PROHIBITED ACTS UNDER THE DATA PRIVACY ACT OF 2012

Aside from prohibited acts under Data Privacy Act, read also: WHEN DATA PRIVACY ACT DOES NOT APPLY

• Unauthorized processing of personal information is punishable under the law

• Processing of personal information for unauthorized purposes is also punishable

• An imprisonment and a fine are imposed upon any person who violated the Data Privacy Act

Malicious Disclosure of any personal information is a prohibited act under the Data Privacy Act.

What are other acts punishable under the Data Privacy Act?

The law says:

The following are punishable under the Data Privacy Act of 2012:

1. Unauthorized processing of personal information and sensitive personal information

• It is committed when the processing of the same was done without the required consent of the data subject or the person whose personal information is being processed, or without being authorized under the Data Privacy Act or any existing law.

2. Accessing personal information and sensitive personal information due to negligence

• It is committed when a person provided access to personal information of the data subject due to his or her negligence.

3. Improper disposal of personal information and sensitive personal information

• It is committed when a person knowingly or negligently disposes, discards, or abandons the personal information of an individual in an area accessible to the public or has otherwise placed the personal information of an individual in its container for trash collection.

4. Processing of personal information and sensitive personal information for unauthorized purposes

• It is committed when a person processed personal information for purposes not authorized by the data subject, or otherwise authorized under the Data Privacy Act or under existing laws.

5. Unauthorized access or intentional breach

• It is committed when a person knowingly and unlawfully violates data confidentiality and security data systems, breaks in any way into any system where personal and sensitive persona information is stored.

6. Concealment of security breaches involving sensitive personal information

• It is committed when a person, after having knowledge of a security breach and of the obligation to notify the National Privacy Commission, intentionally or by omission conceals the fact of such security breach.

7. Malicious Disclosure

• It is committed when a person, with malice or in bad faith, discloses unwarranted or false information relative to personal information or personal sensitive information obtained by him.

8. Unauthorized Disclosure

• It is committed when a person discloses to a third person personal information without the consent of the data subject. In this mere disclosure without the consent of the data subject is prohibited.

What if the offender is a corporation, partnership any juridical person?

The law says:

The penalty shall be imposed upon the responsible officers, as the case may be, who participated in, or by their gross negligence, allowed the commission of the crime.

What is common among the above-enumerated prohibited acts is that all of them are punishable by imprisonment and a fine. The duration of the imprisonment and the amount of imposable fine depends on what specific prohibition was committed.

To sum up:

PROHIBITED ACT			PENALTY
			As to imprisonment (in years)	As to fine (In Philippine Peso)
1.Unauthorized Processing of:		a. Personal information	1 to 3	500,000 to 2,000,000
		b. Sensitive personal information	3 to 6	500,000 to 4,000,000
2. Accessing to information due to negligence		a. Personal information	1 to 3	500,000 to 2,000,000
		b. Sensitive personal information	3 to 6	500,000 to 4,000,000
3. Improper Disposal of:		a. Personal information	6mos to 2y	100,000 to 500,000
		b. Sensitive personal information	1 to 3	100,000 to 1,000,000
4. Processing of Information for Unauthorized Purposes		a. Personal information	1y and 6mos to 5y	500,000 to 1,000,000
		b. Sensitive personal information	2 to 7	500,000 to 2,000,000
5. Concealment of Security Breaches Involving Sensitive Personal Information			1y and 6mos to 5y	500,000 to 1,000,000
7. Malicious Disclosure			1y and 6mos to 5y	500,000 to 1,000,000
8. Unauthorized  Disclosure	a. Personal information		1 to 3	500,000 to 1,000,000
	b. Sensitive personal information		3 to 5	500,000 to 2,000,000

Please note that a longer duration of imprisonment ranging from three (3) years to six (6) years and a increased fine ranging from One (1) million pesos to Five (5) million pesos are imposable when a person committed any combination or series of the above-mentioned prohibited acts.

---

Alburo Alburo and Associates Law Offices specializes in business law and labor law consulting. For inquiries, you may reach us at info@alburolaw.com, or dial us at (02)7745-4391/0917-5772207.

All rights reserved.

---

SUBSCRIBE NOW FOR MORE LEGAL UPDATES!

[email-subscribers-form id=”4″]