The Research Exception under the Data Privacy Act of 2012

The Data Privacy Act of 2012 (herein after referred to as the “Act” or “DPA”) was enacted to bring the Philippines in line with international data protection standards to encourage investment and reinforce the Philippines’ position as a leading Information Technology and Business Process Outsourcing destination.¹

The Act aims to reconcile the right to privacy with the efficient utilization of information. Under the policy statement of the Act, it is understood that even as the law guarantees the protection of an individual’s fundamental right to privacy, it also ensures the free flow of information for innovation, growth, and national development.² The DPA, while upholding the rights of the data subject – a person whose personal information is collected, stored, and processed – does not impede access to information, which may hinder progress and advancement. It does not preclude the processing of personal data for research. In fact, the Act supports initiatives for data sharing, freedom of information and the responsible use and processing of personal data.

Scope and Application

The DPA applies to the processing of all types of personal data – both personal and sensitive information. It does not distinguish between the private and the government sector, as long as the act, practice or processing relates to personal data about a Philippine citizen or Philippine residence, or the processing of personal data is being done in the Philippines or engaged in by an entity with links to the Philippines.³

Research Exception

The Act enumerates categories of information where it will not apply – such as information that fall within matters of public concern.⁴ One such category is that of research purpose. The DPA explicitly exclude the processing of personal information for journalistic, artistic, literary or research purposes from the scope of application of the Act.⁵ The Act and its Implementing Rules and Regulations (the “Rules”) are not applicable to personal information that will be processed for research purposes, intended for a public benefit; subject to the requirements of applicable laws, regulations, or ethical standards.⁶

Data collected from parties other than the data subject for purpose of research shall be allowed when the personal data is publicly available, or has the consent of the data subject for purpose of research. It must be ensured that adequate safeguards are in place, and no decision directly affecting the data subject shall be made on the basis of the data collected or processed. Through the whole process, the rights of the data subject shall be upheld without compromising research integrity.⁷

Under the DPA, the data subject also has the right to data portability. Where a data subject’s personal data is processed by electronic means and in a structured and commonly used format, the data subject shall have the right to obtain from the personal information controller a copy of such data. The exercise of this right to data portability shall primarily take into account the right of the data subject to have control over his or her personal data being processed. This means that if the data subject requests for the data, the data subject has the right to compel the data processor to transfer such data directly to another organization. The electronic format, as well as the technical standards, modalities, procedures and other rules for their transfer shall subsequently be specified by the National Privacy Commission (hereinafter referred to as the “Commission”).⁸

This right to data portability does not apply if the processed personal data are used only for scientific and statistical research, provided that no activities are carried out and no decisions are taken regarding the data subject. However, personal data shall be held under strict confidentiality and shall be used only for the declared purpose. Any limitations on the rights of the data subject shall only be to the minimum extent necessary to achieve the purpose of said research or investigation. ⁹

Review by the National Privacy Commission

Although processing of personal data for research purposes is exempted from the scope of the DPA, the Commission is authorized by the Act to review, upon its own initiative or upon the filing of the complaint by a data subject, the processing of personal data for research purposes. As an exception to the general rule, the exemption of processing of personal and sensitive data from the scope of the DPA should be construed strictly. As aforementioned, any limitations on the rights of the data subject shall only be to the least extent necessary to accomplish the purpose of said research. The non-applicability of the Act or its Rules does not extend to personal information controllers or personal information processors, who remain subject to the requirements of implementing security measures for personal data protection. Any doubt in the interpretation of any provision of the DPA shall be liberally interpreted in favor of the rights and interests of the individual whose personal information is being processed.¹⁰

The rights of a data subject must, at all times, be of the highest importance. Any person, natural or juridical, or any other body that deals with a data subjects’ personal details, whereabouts, and preferences, are duty-bound to observe and respect the data subject’s privacy rights. The Commission remains empowered to compel compliance of the parties concerned and to enable the data subject to remain in full control of his or her information. Should any natural or juridical person, or other body involved in the processing of personal data, violate the provisions of the Act, its Implementing Rules, and other issuances of the Commission, it shall be subject to the corresponding sanctions, penalties, or fines, in addition to any civil or criminal liability, as may be applicable. ¹¹