Activity 1.2 (Data Privacy Act of 2012)

Data Privacy Act of 2012)

Multiple Choice

Data privacy is the right of a citizen to have control over how personal information is collected and used.

• True

• False

Multiple Choice

An act protecting individual personal information in information and communications systems in the government and the private sector, creating for this purpose a national privacy commission, and for other purposes

• Data Privacy Act of 2012

• Cyber Crime Law

• Security Commission

• Information and Communication Technology

Data Privacy Act of 2012

It is an act protecting individual personal information in information and communications systems in the government and the private sector, creating for this purpose a national privacy commission, and for other purposes

Multiple Choice

Consent of the data subject refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her.

• True

• False

Multiple Choice

Is everyone potentially a ‘data subject’? What about children, the elderly?

• Yes

• No

Data subject refers to an individual whose personal information is processed.

Multiple Select

What are the Different Rights of the data subject? (SELECT ALL THAT APPLY)

• Be informed whether personal information pertaining to him or her shall be, are being or have been processed

• Be furnished the information indicated before the entry of his or her personal information into the processing system of the personal information controller

• Reasonable access to, upon demand

• Dispute the inaccuracy or error in the personal information

• Suspend, withdraw or order the blocking, removal or destruction of his or her personal information

SEC. 16. Rights of the Data Subject. – The data subject is entitled to:

Be informed whether personal information pertaining to him or her shall be, are being or have been processed

Multiple Choice

If my data is anonymized, do I need to consider data protection issues?

• Yes

• No

Data which cannot be linked to an identifiable living individual is not personal data, as defined by the DPA 

Open Ended

What is the difference between ’anonymous’ and ‘pseudonymous’ data?

Technically, data is only anonymized when an individual can no longer be identified from it.

Multiple Choice

Offenses against the confidentiality, integrity and availability of computer data and systems shall be punished with imprisonment of prison mayor or a fine of at least Two Hundred Thousand Pesos (P200,000.00)

• True

• False

Section 4. Cybercrime Offenses. – The following acts constitute the offense of core cybercrime punishable under RA 10175

Multiple Choice

The access to the whole or ANY PART of a computer system without right can be considered as Illegal Access

• True

• False

Republic Act No. 10175 

Section 4. 1

Illegal Access – The access to the whole or any part of a computer system without right.

Multiple Choice

The intentional or reckless alteration, damaging, deletion or deterioration of computer data, electronic document, or electronic data message, without right, including the introduction or transmission of viruses is considered a Cybercrime Offense?

• True

• False

Republic Act No. 10175 

Section 4.3 Data Interference. — The intentional or reckless alteration, damaging, deletion or deterioration of computer data, electronic document, or electronic data message, without right, including the introduction or transmission of viruses.

Open Ended

What is Cyber-squatting?

Computer-related Forgery

The input, alteration, or deletion of any computer data without right resulting in inauthentic data with the intent that it be considered or acted upon for legal purposes as if it were authentic, regardless whether or not the data is directly readable and intelligible

Multiple Choice

The input, alteration, or deletion of any computer data without right resulting in inauthentic data with the intent that it be considered or acted upon for legal purposes as if it were authentic.

• Computer-related Forgery

• Cyber Squatting

• Computer-related Fraud

• Computer-related Identity Theft

When a perpetrator alters documents stored in computerized form, the crime committed may be forgery.

Open Ended

What is a Privacy

Notice?

A privacy notice is a statement made to a data

subject that describes how the organization collects,

uses, retains and discloses personal information.

Open Ended

What is a Privacy Management Program?

Privacy Management Program

The PMP puts everyone on the same page. It provides

an easier way to explain to the management and

staff: why are we doing this, what are the results we

expect, what are the benefits of those results, and

what do we need to do to get there. With this, you

will smoothly get everyone on board.

Multiple Select

What does the Data

Privacy Act of 2012 regulates? (SELECT ALL THAT APPLIES)

• It regulates the collection of personal data

• It regulates the recording, organization and storage of data

• It regulates updating

  or modification, retrieval of personal data

• It regulates consultation, use, consolidation, blocking, erasure or destruction of

  personal data

Republic Act No. 10173 is also known as the Data

Privacy Act of 2012 (DPA).

