⭐ RA 10173 (Part 2) Flashcards
must implement reasonable and appropriate organizational, physical and technical measures intended for the protection of personal information
personal information controller
shall implement reasonable and appropriate measures to protect personal information against natural dangers
personal information controller
T/F:
The determination of the appropriate level of security under this section must take into account the nature of the personal information to be protected, the risks represented by the processing, the size of the organization and complexity of its operations, current data privacy best practices and the cost of security implementation.
T
T/F:
Security measures include safeguarding to protect its computer network against intentional, lawful or authorized usage or interference with or hindering of their functioning or availability
F;
accidental, unlawful or unauthorized usage
T/F:
Security measures include a security policy with respect to the processing of personal information.
T
T/F:
Security measures include a process for identifying and accessing reasonably foreseeable vulnerabilities in its computer networks, and for taking preventive, corrective and mitigating action against security incidents that can lead to a security breach.
T
T/F:
Security measures include regular monitoring for security breaches and a process for taking preventive, corrective and mitigating action against security incidents that can lead to a security breach.
T
T/F:
Third parties processing personal information shall implement their own security measures.
F;
The personal information controller must further ensure that third parties processing personal information on its behalf shall implement the security measures
T/F:
The employees, agents or representatives of a personal information controller who are involved in the processing of personal information shall operate and hold personal information under strict confidentiality if the personal information are intended for public disclosure.
F;
if the personal information are not intended for public disclosure
T/F:
The personal information controller shall promptly notify the Commission and affected data subjects when sensitive personal information or other information that may, under the circumstances, be used to enable identity fraud are reasonably believed to have been acquired by an authorized person.
F;
unauthorized person
T/F:
In evaluating if notification is unwarranted, the Commission may take into account compliance by the personal information controller with this section and existence of good faith in the acquisition of personal information.
T
T/F:
The Commission may exempt a personal information controller from notification where, in its reasonable judgment, such notification would be in the public interest or in the interests of the affected data subjects.
F;
such notification would NOT be in the public interest
T/F:
The Commission cannot authorize postponement of notification where it may hinder the progress of a criminal investigation related to a serious breach.
F;
The Commission may authorize postponement of notification
T/F:
Each personal information controller is responsible for personal information under its control or custody, which excludes information that have been transferred to a third party for processing.
F;
includes third party
(whether domestically or internationally, subject to cross-border arrangement and cooperation)
Who is accountable for complying with the requirements of this Act and shall use contractual or other reasonable means to provide a comparable level of protection while the information are being processed by a third party?
personal information controller
T/F:
The personal information controller shall designate an individual or individuals who are accountable for the organization’s compliance with this Act. The identity of the individual(s) so designated shall not be made known to any data subject.
TF;
shall be made known to any data subject upon request
T/F:
All sensitive personal information maintained by the government, its agencies and instrumentalities shall be secured.
T
Who shall be responsible for complying with the security requirements for all the sensitive personal information maintained by the government, its agencies, and instrumentalities?
The head of each government agency or instrumentality
T/F:
Except as may be allowed through guidelines to be issued by the Commission, the employees of the government shall have access to sensitive personal information on government property or through online facilities.
F;
no employee shall have access
(unless the employee has received a security clearance from the head of the source agency)
T/F:
Sensitive personal information maintained by an agency may be transported or accessed from a location off government property.
F;
may not be transported or accessed
(unless a request for such transportation or access is submitted and approved by the head of the agency in accordance with the guidelines)
Off-line Access:
Deadline for Approval or Disapproval
(2) business days after the date of submission of the request
Off-line Access:
Limitation to how many records?
not more than 1,000 at a time
T/F:
Off-line Access:
Any technology used to store, transport or access sensitive personal information for purposes of off-site access approved under this subsection shall be secured by the use of the most secure encryption standard recognized by the Commission.
T
In the requirements relating to access by agency personnel to sensitive personal information, these requirements shall be implemented not later than ______ after the enactment of this act.
