Data privacy breaches or losses, which open up the possibility of illegal use, can make one’s hair stand on end. You fear your information could be in the hands of faceless entities planning to use your details for nefarious purposes.

Such is the general nervousness that surrounds the management of digital data that, until now, there are those who remain on the fence about the National ID System — already signed, sealed and about to be delivered.

It also explains why a little tweet recently became a blast of explosive conjectures.

It started when Department of Foreign Affairs (DFA) Secretary Teodoro Locsin Jr. posted that bit about a passport contractor “making off” with private data in explaining the current requirement for pre-2010 passport renewal applicants to present their birth certificates.

The public, naturally, gave a hue and cry, although it could have been initially about that “cumbersome” requirement to produce one’s birth certificate anew instead of just presenting old passports.

Then it rapidly dawned on many that more serious issues and repercussions may lie beneath the cryptic revelation.

Even if it was “not a breach” but “an apparent inability to access data,” as explained by former Foreign Affairs chief Perfecto Yasay Jr., the thought of any personal data being “lost,” in whatever sense, still has the power to put people on the warpath.

Locsin through his ensuing posts, however, revealed that a disgruntled company “had been terminated because government officials at the time wanted to make kickbacks from a new deal,” as one report sums up.

Indeed, several concerns unraveled, one after the other. Who was this contractor and how could it be allowed to leave with something government-owned? What do the so-called Yellows have to do with the fiasco, and why? On the other hand, should we be afraid of identity theft and other such digital crimes? Does this bode ill for the national ID system? Were there violations made under the Data Privacy Act (DPA)?

As we can glean from that 2016 “Comeleaks” fiasco (which remains unresolved to this day), data privacy is a sensitive matter, and news of mishandled/mismanaged/missing data that the public entrusts to government can be remarkably painful, especially when it seems the whole thing reeks of a stink we know so well.

The DFA chief did not name the company in question, but follow-up reports say Oberthur Technologies of France had won the contract to produce e-passports in 2008. The DFA at the time (under then President Noynoy Aquino) transferred the production of the passports to APO Production Unit Inc. (APO), one of the three government-authorized printers in October 2015.

APO, for its part, later told news outfits that said data was “intact and accessible” all along, kept in their Batangas plant.

So now, pending planned investigations into the matter, we can try to figure out ourselves what this is all about. Or we can do away with the political undertones for now and focus on the DPA which affects us all.

Republic Act 10173, otherwise known as the Data Privacy Act, aims “to protect all forms of information, be it private, personal, or sensitive” and covers “both natural and juridical persons involved in the processing of personal information.”

Such a law is supposed to make us heave a sigh of relief when doubts arise about data security, such as with all records we submit to public and private entities for whatever transactions we make, and also for the upcoming Philippine Identification System (PhilSys).

PhilSys will be the government’s central identification platform that will simplify public and private transactions. If implemented properly, it should “greatly improve the delivery of government services to all citizens,” as well as “reduce corruption and curtail bureaucratic red tape, prevent fraudulent transactions and ease doing business in the Philippines,” as explained in a report.

Considering the nature of data that PhilSys will keep, the DPA comes as the necessary element to assure that our right to privacy is protected. It even came with a “twin” bill on cyber security — RA 10175 or the Cybercrime Prevention Act — and gave rise to new agencies, the National Privacy Commission and the Department of Information and Communications Technology.

Now, because of this passport data mess, we shall see how these unfamiliar new laws and untried regulators will work in this high-tech world where many low-blow anomalies continue to thrive.