It (1) protects the privacy of individuals while

ensuring free flow of information to promote

innovation and growth; (2) regulates the collection,

recording, organization, storage, updating

or modification, retrieval, consultation, use,

consolidation, blocking, erasure or destruction of

personal data; and (3) ensures that the Philippines

complies with international standards set for data

protection through National Privacy Commission.

Multiple Choice

What do I need to keep

in mind when storing

clients’ information?

• Personal data shall

  not be retained longer than necessary

• I can keep data as long as i what and can be used as a future reference

The DPA and its IRR provides that personal data shall

not be retained longer than necessary:

1.  for the fulfillment of the declared, specified, and legitimate

purpose, or when the processing relevant to the purpose

has been terminated;

2.  for the establishment, exercise or defense of legal claims; or

3.  for legitimate business purposes, which must be consistent

with standards followed by the applicable industry or

approved by appropriate government agency.

Multiple Choice

Where someone agrees to participate in a particular data collection method, this implies consent about the way in which the data provided are subsequently used.

• True

• False

Consent of the data subject refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her.

Open Ended

What is the meaning of a data subject?

DPA 2012

Data subject refers to an individual whose personal information is processed.

Multiple Choice

The guiding principles of The Data Protection Act are transparency and consent.

• True

• False

Open Ended

What is the Right to Data Portability?

Under R.A. 10173

Your personal data is treated almost literally in the same way as your own personal property. Thus, it should never be collected, processed and stored by any organization without your explicit consent, unless otherwise provided by law. Information controllers usually solicit your consent through a consent form.

SEC. 18. Right to Data Portability. 

The data subject shall have the right, where personal information is processed by electronic means and in a structured and commonly used format, to obtain from the personal information 

Open Ended

What is the meaning of the right to be informed? – RA10173

Open Ended

SCENARIO

A medical doctor in a private hospital in Manila recorded a conversation with his lady patient without the patient’s knowledge and prior consent. Upon realizing what was happening, the patient immediately confronted the doctor and expressed her strong dismay, pointing out the physician’s lack of professionalism in recognizing his personal right to privacy.

Question: What is the responsibility of the Data Controller?

SEC. 16. Rights of the Data Subject. – The data subject is entitled to:

(a) Be informed whether personal information pertaining to him or her shall be, are being or have been processed;

(b) Be furnished the information indicated hereunder before the entry of his or her personal information into the processing system of the personal information controller

Open Ended

Explain - The right to access

The Right to Access

This is your right to find out whether an organization holds any personal data about you and if so, gain “reasonable access” to them. Through this right, you may also ask them to provide you with a written description of the kind of information they have about you as well as their purpose/s for holding them.

Open Ended

Scenario: An individual had been involved in an incident inside and outside a Manila restaurant where his wallet was stolen. He also suffered minor injuries in the incident. He requested access to the restaurant CCTV footage relating to himself, saying he wants to see all details surrounding the incident and possibly figure out a way to recover his wallet.

Question: What should the person in an incident do on the given situation?

How to exercise your right to access your personal data

You must execute a written request to the organization, addressed to its Data Protection Officer (DPO). In the letter, mention that your request is being made in exercise of your right to access under the Data Privacy Act of 2012.

Open Ended

What is the meaning of "The Right to Object"?

The Right to Object

The right to object is most specifically applicable when organizations or personal information controllers are processing your data without your consent for the following purposes

• Direct marketing purposes.

• Profiling purposes.

• Automated processing purposes.

Open Ended

What is The right to erasure or blocking?

Under the law, you have the right to suspend, withdraw or order the blocking, removal or destruction of your personal data.

Multiple Select

Under the law, "RIGHT TO ERASURE OR BLOCKING" You can exercise this right upon discovery and substantial proof of the following. (SELECT ALL THAT APPLY)

• Your personal data is incomplete, outdated, false, or unlawfully obtained.

• It is being used for purposes you did not authorize.

• The data is no longer necessary for the purposes for which they were collected.

• You decided to withdraw consent, or you object to its processing and there is no overriding legal ground for its processing.

• The processing is unlawful.

Open Ended

How to exercise your right to erasure (or blocking)?

Execute a written request to the organization, addressed to its Data Protection Officer (DPO), and have it received. In the letter, mention that your request is being made in exercise of your right to erasure under the Data Privacy Act of 2012.