Continue reading on DataGuidance with:
Free Member
Limited ArticlesCreate an account to continue accessing select articles, resources, and guidance notes.
Already have an account? Log in
Create an account
Join our community for free to access exclusive whitepapers, reports, and regulatory information.
Philippines: NPC requests comments on draft circular on ID cards
On May 9, 2023, the National Privacy Commission (NPC) requested public comments on the Draft Circular - Guidelines on Identification Cards Issued by Private Sector Personal Information Controllers (the Draft Circular).
Scope
The Draft Circular applies to personal information controllers (PICs) in the private sector that issue Identification (ID) cards to data subjects. ID cards under the Draft Circular are understood to be any physical or digital ID card that identifies a data subject and may include, company IDs, school IDs, insurance cards, membership cards, and reward or loyalty cards.
Content of ID Cards
The Draft Circular provides that all PICs issuing ID cards must ensure only necessary personal data is indicated in relation to the primary purpose of identifying the data subject. Notably, the Draft Circular clarifies that:
- in the case of ID cards with additional functions, PICs must ensure that all other personal data that will be included are reasonable and necessary for the specified and declared purposes of that specific ID card;
- nothing in the Draft Circular shall be construed as prohibiting the inclusion of any personal data that is explicitly required by law or regulation to be indicated in an ID card issued by PICs in the private sector;
- PICs shall implement reasonable and appropriate safeguards to protect personal data on ID cards and shall ensure that such security features are level with technological advances, best practices, and industry standards; and
- in all cases, ID cards shall not contain information that is excessive, noting that PICs must bear the burden of demonstrating that the inclusion of a particular category of personal data is proportionate to the legitimate purpose of processing.
The Draft Circular shall enter into effect 15 days after its publication in the Official Gazette, and PICs have 90 days from its date of entry into effect to comply with the requirements of the same.
Public comments may be submitted to [email protected] until June 9, 2023.
You can read the Draft Circular here.
