The Data Privacy Act COMMISSION of 2012 for the Real PRIVACY … · 2020. 9. 30. · PROPERTY...

The Data Privacy Act of 2012 for the Real

Estate SectorRaymund Enriquez Liboro

Privacy CommissionerNational Privacy Commission

September 27, 2018PROPERTY OF THE NATIONAL PRIVACY COMMISSION

What the lawis all about

How it will affect you

PROPERTY OF THE NATIONAL PRIVACY COMMISSION

https://timeline.com/how-the-first-mass-market-camera-led-to-the-right-to-privacy-and-roe-v-wade-4fb4cd87df7a

R I G H T T O P R I V A C Y

“the right to be let alone - the

most comprehensive of

rights and the right most

valued by civilized men”

[Brandeis J, dissenting in Olmstead v. United States, 277 U.S. 438 (1928)]. PROPERTY OF THE NATIONAL PRIVACY COMMISSION

Picture from http://www.rappler.com/specials/pope-francis-ph/80492-pope-john-paul-assassination-plot

Picture from http://dzrhnews.com.ph/pope-silent-upon-hearing-stories-yolanda-victims/

210 terabytes per second in

2017PROPERTY OF THE NATIONAL PRIVACY COMMISSION

Reference: Computerworld Magazine as noted by the McKinsey Singapore Office

http://s17026.pcdn.co/wp-content/uploads/sites/11/2017/08/AdobeStock_135873223-634x0-c-default.jpeg

http://4.bp.blogspot.com/-s367TP8u6Mw/ULZmvTPEiNI/AAAAAAAACyk/glTGYJrzj9Q/s1600/friends+collage.jpg 1.6 Billion Selfies a Minute

Reference: Computerworld Magazine as noted by the McKinsey Singapore Office

http://s17026.pcdn.co/wp-content/uploads/sites/11/2017/08/AdobeStock_135873223-634x0-c-default.jpeg

http://4.bp.blogspot.com/-s367TP8u6Mw/ULZmvTPEiNI/AAAAAAAACyk/glTGYJrzj9Q/s1600/friends+collage.jpg

From 2005 to 20015, cross-border data flow grew 45 times.

https://images.dazeinfo.com/wp-content/uploads/2017/06/worlds-most-valuable-brands-2017-vs-2012-forbes.jpg

marital status

name net worth

car owner voting habits

clicksdownloads political party

purchases

internet searches

average spending

astrological sign

criminal record

kids in house

usernames

homeowner

AGGREGATION OF PERSONAL DATA

marital status

name net worth

car owner voting habits

clicksdownloads political party

purchases

internet searches

average spending

astrological sign

criminal record

kids in house

usernames

homeowner

AGGREGATION OF PERSONAL DATA

DISCRIMINATIONPeople are discriminated because of their race, color or ethnic origin

Stigmatization

Unfair Decision-Making

Personal information such as marital status, religious or political affiliations affects the decision-making of companies in various cases.

In employment, some experience difficulties in getting hired while others are unfairly dismissed.

Based on Profiling

Sources of Data used in ProfilingTypes of data used in profiling:

• Internet search and browsing history• Education and professional data• Data derived from existing customer relationships• Data collected for credit-worthiness assessments;• Financial and payment data;• Consumer complaints or queries• Driving and location data• Property ownership data• Information from store cards and credit cards• Consumer buying habits• Wearable tech, such as fitness trackers• Lifestyle and behavior data gathered from mobile• Social network information• Video surveillance systems• Internet of things• telematicsPROPERTY OF THE NATIONAL PRIVACY COMMISSION

Access to personal information such as name, date of birth, address, or email address can result to fraudsters victimizing individuals.

Identity Theft

Loss of Reputation

People have experienced stalking or harassment online, trouble with family members, lost a job or educational opportunity because of something posted online, and even as grave as physical danger.

https://www.philstar.com/nation/2008/09/06/398622/canister-scandal-90-day-suspension-2-docs-nurse-ends

http://news.abs-cbn.com/trending/07/27/16/top-gear-sorry-for-identifying-wrong-suspect-in-road-rage

Loss of Autonomy

21st Century Hazards and Risks

The Data Privacy Act (“DPA”) of 2012

Data privacy - acknowledging the rights of Data Subjects over their data and enforcing the responsibilities of entities who process them

a. Transparency – The data subject must be aware of thenature, purpose, and extent of the processing of his or herpersonal data, including the risks and safeguards involved,the identity of personal information controller, his or herrights as data subjects, and how these can be exercised.Any information and communication relating to theprocessing of personal data should be easy to access andunderstand, using clear and plain language.

a. Legitimate Purpose – The processing of information shallbe compatible with a declared and specific purpose whichmust not be contrary to law, morals, or public policy.

b. Proportionality – the processing of information shall beadequate, relevant, suitable, necessary, and not excessive inrelation to a declared and specified purpose. Personal datashall be processed only if the purpose of the processingcould not reasonably be fulfilled by other means.

Transparency, Legitimate Purpose and Proportionality

ROOT CAUSES OF BREACH

Malicious orcriminal attack

System Glitch

Human Error

Ponemon Institute LLC, 2015 Cost of Data Breach Study: Global Analysis, May 2015, p. 10.

• lost or stolen laptops, removable storage devices, or paper records containing personal information

• hard disk drives and other digital storage media (integrated in other devices, for example, multifunction printers, or otherwise) being disposed of or returned to equipment lessors without the contents first being erased

• databases containing personal information being ‘hacked’ into or otherwise illegally accessed by individuals outside of the agency or organization

HOW DO PRIVACY BREACHES OCCUR?

Office of the Australian Information Commissioner, Data breach notification guide: A guide to handling personal information security breaches, August 2014, p. 5.

