The National Privacy Commission recently issued Circular No. 2023-04, which provides guidelines on the use of consent as a lawful basis for processing personal data, including default formats for privacy notices and rules on withdrawal of consent.
Personal Information Controllers and Personal Information Processors that are covered by the registration requirement under NPC Circular No. 2022-04 have until 10 July 2023 to register their respective Data Protection Officers (DPOs) and Data Processing Systems (DPS) with the National Privacy Commission through its online registration portal.
The National Privacy Commission issued Circular No. 2023-01, entitled “Schedule of Fees and Charges of the National Privacy Commission”, which sets out their fee schedule for various services, including fees for the registration of Data Protection Officers and Data Processing Systems with the NPC. The Circular takes effect on 8 June 2023. Services rendered or filings done prior to 8 June will not be charged with these fees.
The National Privacy Commission issued Circular No. 2022-04 on 5 December 2022, which sets out the registration framework of Data Protection Officers and Data Processing Systems. Under the Circular, personal information controllers and personal information processors operating in the Philippines are required to register with the NPC as long as they meet any of the conditions for registration. The Circular took effect on 11 January 2023.
On 10 October 2022, President Ferdinand Marcos Jr. signed into law Republic Act No. 11934, otherwise known as the “Subscriber Identity Module (SIM) Registration Act”. The primary purpose of the Act is to mandate all public telecommunications entities to require the registration of SIM cards prior to their sale and activation, in an effort to promote accountability and provide law enforcement with an identification tool in resolving crimes .
The National Privacy Commission issued Circular No. 2022-01 on 12 August 2022, entitled “Guidelines on Administrative Fines”. The Circular fixes the administrative fines to be imposed upon personal information controllers or personal information processors for infractions of the Data Privacy Act of 2012, its implementing rules and regulations, and the issuances of the NPC. The Circular takes effect on 27 August 2022 and will apply prospectively. Thus, complaints that have already been filed with the NPC prior to the effectivity date are not covered by the Circular.
The National Privacy Commission recently announced that the deadline for the submission of Annual Security Incident Reports for the years 2018 to 2021 is on 31 October 2022, while the deadline to submit the 2022 version of said report is on 31 March 2023.
President Rodrigo Duterte signed into law Republic Act No. 11659 or “An Act Amending Commonwealth Act No. 146,” otherwise known as the Public Service Act, as amended on 21 March 2022. The amendment aims to liberalize previously restricted service industries to encourage private enterprise and foreign investment. While the law provides an exclusive list of sectors that are to be classified as ‘public utilities’ that remain subject to foreign ownership restrictions, the amendment also removes the 40% foreign ownership investment cap on certain public service sectors, including telecommunications.
In an announcement made on 4 March 2022, the Philippine National Privacy Commission officially extended the validity of all existing Certificates of Registration issued in 2021 from 8 March 2022 to 8 March 2023. For Certificates of Registration issued in 2020 or earlier, which are expiring this 8 March 2022, the NPC is directing all affected personal information controllers and personal information processors to renew their registration with the Commission.
On 4 June 2021, the Philippine National Privacy Commission (NPC) announced that it will be holding off the launch of its eRehistro system in order “to make way for a complete solution that integrates all the services related to data privacy compliance.”