Bose, Noel Allen

SY 2012-2013, Second Semester


R.A. 10173 Your Soul Protector in The World of Information Technology

Introduction

In the early days when the first cameras were produced and made available to the public, people were hesitant of having their portraits taken. This was due to a rumor that, by the flash of such peculiar device, the subject’s soul may be taken away. They said that the camera was a soul eating tool. Such fear still exists today, but not anymore concerning cameras, but the thought of parting with one’s person in the form of information. With the advent of computer technology, work has become easier and less complex behind the ever labyrinthian structure that makes computer work for us. In filling out forms, we input characters on several fields in order to create what we call an information, and when we give personal information, we thus give a part of ourselves. People become aware that their persons become a file in the memory. Our accounts become a living person in itself as we dispense with information that separates one human from another- the identity. With this, we need a protective barrier from wrongs that may arise in its misuse. We already are at a digital and must be kept updated, or at least abreast with the standards of other countries, whose services to their people are notch higher than ours due to the employment of better services with the use of technology. We need a law that works for the digital age. And thus, our legislators have passed something new.

Title

RA 10173, at length, is entitled as An Act Protecting Individual Personal Information And Communications Systems in The Government and The Private Sector, Creating for This Purpose a National Privacy Commission And for Other Purposes. But we can simply call it as Data Privacy Act of 2012. [1] It was signed into law on August 15, 2012 by President Benigno S. Aquino III.

Raisons D’etre

This law has recognized the need to protect privacy rights in the growing information society as stated under section 2 of said law, to wit:
It is the policy of the State to protect the fundamental human right of privacy of communication while ensuring free flow of information to promote innovation and growth. The State recognizes the vital role of information and communications technology in nation-building and its inherent obligation and communications systems in the government and in the private sector are secured and protected. [2]

Senator Ed Angara, one of the key proponents of the Data Privacy Act, in his statement concerning the enactment of this law pointed out that “All public and private enterprises are now mandated to safeguard the confidentiality and integrity of personal information collected in the course of their operations. This will not only boost the confidence of potential investors in the country’s booming Information Technology and Business Process Outsourcing (IT-BPO) industry, but also the trust of ordinary citizens in our e-governance initiatives. [3]

Cast of Characters

There are at least four players that interact under this Act. The following are:

a. National Privacy Commission;

b. Data Subject;

c. Personal Information Controller; and

d. Personal Information Processor

National Privacy Commission

The title of the Act calls for the creation of the Commission [4], as the administrative agency that will administer and implement the provisions of the Act. [5] The curious reader would ask, “How would we shorten the name of this agency? NatPriCom, maybe? Regardless, one of its most reassuring powers is that it can compel or petition any entity, government agency or instrumentality to abide by its orders or take action on a matter affecting data privacy. [6] Without a doubt, this provision endows the Commission with the power to enforce the law.

Its power to issue cease and desist order, impose a temporary or permanent ban on the processing of information if it finds the processing to be detrimental to national security and public interest is an aegis of the data subject.

Data Subject

The data subject is an individual whose personal information is processed. Chapter IV provides for the rights of the data subject. [7] From this short definition, it obviously pertains to the data subject as a natural person. The Act uses the term individual to refer to a single human being, and organization to refer to juridical entities created by law. If the legislature willed it any other way, then they would not have confined the definition of the data subject to only an individual, unlike how they have worded the definition of a personal information controller as a person or organization. [8]

As held by the Supreme Court, a corporation has no right of privacy in its name since the entire basis of the right to privacy is an injury to the feelings and sensibilities of the party and a corporation would have no such ground for relief. [9] Among the rights of the data subject is to have a reasonable access to, upon demand, of the designation, name or identity and address of the personal information controller. [10] This endows the controller to be vigilant in the conduct of his duties. Since, if the personal information controller is an individual, and if I were the data subject, I would take his name and address just for good measure.