• employees accessing or disclosing personal information outside the requirements or authorization of their employment

• paper records stolen from insecure recycling or garbage bins

• an agency or organization mistakenly providing personal information to the wrong person, for example by sending details out to the wrong address, and

• an individual deceiving an agency or organization into improperly releasing the personal information of another person.

Office of the Australian Information Commissioner, Data breach notification guide: A guide to handling personal information security breaches, August 2014, p. 5.

HOW DO PRIVACY BREACHES OCCUR?

The Rights of the Data Subject

üRight to be informed Why are you processing my data?üRight to object I don’t want to do this survey anymore

Stop videotaping me.üRight to access What do you know about me?üRight to correct/rectify I want to amend/correct my details.

üRight to block/remove Remove me from your database.üRight to data portability I want a copy of my data.üRight to file a complaintüRight to be indemnified

THE FIVE PILLARS OF ACCOUNTABILITY AND COMPLIANCE

2018Road to Data Privacy Resilience

Five Pillars of Compliance& Accountability

CertificationAnd Seals

Global Certification

Domestic

• Philippine DPO Certification

• The 5 Star Accountability and Compliance (ACE) program

• CBPR: Cross-border Privacy regulations

• GDPR adequacy

• (1) Appoint a DPO

• (2) Know your Risks: Conduct a Privacy Impact Assessment

• (3) Create a Privacy Management Program and Privacy Manual

• (4) Demonstrate accountability and compliance through Privacy and Data Protection Measures

• (5) Breach Management

SectoralCode ofConduct

• Privacy code of conduct

Sectors

Non-CompliantPersonal InformationControllers/Processor

Willful Violators; Evading Compliance

Ignorant Violators; Non-Compliant

EnforcementAwareness Campaigns;

30-60-90 day

Paper Compliance; Non-Operational

Operational Compliance Accountability and

Assurance

Data Privacy Council

building proper

accountability and

assurance

Aim of the

Commission

CompliantPersonal InformationControllers/Processor

1. Privacy management is a top to bottom approach;

2. You should appoint a data protection officer and be sure

to listen to them;

3. Conduct a privacy impact assessment on your

organization;

4. Develop privacy policies within your organization and

Construct your privacy management program to guide your

organization

5. Start building a culture of privacy within your

organizations by implementing organizational, Technical

and physical measures to protect personal data;

6. Build capacity among your staff.

7. Be prepared for breach.

Building a Culture of Privacy

The Data Privacy Golden Rule

If you Can’t Protect It…

DONT Collect It.

Raymund Enriquez LiboroPrivacy Commissioner

September 27, 2018

Thank you for listening!

facebook.com/privacy.gov.phtwitter.com/privacyPHinfo@privacy.gov.ph

The Data Privacy Act COMMISSION of 2012 for the Real PRIVACY … · 2020. 9. 30. · PROPERTY...

Documents

COMMISSION National Privacy Commission: The Data Privacy ... … · An officer or employee of a government institution • Individual is or was an officer or employee of the government

Before the FEDERAL COMMUNICATIONS COMMISSION ...epic.org/privacy/telemarketing/allied_petition.pdfTeleTech Holdings, Inc.; TPG TeleManagement, Inc.; and West Business Services, LP1

EPIC - Electronic Privacy Information Center - Comments of ...2015/02/25 · EPIC’s previous efforts to alert the Commission of the need to assess the impact on consumer privacy

British Columbia Utilities Commission (BCUC or Commission ... · fwtu re jeopardlze: (a) the privacy of indiviouals; (b) the security of any computer system in its custody that is

Presentation to California Energy Commission on Open Source, Security, and Privacy

Library privacy and the privacy audit

the usable security & privacy group · the usable security & privacy group. overview • framing privacy and security decisions • privacy and IoT • privacy on mobile devices

PRIVACY + SECURITY FORUM DIGITAL HEALTH PRIVACY: THE …

Antitrust, Privacy & Big Data Seminar Commission • European Commission considered customer privacy in its review of TomTom/TeleAtlas case • TomTom proposed acquisition of TeleAtlas

The Robot Privacy Paradox: Understanding How Privacy

NEW JERSEY PRIVACY STUDY COMMISSION By: Catherine Starghill, Esq. Privacy Study Commission, Staff

The Federal Trade Commission and Consumer Privacy in · PDF filee The Federal Trade Commission and Consumer ... approaches ranging from industry best practices, self-regulatory

The Privacy Symposium/HIPAA Summit Healthcare Privacy: The Perspective of a Privacy Advocate

Renewing The Privacy Act - Law Commission › Renewing_the_Privacy_Act_Fina… · i The Law Reform Commission of Saskatchewan was established by An Act to Establish a Law Reform Commission,

Privacy in the workplace€¦ · privacy.4 All VPS employees must also adhere to binding Codes of Conduct issued by the Victorian Public Sector Commission. The Codes of Conduct set

PRIVACY IMPACT ASSESSMENT FOR - Federal Trade Commission · PRIVACY IMPACT ASSESSMENT FOR: Sentinel Network Services (SNS) Updated November 2019 . The Federal Trade Commission’s

ris.pmc.gov.auris.pmc.gov.au/sites/default/files/posts/2015/12/Privacy... · Web viewAustralian Law Reform Commission Report on Privacy. In May 2008, the Australian Law Reform Commission

Before the Federal Communications Commission …May 27, 2016 By notice published on April 1, 2016, the Federal Communications Commission (“FCC”) proposes rules to apply privacy

1 Access to Information & Protection of Privacy Information and Privacy Commission, Ontario 2001

THE RISE OF PRIVACY TECH DEFINING THE PRIVACY TECH