NPC intensifies online, onsite privacy sweeps
The National Privacy Commission (NPC) will be intensifying its enforcement of “privacy sweeps” in line with its compliance measures as part of the amendments made to some provisions of its 2021 Rules of Procedure.
Privacy sweeps, as defined by NPC Circular No. 2024-01, is where the agency reviews the compliance of a personal information controller (PIC) or personal information processor (PIP) to its obligations stipulated in the Data Privacy Act of 2012, the implementing rules and regulations (IRR), and the NPC's own policies.
The sweeps are the initial mode of compliance checks. It involves accessing all publicly available information in websites, mobile applications, brochures, privacy notices, social media pages or accounts, raffle coupons, and all forms of PICs and PIPs.
Once effective, the circular mandates the agency to conduct impromptu, onsite privacy sweeps at the premises, pop-up stores, kiosks, or stalls of a PIC or PIP, especially those in public areas or are easily accessible by the public.
The agency “may verify the PIC or PIP's compliance by examining all physical or digital forms, including but not limited to data processing systems, logbooks, raffle coupons, brochures, and posters used in their operations.”
The compliance checks aim to improve the agency's detection of violations to the Data Privacy Act.
Complementary to this, the NPC has also ensured to streamline its complaint and investigation process by amending its complaint filing criteria and recognizing digital means of complaint processing and mediation.
Section 2 of the new circular, which amended Section 1, Rule II of the 2021 policy, now includes specific provisions for minors, individuals alleged to be incompetent, and non-resident citizens who want to file complaints. It states that proof establishing the representative's relationship with the complainant is sufficient, such as the birth certificate of the parent, or a court order designating guardianship. These documents must be attached to the complaint.
Section 4 of the new policy also now allows multiple partie to join or be joined as complainants or respondents in one complaint.
Through amendments in Section 3, judgements, orders, and resolutions issued by the NPC through electronic systems will be recognized.
Section 5 has also allowed videoconferencing as a legitimate alternative to hold mediation proceedings, enabling appearance and testimonies be done and delivered remotely.
Parties can now also re-apply for mediation even if they failed to reach a settlement in a previous mediation.
The amendments stated within the circular issued on Jan. 26, will be effective by Feb. 10.
The NPC has assured that it will continue to improve its internal mechanisms and systems to facilitate better services for complainants and respondents.
“With the difficulties encountered by the NPC over the past couple of years, especially during the pandemic, it is imperative to streamline, improve, and institutionalize its processes and procedures and amend certain provisions of its Rules of Procedure. To this end, the NPC will be able to further carry out its mandates and functions efficiently,” said Privacy Commissioner Atty. John Henry D. Naga.