Personal Information Controller

The Personal Information Controller refers to a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf. [11] The PIP must be vigilant, though reasonable care is required of him in his conduct, because he remains principally accountable for personal information that he transfers to a foreign third party for processing- the Personal Information Processor. [12]

Personal Information Processor

The Personal Information Processor refers to any natural or juridical person qualified to act as such under this Act to whom a personal information controller may outsource the processing of personal data pertaining to a data subject. [13] When we speak of outsource, we mean to procure under contract with an outside supplier. The law has included foreign personal information processors and controllers under its coverage if said foreign person use equipment that are located in the Philippines, or those who maintain an office, branch or agency in the Philippines

Scope

What is the scope of this law? Section 4 states that this law applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing including those personal information controllers and processors who, although not found or established in the Philippines, use equipment that are located in the Philippines, or those who maintain an office, branch or agency in the Philippines xxx [14]

From the above-mentioned definition, we can arrive at the following conclusions:

1. The law is limited only to personal information;

2. The law may be limited only to electronic processing;

1. Personal not Public

The information sought to be protected is only personal, not public. The law defines personal information as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual. [15]

Under the second paragraph of Section 4 is an enumeration of those which are excluded from the application of this law. This is because all of those enumerated are public information, which is afforded to the public as provided for under the Constitution. [16] An example the classification, salary range and responsibilities of the position held by an officer or employee of a government institution. [17]

2. Electronic and Paper

The title of the Act includes the words, “Information And Communications Systems” which the law defines as a system for generating, sending, receiving, storing or otherwise processing electronic data messages or electronic documents and includes the computer system or other similar device by or which data is recorded, transmitted or stored and any procedure related to the recording, transmission or storage of electronic data, electronic message, or electronic document.[18]

However, it defines the term “processing”as referring to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data. [19] Such term is broad enough to include many acts and scenarios involving processing, and does not confine itself to the electronic means. Therefore, processing in itself is not electronic unless linked together with the latter term as what the law defines Information and Communications System.

Section 38 of said Act gives an interpretation for any doubt that may arise in the reading of the law that is to be liberally interpreted in a manner mindful of the rights and interests of the individual about whom personal information is processed. [20] This afore-quoted provision can be plainly interpreted as liberally favorable to the rights of the data subject. After I have posited that the scope of the Act is not limited to electronic data processing, a question would thus surface. Would a liberal interpretation in a manner mindful of the rights and interests of the data subject include in the Act’s coverage those manual or paper processes? And should the title be used to mean that the adjective, electronic be deemed imbued when we speak of processing?

The Spirit, Not the Letter

As stated in the Act’s policy, the state recognizes the vital role of information and communications technology. The title of the Act may also be resorted to in order to serve as a guideline as to what is the true intent of the framers. This in itself already acknowledges electronic technology. The provisions must be read together as to give efficacy to the whole while giving way to the spirit of the legislature. It is a rule in statutory construction that every part of the statute must be interpreted with reference to the context, i.e., that every part of the statute must be considered together with the other parts, and kept subservient to the general intent of the whole enactment. [21]

The Supreme Court stated that in the interpretation of a statute, the Court should start with the assumption that the legislature intended to enact an effective law, and the legislature is not presumed to have done a vain thing in the enactment of a statute. An interpretation should, if possible, be avoided under which a statute or provision being construed is defeated, or as otherwise expressed, nullified, destroyed, emasculated, repealed, explained away, or rendered insignificant, meaningless, inoperative or nugatory. [22] Moreover, it is not the letter that killeth , but the spirit that giveth life. [23] Applying these principles, we can conclude that the legislature intended to protect personal data privacy in electronic processing. The omission of the word electronic does not preclude the fact that it is for electronic personal data privacy protection that the law was passed. This is also what is intended for in lengthening the title with a term which is defined under the Act as including electronic processes.

Journalists And Their Sources

The scope does not cover personal information obtained for journalistic purpose. [24] This is a provision to protect journalistic freedom and is in consonance with the constitutional freedom of the press, which states that “No law shall be passed abridging the freedom of speech, of expression, or of the press xxx”. [25] Also, the scope explicitly requires Section 5 of this Act to be complied with. [26] Section 5 thus states that the Act does nothing to amend the Sotto Law’s provisions protecting newspaper journalists to reveal their sources. [27]

Under the Sotto Law, a duly accredited journalist of any print, broadcast, internet, or wire service organization cannot be compelled to reveal the source of his information which was related to him in confidence. [28] Linked together, we may face a situation that personal information controllers freely give personal information under their control to newspaper journalists under the guise of confidence. This is their only exemption from their duties as provided under this Data Privacy Act because they have a role of confidentiality with the data subject. [29] However, without the freedom of the press, then the right to information cannot be truly enjoyed. When did personal private information become permissible to the public eye through two linking bridges- the journalist and his confidant personal information processor/controller?

