he Data Privacy Act of 2012 and its Implementing Rules and Regulations use an entity's link or presence in the Philippines as a key factor in determining the law's extraterritorial application.

Text of Relevant Provisions

DPA of 2012 Sec.6(b):

"This Act applies to an act done or practice engaged in and outside of the Philippines by an entity if: (b) The entity has a link with the Philippines, and the entity is processing personal information in the Philippines or even if the processing is outside the Philippines as long as it is about Philippine citizens or residents such as, but not limited to, the following:

Implementing Rules and Regulations Sec.4(d):

"The Act and these Rules apply to the processing of personal data by any natural and juridical person in the government or private sector. They apply to an act done or practice engaged in and outside of the Philippines if: d. The act, practice or processing of personal data is done or engaged in by an entity with links to the Philippines, with due consideration to international law and comity, such as, but not limited to, the following:

Analysis of Provisions

The Data Privacy Act of 2012 and its Implementing Rules and Regulations establish a broad scope for the law's applicability based on an entity's link or presence in the Philippines. This factor is used to extend the law's reach to entities operating outside the Philippines but with significant connections to the country.The law applies to entities with various types of links to the Philippines, including:

1. Contractual relationships: "A contract is entered in the Philippines"
2. Management and control: "A juridical entity unincorporated in the Philippines but has central management and control in the country"
3. Corporate structure: "An entity that has a branch, agency, office or subsidiary in the Philippines"
4. Data access: "the parent or affiliate of the Philippine entity has access to personal information"
5. Equipment or office presence: "Use of equipment located in the country, or maintains an office, branch or agency in the Philippines for processing of personal data"
6. Business operations: "An entity that carries on business in the Philippines"
7. Data collection or storage: "An entity that collects or holds personal data in the Philippines"

The law's broad definition of "links to the Philippines" allows for a wide interpretation of what constitutes a sufficient connection to trigger the law's applicability. This approach aims to ensure comprehensive protection of personal data related to Philippine citizens or residents, regardless of where the processing entity is physically located.

Implications

The broad scope of the entity's link or presence factor has significant implications for businesses operating in or connected to the Philippines:

1. Extraterritorial reach: Companies outside the Philippines may be subject to the law if they have any of the specified links to the country.
2. Contractual considerations: Entering into contracts in the Philippines can trigger the law's applicability, even for foreign entities.
3. Corporate structure impact: Having a branch, agency, office, or subsidiary in the Philippines can make the entire corporate group subject to the law.
4. Data access scrutiny: Parent companies or affiliates with access to personal data of Philippine entities must comply with the law.
5. Equipment and office presence: Using equipment in the Philippines or maintaining any form of office presence for data processing purposes brings an entity under the law's purview.
6. Business operations: Carrying on business in the Philippines, even without a physical presence, can trigger the law's applicability.
7. Data collection and storage: Collecting or holding personal data in the Philippines, regardless of the entity's location, is sufficient to apply the law.

These provisions require businesses to carefully assess their connections to the Philippines and ensure compliance with the Data Privacy Act if they fall within its scope. The broad interpretation of "links to the Philippines" means that even minimal connections could potentially trigger the law's applicability, necessitating a thorough review of data processing activities and their relation to the country.