6 months
T/F:
In entering into any contract that may involve accessing or requiring sensitive personal information from one thousand (1,000) or more individuals, an agency shall require a contractor and its employees to register their personal information processing system
T
Penalty:
unauthorized processing of personal information
imprisonment: 1-3y
fine: Php 500k to Php 2M
Penalty:
unauthorized processing of personal sensitive information
imprisonment: 3-6y
fine: Php 500k to Php 4M
Penalty:
Accessing personal information due to negligence
imprisonment: 1-3y
fine: Php 500k to Php 2M
Penalty:
Accessing sensitive personal information due to negligence
imprisonment: 3-6y
fine: Php 500k to Php 4M
Penalty:
improper disposal of personal information
imprisonment: 6m-2y
fine: Php 100k to Php 500k
Penalty:
improper disposal of sensitive personal information
imprisonment: 1-3y
fine: Php 100k to Php 1M
Penalty:
processing of personal information for unauthorized purposes
imprisonment: 1y & 6m - 5y
fine: Php 500k to Php 1M
Penalty:
processing of sensitive personal information for unauthorized purposes
imprisonment: 2y-7y
fine: Php 500k to Php 2M
Penalty:
Unauthorized Access or Intentional Breach
imprisonment: 1y-3y
fine: Php 500k to Php 2M
Penalty:
Concealment of Security Breaches Involving Sensitive Personal Information
imprisonment: 1y & 6m - 5y
fine: Php 500k to Php 1M
Penalty:
Malicious Disclosure
(discloses unwarranted or false information relative to any personal information or personal sensitive information)
imprisonment: 1y & 6m - 5y
fine: Php 500k to Php 1M
Penalty:
Unauthorized disclosure of personal information
imprisonment: 1-3y
fine: Php 500k to Php 1M
Penalty:
Unauthorized disclosure of sensitive personal information
imprisonment: 3-5y
fine: Php 500k to Php 2M
Penalty:
combination or series of acts (sections 25-32)
imprisonment: 3-6y
fine: Php 1M to Php 5M
Extent of Liability:
If the offender is a/an ________, the penalty shall be imposed upon the responsible officers, as the case may be, who participated in, or by their gross negligence, allowed the commission of the crime.
a. corporation, partnership or any juridical person
b. juridical person
c. alien
d. public official or employee
a. corporation, partnership or any juridical person
Extent of Liability:
If the offender is a/an _________, the court may suspend or revoke any of its rights under this Act.
a. corporation, partnership or any juridical person
b. juridical person
c. alien
d. public official or employee
b. juridical person
Extent of Liability:
If the offender is a/an _________, he or she shall, in addition to the penalties herein prescribed, be deported without further proceedings after serving the penalties prescribed.
a. corporation, partnership or any juridical person
b. juridical person
c. alien
d. public official or employee
c. alien
Extent of Liability:
If the offender is a/an _________, and lie or she is found guilty of acts penalized under Sections 27 and 28 of this Act, he or she shall, in addition to the penalties prescribed herein, suffer perpetual or temporary absolute disqualification from office, as the case may be.
a. corporation, partnership or any juridical person
b. juridical person
c. alien
d. public official or employee
d. public official or employee
Large Scale:
The maximum penalty in the scale of penalties respectively provided for the preceding offenses shall be imposed when the personal information of at least ______ persons is harmed, affected or involved as the result of the above mentioned actions.
100 persons
Offense Committed by Public Officer:
When the offender or the person responsible for the offense is a public officer as defined in the Administrative Code of the Philippines in the exercise of his or her duties, an accessory penalty consisting in the disqualification to occupy public office for a term _______ the term of criminal penalty imposed shall be applied.
a. 2x
b. 3x
c. 4x
d. 5x
a. 2x (double the term)
lmplementing Rules and Regulations (IRR):
Within ____ days from the effectivity of this Act, the Commission shall promulgate the rules and regulations to effectively implement the provisions of this Act.
90
Reports and Information:
The Commission shall annually report to the _______ and ________ on its activities in carrying out the provisions of this Act.
President
Congress
T/F:
Reports and Information:
The Commission shall undertake whatever efforts it may determine to be necessary or appropriate to inform and educate the public of data privacy, data protection and fair information rights and responsibilities.
T
Appropriations Clause:
The Commission shall be provided with an initial appropriation of ______ to be drawn from the national government.
Php 20M
Appropriations Clause:
Appropriations for the succeeding years shall be included in the General Appropriations Act. It shall likewise receive _______ per year for ____ years upon implementation of this Act drawn from the national government.
Php 10M
5 years
Transitory Provision:
Existing industries, businesses and offices affected by the implementation of this Act shall be given ____ year(s) transitory period from the effectivity of the IRR or such other period as may be determined by the Commission, to comply with the requirements of this Act.
1 year transitory period
Transitory Provision:
In case that the ______ has not yet been created by the time the law takes full force and effect, the ____________ shall be attached to the Office of the President.
DICT
National Privacy Commission
Repealing Clause:
The provision of Section ___ of Republic Act No. ______, otherwise known as the ______________·; is hereby amended.
Section 7
RA 9372
Human Security Act of 2007
