The National Privacy Commission (NPC) released its latest circular updating the policy framework for personal information controllers (PICs) and personal information processors (PIPs) aiming to protect personal data of citizens even with the use of Closed-Circuit Television (CCTV) systems.

Published on Monday, the circular outlines the responsibilities and obligations of entities using CCTV systems to ensure compliance with the Data Privacy Act of 2012 (DPA).

Privacy Commissioner Atty. John Henry D. Naga said the Circular applies to CCTV systems used by PICs and PIPs that process the personal data of their clients, while those users of CCTV for purely personal, family, or household affairs, and lawful surveillance, were excluded.

Naga stressed the importance of these guidelines in balancing security needs with privacy obligations, saying as technology advances, so too must their policies.

“This Circular ensures that the use of CCTV systems is both responsible and respectful of data subject rights. PICs and PIPs using CCTV systems must understand their obligations under the DPA and implement appropriate safeguards to protect personal data," he said.

One of the key provisions of the Circular is the requirement for PICs to prominently display CCTV notices in surveillance areas.

The notices must clearly indicate the nature, scope, and extent of surveillance, the purpose of the CCTV system, its capabilities and other relevant details.

Section 5 of the Circular outlines reasonable and appropriate security measures that organizations must implement to protect personal data processed through CCTV systems.