GENERAL PRINCIPLES FOR DATA SHARING UNDER THE DATA PRIVACY ACT

Read also: GUIDELINES ON THE VERIFICATION OF THE QUALIFICATIONS OF PRIVATE HEALTH WORKERS AND/OR THEIR BENEFICIARIES ON THE GRANT OF COMPENSATION

• Data sharing shall be allowed when it is expressly authorized by law, provided, that there are adequate safeguards for data privacy and security.

• Data Sharing shall be allowed in the private sector if the data subject consents to data sharing.

• Data collected from parties other than the data subject for purpose of research shall be allowed when the personal data is publicly available, or has the consent of the data subject for purpose of research.

The disclosure or transfer to a third party of personal data under the custody of a personal information controller or personal information processor may be allowed. In such case, the disclosure or transfer must have been upon the instructions of the personal information controller concerned.

Implementing Rules and Regulations of Data Privacy Act of 2012 provides for the General Principles for Data Sharing:

Processing of Personal Data collected from a party other than the Data Subject shall be allowed under any of the following conditions:

1. Data sharing shall be allowed when it is expressly authorized by law: Provided, that there are adequate safeguards for data privacy and security, and processing adheres to principle of transparency, legitimate purpose and proportionality.
2. Data Sharing shall be allowed in the private sector if the data subject consents to data sharing, and the following conditions are complied with:
   1. Consent for data sharing shall be required even when the data is to be shared with an affiliate or mother company, or similar relationships;
   2. Data sharing for commercial purposes, including direct marketing, shall be covered by a data sharing agreement.
      1. The data sharing agreement shall establish adequate safeguards for data privacy and security, and uphold rights of data subjects.
      2. The data sharing agreement shall be subject to review by the National Privacy Commission, on its own initiative or upon complaint of data subject;
   3. The data subject shall be provided with the following information prior to collection or before data is shared:
      1. Identity of the personal information controllers or personal information processors that will be given access to the personal data;
      2. Purpose of data sharing;
      3. Categories of personal data concerned;
      4. Intended recipients or categories of recipients of the personal data;
      5. Existence of the rights of data subjects, including the right to access and correction, and the right to object;
      6. Other information that would sufficiently notify the data subject of the nature and extent of data sharing and the manner of processing.
   4. Further processing of shared data shall adhere to the data privacy principles laid down in the Act, these Rules, and other issuances of the Commission.
3. Data collected from parties other than the data subject for purpose of research shall be allowed when the personal data is publicly available, or has the consent of the data subject for purpose of research: Provided, that adequate safeguards are in place, and no decision directly affecting the data subject shall be made on the basis of the data collected or processed. The rights of the data subject shall be upheld without compromising research integrity.
4. Data sharing between government agencies for the purpose of a public function or provision of a public service shall be covered a data sharing agreement.
   1. Any or all government agencies party to the agreement shall comply with the Data Privacy Act, Implementing Rules and Regulations, and all other issuances of the National Privacy Commission, including putting in place adequate safeguards for data privacy and security.
   2. The data sharing agreement shall be subject to review of the National Privacy Commission, on its own initiative or upon complaint of data subject.

---

Alburo Alburo and Associates Law Offices specializes in business law and labor law consulting. For inquiries, you may reach us at info@alburolaw.com, or dial us at (02)7745-4391/0917-5772207.

All rights reserved.

---

SUBSCRIBE NOW FOR MORE LEGAL UPDATES!

[email-subscribers-form id=”4″]