Situational Gray Areas of Republic Act no. 10173 otherwise known as the Data Privacy Act of 2012

Republic Act no. 10173 otherwise known as the Data Privacy Act of 2012 is an act protecting individual personal information in information and communications systems in the government and the private sector, creating for this purpose a national privacy commission and for other purposes.

Section 2 of the law states that it is the policy of the State to protect the fundamental human right of privacy, of communication while ensuring free flow of information to promote innovation and growth. The State recognizes the vital role of information and communications technology in nation-building and its inherent obligation to ensure that personal information in information and communications systems in the government and in the private sector are secured and protected.

The right to privacy is the right to be left alone, the right of a person to be free from undesired publicity or disclosure and the right to live without unwarranted interference by the public in matters with which the public is not necessarily concerned.[1] It is a right guaranteed by the Bill of Rights of the 1987 Philippine Constitution, to wit:

Article III Section 3:
1. The privacy of communication and correspondence shall be inviolable except upon lawful order of the court, or when public safety or order requires otherwise, as prescribed by law.
2. Any evidence obtained in violation of this or the preceding section shall be inadmissible for any purpose in any proceeding.

It is essential that the right to privacy is protected by the State. It is important because privacy helps maintain individuality and it has functional benefits.[2] Everyone has the right to act free from public scrutiny and opinion. It encourages freedom of individuality and of secrecy to matters not of public concern. It is relevant in all aspects of human existence. Several examples include bank accounts, statements, trade secrets, records, other personal or business dealings and the like. If this right is not protected, it may lead to a great deal of misunderstanding, serious distress, embarrassment, prejudice, harassment and discrimination. Society may feel restricted in their individual exercise of freedoms granted to them by the State. Security of persons may also be an issue. When information of every individual is open to public, anyone can act in prejudice to another. It may lead to the increase of commission of crimes and thus, a more chaotic State.

Nevertheless, there are certain information that cannot be concealed to the public. This is true as when it is necessary for public welfare. One who is bound to answer in the court of law is obligated to disclose certain information to facilitate rendition of justice. More so, the free flow of information is also necessary to promote innovation and growth. Information is a form of knowledge that can be put to good use when shared. Medical inventions can be created through different studies by different practitioners. It can be improved over time to aid in curing any form of ailments. Solutions to problems in the country can be discussed that may help better the economy. Opinions can be put into intellectual or artistic use. When information is put to good use, it can help build a better economy.

The information and communications technology (ICT) paved the way to bridge the gap of reaching out to people in any part of the world. It refers to all the technology used to handle telecommunications, broadcast media, intelligent building management systems, audiovisual processing and transmission systems, and network-based control and monitoring functions.[3] It has become an integral and accepted part of everyday life for many people.[4] It is increasing in importance in people’s lives and it is expected that this trend will continue, to the extent that ICT literacy will become a functional requirement for people’s work, social, and personal lives.[5] ICT made research faster and communication easier. Unlike the olden times where information can only be obtained through browsing the pages of books, now, information can be generated by just clicking a few buttons in the internet. The study in any field is made available online through different sources like google and yahoo. Business enterprises make use of ICT in advertising and marketing their products. Social networking is made available through Facebook, Instagram, Tweeter and the like. As such, the use of ICT is not only an amenity, but is also an imperious need. Hence, it is inevitable for the State to support its use and at the same time, regulate it.

The Data Privacy Act of 2012 is enacted to regulate the processing of personal information of individuals collected by both public and private entities as a way to protect one’s privacy.[6] Atty. JJ. Disini, a technology law expert said that it tries to give the people their right to control of any kind of personal information that is collected about them, its use and its further disclosure. It is a consolidation of Senate Bill no. 2965 and House Bill no. 4115 which was finally passed by the Senate and the House of Representatives on June 6, 2012. It was approved on August 15, 2012. It was signed by Feliciano Belmonte Jr, Speaker of the House of Representatives, Juan Ponce Enrile, President of the Senate, Marilyn B. Barua-Yap, Secretary General of the House of Representatives, Emma Lirio-Reyes, Secretary of the Senate and Benigno S. Aquino III, President of the Philippines. It took effect fifteen (15) days after its publication in at least two (2) national newspapers of general circulation.

