PERSONAL DATA PROCESSING SYSTEM’S PRIVACY RIGHTS PROCESSES CONFORMITY TEST -RA 10173
Rule VIII of R.A. 10173 implementing rules and regulation identify and describes the privacy rights of a data subject, or individual whose personal information is to be
processed by a data processing system of a business enterprise or government agency under the instruction of a personal information controller, and to be executed by the
instructed personal information processor.
The conformity test of a filing system, automation program, and technology services of personal data processing is meant to establish the behavioural agreement of the
data processing system to the required policy, activities and documentation that demonstrate respect of the data privacy rights of a data subject, an individual whose personal
information is to be processed as per instruction of a personal information controller and executed by a personal information controller. The data privacy right processes to be
examined have to deliver and support the following data privacy rights objectives.
1. Data subject is INFORMED before the collection, retention, processing, disclosure, and disposal of personal data, and in the event there is breach of privacy.
2. Data subject entered direct CONSENT before collection, retention, processing, disclosure, and disposal of personal data
3. Data subject is provided ACCESS to the data processing activities, as determined by existing laws and agreement.
4. Data subject is allowed to OBJECT the processing of personal data, most especially when it is related to direct marketing, automated processing or profiling. A
procedure to withdraw consent is made available.
5. Data subjected is allowed to BLOCK or ERASE personal data processing and personal information in the personal information controller’s filing system. .
6. Data subject is allowed to RECTIFY or CORRECT the inaccuracy or error in the personal data, and have the personal information controller to make correction,
7. Data subject is provided with procedure to claim DATA PORTABILITY. The ability to obtain from the personal information controller a copy of personal data in an
electronic or structured format that is commonly used and allows for further use by the data subject.
8. Data subject is informed and provided with procedure to COMPLAIN privacy violation
9. Data subject is provided with procedure to CLAIM DAMAGES, which is to be indemnified for damages sustained due to inaccurate, incomplete, outdated, false,
unlawfully obtained, or unauthorized use of personal data.
Conformity Rating
4 3 2 1
The compliance is systematically The control can be improved, mainly The compliance is not systematically The compliance is not implemented.
implemented and no improvement is from a procedural (i.e. support implemented or it is completely not suitable, so
needed. documentation) point of view. its effectiveness is not ensured.
“I am Data Subject. Data Privacy is MY Right.”
PERSONAL DATA PROCESSING SYSTEM’S PRIVACY RIGHTS PROCESSES CONFORMITY TEST -RA 10173
Rights of Data Subject Compliance Requirements Rating
4 3 2 1
1. Right to be informed Rule VIII Section 34a states that data subject has a right to be informed about his or her personal data that are to be *
processed, being processed, or have been processed, including the existence of automated decision-making and profiling.
The data subject shall be notified and furnished with the mandated information before the entry of his or her personal
data into the processing system of the personal information controller, or at the next practical opportunity:
1. Description of the personal data to be entered into the system
2. Purposes for which they are being or will be processed, including processing for direct marketing, profiling or
historical, statistical or scientific purpose
3. Basis of processing, when processing is not based on the consent of the data subject
4. Scope and method of personal data processing
5. The recipients or classes of recipients to whom the personal data are or may be disclosed
6. Methods utilized for automated access, if the same is allowed by the data subject, and the extent to which such access
is authorized, including meaningful information about the logic involved, as well as the significance and the envisaged
consequences of such processing for the data subject
7. The identity and contact details of the personal data controller or its representative
8. The period for which the information will be stored
9. The existence of their rights as data subjects, including the right to access, correction, and object to the processing, as
well as the right to lodge a complaint before the Commission.
The right to be informed include notification of the data subject on the breach incident that violates privacy of personal
information. The data subject is given the contact detail of the Data Protection Officer to obtain information about the
breach as described in Rule IX – Data Breach Notification.
“I am Data Subject. Data Privacy is MY Right.”
PERSONAL DATA PROCESSING SYSTEM’S PRIVACY RIGHTS PROCESSES CONFORMITY TEST -RA 10173
Rights of Data Subject Compliance Requirements Rating
4 3 2 1
2. Right to give consent Rule IV Section 19a1 on collection, processing and retention principles states that consent of a data subject is required *
prior to the collection and processing of personal data, subject to exemptions provided by the Act and other applicable
laws and regulations. When consent is required, it must be time-bound in relation to the declared, specified and
legitimate purpose. Consent given may be withdrawn.
