Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Philippines: NPC requests comments on draft circular on ID cards

On May 9, 2023, the National Privacy Commission (NPC) requested public comments on the Draft Circular - Guidelines on Identification Cards Issued by Private Sector Personal Information Controllers (the Draft Circular).

Scope

The Draft Circular applies to personal information controllers (PICs) in the private sector that issue Identification (ID) cards to data subjects. ID cards under the Draft Circular are understood to be any physical or digital ID card that identifies a data subject and may include, company IDs, school IDs, insurance cards, membership cards, and reward or loyalty cards.

Content of ID Cards

The Draft Circular provides that all PICs issuing ID cards must ensure only necessary personal data is indicated in relation to the primary purpose of identifying the data subject. Notably, the Draft Circular clarifies that:

  • in the case of ID cards with additional functions, PICs must ensure that all other personal data that will be included are reasonable and necessary for the specified and declared purposes of that specific ID card;
  • nothing in the Draft Circular shall be construed as prohibiting the inclusion of any personal data that is explicitly required by law or regulation to be indicated in an ID card issued by PICs in the private sector;
  • PICs shall implement reasonable and appropriate safeguards to protect personal data on ID cards and shall ensure that such security features are level with technological advances, best practices, and industry standards; and
  • in all cases, ID cards shall not contain information that is excessive, noting that PICs must bear the burden of demonstrating that the inclusion of a particular category of personal data is proportionate to the legitimate purpose of processing.

The Draft Circular shall enter into effect 15 days after its publication in the Official Gazette, and PICs have 90 days from its date of entry into effect to comply with the requirements of the same.

Public comments may be submitted to [email protected] until June 9, 2023.

You can read the Draft Circular here.