With the advances in information technology, privacy in personal data has become illusory and for the right price or with good connections, private information disclosed in confidence to companies or government offices can be made available to or accessed by interested parties.[7] This is the problem that is sought to be minimized, if not eliminated, by the Data Privacy Act of 2012.[8] It is intended to protect the integrity and security of personal data in both the private and public sectors.[9] The enactment of the law seeks to bring the Philippines’ data protection policies and measures on par with the international standards of data privacy protection.[10] Government and business leaders also believe that the implementation of the law will help maintain the competitiveness of the Philippines and boost investments in its information technology-business process outsourcing (IT-BPO) sector and support the healthy information and communications technology (ICT) industry.[11]

The law clearly enumerates where it is made applicable and where it isn’t applicable. Section 4 states that “This Act applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing including those personal information controllers and processors who, although not found or established in the Philippines, use equipment that are located in the Philippines, or those who maintain an office, branch or agency in the Philippines subject to the immediately succeeding paragraph: Provided, That the requirements of Section 5 are complied with.”

The requirement of Section 5 is the protection afforded to journalists and their sources. It states that “Nothing in this Act shall be construed as to have amended or repealed the provisions of Republic Act No. 53, which affords the publishers, editors or duly accredited reporters of any newspaper, magazine or periodical of general circulation protection from being compelled to reveal the source of any news report or information appearing in said publication which was related in any confidence to such publisher, editor, or reporter.”

Section 4 also states that the Data Privacy Act of 2012 does not apply to the following: (a) Information about any individual who is or was an officer or employee of a government institution that relates to the position or functions of the individual, including: (1) The fact that the individual is or was an officer or employee of the government institution; (2) The title, business address and office telephone number of the individual; (3) The classification, salary range and responsibilities of the position held by the individual; and (4) The name of the individual on a document prepared by the individual in the course of employment with the government; (b) Information about an individual who is or was performing service under contract for a government institution that relates to the services performed, including the terms of the contract, and the name of the individual given in the course of the performance of those services; (c) Information relating to any discretionary benefit of a financial nature such as the granting of a license or permit given by the government to an individual, including the name of the individual and the exact nature of the benefit; (d) Personal information processed for journalistic, artistic, literary or research purposes; (e) Information necessary in order to carry out the functions of public authority which includes the processing of personal data for the performance by the independent, central monetary authority and law enforcement and regulatory agencies of their constitutionally and statutorily mandated functions. Nothing in this Act shall be construed as to have amended or repealed Republic Act No. 1405, otherwise known as the Secrecy of Bank Deposits Act; Republic Act No. 6426, otherwise known as the Foreign Currency Deposit Act; and Republic Act No. 9510, otherwise known as the Credit Information System Act (CISA); (f) Information necessary for banks and other financial institutions under the jurisdiction of the independent, central monetary authority or Bangko Sentral ng Pilipinas to comply with Republic Act No. 9510, and Republic Act No. 9160, as amended, otherwise known as the Anti-Money Laundering Act and other applicable laws; and (g) Personal information originally collected from residents of foreign jurisdictions in accordance with the laws of those foreign jurisdictions, including any applicable data privacy laws, which is being processed in the Philippines.

Furthermore, the Data Privacy Act of 2012 has extraterritorial application as laid down by Section 6 thereof. It states that “This Act applies to an act done or practice engaged in and outside of the Philippines by an entity if: (a) The act, practice or processing relates to personal information about a Philippine citizen or a resident; (b) The entity has a link with the Philippines, and the entity is processing personal information in the Philippines or even if the processing is outside the Philippines as long as it is about Philippine citizens or residents such as, but not limited to, the following: (1) A contract is entered in the Philippines; (2) A juridical entity unincorporated in the Philippines but has central management and control in the country; and (3) An entity that has a branch, agency, office or subsidiary in the Philippines and the parent or affiliate of the Philippine entity has access to personal information; and (c) The entity has other links in the Philippines such as, but not limited to: (1) The entity carries on business in the Philippines; and (2) The personal information was collected or held by an entity in the Philippines.”