Repealing Clause

The Act has repealed Section 7 of the Human Security Act of 2007. The surveillance of suspects and interception and recording of communications using electronic or surveillance device can no longer be done by the police or law enforcement. [30]

Overall Impressions

R.A. 10173, as a statute, is complete in itself. It submits itself to the limits prescribed under the Constitution. It is also a wise law as it engages the Philippines to be abreast with the digital age, where personal information may not remain so personal due to leakages in the system or wanton negligence of its controllers. Moreover, flourishing into this age are the IT companies that for whom the law gives restrictions and penalties in order that not only for our privacy rights but for investors to flock to our country, and for us to meet international standards. In the words of Mukesh Ambani, “I think that our fundamental belief is that for us growth is a way of life and we have to grow at all times.”

Our state cannot be left to the archaic age of typewriters and desk drawers. This law is for the digital age. For its implementation, it created a Commission, possessed with powers to administer said law. The Data Privacy Act may seem to extol our fundamental right to privacy, but, on the other hand, may actually impede it for the sake of freedom of the press as it affords protection to journalists from disclosing their sources.

Regardless, with the passage of this law I am confident that, when my form is filled creating an information akin to me- that is my identity, my soul will be at least kept safe in this peculiar world of information technology.


Endnotes

[1] R.A. 10173, Sec. 1

[2] R.A. 10173, Sec. 2

[3] http://www.edangara.com/content/statement-passage-data-privacy-act

[4] R.A. 10173, Sec. 3(a)

[5] R.A. 10173, Sec. 7

[6] R.A. 10173, Sec.7(d)

[7] R.A. 10173, Chapter IV

[8] R.A. 10173, Sec.3(h)

[9] Vassar College v. Loose Wills Biscuit Co., 197 F. 982 (1912)

[10] R.A. 10173, Sec. 16(c)[8]

[11] R.A. 10173, Sec. 3(f)

[12] R.A. 10173, Sec. 21

[13] R.A. 10173, Sec. 3(i)

[14] R.A. 10173, Sec. 4

[15] R.A. 10173, Sec. 3(g)

[16] Article III, Sec. 7 1987 Philippine Constitution

[17] R.A. 10173, Sec. 4(a)[3]

[18] R.A. 10173, Sec. 3(f)

[19] R.A. 10173, Sec. 3(j)

[20] R.A. 10173, Sec. 38

[21] Aisporna v. Court of Appeals, 113 SCRA 464, 467

[22] Paras v. Comelec, GR No. 123169, 4 November 1996, 264 SCRA 49

[23] 2 Corinthians 3:6

[24] R.A. 10173, Sec. 4(d)

[25] Article III, Sec. 4 1987 Philippine Constitution

[26] R.A. 10173, Sec. 4

[27] R.A. 10173, Sec. 5

[28] R.A. 53, Sec. 1

[29] R.A. 10173, Sec. 20(e)

[30] R.A. 10173, Sec. 44


Why is it Time to Protect Filipino Rights in The Internet?

Introduction

2012 was a year of controversies and hysterias. Yes, we’ve seen it all with the fall of our national fist to another state’s national fist; a man gets to keep a house opposite his skin color; the placing of police buoys near our shores and, the postponement of our world’s inevitable endings. Why inevitable? It is so, because the reality is that we are highly capable of ending any worlds ourselves. Said worlds may be physical, fictional or even digital. Even our own agents hired to pass our supposed biddings, in their interpretation of what they deem their principal’s needs may be, are highly capable of muddling or even destroying our digital spaces. Yes, my friends, another bill is in the oven of legislature with the intention of besting its undercooked predecessor which the master food tasters of the judiciary have restrained to serve to us, the consumers. People are highly capable of causing any harm to anyone, may they be permitted through the silence of the law or just allowed by the weak awareness of one’s individual rights.

