By Alden A. Quiñones
Understanding the Data Privacy Act of 2012 (Republic Act No. 10173)
In today’s digital world, personal information is being collected, stored, accessed, and shared almost every day. Whether we are using computers, mobile phones, online applications, email, or physical documents, we have a responsibility to ensure that personal information is properly protected.
The Philippines enacted Republic Act No. 10173, also known as the Data Privacy Act of 2012, to protect the fundamental right to privacy while allowing the responsible use of information.
The law applies to both government and private organizations that process personal information.
What information should we protect?
Personal information includes any information that can identify an individual, either directly or when combined with other available information.
Examples include:
- Full name, address, and contact number
- Birthdate and identification numbers
- Employment and educational records
- Financial and account information
- Medical and health records
- Government-issued identification details
Some information is classified as sensitive personal information and requires additional protection under the law.
What are the responsibilities of every user?
Regardless of position or designation, every employee or system user must practice responsible handling of information.
1. Protect your account credentials.
Never share your username and password with other people. Use strong passwords and avoid using the same password across different systems.
2. Access only the information you are authorized to use.
Having access to a computer system does not mean you are allowed to access every record. Only access information necessary for your assigned responsibilities.
3. Do not disclose personal information without proper authority.
Never send, share, or discuss personal information with unauthorized individuals. Be careful when sending emails, attachments, screenshots, and documents.
4. Secure your workstation and documents.
Lock your computer when leaving your workstation. Do not leave printed documents containing personal information unattended.
5. Be careful when using social media.
Never post screenshots, beneficiary information, employee records, internal documents, or other confidential information on social media or public platforms.
6. Avoid suspicious links and attachments.
Be alert to phishing emails, suspicious websites, and unknown files that may compromise your account or expose organizational information.
7. Report suspected data breaches immediately.
If you accidentally send information to the wrong recipient, lose a device, discover unauthorized access, or notice suspicious system activity, report it immediately through the proper organizational channels.
8. Follow organizational data privacy policies.
Observe established guidelines on data collection, storage, retention, sharing, and disposal. When unsure, consult your supervisor or Data Protection Officer.
Remember the Three General Data Privacy Principles
The Data Privacy Act establishes three fundamental principles that guide the proper processing of personal information.
Transparency – Individuals must be properly informed about how and why their personal information is collected and processed.
Legitimate Purpose – Personal information must only be processed for declared, specified, and legitimate purposes.
Proportionality – Only personal information that is adequate, relevant, and necessary for the intended purpose should be collected and processed.
Why does this matter?
A single careless action can expose personal information and affect the privacy, security, and trust of individuals.
A simple mistake, such as sharing a password, sending an attachment to the wrong recipient, or posting a screenshot containing personal information, can result in serious consequences.
Data privacy should not be treated as a responsibility of the IT Office alone. Technical safeguards, security systems, and organizational policies are important, but the cooperation and discipline of every user are equally necessary.
Make Data Privacy a Daily Practice
Before collecting, accessing, using, or sharing information, always ask yourself:
- Am I authorized to access this information?
- Do I really need this information for my work?
- Am I sharing it with the right person?
- Is the information properly secured?
- Am I following the applicable data privacy policies?
Remember: Protecting personal information is not just about complying with the law. It is about respecting the rights, dignity, and privacy of every individual.
Let us all become responsible users and make data privacy part of our everyday work.
Reference:
- Republic Act No. 10173 – Data Privacy Act of 2012
- National Privacy Commission – https://privacy.gov.ph/
Think before you access. Think before you share. Protect personal information.