There is no existing comprehensive legislation on personal data protection or information privacy. Privacy rights are generally considered to be connected with the due process clause of the Constitution.

The right to privacy is closely related to constitutional guarantees granted to individuals:

These guarantees serve as safeguards for private citizens against the state's actions, and do not limit private transactions and activities undertaken by non-state entities and individuals in relation to private persons.

There are specific statutory provisions that recognise and safeguard an individual's right to privacy providing a cause of action for damages and for other equitable relief if intrusive acts are committed by private persons. These acts include (Articles 26 and 32, Civil Code):

The courts have yet to interpret these privacy provisions in relation to personal data. However, the collection, processing, and use of personal information for commercial and non-commercial purposes without an individual's (data subject's) knowledge and consent can be construed as, and can give rise to, a cause of action for violation of privacy rights.

Specific provisions concerning the right to privacy over information are found in the:

The Electronic Commerce Act (ECA) imposes a confidentiality obligation on any person who gained lawful access to information covered by or contained in an electronic data message or electronic document (section 32, ECA).

Although the Philippines has not yet enacted comprehensive data protection and privacy legislation, the government can set up and impose regulatory measures on activities relating to the collection, processing and use of personal information through its policing powers. Under Executive Order No. 269, the government created the Commission on Information and Communications Technology (CICT) to play a more proactive role in the information and communications technology industry. The CICT is responsible for creating policies that preserve the rights of individuals to the privacy and confidentiality of their personal information.

There are currently efforts to draft legislation for data protection based on the EU Council Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Data Protection Directive).

The Department of Trade and Industry (DTI) issued Department Administrative Order No. 8, Series of 2006 (DTI Guidelines) as guidelines for the protection of personally identifiable data in private sector information and communications systems. These guidelines aim to encourage and provide support to private entities in protecting personal data through policies that are legally compliant and driven by choice, individual empowerment and market-led solutions. The DTI Guidelines are closely based on the Data Protection Directive. They also encourage entities to provide options to consumers or data subjects in relation to the control, confidentiality and anonymity of their personal information.

However, the DTI Guidelines do not impose any mandatory compliance obligations on the data controller and/or data processor. They serve only as a best practice guide and therefore there are no penal or administrative sanctions for breach.

As the DTI Guidelines are the only regulatory measure which deals directly with the protection of personally identifiable information, the chapter focuses on these guidelines.

The DTI Guidelines apply to data protection certifiers. A data protection certifier is an independent third party duly accredited by the DTI Accreditation Office to certify a licensee company's privacy programme, and to monitor and oversee the programme's implementation and enforcement (section 3.6, DTI Guidelines).

A licensee company is any data processor duly certified by the DTI-accredited data protection certifier as having a privacy programme that complies with and meets minimum standards under the DTI Guidelines (section 3.11, DTI Guidelines).

The definitions for data controllers and data processors under the DTI Guidelines are similar to those found in the Data Protection Directive. A data controller is any person who (either alone, jointly or in common with other persons) determines the purposes and the manner in which, any personal data is, or is to be, processed (section 3.4, DTI Guidelines). A data processor is any person (other than the data controller's employee(s)) who processes data on behalf of the data controller (section 3.5, DTI Guidelines).

The DTI Guidelines regulate personal data. Personal data is defined as any information relating to an identified or identifiable natural person (section 3.12, DTI Guidelines). The DTI Guidelines apply to the processing of all types of personal data which (section 2.3, DTI Guidelines):

The DTI Guidelines set out minimum standards for the following in relation to personal data:

The DTI Guidelines apply to the following parties situated in the Philippines:

There are no exemptions to the DTI Guidelines because compliance is not mandatory (see Question 1).

Although the DTI Guidelines are not mandatory, they set out criteria which are considered to make the processing of personal data lawful, including that (section 4.2, DTI Guidelines):

These criteria are similar to those in Article 7 of the Data Protection Directive.

The general principles in relation to protection of personal data are that personal data must be (section 4.1, DTI Guidelines):

This provision of the DTI Guidelines is similar to Article 6 of the Data Protection Directive.

Consent of the data subjects is generally not an indispensable requirement (see Question 7), provided that both (section 4.2, DTI Guidelines):

Consent is required before the processing of personal data, provided that certain conditions exist (see Questions 7 and 9).

Apart from the DTI Guidelines, there are provisions in other local laws which regulate an individual's right to privacy over specific types of information (see Question 1).

The Secrecy of Bank Deposits Law (SBDL) generally prohibits the unwarranted disclosure and/or use of information in relation to bank depositors. However, the SBDL provides for several exceptions as a result of recent amendments, including in the following circumstances:

The National Internal Revenue Code gives the Commissioner of Internal Revenue the power to obtain information to:

The Commissioner can obtain this information by examining any record, book or material relevant to his inquiry, or from any person other than the taxpayer under investigation.

Republic Act No. 8282 (the new Social Security System Law (SSS Law)) imposes on the SSS the obligation to keep information given by SSS members or by their employers in their records and reports confidential except in compliance with a court subpoena (section 24(c), SSS Law).

This law was enacted to provide a legal framework to safeguard the rights of persons inflicted with AIDS, particularly their basic human rights and civil liberties, which includes the right to privacy.

The law has established anonymous HIV testing which requires all hospitals, clinics, laboratories, and testing centres for HIV/AIDS to adopt measures that will assure the confidentiality of all relevant medical records and data. In addition, the following parties must strictly observe confidentiality in handling medical records, files or data, particularly the identity and status of persons with HIV/AIDS:

Only the following parties are authorised to receive the results of an HIV/AIDS test:

The DTI Guidelines are silent concerning the types of information that a data controller should provide to data subjects at the point of collection of the personal data. However, at the point of processing of personal data, the data subject has the right to be informed by the data controller that his personal data is being processed (section 4.5, DTI Guidelines).

The DTI Guidelines outline the rights granted to data subjects.

A data subject also has the right to request the following information (section 4.6, DTI Guidelines):

Within 30 days from the submission date of the relevant request, the data subject has the right to receive the information details in section 4.6 of the DTI Guidelines from the data controller or data processor (section 4.7, DTI Guidelines).

The data subject can request that his personal data be supplemented or rectified, for its processing to be suspended, or for data to be destroyed, if a data subject's personal data is (section 4.8.1, DTI Guidelines):

The data subject has the right to object to the processing of his personal information when the data will be used for commercial purposes (section 4.9, DTI Guidelines).

The data controller and data processor must implement appropriate organisational and technical measures to protect personal data from (section 8.1, DTI Guidelines):

These measures must ensure an appropriate level of security.

The DTI Guidelines do not set out specific security requirements for the protection of personal data.

The data controller can allow a data processor to process personal data provided that:

There are currently no rules that regulate the transfer of data outside the Philippines.

There are currently no standard-form data transfer agreements approved by national authorities.

There is no legislation or guidance on data transfer agreements legitimising transfer.

There is no legislation or guidance on national regulator approval.

The DTI Guidelines are not mandatory obligations (see Question 1). Therefore the powers granted by the DTI Guidelines to the Accreditation Office do not include sanctions against entities who do not submit themselves to voluntary accreditation. Therefore, the powers of the Accreditation Office are limited to those who sought voluntary accreditation of their respective privacy policies and programmes.

See Question 20.