HIS FINALS: MODULE 5 (3)

Question 1

The data subject must be aware of the nature, purpose, and extent of the processing of his or her data, including the risks and safeguards involved, the identity of a personal information controller, his or her rights as a data subject, and how these can be exercised.

Answer 1

Transparency

Question 2

Any information and communication relating to the processing of personal data should be easy to access and understand, using clear and understandable language.

Answer 2

transparency

Question 3

The processing of information shall be compatible with a declared and specified purpose, which must not be contrary to law, morals, or public policy.

Answer 3

Legitimate Purpose

Question 4

The processing of information shall be adequate, relevant, suitable, necessary, and not excessive concerning a declared and specified purpose

Answer 4

Proportionality

Question 5

Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other mean

Answer 5

Proportionality

Question 6

data privacy act states that the collection of perconal data:

Answer 6

must be declared, specified and legitimate purpose

Question 7

When obtaining consent, the ——– is informed about the extent and purpose of processing, and it specifically mentions the “automated processing of his or her data for profiling, or processing for direct marketing, and data sharing.”

Answer 7

data subject

Question 8

Consent is not required for processing where:

Answer 8

o The data subject is a party to a contractual agreement
o For purposes of fulfilling that contract
o Compliance with a legal obligation upon the data controller
o Protection of the vital interests of the data subject
o Response to a national emergency is also available

Question 9

when: Processing is necessary to pursue the legitimate interests of the data controller, except where overridden by the fundamental rights and freedoms of the data subject

Answer 9

exception to consent

Question 10

The law requires that when sharing data, the sharing be covered by an agreement that provides adequate safeguards for the rights of data subjects, and that these agreements are subject to review by the ———

Answer 10

national privacy commission

Question 11

The law defines sensitive personal information as being:

Answer 11

• About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical, or political affiliations.
• About an individual’s health, education, the genetic or sexual life of a person, or to any proceeding or any offense committed or alleged to have committed.
• Issued by government agencies “peculiar” (unique) to an individual, such as social security number.
• Marked as classified by executive order or act of Congress.

Question 12

All processing of sensitive and personal information is prohibited except in certain circumstances. The exceptions are:

Answer 12

• Consent of the data subject.
• Pursuant to a law that does not require consent.
• Necessity to protect the life and health of a person.
• Necessity for medical treatment.
• Necessity to protect the lawful rights of data subjects in court proceedings, legal proceedings, or regulation.

Question 13

a major anti-terrorism law that enables surveillance

Answer 13

Human Security Act of 2007

Question 14

The law further provides that not all “personal data breaches” require notification., which provides several bases for not notifying —————-

Answer 14

data subjects or the data protection authority.

Question 15

Section 38 of the Implementing Rules and Regulations (IRRs) provides the requirements of breach notification:

Answer 15

• The breached information must be sensitive personal information or information that could be used for identity fraud, and
• There is a reasonable belief that unauthorized acquisition has occurred, and
• The risk to the data subject is real, and
• The potential harm is serious.

Question 16

The law places a concurrent obligation to notify the National Privacy Commission as well as affected data subjects within ——— of knowledge of or reasonable belief by the data controller of a personal data breach that requires notification.

Answer 16

72 hours

Question 17

Any combination or series of acts may cause the entity to be subject to imprisonment ranging from —- as well as a fine of approximately ——-

Answer 17

three to six years
PHP 1,000,000 to PHP 5,000,000.