Personal data of citizens are now protected even with the use of Closed-Circuit Television (CCTV) systems, as the National Privacy Commission released its latest circular updating the policy framework for personal information controllers (PICs) and personal information processors (PIPs).

Published on Monday, the circular outlines the responsibilities of entities using CCTV systems to ensure compliance with the Data Privacy Act of 2012 (DPA).

Privacy Commissioner John Henry D. Naga said the Circular applies to CCTV systems used by PICs and PIPs that process the personal data of their clients, while those users of CCTV for purely personal, family, or household affairs, and lawful surveillance, were excluded.

Naga emphasized the importance of these guidelines in balancing security needs with privacy obligations, saying as technology advances, so too must their policies.

“This Circular ensures that the use of CCTV systems is both responsible and respectful of data subject rights. PICs and PIPs using CCTV systems must understand their obligations under the DPA and implement appropriate safeguards to protect personal data," he said.

One of the key provisions of the Circular is the requirement for PICs to prominently display CCTV notices in surveillance areas.

The notices must indicate the nature, scope, and extent of surveillance, the purpose of the CCTV system, its capabilities, and other relevant details.

Section 5 of the Circular outlines reasonable and appropriate security measures that organizations must implement to protect personal data processed through CCTV systems.

These include establishing policies that govern the operation and deployment of CCTV systems, as well as procedures for handling access requests, managing personal data breaches, and ensuring regular audits of security practices.

Individuals whose personal data are recorded by CCTV systems have a right to reasonable access to footage in which they appear, subject to the DPA, its IRR, relevant issuances of the NPC, and other existing laws and regulations.

The Circular requires PICs and PIPs to have procedures in place to respond to such requests efficiently.

Naga said additionally, that CCTV footage may be disclosed for purposes such as law enforcement, criminal investigations, court orders, and administrative inquiries, under the provisions of the Circular.

The Circular shall take effect after fifteen days following the completion of publication or on 27 August 2024.