The Data Privacy Act of the Philippines

Which statement best captures the dual aim of the Data Privacy Act (RA 10173)?

• Promote information flow while protecting privacy rights

• Restrict information sharing across all private entities

• Prioritize innovation over individual confidentiality rights

• Allow unrestricted data use by government and industry

Which statement best captures the dual aim of the Data Privacy Act (RA 10173)?

• Promote information flow while protecting privacy rights

• Restrict information sharing across all private entities

• Prioritize innovation over individual confidentiality rights

• Allow unrestricted data use by government and industry

Which statement best captures the dual aim of the Data Privacy Act (RA 10173)?

• Promote information flow while protecting privacy rights

• Restrict information sharing across all private entities

• Prioritize innovation over individual confidentiality rights

• Allow unrestricted data use by government and industry

When was RA 10173 passed and when was it fully implemented?

• Passed 2012, implemented 2016

• Passed 2016, implemented 2012

• Passed 2013, implemented 2018

• Passed 2011, implemented 2015

Which best describes how RA 10173 protects customers’ confidentiality?

• Focuses only on data encryption technologies

• Outsources oversight entirely to third-party auditors

• Encourages voluntary guidelines without penalties

• Sets legal rules for collection, handling, and disposal

Which example fits the law’s definition of personal information?

• A dataset with no possibility of identification

• Information about a species without human context

• A data point that can directly identify an individual

• Aggregated statistics with irreversible anonymization

Select all that qualify as sensitive personal information under RA 10173.

• Publicly available weather reports

• Religious or political affiliations

• Health and genetic information

• Tax returns and social security numbers

Which situation would make a company legally responsible under RA 10173?

• Reporting aggregated trends with no identifiers

• Failing to prevent internal misuse of customer data

• Publishing open data with prior lawful consent

• Selling anonymized, nonidentifiable weather data

Personal information may be identified when it is combined with other data that can reasonably and directly identify a person. What does this emphasize?

• Risk from data linkage and re-identification

• Safety of all de-identified information sets

• Privacy is not affected by contextual details

• Only explicit names count as identifiers

Which category is explicitly included in sensitive personal information?

• Preferred smartphone operating system

• Email provider and inbox storage size

• Favorite sports and leisure activities

• Court proceedings and case outcomes