Consent of the data subject is defined by Rule I Section 3c as:
1. Freely given, specific, informed indication of will. (Not implied)
2. Data subject agrees to the collection and processing of his or her personal, sensitive personal or privileged
information. (Agreement is specific, clear, and actionable)
3. Consent s is evidenced by written, electronic or recorded means. (Recorded activity)
4. Consent is also given on behalf of a data subject by a lawful representative or an agent specifically authorized by the
data subject to do so. (Transmitabiity)
The data privacy consent form –paper or digital based is a demonstration of the data subject knowing and agreeing with
the data processing conditions associated to the collection, processing , retention, sharing and disposal of personal
information
“I am Data Subject. Data Privacy is MY Right.”
PERSONAL DATA PROCESSING SYSTEM’S PRIVACY RIGHTS PROCESSES CONFORMITY TEST -RA 10173
Rights of Data Subject Compliance Requirements Rating
4 3 2 1
3. Right to access Rule VIII Section 34c states that the data subject has the right to reasonable access to, upon demand, the following: *
1. The contents of his or her personal data that were processed.
2. The sources from which personal data were obtained.
3. The names and addresses of recipients of the personal data.
4. The manner by which such data were processed;
5. The reasons for the disclosure of the personal data to recipients, if any
6. The information on automated processes where the data will, or is likely to, be made as to the sole basis for any
decision that significantly affects or will affect the data subject
7. The date when his or her personal data concerning the data subject were last accessed and modified
8. The designation, name or identity, and address of the personal information controller.
The right to access must be made based on what is considered by regulation as reasonable and can be demanded.
“I am Data Subject. Data Privacy is MY Right.”
PERSONAL DATA PROCESSING SYSTEM’S PRIVACY RIGHTS PROCESSES CONFORMITY TEST -RA 10173
Rights of Data Subject Compliance Requirements Rating
4 3 2 1
4. Right to object Rule VIII Section 34b of R.A. 10173 implementing rules speaks of the right of a Data Subject to object the processing of *
personal data, which includes processing the personal information to meet the purpose of direct marketing, automated
processing or profiling.
The right to object includes the withdrawal of "consent" given to the information controller or processor to process the
submitted personal data.
The rule specifies the conditions that override or make invalid the objection of a Data Subject
1. The personal data is needed pursuant to a subpoena.
2. The collection and processing are for obvious purposes, including, when it is necessary for the performance of or in
relation to a contract or service to which the data subject is a party, or when necessary or desirable in the context of
an employer-employee relationship between the collector and the data subject; or
3. The information is being collected and processed as a result of a legal obligation.
Know the listed conditions, and from there claim the situation that allows the right to object.
“I am Data Subject. Data Privacy is MY Right.”
PERSONAL DATA PROCESSING SYSTEM’S PRIVACY RIGHTS PROCESSES CONFORMITY TEST -RA 10173
Rights of Data Subject Compliance Requirements Rating
4 3 2 1
5. Right to block or erase The Data Subject has the right to ask the personal information controller and processor to stop the processing of personal *
data, or erase their collected, retained or shared personal data of the customer or citizen.
Rule VIII section 34e of the R.A. 10173 implementation rules states that data subject shall have the right to suspend,
withdraw or order the blocking, removal or destruction of his or her personal data from the personal information
controller’s filing system.
The right may be exercised upon discovery and substantial proof of any of the following:
1. The personal data is incomplete, outdated, false, or unlawfully obtained;
2. The personal data is being used for a purpose not authorized by the data subject;
3. The personal data is no longer necessary for the purposes for which they were collected;
4. The data subject withdraws consent or objects to the processing, and there is no other legal ground or overriding
legitimate interest for the processing;
5. The personal data concerns private information that is prejudicial to a data subject, unless justified by freedom of
speech, of expression, or of the press or otherwise authorized.
