects for no longer than is necessary for the
purposes for which the data were collected and processed: Provided, That personal information collected for
other purposes may lie processed for historical, statistical or scientific purposes, and in cases laid down in
law may be stored for longer periods: Provided, further, That adequate safeguards are guaranteed by said
laws authorizing their processing.

The personal information controller must ensure implementation of personal information processing
principles set out herein.
3
For the exclusive use of University of the Visayas LAW 222 students of AS1-AS2 A.Y. 2022 – 2023. Unauthorized reproduction and/or distribution is prohibited.
Criteria for Lawful Processing of Personal Information.
The processing of personal information shall be permitted only if not otherwise prohibited by law, and when
at least one of the following conditions exists:

(a) The data subject has given his or her consent;

(b) The processing of personal information is necessary and is related to the fulfillment of a contract with the
data subject or in order to take steps at the request of the data subject prior to entering into a contract;

(c) The processing is necessary for compliance with a legal obligation to which the personal information
controller is subject;

(d) The processing is necessary to protect vitally important interests of the data subject, including life and
health;

(e) The processing is necessary in order to respond to national emergency, to comply with the requirements
of public order and safety, or to fulfill functions of public authority which necessarily includes the processing
of personal data for the fulfillment of its mandate; or

(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal
information controller or by a third party or parties to whom the data is disclosed, except where such interests
are overridden by fundamental rights and freedoms of the data subject which require protection under the
Philippine Constitution.

Sensitive Personal Information and Privileged Information.

The processing of sensitive personal information and privileged information shall be prohibited, except in the
following cases:

(a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case
of privileged information, all parties to the exchange have given their consent prior to processing;

(b) The processing of the same is provided for by existing laws and regulations: Provided, That such
regulatory enactments guarantee the protection of the sensitive personal information and the privileged
information: Provided, further, That the consent of the data subjects are not required by law or regulation
permitting the processing of the sensitive personal information or the privileged information;

(c) The processing is necessary to protect the life and health of the data subject or another person, and the
data subject is not legally or physically able to express his or her consent prior to the processing;

(d) The processing is necessary to achieve the lawful and noncommercial objectives of public organizations
and their associations: Provided, That such processing is only confined and related to the bona fide members
of these organizations or their associations: Provided, further, That the sensitive personal information are not
transferred to third parties: Provided, finally, That consent of the data subject was obtained prior to
processing;

(e) The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or
a medical treatment institution, and an adequate level of protection of personal information is ensured; or

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and
interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal
claims, or when provided to government or public authority.

Subcontract of Personal Information

A personal information controller may subcontract the processing of personal information: Provided, That
the personal information controller shall be responsible for ensuring that proper safeguards are in place to
ensure the confidentiality of the personal information processed, prevent its use for unauthorized purposes,
and generally, comply with the requirements of this Act and other laws for processing of personal
information. The personal information processor shall comply with all the requirements of this Act and other
applicable laws.

Extension of Privileged Communication

Personal information controllers may invoke the principle of privileged communication over privileged
information that they lawfully control or process. Subject to existing laws and regulations, any evidence
gathered on privileged information is inadmissible.
4
For the exclusive use of University of the Visayas LAW 222 students of AS1-AS2 A.Y. 2022 – 2023. Unauthorized reproduction and/or distribution is prohibited.
OBLIGATION OF CREDITORS TO PERSONS TO WHOM CREDIT IS EXTENDED
Any creditor shall furnish to each person to whom credit is extended, prior to the consummation of the
transaction, a clear statement in writing setting forth, to the extent applicable and in accordance with rules
and regulations prescribed by the Board, the following information:

1. the cash price or delivered price of the property or service to be acquired;

2. the amounts, if any, to be credited as down payment and/or trade-in;
3. the difference between the amounts set forth under clauses (1) and (2);
4. the charges, individually itemized, which are paid or to be paid by such person in connection with the
transaction but which are not incident to the extension of credit;
5. the total amount to be financed;
6. the finance charge expressed in terms of pesos and centavos; and
7. the percentage that the finance bears to the total amount to be financed expressed as a simple annual rate
on the outstanding unpaid balance of the obligation.

Required Information under BSP Circular No.755 Series of 2012

1. the total amount to be financed;
2. the finance charges expressed in terms of pesos and centavos;
3. the net proceeds of the loan;
4. the percentage that the finance charge bears to the total amount to be financed expressed as a simple
annual rate or an effective annual interest rate (EIR)

COVERED TRANSACTIONS
The following regulations shall apply to all banks engaged in the following types of credit transactions:

a. Any loan, mortgage, deed of trust, advance and discount;

b. Any conditional sales contract, any contract to sell, or sale or contract of sale of property or services, either
for present or future delivery, under which part or all of the price is payable subsequent to the making of such
sale or contract;
c. Any rental-purchase contract;
d. Any contract or arrangement for the hire, bailment, or leasing of property;
e. Any option, demand, lien, pledge, or other claim against, or for delivery of, property or money;
f. Any purchase, or other acquisition of, or any credit upon security of any obligation or claim arising out of
any of the foregoing; and
g. Any transaction or series of transactions having a similar purpose or effect.

EXCLUDED TRANSACTIONS
The following categories of credit transactions are outside the scope of these regulations:
1. Credit transactions which do not involve the payment of any finance charge by the debtor; and
2. Credit transactions in which the debtor is the one specifying a definite and fixed set of credit terms such as
bank deposits, insurance contracts, sale of bonds, etc.

PROHIBITED ACTS

a. Any creditor who in connection with any credit transaction fails to disclose to any person any information
in violation of this Act or any regulation issued thereunder
 shall be liable to such person in the amount of P100 or in an amount equal to twice the finance
charged required by such creditor in connection with such transaction, whichever is the greater,
 except that such liability shall not exceed P2,000 on any credit transaction.

Prescriptive period: Action to recover such penalty may be brought by such person within one year from
the date of the occurrence of the violation, in any court of competent jurisdiction.

Costs: In any action under this subsection in which any person is entitled to a recovery, the creditor shall be
liable for reasonable attorney's fees and court costs as determined by the court.

Except as specified in subsection (a) of this section, nothing contained in this Act or any regulation contained
in this Act or any regulation thereunder shall affect the validity or enforceability of any contract or
transactions.
5
For the exclusive use of University of the Visayas LAW 222 students of AS1-AS2 A.Y. 2022 – 2023. Unauthorized reproduction and/or distribution is prohibited.
b. Any person who willfully violates any provision of this Act or any regulation issued thereunder
 shall be fined by not less than P1,00 or more than P5,000 or imprisonment for not less than 6 months,
nor more than one year or both.

No punishment or penalty provided by this Act shall apply to the Philippine Government or any agency or
any political subdivision thereof.

A final judgment hereafter rendered in any criminal proceeding under this Act to the effect that a defendant
has willfully violated this Act shall be prima facie evidence against such defendant in an action or proceeding
brought by any other party against such defendant under this Act as to all matters respecting which said
judgment would be an estoppel as between the parties thereto.

6
For the exclusive use of University of the Visayas LAW 222 students of AS1-AS2 A.Y. 2022 – 2023. Unauthorized reproduction and/or distribution is prohibited.