The National Privacy Commission (NPC) formally announced through its official website that the Annual Security Incident Report for the year 2023 must be filed by 31 March 2024.
Any natural and juridical person in the government or private sector processing personal data in or outside of the Philippines that are subject to the provisions of Republic Act No. 10173 or the Data Privacy Act of 2012 must submit the ASIR containing the following information:
• Summary of the number of security incidents encountered in a particular calendar year and categorized by type, i.e., theft, identity fraud, sabotage/physical damage, malicious code, hacking, misuse of resources, hardware failure, software failure, communication failure, natural disaster, design error, user error, operations error, software maintenance error, third-party service, and other analogous causes
• Summary of the number of personal data breaches encountered in a particular calendar year and classified based on the application of the breach notification obligations, i.e., mandatory and voluntary notification

Consent is not the only available lawful basis for processing personal information. Personal information controllers and other parties engaged in the processing of personal information may also use legitimate interest as a lawful basis for processing. However, these parties must be aware of the conditions and limitations for processing personal information based on legitimate interest. For this reason, the National Privacy Commission (“NPC”) recently issued NPC Circular No. 2023-07, which provides guidelines on the processing of personal information based on legitimate interest. The Circular takes effect on 14 January 2024.

The National Privacy Commission (NPC) recently issued NPC Circular No. 2023-03 (“Circular”), which sets out guidelines on the issuance of identification cards to data subjects. The Circular applies to all personal information controllers (PICs) that issue ID cards to data subjects, excluding government-issued ID cards. The Circular took effect on 30 November 2023.

On 7 November 2023, the National Privacy Commission issued Advisory No. 2023-01, which sets out guidance on the nature of deceptive design patterns and how their use by personal information controllers and personal information processors when securing consent vitiates the consent of the data subject and consequently renders the data processing to be without lawful basis.
This Advisory supplements the recently issued NPC Circular No. 2023-04, or the comprehensive guidelines on the use of consent as a lawful basis for processing data, which, among others, prohibits the use of deceptive design patterns.

The National Privacy Commission recently issued Circular No. 2023-04, which provides guidelines on the use of consent as a lawful basis for processing personal data, including default formats for privacy notices and rules on withdrawal of consent.

Personal Information Controllers and Personal Information Processors that are covered by the registration requirement under NPC Circular No. 2022-04 have until 10 July 2023 to register their respective Data Protection Officers (DPOs) and Data Processing Systems (DPS) with the National Privacy Commission through its online registration portal.

The National Economic Development Authority has issued the implementing rules and regulations of the amended Public Service Act or Republic Act No. 11659, which took effect on 4 April 2023.

The National Privacy Commission issued Circular No. 2023-01, entitled “Schedule of Fees and Charges of the National Privacy Commission”, which sets out their fee schedule for various services, including fees for the registration of Data Protection Officers and Data Processing Systems with the NPC. The Circular takes effect on 8 June 2023. Services rendered or filings done prior to 8 June will not be charged with these fees.

The National Privacy Commission issued Circular No. 2022-04 on 5 December 2022, which sets out the registration framework of Data Protection Officers and Data Processing Systems. Under the Circular, personal information controllers and personal information processors operating in the Philippines are required to register with the NPC as long as they meet any of the conditions for registration. The Circular took effect on 11 January 2023.

On 10 October 2022, President Ferdinand Marcos Jr. signed into law Republic Act No. 11934, otherwise known as the “Subscriber Identity Module (SIM) Registration Act”. The primary purpose of the Act is to mandate all public telecommunications entities to require the registration of SIM cards prior to their sale and activation, in an effort to promote accountability and provide law enforcement with an identification tool in resolving crimes .