Privacy watchdog calls out 65 establishments for data protection violations

May 16, 2024 , 10:52 AM

By Briane Basa

(May 16, 2024) – The National Privacy Commission (NPC) on Wednesday demanded an explanation from 65 establishments that were found with violations in protecting consumers’ personal data.

Show cause orders have been served to the said businesses after the NPC conducted its first-ever on-the-spot privacy sweep at a mall in Parañaque City.

This is part of ramped up efforts of the country’s privacy watchdog to monitor how establishments comply with Philippine laws and regulations on data protection.

According to the NPC, 56 of the 65 establishments have not registered their data processing systems or their designated data protection officers.

The remaining nine committed lapses in displaying the NPC Seal of Registration, a keyhole-shaped emblem with a QR code that serves as proof of registration.

Privacy Commissioner John Naga echoed Section 32 of NPC Circular 2022-04, which requires firms to prominently display the said seal at the main entrance of their establishments.

“There are instances na na-display nga po ‘yung privacy seal, kaso sobrang liit na mahirap na itong i-scan, so ini-call out din namin sila,” said Naga.

(There were instances where the privacy seal was displayed but the QR code was too small to be read by a scanner, so we also called out the establishments concerned.)

Naga gave another example of a store that failed to post the NPC Seal of Registration in all of its payment counters.

“Bawat counter kung saan ka nagpa-process [ng personal na datos], dapat mayroong seal,” he added. “Ala nga namang hahanapin mo kung saan ang seal ng NPC — kung, halimbawa, gusto mong magreklamo — lalo na kung malaki ang establishment.”

(Each counter where you process personal data must display the seal. You would not want to scour the area, especially a vast one, just for the emblem in case you want to, say, file a complaint against the establishment before the NPC.)

Apart from the Seal of Registration, the NPC examined other forms of data collection and processing, including logbooks, raffle coupons, brochures, and posters.

Officials also checked whether businesses have their own privacy notices, which specify what kind of information they get from customers and whether they are being recorded on closed circuit television (CCTV) cameras, among others.

The erring establishments have five days to respond to the show cause order.

Administrative fines ranging from ₱20,000 to ₱5 million await businesses that ultimately fail to comply with their data privacy obligations.

NPC Compliance & Monitoring Chief Rainier Milanes illustrated how even the slightest vulnerability can expose sensitive information to scams and organized criminal activities.

“Kung isang logbook lang iyan, and then nakabuyangyang ang logbook… pipiktyuran lang po iyan,” said Milanes. “‘Yung page lang pong iyon contains personal information…naibebenta po iyan sa scammers.”

(It’s as easy as taking a photo of even a single logbook that is left out in the open. One page alone contains personal information that can be sold to scammers.)

“‘Yung [cellphone numbers], padadalhan po iyan ng smishing [SMS phishing], ‘yung mga clickable links na uso ngayon,” he added.

(The sold cellphone numbers, for instance, will eventually receive phishing texts that contain clickable links.)

The Philippines ranked the highest in e-shopping scam rates among 11 Asian economies in 2023, according to the Asia Scam Report published by the Global Anti-Scam Alliance and Gogolook.

Privacy Statement

Our Privacy Commitment

TV5 Network Inc. values and respects your privacy. We are committed to safeguarding your personal data in compliance with Republic Act No. 10173 or the Data Privacy Act of 2012 and its implementing rules and regulations.

We have developed a Privacy Policy that adopts and observes appropriate standards for personal data protection. While our Privacy Policy sets out the general principles governing the collection, use, and disclosure of our users’ personal information, our Privacy Commitment seeks to inform you more about TV5’s privacy practices.

Why do we collect your personal information (as applicable)?

We may collect and maintain basic information about you as site user of TV5 sites for the following purposes:

To deliver news and updates on current events, sports, esports and entertainment;
To share livestreams of news and sports events;
To understand our viewers’ needs and preferences;
To meet legal and regulatory requirements; and
To perform other processes or disclosures that are required to comply with pertinent laws, rules, or regulations.

Where do we get your personal information?

There are several ways we collect your personal information.

Information that you personally provided.

Most of the personal information we have are those that you have provided us when you:
- Register to our programs or services;
- Inquired, filed a complaint or requested for our services;
- Took part in our research and surveys; and/or
- Became our Partner, Vendor, Contractor or Supplier.

Information we collect during your engagement with us

We also collect information as you use our products and services, like:
- Viewing our websites;
- Activities that are being tracked by our website cookies;
- Calling our hotline;
- Using our apps, websites, and self-service channels and portals; and/or
- Joining our promos, prize raffles, or rewards and loyalty programs.

Information we collect from other sources

Other means of collection of information may be through:
- Our market research initiatives;
- When you visit and use our websites and mobile application; and
- Subsidiaries, affiliates, and third-party business partners to whom you have given consent to share your information to us.

When do we disclose personal information?

There may be instances when we are required to share the information you provided us. In such cases, we ensure that your personal information will be disclosed on a confidential manner, through secure channels and in compliance with the Data Privacy Act and other privacy laws.

We will never share, rent, or sell your personal information to third parties outside of TV5 except in special cases where you have given consent, and in cases described in our privacy policy.

In some instances, we may be required to disclose your personal information to our agents, subsidiaries, affiliates, business partners and other third-party agencies and service providers as part of our regular business operations and for the provision of our programs and services. This means we might share your information with our service providers, contractors, and professional advisers who help us provide our services.

How we protect your personal information

The integrity, confidentiality, and security of your information is important to us. We have implemented technical, organizational, and physical security measures that are designed to protect your information from unauthorized or fraudulent access, alteration, disclosure, misuse, and other unlawful activities.

We also put in effect the following safeguards:

We keep and protect your information using a secured server behind a firewall, encryption and security controls;
We keep your information only for as long as it is necessary for us to (a) provide the products and services that you avail from us, (b) for our legitimate business purposes, (c) to comply with pertinent laws, and (d) for special cases that will require the exercise or defense of legal claims;
We limit the access to your information only to qualified and authorized personnel who are trained to handle your information with strict confidentiality;
We undergo regular audits and rigorous testing of our infrastructure’s security protocols to ensure your data is always protected;
We promptly notify you and the National Privacy Commission when sensitive personal information that may, under the circumstances, be used to enable identity fraud are reasonably believed to have been acquired by an unauthorized person; and
We let you update your information securely to keep our records accurate.

TV5 will not collect, use, or disclose your personal information for any purpose other than the purpose that you may have given your consent for.

What are your choices?

We make sure that we have your consent to continue to collect, use, and disclose your personal information for the purposes that we have identified. We want you to know that you may object or withdraw your consent and/or edit your consent preferences at any time.

If you wish to have access to the personal information in our custody or if you think that the personal information you provided is incomplete, or otherwise inaccurate, you may get in touch with our Data Protection Officer through the contact details provided below. In some instances, we may request for supporting documents or proof before we effect requested changes.

Data Protection Officer
TV5 Network Inc.
Reliance corner Sheridan Streets
Mandaluyong City
tv5dataprivacy@tv5.com.ph

What happens when there are changes in our Policy?

From time to time, we may update our privacy policy and practices to comply with changes in applicable laws and regulatory requirements, adapt to new technologies and protocols, and align with the best practices of the industry.

You will be provided notices if the changes are significant and, if we are required by law, we will obtain your updated consent.