Senate Bill No. 3327 [1] of the 15th Congress of the Republic of the Philippines is now being baked for our digital appetites. And, wow! It’s one heftily baked bills we’re going to be served with 87 pages of double-spaced paragraphs. The bill might not fit our newspapers of general circulation when it is passed into law. Of course, it may go through adjustments with the removal of unnecessary words, which we call surplusages, which, however, would less likely occur due to a typhoon of a cook in the personality of our Senator Miriam Defensor Santiago, claiming that the new bill specifically upholds the freedom of expression online. [2] Now, I am no cook nor a master food taster, but I’m taught to think like them. Hence, there is a need to see how it’s cooked and served. Another thing, note that the title of the blog asking why there’s a need to protect our rights in the internet can be well answered in my own perspective from what is laid down in the succeeding paragraphs. It won’t answer questions directly, but the perspectives presented hereunder may be of assistance in building up your idea of the bill. Moreover, I will not be explaining everything contained in this law but will present them with the thinking of a regular, simple, average, nonchalant and humble student of law. Finally, your humble author expressly permits you to use the information as you see fit.

A Magna Carta

SB No. 3327, An Act Establishing a Magna Carta for Philippine Internet Freedom, Cyber Crime Prevention and Law Enforcement, Cyber Defense and National Cyber Security. The title itself seems to seek to establish a state within the cyber world. Try reading the Title out loud sans the word, “Cyber”. You might get my point that way. To shorten the title, we may simply call this The Magna Carta for Philippine Internet Freedom. [3] The word, Magna Carta is an ambitious one, as it is a product of Sen. Santiago’s farsightedness.

Latin, for Great Charter, the Magna Carta is widely known to have come into effect upon the attachment of King John of England’s seal to a document proclaiming certain liberties to the lower classes which in turn weakens the monarchs rule in England. It was signed under protest by his majesty in consideration for the baron’s renewal of fealty to his rule. [4]

Scope

The scope is very broad as it covers several statutes, which generally regulate or penalize activities done in the physical world, and intends for them to apply in the cyberspace. I will not discuss much of felonies as this would warrant another post to specifically address its ever-large scope.

Players

How the bill works is dependent on the perspective of roles, their duties as well as rights. Henceforth, the reader must first identify the key players, to wit:

User [5]

The Government>

User. This guy refers to you who, having the freedom to access the internet [6], have been reading my blog in the cyberspace [7] and have the freedom to type your mind out as a comment. [8] In one activity, you can exercise these rights. As the blogger, I have the right that the content of this blog is presumed to be the copyrighted.[9] All this and more rights are guaranteed to the user by the State pursuant to the latter’s duty to bear it. [10]

The Government is not defined in the bill. Instead, I placed this because there are multiple government agencies involved that enforces the many statutes included under this bill. However, a key agency is involved herein that seeks much attention, and that is the Department of Information and Communications Technology, being the oversight agency, has the lead role when it comes to development and implementation of actions concerning the use of the internet and information and communications technology in the Philippines. It has also appended several agencies such as the National Telecommunications Commission and the National Data Privacy Commission to serve its ends. In the event of civil violations of the bill with respect to instructions for Information and Communications Technology infrastructure, the NTC be responsible for quasi-judicial, administrative and alternative dispute resolution. So is the NDPC when it comes to data privacy and security. [11]

Online and Offline

It covers the use of the internet. As we have arrays of laws protecting our physical world. This Magna Carta to some extent is a copy-paste of some of our rights in the physical world. However, it can also be used offline. Take for example the Data Privacy Act of 2012 [12], which includes the duty of a personal information controller to keep confidential the personal information inputted by the private individual. [13] This may or may not involve the internet as, upon filing the information, the personal information controller will store it. R.A. 10173 may even be violated through means outside the internet.

