Does the Data Privacy Act hinder banks from complying with the Anti-Money Laundering Act?
Information necessary for banks and financial institutions to officially comply with the Anti-Money Laundering Act is specifically exempted from the Act.
Does the Data Privacy Act apply to personal data of foreigners collected abroad but processed in the Philippines?
Personal data collected from foreign residents abroad but processed in the Philippines is generally exempt, though local security measures apply.
Under what conditions can a government employee be granted online access to sensitive personal information?
Government employees can access sensitive data online only with proper security clearances, robust IT governance frameworks, and direct functional necessity.
What are the rules for processing data collected for research from parties other than the data subject?
Research data from third parties is allowed if publicly available or with consent, provided no decisions directly affect the data subject.
Does a data subject have the legal right to be indemnified for damages?
Data subjects have the absolute right to be indemnified for any damages caused by inaccurate, unlawfully obtained, or unauthorized personal data.
Does a data subject have the legal right to be indemnified for damages? Read More »
Can the National Privacy Commission authorize the delay of a mandatory breach notification?
The Commission may legally authorize the postponement of a breach notification if it would actively hinder the progress of a criminal investigation.
What details must be included in a breach report submitted to the Commission?
A breach report must contain the required notification contents along with the specific name and contact details of the controller’s designated representative.
What details must be included in a breach report submitted to the Commission? Read More »
Are organizations required to strictly document all security incidents, even minor ones?
All security incidents, including those not strictly requiring formal notification, must be rigorously documented internally through comprehensive written or aggregated reports.
Are organizations required to strictly document all security incidents, even minor ones? Read More »
What is the specific penalty for unauthorized access or intentionally breaking into a data system?
Intentionally breaking into systems containing personal data is severely punished by 1 to 3 years imprisonment and hefty criminal fines.
How is the concealment of a security breach legally penalized?
Intentionally concealing a known security breach brings a harsh penalty of 1.5 to 5 years imprisonment and severe financial fines.
How is the concealment of a security breach legally penalized? Read More »