In the Philippines, the real estate sector is booming and this is predicted to continue this year 2014 and onwards according to property experts. Condominiums are being built everywhere by different developers like Ayala Land, SM Land, Megaworld, Robinsons Land Corporation, Century Properties, DMCI etc. These companies continue to grow which is good for the Philippine economy. The recent economic improvement to name a few are 7.5% Gross Domestic Product growth which is considered as the best in Asia and the world, Consumer Confidence Index (CI) climbed from -11.2 percent to -5.7 percent, low inflation rate remains below 3% as of August 2013, slight decrease of unemployment from 7.5% in Q2 2013 to 7.3% in Q3 2013in the labor sector. (Although this slight change is barely noticeable, there is an optimistic, long term action-plan to remedy the unemployment problem initiated by World Bank), low interest rate: on 4-year low of 3.5% bench mark rate, changes in the political system have impacted a lot to improve foreign investors’ confidence in our country.[12] These real estate companies continue in business because the Philippine market sees it as a good form of investment. From the point of view of the Philippine market, investing in real estate allows them to gain more leverage in terms of return in investment compared to banks, to grow a tax deferred strategy through installment sale, to get a tax free cash flow, to have tax write offs against other income, to increase tax deduction strategies or to have a forced retirement plan.[13] On the other hand, from the point of view of the real estate developers, they mean business. When they construct a real estate development for commercial, business or residential use, they want a return of their investment. They invest their money for its construction, sales, marketing, legal documentation in the hope that once sold, they will earn more than they spent.

Real estate developers develop a sales team to sell their property to the market. This team may be from different channels which include in-house property specialists or real estate brokers with real estate agents. These sales people introduce the development to the market for them to be encouraged to invest and thus, a sale is consummated. The process is done through the art of salesmanship. They apply the skills and techniques through workshops activities, learn core communication skills required in the sales process and imbibe the skills in their daily selling activities. Selling is both a science and an art. It is a science because there is a study of knowledge of products, principles, tools and techniques. It is an art because there is need for an effective application of knowledge and a genuine dedication needed to build rapport to a client. The sales process is a systematic approach involving a series of steps that enables a sales force to close more deals, increase margins and make more sales through referrals.[14] It involves prospecting, qualifying, proposal or presentation, handling objections, closing and follow up for repeated business through referrals.[15] Prospecting is the lifeblood and the first step to selling. It involves seeking, identifying and qualifying people who could meet and talk regarding the product. In simpler terms, it means looking for the perfect client. Sales people use different kinds of prospecting. They use their own strategies to get their leads. Some use their warm prospects or people they know, while others use cold prospects or people they don’t know personally. The most common source of prospects are their natural market, referrals, existing clients, center of influence, networking, nest prospecting, fish bowl events, personal observation, direct marketing, advertising campaigns and many more. Does the Data Privacy Act of 2012 protect the information that sales people in the real estate industry take as part of their sales process?

More often than not, everyone in the Philippines receive text blasts from people they don’t know selling properties of all kinds. Some even call just to sell their products. This is called telemarketing. Let’s begin to wonder, how did they get the cellphone number anyway? How did they know the prospect’s name and his or her other personal information?

Section 3(j) defines processing to refer to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data. Most human activities oblige people to give their personal information. These include but not limited to applications to universities and to work whether sent online or personally, filling out government forms, joining fundraising events through raffle tickets, handing out information to business process outsourcing or call center companies, attendance to seminars and conventions where a database is created, applications for credit cards or loans, purchasing automobiles, insurance policy and claims, advertisement in the radio, newspapers or online, affidavits or contracts, membership in clubs, creating an account online for whatever purpose, becoming a part of a yahoo group or forums, making personal websites, posting queries to different sites, complying with accreditation requirements, engaging the services of couriers like LBC, 2Go, JRS Express, Air 21 etc. , bookings for accommodations in hotels or airline tickets or online purchases. Are these information covered and protected by the Data Privacy Act of 2012? Are these the leads that sales people in the real estate industry use? Where do sales people get both their warm and cold prospects and their contact information? Is this not a violation of the right to privacy?

