The National Privacy Commission issued a press release on 5 June 2024 to “sternly” warn businesses processing personal information that it will issue show cause orders in the case of non-compliance with the Data Privacy Act of 2012 and relevant NPC issuances, particularly NPC Circular No. 2022-04, which outlines the registration framework for data processing systems and data protection officers.

The National Privacy Commission (NPC) recently issued NPC Circular No. 2024-01 (“Circular”), which amends certain provisions of the 2021 Rules of Procedure. The Circular aims to further streamline the process of receiving complaints and instituting investigations on matters affecting any personal information. The amendments impose certain requirements in case of privacy violation complaints by minors or persons alleged to be incompetent.

Consent is not the only available lawful basis for processing personal information. Personal information controllers and other parties engaged in the processing of personal information may also use legitimate interest as a lawful basis for processing. However, these parties must be aware of the conditions and limitations for processing personal information based on legitimate interest. For this reason, the National Privacy Commission (“NPC”) recently issued NPC Circular No. 2023-07, which provides guidelines on the processing of personal information based on legitimate interest. The Circular takes effect on 14 January 2024.