PRIVATE ORGANIZATIONS could be fined for the year if they violate data privacy rules, according to draft guidelines being circulated for comment by the National Privacy Commission (NPC) said.
The NPC on Thursday published a notice detailing the proposed guidelines, which call for fines on companies violating the Data Privacy Act, or Republic Act 10173.
The proposed fines run as high as 5% of “gross income” for the year for violations. Asked to elaborate on the exact item on the income statement line the fine will be assessed from, the NPC declined to comment, other than to say that it will not be discussing the draft until all comments that emerge from the public consultation are compiled.
Private-sector organizations that process personal information — or those that outsource such processing — can be fined between 1% to 5% of gross income if they break general data privacy rules, such as using personal information beyond the declared purposes.
Last year the commission asked businesses that collect contact tracing forms to limit their use of customers’ personal information, asking the businesses to seek consent for the use of data for other purposes.
Organizations could also be fined for failing to secure consent for the use of personal data or violating people’s rights to be informed about, access, and dispute inaccuracies about their personal information.
Fines can also be imposed on organizations that fail to use appropriate data protection measures or which fail to notify the commission about personal data breaches.
They can also be fined up to P50,000 if they fail to comply with orders from the commission.
The NPC, in deciding on fines, will consider if the violation was intentional or the result of negligence, and the extent of the damage done to the data subject. The commission may under the guidelines also decrease fines for organizations that show proof of financial difficulty.
Comments on the draft will be accepted until May 14. The commission will hold an online public consultation on Friday, April 30. — Jenina P. Ibañez