The law defines personal information that is seeks to protect. Section 3(g) defines personal information to refer to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual. It is differentiated with sensitive personal information defined in Section 3(l) to refer to “personal information: (1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; (2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or cm-rent health records, licenses or its denials, suspension or revocation, and tax returns; and (4) Specifically established by an executive order or an act of Congress to be kept classified. Along with these, the security of personal information under Section 20 mandates that personal information controllers must implement reasonable and appropriate organizational, physical and technical measures intended for the protection of personal information in as much as they will be accountable for its transfer under Section 21. This is likewise to prevent the payment of penalties provided under Section 25 to 37 and any other laws that may be violated along with it.

Therefore, when a person hands out personal information whether ordinary or sensitive to another natural or juridical person, they must be careful when disclosing it to other people. Consent must be obtained first before giving it away. Atty. Guerrero, a technology and the law professor said that information is power, the more information, the more power and the more money there is. Disclosing of personal information to be liable under the law must consider the intent and purpose of such disclosure. Sales people before contacting their prospective clients must be able to establish that they got their personal information through lawful means. Otherwise, they may cause a violation of the right to privacy. Telemarketing in the sale of real estate should be regulated. Texting or calling unknown prospects that sales people don’t know personally or by referral, have not met in any event or sales booths or site visits or have no connection at all to them must be punished under the law. Sending of messages must be filtered to only those who allow themselves to receive these information. This encourages protection to people who opt to live private lives. At the end of the day, the people must have a choice when giving away their personal information and to whom it may be given. It must only be for the purpose on which it was intended.

Sources:

[1] Salonga, J. (2011). Right to Privacy. Retrieved from http://salongacenter.org/2011/07/right-to-privacy/

[2] Privicilla (2001). Privacy Fundamentals. Retrieved from http://www.privacilla.org/fundamentals/whyprivacy.html

[3] Janalta Interactive Inc, (2010-2014). Techopedia. Retrieved from http://www.techopedia.com/definition/24152/information-and-communications-technology-ict

[4] NCCA. Information and Communications Technology. Retrieved from http://www.ncca.ie/en/Curriculum_and_Assessment/ICT/

[5] Ibid.

[6] TJD, GMA News, (2013, October 11). How the Data Privacy Act impacts Philippine Businesses. Retrieved from https://ph.news.yahoo.com/data-privacy-act-impacts-phl-businesses-161916797.html

[7] Palabrica, R. (2012, August 31). Data Privacy Act of 2012. Retrieved from http://business.inquirer.net/79534/data-privacy-act-of-2012

[8] Ibid.

[9] Rosell, L. & Tomarong-Cañaban, S. (2012). Analysis: The Philippines’ Data Privacy Act of 2012. Retrieved from http://www.globallawwatch.com/2012/09/analysis-the-philippines-data-privacy-act-of-2012/

[10] Ibid.

[11] Ibid.

[12] Almaden, J. Philippine Real Estate: Is it still a good investment in 2014?. Retrieved from http://philpropertyexpert.com/philippine-real-estate-is-it-still-a-good-investment-in-2014/

[13] Kohler, M. Why you should be investing your money in real estate”. Retrieved from http://www.entrepreneur.com/article/228506

[14] Dvorak, D. How to Define a Sales Process for Sales Success”. Retrieved from http://www.nasp.com/article/D6BC485A-B705/how-to-define-a-sales-process-for-sales-success.html

[15] Ibid.

 

Advertisements

One thought on “Situational Gray Areas of Republic Act no. 10173 otherwise known as the Data Privacy Act of 2012

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s