What the Circular provides

The Circular follows a tiered system, such that the amount of the administrative fine, which the NPC can impose to an erring PIC or PIP, will depend on the type of infraction committed, namely:

• For grave infractions, the NPC can impose an administrative fine ranging from 0.5% to 3% of the PIC's or PIP's annual gross income. 
  A grave infraction is committed when: 
  1. There is an infraction of any of the general privacy principles in the processing of personal data pursuant to Section 11 of the DPA, where the total number of affected data subjects exceeds 1,000.
  2. There is an infraction of any of the data subject rights pursuant to Section 16 of the DPA, where the total number of affected data subjects exceeds 1,000.
  3. There is a repetition of the same infraction penalized under the Circular, regardless of whether the first infraction was classified as a major or other infraction.
• For major infractions, the NPC can impose an administrative fine ranging from 0.25% to 2% of the PIC's or PIP's annual gross income. 
  A major infraction is committed when: 
  1. There is an infraction of any of the general privacy principles in the processing of personal data pursuant to Section 11 of the DPA, and where the total number of affected data subjects is 1,000 or below.
  2. There is an infraction of any of the data subject rights pursuant to Section 16 of the DPA, where the total number of affected data subjects is 1,000 or below.
  3. There is failure on the part of the PIC to implement reasonable and appropriate measures to protect the security of personal information pursuant to Section 20 (a), (b), (c), or (e) of the DPA.
  4. There is failure on the part of the PIC to ensure that third parties processing personal information on its behalf shall implement security measures pursuant to Section 20 (c) or (d) of the DPA.
  5. There is failure on the part of the PIC to notify the NPC and affected data subjects of a personal data breach pursuant to Section 20(f) of the DPA, unless otherwise punishable by Section 30 of the DPA.

In both cases, the computation shall be based on the PIC's or PIP's annual gross income of the immediately preceding year when the infraction occurred. Note that for purposes of said computation, the NPC may require the PIC or PIP to submit its audited financial statement filed with the appropriate tax authorities for the immediately preceding year when the infraction occurred, its last regularly prepared balance sheet or annual statement of income and expenses, and such other financial documents as the NPC may deem relevant and appropriate. However, where the PIC or PIP has not been operating for more than one year, the basis for the NPC's computation will be its gross income at the time the infraction was committed.

The NPC is also empowered to impose administrative fines for other infractions, including the failure to register the true identity or contact details of the PIC, the data processing system, or information on automated decision-making which can reach up to either PHP 200,000¹ (approximately USD 4,000) or PHP 50,000² (approximately USD 1,000), depending on the violation committed.

Notwithstanding the foregoing, please note that the total imposable administrative fine for a single act or omission of a PIC or PIP, whether resulting in a single or multiple infractions, shall not exceed PHP 5 million (approximately USD 100,000).

The Circular further sets out the factors that the NPC should consider, including the categories of data affected and any mitigating action adopted by the PIC or PIP to reduce the harm to the data subject, when determining the amount to be imposed, which must nevertheless be within the ranges mentioned in the Circular.³ Moreover, the Circular provides that no administrative fine shall be imposed by the NPC unless the PIC or PIP is afforded due process (i.e., notice and hearing) in accordance with its Rules of Procedure.

Finally, the Circular provides that PICs or PIPs who refuse to pay the imposed administrative fine may be subject to a cease and desist order, other processes or reliefs that the NPC may be authorized to initiate under the DPA, and appropriate contempt proceedings under the Rules of Court.
 

Recommended actions

Clients are advised to take the necessary steps to ensure compliance with the DPA, its implementing rules and regulations, and the issuances of the NPC, and to avoid committing any of the infractions mentioned in the Circular, which are subject to potential administrative fines imposed by the NPC.