The National Privacy Commission (NPC) says that it will impose an administrative fine ranging from 0.25% to 3% of the annual gross income of personal information processors (PIP) and personal information controllers (PIC) who will commit data privacy infractions.

This development is part of the commission’s Circular No. 2022-01 or the Guidelines on Administrative Fines. It recognizes how essential it is for the public and Filipinos’ interests to impose fines that are proportional and will help end data privacy infractions.

Data privacy infractions administrative fines

It is said that PICs may face 0.5% to 3% fines based on their gross annual income while PIP could suffer 0.25% to 2% penalty.

Meanwhile, when committing other violations, PICs and PIPs could face a fine of not less than Php50,000 but not more than Php200,000.

ViolationsPICPIP
Infraction fines0.5% to 3%
of annual gross income
0.25% to 2%
of annual gross income
Fine for other violationsNot less than Php50,000
but not more than Php200,000
Not less than Php50,000
but not more than Php200,000
Failure to comply on any Order, Resolution, or Decision of the commissionFine for the original infraction + fine not exceeding Php50,000Fine for the original infraction + fine not exceeding Php50,000

What does “other violations” mean?

Such violations include failure to register the true identity or contact details of the PIC, the data processing system, or information on automated decision-making; or failure to provide updated information as to the identity or contact details of the PIC, the data processing system, or information on automated decision-making.

How will the NPC determine the annual gross income?

To determine the PIC or PIP’s annual gross income, the NPC will evaluate and require the audited financial statements that were filed with the tax authorities to be submitted from the year preceding where the violation occurred.

It will also include the latest balance sheet that’s regularly prepared, or annual statement of expenses and income, as well as other relevant financial documents.

What if the PIC/PIP is only working for less than a year?

The computation of the administrative fees will be based on his/her total gross income during the time that the violation was committed.

What happens if the PIC/PIP doesn’t pay the administrative fine?

PICs or PIPs who will refuse to pay the admin fines will be given a Cease and Desist Order, as well as other possible reliefs or processes the NPC is authorized to do pursuant to the Section of the Data Privacy Act, and the right contempt proceedings under the Rules of Court.

NPC added that the new rule works prospectively. This means that the complaints that were already filed will not be affected.

Leave a comment

Your email address will not be published. Required fields are marked *