Philippines: More updates on eRehistro from the National Privacy Commission

In brief

On 20 March 2021, the Philippine National Privacy Commission (NPC) answered a new batch of frequently asked questions regarding eRehistro, specifically with regard to the commission’s validation process, user credentials and the certificate of registration.

For previous responses from the NPC on this topic, check out our earlier client alert here.


Contents

Recommended actions

While we continue to await the issuance of the formal guidelines by the NPC regarding the eRehistro system, we recommend that personal information controllers (PICs) and personal information processors (PIPs) keep themselves updated by monitoring developments shared by the NPC through both its social media channels and official website. Our firm continues to closely monitor this compliance matter and we will provide more updates in due course.

In more detail

Validation process

After creating an eRehistro account, PICs and PIPs may proceed to upload their documentary requirements1 using the online system in order to complete the application process. The NPC will then validate the application and determine the completeness and correctness of the submission. Thereafter, the commission will notify the PIC or PIP, through the latter’s registered email address, regarding the status of its application, specifically whether it is already “For Approval” or is “Invalid.”

If the NPC finds the PIC or PIP’s application to be complete and accurate, the eRehistro system will send a notification stating that the application has been approved. The NPC will then issue the certificate of registration within seven (7) days.

In case the NPC finds the application to be incomplete and/or inaccurate, the PIC or PIP will receive a notification to this effect, and shall be provided an opportunity to re-submit or complete the required documents for registration.

Registered email address

The NPC recommends using an official or business email address when creating an eRehistro account in order to ensure access by PICs and PIPs.

Effects of registration

The issuance of a certificate of registration by the NPC does not automatically mean that the PIC or PIP is fully compliant with the Data Privacy Act of 2012, its Implementing Rules and Regulations, and the issuances of the NPC, as the registration of both Data Protection Officers and Data Processing Systems is only one of several other compliance points under the law. Hence, despite receiving the certificate of registration, PICs and PIPs are still required to comply with all other data privacy-related requirements which include, among others, upholding the rights of data subjects, ensuring the security of personal data during processing, and adhering to the general data privacy principles of proportionality, transparency and legitimate purpose.


1 To know more about the documentary requirements that need to be uploaded to eRehistro, please refer to our earlier client alert here.

 

LOGO Philippines_QuisumbingTorres_Manila

*Authored by Quisumbing Torres, a member firm of Baker & McKenzie International, a Swiss Verein. Please contact QTInfoDesk@quisumbingtorres.com for inquiries.


© 2021 Baker & McKenzie. Ownership: This site (Site) is a proprietary resource owned exclusively by Baker McKenzie (meaning Baker & McKenzie International and its member firms, including Baker & McKenzie LLP). Use of this site does not of itself create a contractual relationship, nor any attorney/client relationship, between Baker McKenzie and any person. Non-reliance and exclusion: All information on this Site is of general comment and for informational purposes only and may not reflect the most current legal and regulatory developments. All summaries of the laws, regulation and practice are subject to change. The information on this Site is not offered as legal or any other advice on any particular matter, whether it be legal, procedural or otherwise. It is not intended to be a substitute for reference to (and compliance with) the detailed provisions of applicable laws, rules, regulations or forms. Legal advice should always be sought before taking any action or refraining from taking any action based on any information provided in this Site. Baker McKenzie, the editors and the contributing authors do not guarantee the accuracy of the contents and expressly disclaim any and all liability to any person in respect of the consequences of anything done or permitted to be done or omitted to be done wholly or partly in reliance upon the whole or any part of the contents of this Site. Attorney Advertising: This Site may qualify as “Attorney Advertising” requiring notice in some jurisdictions. To the extent that this Site may qualify as Attorney Advertising, PRIOR RESULTS DO NOT GUARANTEE A SIMILAR OUTCOME. All rights reserved. The content of the this Site is protected under international copyright conventions. Reproduction of the content of this Site without express written authorization is strictly prohibited.