Philippines Jurisdiction: Physical Location/Residency of Data Subject in Jurisdiction

The factor of Physical Location/Residency of the Data Subject is a significant criterion for determining the applicability of the Data Privacy Act of 2012 (DPA) in the Philippines. The DPA explicitly applies to the processing of personal information about Philippine citizens or residents, regardless of where the processing occurs.

Text of Relevant Provisions

DPA of 2012 Sec.6(a):

"This Act applies to an act done or practice engaged in and outside of the Philippines by an entity if: (a) The act, practice or processing relates to personal information about a Philippine citizen or a resident;"

DPA of 2012 Sec.6(b):

"This Act applies to an act done or practice engaged in and outside of the Philippines by an entity if: (b) The entity has a link with the Philippines, and the entity is processing personal information in the Philippines or even if the processing is outside the Philippines as long as it is about Philippine citizens or residents such as, but not limited to, the following: (1) A contract is entered in the Philippines; (2) A juridical entity unincorporated in the Philippines but has central management and control in the country; and (3) An entity that has a branch, agency, office or subsidiary in the Philippines and the parent or affiliate of the Philippine entity has access to personal information;"

Implementing Rules and Regulations Sec.4(b):

"The Act and these Rules apply to the processing of personal data by any natural and juridical person in the government or private sector. They apply to an act done or practice engaged in and outside of the Philippines if: b. The act, practice or processing relates to personal data about a Philippine citizen or Philippine resident;"

Analysis of Provisions

• DPA of 2012 Sec.6(a) and Sec.6(b) both emphasize that the DPA applies to the processing of personal information about Philippine citizens or residents, even if the processing occurs outside the Philippines. The critical factor here is the residency or citizenship status of the data subject, rather than the location of the data processing.
• The law clearly states that "The act, practice or processing relates to personal information about a Philippine citizen or a resident" is sufficient to bring the processing activities under the jurisdiction of the DPA. This includes scenarios where a foreign entity processes data about Philippine residents but has no physical presence in the Philippines.
• Additionally, Sec.6(b) extends the DPA's applicability to entities with any link to the Philippines, such as those that have contracts within the country, central management and control located in the Philippines, or branches and offices in the Philippines. The processing of personal data by these entities falls under the DPA, especially if it concerns Philippine citizens or residents.
• Implementing Rules and Regulations Sec.4(b) reinforces this by extending the law’s application to acts or practices that involve processing personal data about Philippine citizens or residents, regardless of where the processing occurs.

Implications

• For businesses, this means that if they process personal data about Philippine citizens or residents, they must comply with the DPA, even if the processing occurs outside the Philippines. This includes multinational companies with operations in the Philippines or that target Philippine residents.
• Companies must be aware that any processing activities involving data subjects who are Philippine citizens or residents could trigger the application of the DPA. This broad extraterritorial scope requires businesses to consider Philippine data protection laws even when their operations are primarily based outside the country.
• An example of this would be a foreign e-commerce company that processes orders from Philippine residents. Even though the company operates outside the Philippines, the personal data of these customers would still be subject to the DPA due to their residency status.