6. The processing is unlawful.
7. The personal information controller or personal information processor violated the rights of the data subject.
If any of the said proofs are available, the Data Subject may call the attention of the enterprise or agency Data Protection
Officer to request personal data erasure.
“I am Data Subject. Data Privacy is MY Right.”
PERSONAL DATA PROCESSING SYSTEM’S PRIVACY RIGHTS PROCESSES CONFORMITY TEST -RA 10173
Rights of Data Subject Compliance Requirements Rating
4 3 2 1
6. Right to rectify (correct) Rule VIII section 34d states the right of a data subject to dispute the inaccuracy or error in the personal data, and have the *
personal information controller to make the correction.
1. When data correction is done, the personal information controller shall ensure the accessibility of both the new and
the retracted information and the simultaneous receipt of the new and the retracted information by the intended
recipients thereof:
2. The recipients or third parties who have previously received such processed personal data shall be informed of its
inaccuracy and its rectification, upon reasonable request of the data subject.
3. The data correction is not made when the request is vexatious or otherwise unreasonable.
4. The request for personal data correction must consider the legitimate conditions that allow immediate action.
Rights of Data Subject Compliance Requirements Rating
“I am Data Subject. Data Privacy is MY Right.”
PERSONAL DATA PROCESSING SYSTEM’S PRIVACY RIGHTS PROCESSES CONFORMITY TEST -RA 10173
7. Right to data portability Rule VIII Section 36 states that data subject shall have the right to obtain from the personal information controller a copy *
of such data in an electronic or structured format that is commonly used and allows for further use by the data subject.
The exercise of this right shall primarily take into account the right of data subject to have control over his or her personal
data being processed based on consent or contract, for commercial purpose, or through automated means.
Data portability applies to personal data that is processed by electronic means and in a structured and commonly used
format. It follows the regulators specification of the electronic format, as well as the technical standards, modalities,
procedures and other rules for data transfer.
Rights of Data Subject Compliance Requirements Rating
“I am Data Subject. Data Privacy is MY Right.”
PERSONAL DATA PROCESSING SYSTEM’S PRIVACY RIGHTS PROCESSES CONFORMITY TEST -RA 10173
4 3 2 1
8. Right to complain In Rule VIII of Data Privacy Right, section 34a on the Right to be Informed, there is a provision in Section 34a 2i that gives *
the Data Subject the right to lodge a complaint before the National Privacy Commission.
Section 34 a2 states, "the data subject shall be notified and furnished with the information… including the right to access,
correction, and object to the processing, as well as the right to lodge a complaint before the Commission."
The National Privacy Commission has provided Complaints-Assisted Form to be filled up by a complaining data subject.
The NPC Circular 16-04 Rules on Procedures identifies who files privacy complaint, namely.
1. National Privacy Commission, sua sponte
2. Persons who are the subject of a privacy violation or personal data breach
3. Persons who are personally affected by a violation of the Data Privacy Act
Complain is entertained by the National Privacy Commission when the following remedies are exhausted.
1. The complainant has informed, in writing, the personal information controller or concerned entity of the privacy
violation or personal data breach to allow for appropriate action on the same;
2. The personal information controller or concerned entity did not take timely or appropriate action on the claimed
privacy violation or personal data breach, or there are no response from the personal information controller within
fifteen (15) days from receipt of information from the complaint
3. The complaint is filed within six (6) months from the occurrence of the claimed privacy violation or personal data
breach, or thirty (30) days from the last communiqué with the personal information controller or concerned entity,
whichever is earlier.
Rights of Data Subject Compliance Requirements Rating
“I am Data Subject. Data Privacy is MY Right.”
PERSONAL DATA PROCESSING SYSTEM’S PRIVACY RIGHTS PROCESSES CONFORMITY TEST -RA 10173
4 3 2 1
9. Right to claim damages Rule VIII Section 34F states that the data subject shall be indemnified for any damages sustained due to such inaccurate, *
incomplete, outdated, false, unlawfully obtained or unauthorized use of personal data, taking into account any violation of
his or her rights and freedoms as the data subject
NPC Circular 18-03 – Rules on Mediation before the National Privacy Commission applies in the settlement of claim of
damages
“I am Data Subject. Data Privacy is MY Right.”