Not a Successor

We have to be noted that the lengthy title does not only include punishment of cybercrimes. Let us also not forget that said title is ambitious if not well intended as a magna carta. We have come across several laws whose sphere of application is dedicated and restricted to the internet. We have also seen some key dilemmas in many provisions of the Cybercrime law, which this law intend to rectify. However, we must be dispelled of the thought that this is not a successor law as it covers a much broader scope. We may even come to conclude that this lives up to the rightful reputation of any Magna Carta, not because of the number of pages in said law, but, because of the broad scope it encompasses combining or amending several statutes concerning internet use.

Changes

The bill specifically seeks to repeal in its entirety the controversial Cybercrime Prevention Act of 2012 [14] apart from the fact that at the end of the bill lies a repealing clause which is generally worded. [15] It replaced R.A. 10175 with its Chapter VII. Even Sen. Miriam Defensor Santiago firmly believed of the unconstitutionality of the Cyber Crime Law. [16]

Also, some changes were introduced to the Data Privacy Act of 2012. The name of the National Privacy Communication has been extended to National Data Privacy Communication. [17] This implies, as I believed, that said commission created under R.A. 10173 applies only to “electronic” information security, not paper in my previous blog. [18]

With the intent to repeal of R.A. 10175, we are exempt from prosecution when we express protest against the government or dissatisfaction against the said government, NGOs, political parties, religious groups, PUBLIC FIGURES, and many more. [19] What is striking about being allowed to use expressions of dissatisfaction in the internet against these entities? We are guaranteed safety to express whatever we want! We may have expanded right to express ourselves other than what is guaranteed under the Constitution! Think about it. If I am “dissatisfied” with a certain public figure, I could express myself in the internet through the making of a film in parody to him the way the Americans do former President Bush.

(Note: I almost forgot that the bill is yet to pass)

Amendments by Inclusion

Read through the bill and you will come across with some amendments of the several statutes which includes the word, “Data” or “programs”. Our Intellectual Property Code of the Philippines [20] which secures those expressions generally conceived in the physical world is being amended to include codes, scripts, computer programs, software application and other similar work as artistic or literary works under Section 172(n). [21] Thus, we could wave a big goodbye, should I say, to the certainty of a certain senator that It’s just a blog, hence no copyright. [22]

Internet providers are burdened the same way as telecommunication companies in providing us access to the internet and adequate service, free from discrimination. [23]

On Cyber Wars and Terrorism

The bill has recognized that the internet can be a means for one Filipino to harm his fellow nationals. More so did it recognize a state harming another state through internet use. The possibility of a cyber-war is not far from reality- may it be a group of overzealous patriots hack another country’s websites which cater to civil services or access confidential military records deposited in another site. The scenarios are endless. We have seen it happen when some of our zealous hackers defaced Chinese websites in response to the Chinese claims over the Panatag Shoal. [24] And, as a counter-attack, Chinese hackers defaced some of our websites as well. [25] What if these people are commissioned by their respective countries to cause ruin on each other’s sides? Or worse, these people just do it for the kicks. We’ll then be at a situation of great ruin. Services that may be rendered with haste would be caught in delay. Economy would become sluggish as transactions may be completed over the internet. And for once, users will use the internet less and socialize with the people outside making less friends compared to their friends in social websites.

With this bill, we shall recognize cyberwarfare, [26] prohibiting our military personnel from “first use” employment of cyberattack. [27] [28] To improve our national defense, several amendments are presented, such as our Philippine Air Force to develop cyberdefense capabilities as they are the first line of defense in case of warfare. [29] By the definition of cyberwarfare, we can conclude that said form of warfare is not limited in the cybernetic world, but also the use of robots. Imagine the employment of gundams raining showers of death upon the panicking civilians, causing untold strife, hardships and most of all, new anime series.

The primary objective of warfare is to win without resulting to any casualties and avoid attritions. The sooner triumph comes, the better. However, this doctrine is so ideal and, by history and current events, serves as proof that it remains to be the same bloody show it is. Therefore, other states may resort to cyberwarfare, by using unmanned aircrafts pursuant to this objective. In the event that it loses ammunition or bombs, a kamikaze strike may be employed. Warfare, in its primordial conceptualization loses meaning. It thus equates itself to a massacre, genocide or apartheid. Truly, the ones who employ such method would limit casualties but at the cost of too many lives on the other side of the fence that the value of State self-preservation is dimmed to incoherency. Would we allow submission? Henceforth, the need to preserve ourselves is forthcoming in this bill. We must be able to stand at least at an equal footing with the capabilities of other state.

