The right to be informed

This is your right to find out whether an organization holds any personal data about you and if so, gain “reasonable access” to them. Through this right, you may also ask them to provide you with a written description of the kind of information they have about you as well as their purpose/s for holding them.

Under the Data Privacy Act of 2012, you have a right to obtain from an organization a copy of any information relating to you that they have on their computer database and/or manual filing system. It should be provided in an easy-to-access format, accompanied with a full explanation executed in plain language.


You may demand to access the following:

  • The contents of your personal data that were processed.

  • The sources from which they were obtained.

  • Names and addresses of the recipients of your data.

  • Manner by which they were processed.

  • Reasons for disclosure to recipients, if there were any.

  • Information on automated systems where your data is or may be available, and how it may affect you.

  • Date when your data was last accessed and modified

  • The identity and address of the personal information controller.

Example:

An individual had been involved in an incident inside and outside a Manila restaurant where his wallet was stolen. He also suffered minor injuries in the incident. He requested access to the restaurant CCTV footage relating to himself, saying he wants to see all details surrounding the incident and possibly figure out a way to recover his wallet. He tried to personally speak to the manager but was referred to the security guard. After a few days of following up on his request, he was finally informed that the establishment would not provide him any data. This infuriated him and, upon going back to the restaurant, he demanded his right to view the footage or else he would create a scene. He was told that, as per their security policy, no “outsider” is allowed to enter areas in their establishment designated only as “for employees only”. As a compromise, the manager said they will give him a record of the footage using the customer’s handheld gadget.

Take note of this:

To protect your privacy, the Philippine data privacy law explicitly require organizations to notify and furnish you the following information before they enter your personal data into any processing system (or at the next practical opportunity at least):

  • Description of the personal data to be entered into the system

  • Exact Purposes for which they will be processed (such as for direct marketing, statistical, scientific etc.)

  • Basis for processing, especially when it is not based on your consent

  • Scope and method of the personal data processing

  • Recipients, to whom your data may be disclosed

  • Methods used for automated access by the recipient, and its expected consequences for you as a data subject

  • Identity and contact details of the personal information controller

  • The duration for which your data will be kept

  • You also have to be informed of the existence of your rights as a data subject.

Additional notes:

  • In recording a conversation or interview with someone, it is enough to verbally ask for a direct consent from an individual data subject. If the subject yields, it would be useful to also mention as part of the recorded conversation that the subject knows the conversation is being recorded and that you asked and were given the consent. It would even be better if you could get the subject to verbally confirm his consent.

  • Banks involved in phone banking tell their callers that the conversation with their call center agent would be recorded, and that proceeding with the call is indication of their consent. This practice is considered sufficient notice.

  • Websites resort to publishing a Privacy Notice page, which essentially accomplishes the same thing. Similar privacy notices should be made in public establishments equipped with security CCTVs.

  • Whenever anyone is making an audio or video recording of you, or even just taking your pictures, you have a right to know, and you must always be given the chance to opt out when you don’t feel comfortable.

  • A salesman may be collecting detailed personal data about you and your family without your permission, under the pretext of targeting you as a prospective customer to tailor-fit their offerings to your individual needs. This, by itself, may be potentially beneficial to you. But since your personal privacy and safety becomes potentially at risk, you have a right to be informed if you are being individually targeted in a sales campaign like this.