Testing the Philippine Data Privacy Act of 2012

Published May 8, 2018, 12:00 AM

by manilabulletin_admin

By Rom Feria

On September 2016, the Implementing Rules and Regulations (IRR) of the Philippine Data Privacy Act of 2012 has come into effect. The Philippines’ National Privacy Commission has complex tasks on their hands — for one, instilling the concept of privacy, both to institutions and the Filipinos. As part of the IRR, citizens (data subjects) have rights outlined in the RA10173’s Rule VIII: Rights of Data Subjects. With these rights in mind, let’s test it, and see how the organizations and the National Privacy Commission will react.

Mr. Anton Reynaldo M. Bonifacio, Data Protection Officer, Globe Telecom, Inc.
Mr. Alvin Gendrano, Data Privacy Officer, Smart Communications, Inc.

Dear Mr. Bonifacio and Mr. Gendrano,
I subscribe to both Globe Telecom, Inc., and Smart Communications, Inc., for my postpaid, mobile phone services. As a long-time subscriber, I am sure that you have amassed personally identifiable data about me. The Data Privacy Act of 2012 details our rights as data subjects, as owners of the data you have collected.
To exercise my rights under the law, please provide the following:
1. All data points you have collected over the span of my subscription to your services, including the actual data, all derived data, and all relevant data purchased from third parties, in CSV file format;
2. The actual purposes for the data collected. If the data is shared to third-parties, please include full details of these third-party entities, including, but not limited to the identity and contact details of the personal data controllers, purpose/use of the shared data, data retention, and whether or not, the data was shared to other entities; AND
3. The lifetime (storage) of my data that you have collected, and how it is secured, whether encrypted or not, and who has access (identified with contact details).
I am hoping to hear from you soon. I will provide the specific account numbers associated with my subscription if needed. However, you may be able to start processing the request based on my name alone.