THE National Privacy Commission (NPC) said on Wednesday that a field inspection resulted in the issuance of show-cause orders to 65 Ayala Malls Manila Bay establishments.
NPC Circular No. 2024-01 authorizes on-the-spot inspections to verify whether personal information controllers (PICs) or personal information processors (PIPs) comply with the Data Privacy Act of 2012 (DPA) and the regulator’s other issuances.
“Malls and retail stores collect significant amounts of personal data from customers daily. Hence, these entities must comply with the DPA and NPC issuances to protect the rights of their data subjects and maintain consumer trust,” according to Privacy Commissioner John Henry Naga.
Mr. Naga said that fines ranging from P20,000 to P5 million can be imposed on violators of the DPA and other NPC issuances.
“This on-the-spot privacy sweep and compliance check should also serve as a warning to all non-compliant and erring PICs and PIPs that the NPC will not hesitate to impose administrative fines for violations of the DPA, its implementing rules and regulations, and the issuances of the NPC,” he said.
According to the NPC, 56 establishments were found to have not registered with the NPC, while nine establishments, while being registered, were issued citation tickets for other violations.
Some 38 establishments were found to have been compliant, registered, with their seal of registration properly displayed.
“Our primary goal is to ensure that PICs and PIPs are fully aware of their responsibilities under the DPA,” NPC Data Security and Compliance Office Director Aubin Arn Nieva said.
“If we find areas of non-compliance or potential vulnerabilities in their data handling practices, we can offer personalized recommendations and support to help them address these gaps and improve their data protection measures,” he added.
After the compliance check, the NPC will present its findings and assess whether the PICs or PIPs have any deficiencies, during which they will be requested to submit the necessary documents
The NPC is planning to replicate the on-the-spot privacy sweep at other malls and has clarified that it is the establishment or the lessee that will be held liable for the violations, not the mall owners or lessors. — Justine Irish D. Tabile