DATE: September 5, 2017

TO: Sir JADS

FROM: Legal Department

RE: Query on Data Privacy Act

Query:
Whether it is mandatory for SCIC to register under the Data Privacy Act?

Advice:
Yes, it mandatory for SCIC to register under the data privacy act.
Section 47 Of Implementing Rules And Regulations Of Republic Act No. 10173 (Irr),
Known As The "Data Privacy Act Of 2012" states that:
Registration of Personal Data Processing Systems. The personal
information controller or personal information processor that employs
fewer than two hundred fifty (250) persons shall not be required to
register unless the processing it carries out is likely to pose a risk to the
rights and freedoms of data subjects, the processing is not occasional,
or the processing includes sensitive personal information of at least
one thousand (1,000) individuals.
Interpreting this section, it is declared that a personal information processor processing
sensitive information of at least one thousand (1000) individuals is required to register. So
what is sensitive information?
According to Section 3(T) of the IRR, Sensitive personal information refers to personal
information:

1. About an individual's race, ethnic origin, marital status, age,

color, and religious, philosophical or political affiliations;
2. About an individual's health, education, genetic or sexual life
of a person, or to any proceeding for any offense committed or
alleged to have been committed by such individual, the disposal of
such proceedings, or the sentence of any court in such
proceedings;
3. Issued by government agencies peculiar to an individual which
includes, but is not limited to, social security numbers, previous or current
 health records, licenses or its denials, suspension or revocation, and tax
returns; and
4. Specifically established by an executive order or an act of Congress
to be kept classified.

Clearly, SCICs recording of the marital status, age, religious affiliations and other data which
are considred as sensitive personal information puts SCIC within the ambit of the law.

Thus, SCIC must register under the Data Privacy Act.