data privacy act Flashcards
Its purpose is to ensure that personal information and communications systems in
government and in the private sector are secured and protected.
Data Privacy Act of 2012
the other name of data privacy?
Information privacy
R.A is also known as “Data Privacy Act of 2012”
R.A 10173
When was the Data Privacy Act of 2012 approved?
a. August 15, 2012
total number of sections under the “Data Privacy Act of 2012”
45
- Who is the president who signed the approval of “Data Privacy Act of 2012”
Gloria Macapagal Arroyo
- Who is in charge of administering and implementing the DPA?
National Privacy Commission
What is one of the major functions of NPC?
a.
Policymaking
is to educate the public about data privacy, data protection, and fair information rights
and responsibilities.
Advisory
It is to manage the registration of personal data processing systems.
Compliance and monitoring
refers to the commission that is created by virtue of the RA 10173.
National Privacy Commission
It refers to a system for generating, sending, receiving, storing or otherwise processing
electronic data messages or electronic documents.
Information and Communications System
- It refers to a person or organization who controls the collection, holding, processing, or
use of personal information.
Personal Information Controller
It refers to any natural or juridical person qualified to act as such under this Act to
whom a personal information controller may outsource the processing of personal data
pertaining to a data subject.
Personal Information Processor
It refers to any and all forms of data which under the Rules of Court and other pertinent
laws constitute privileged communication.
Privileged Information
- Data privacy does not apply to clinical laboratories because they handle sensitive data or
information related to their patients.
t or f
f
Data privacy is connected with data security
t or f
true
Data Privacy Act of 2012 requires each organization to appoint Data Protection Officer (DPO)
(TRUE)
DOH is tasked to monitor and ensure compliance of the Philippines with international standards
for personal data protection. ()
FALSE
Data privacy is a subset of data protection that focuses on the proper handling of data ()
TRUE
ra 10173 is also known as the “Data Privacy Act of 2010” (
false
the policy of the State to protect the fundamental human right of privacy and communication
to promote innovation and growth. ()
TRUE
The consent of the data subject can be evidenced by written, electronic, or recorded means.
()
TRUE
ra 10173 does not apply to the processing of all types of personal information and to any natural
and juridical person involved in personal information processing. ()
false
Data Privacy Act of 2012 does not apply to personal information processed for journalists,
artistic, literary, or research purposes. ()
TRUE
It refers to any freely given, specific, informed indication of will, whereby the data
subject agrees to the collection and processing of personal information relating to them.
coinsent
It refers to an individual whose personal information is processed. (
A. Data Subject)
It refers to any operation or any set of operations performed upon personal information.
(E. )
Processing
It refers to communication by whatever means of any advertising or marketing material
which is directed to particular individuals. (
C. Direct Marketing)
It refers to any information whether recorded in a material form or not, from which the
identity of an individual is apparent or can be directly ascertained. (
D. Personal
Information)
What does the Data Privacy Act of 2012 primarily aim to protect?
Answer: b) Personal data privacy
Which government agency in the Philippines is responsible for implementing the provisions of
the Data Privacy Act?
b) National Privacy Commission
What is the maximum fine, in Philippine Pesos, for offenses under Section 37 (Unauthorized
Processing of Personal Information) of the Data Privacy Act?
b) ₱1,000,000
Sensitive personal information, as defined by the Data Privacy Act, includes details such as:
c) Credit card number
The individual to whom personal data pertains is referred to as:
data subject
An entity or person who determines the purpose and means of processing personal
information.
Personal Information Controller
Permission provided by the data subject for the processing of their personal data.
Consent
An individual appointed by a personal information controller to ensure compliance with the
Data Privacy Act.
Data Privacy Officer
The person to whom the personal data pertains.
_____ Data Subject
The government agency responsible for enforcing the Data Privacy Act.
National Privacy Commission
The Data Privacy Act of 2012 only applies to large corporations.
Answer:
False
Data subjects have the right to request access to their personal data and have it
corrected if it’s inaccurate.
Answer:
True
Consent of the data subject is not required when processing sensitive personal
information.
Answer:
False
The National Privacy Commission is responsible for enforcing the provisions of
the Data Privacy Act.
Answer: True
True or False: Data privacy rights under the Data Privacy Act may not be waived or forfeited by
the data subject.
Answer:
False
Subjected to the guidelines that the Commission issued in Section 20. Security of
Personal Information is the regular monitoring and implementation of preventive,
corrective, and mitigation processes for any security breaches. (t o f)
TRUE
The employees, agents or representatives of a personal information controller who are
involved in the processing of personal information shall operate and hold personal
information under strict confidentiality if the personal information is not intended for
public disclosure. ()
TRUE
The Commission can authorize postponement of notification to determine the scope of
the breach, to prevent further disclosures, or to restore reasonable integrity to the
information and communications system. ()
TRUE
It was stated in Section 20. Principle of Accountability that each personal information
controller is responsible for personal information under its control or custody, including
information that has been transferred to a third party for processing, whether domestically
or internationally, subject to cross-border arrangement and cooperation. (t or f)
FALSE
As recommended by the Commission, all sensitive personal information maintained by
the government, its agencies and instrumentalities shall be secured with the use of the
least appropriate standard recognized by the information and communications technology
industry. )
(FALSE
A request of approval is an important requirement for accessing agency personnel and
sensitive personal information. (t or f )
TRUE
Even without the approval and security clearance from the head of the agency, employees
of the government can still access sensitive personal information. (t or f )
FALSE
Any technology used to store, transport or access sensitive personal information for
purposes of off-site access approved under this subsection shall be secured by the use of
the most secure encryption standard recognized by the Commission. (t or f )
TRUE
Any technology used to store, transport or access sensitive personal information for
purposes of on-site access approved under this subsection shall be secured by the use of
the most secure encryption standard recognized by the Commission. (t or f )
FALSE
- The improper disposal of personal information shall be penalized by imprisonment
ranging from one (1) month to three (3) years and a fine of not less than One hundred
thousand pesos (Php100,000.00) but not more than Five hundred thousand pesos
(Php500,000.00). ()
FALSE
What section indicates the “Responsibility of the Heads of Agencies”?
Section 22
- What type of access should be applied when sensitive personal information is transported
and maintained from a location off government property?
Off-site Access
If a request is approved, the head of the agency shall limit the access to ________ records
at a time.
Not more than 1, 000
- The __________ is accountable for complying with the requirements of this Act and shall
use contractual or other reasonable means to provide a comparable level of protection while the
information is being processed by a third party.
Personal Information Controller
What type of access should be applied if sensitive personal information is maintained on
government property and online facilities?
On-site and Online Access
