Data Privacy Act of 2012

What is the short title of the Data Privacy Act of 2012?

• Republic Act No. 10173

• Data Privacy Act of 2012

• National Privacy Commission

• Protection of Personal Information

What is NOT the definition of 'personal information'?

• Any information from which the identity of an individual can be ascertained

• Includes sensitive personal information

• Can be recorded in online form

• All of the above

What is the function of the National Privacy Commission?

• Ensure compliance of personal information controllers with the Act

• Receive complaints and facilitate settlement

• Issue cease and desist orders

• All of the above

What is one of the principles for processing personal information?

• Processed fairly and lawfully

• Processed without consent

• Processed for commercial purposes

• Processed without safeguards

Under what condition is the processing of personal information permitted?

• The data subject has given consent

• The processing is unnecessary

• The processing violates privacy rights

• The processing is for commercial gain

When can sensitive personal information be processed?

• When the data subject has given consent

• When it is necessary for medical treatment

• When it is used for commercial purposes

• When it is shared with third parties

What is the responsibility of a personal information controller when subcontracting the processing of personal information?

• Ensure proper safeguards are in place

• Transfer all responsibility to the subcontractor

• Ignore the security of personal information

• Avoid any liability for data breaches

What rights does a data subject have?

• Right to be informed and access personal information

• Right to process personal information without consent

• Right to share personal information with third parties

• Right to retain personal information indefinitely

What is the principle of accountability?

• Each personal information controller is responsible for personal information

• Personal information controllers are not accountable for data breaches

• Personal information controllers are exempt from security measures

• Personal information controllers have no obligations

What is the requirement for securing sensitive personal information in government agencies?

• Use the most appropriate security standard

• No security measures are necessary

• Rely on guidelines issued by the Commission

• Transfer all sensitive personal information to third parties