Dilemmas on Application

In order to protect the rights of the people, the law penalizes certain prohibited acts. Prohibited acts may well be seen in the internet, and we use what we see as the violation as evidence against the violator. And, the law prescribes penalties ranging from fine to imprisonment in some or all of the violations. Therefore, those prohibited acts are criminal to begin with by which the Philippines is highly interested to prosecute on our stead. [30] Now here’s the problem. Our Rules on Electronic Evidence does not apply in criminal cases. Therefore, the manner by which we can prosecute persons violating our internet rights cannot extend to using electronic evidence. This is problematic in the sense that the violation may be in plain view in the internet but cannot be used as evidence to penalize a crime. This will be troublesome for our law enforcers as they have to find other forms of evidence to prove the accused person’s guilt beyond reasonable doubt. Of course, if it is a civil case, which is a personal violation of a right, resort to electronic evidence may well be used. Be noted that in a criminal case, it is the State that was legally violated through the violation of an individual’s right, hence, its active participation in criminal prosecution.

Overall Impressions

The bill, if passed into law, promises several key advantages. One is that we may no longer have to fear the government from cyber stalking us, which the Cybercrime Prevention Act of 2012 authorized law enforcement authorities under the ambiguous term, “due cause”. [31] and other problems in R.A. 10175 and conclude that this is so because there is no longer any R.A. 10175.>

Libel has been explicitly stated not to include expressions of protest or disappointment to the government. Our elective officials are given more responsibilities, and are duty bound to respect our property rights over our thoughts not only by ethical standards but by mandatory provisions of this bill. With the inclusion of codes, programs, etc. as literary or artistic expressions, not only our officials, but other users may not anymore copy-paste our research works. We then, as active internet users, trying to contribute to society by the voice of keyboard strokes will be endowed with a sense of self-worth as we open our eyes to the future. This indeed would be a major step for us to channel changes and improvements by the security and respect due to us. Administrators will cater to us with the proper respect we contractually deserve. Our state will thus be geared towards the future.


Endnotes

[1] http://www.senate.gov.ph/lisdata/1446312119!.pdf

[2] Sec. 8[1], S.B. 3327 s. 2012

[3] Sec. 1

[4] http://www.salisburycathedral.org.uk/history.magnacarta.php

[5] Sec. 3(59)

[6] Sec. 6

[7] Sec. 3(23)

[8] Sec. 8

[9] Sec. 12(2)

[10] Sec. 15

[11] Sec. 16(A)

[12] R.A. 10173

[13] Sec 20(a), R.A. 10173

[14] Sec 23 S. B. 3327 s. 2012

[15] Sec. 65

[16] http://technology.inquirer.net/20769/santiago-proposes-magna-carta-for-internet

[17]Sec.22(1) S.B. 3327 s. 2012

[18] On Spirit, not the Letter http://dimmuburgir2003.wordpress.com/2012/12/07/r-a-10173-your-soul-protector-in-the-world-of-information-technology/

[19] Sec. 33(A.3)

[20] R.A. 8293

[21] Sec. 19 S.B. 3327

[22] http://technology.inquirer.net/15540/its-just-a-blog-and-has-no-copyright-says-sotto

[23] Sec 20

[24] http://technology.inquirer.net/10235/filipino-hackers-fight-back-deface-chinese-sites

[25]http://www.google.com/hostednews/afp/article

/ALeqM5ieavMTCtsDq6Jzd8wBfyGQTNj4NA?docId=CNG.46b40 181ee39a090b52dd63a46e30e61.421

[26] Sec. 3(25)

[27] Sec. 3(18)

[28] Sec. 2(7)

[29] Sec. 47(1)

[30] Rule 1, Sec. 3(b) 1997 Rules of Civil Procedure

[31] Sec.12 10175

Advertisements
1 comment

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: