Data privacy

Dear Atty. Kathy,

Our company wants to enter into contracts with several prospective clients, to conduct marketing analytics. The clients will be providing statistical data of their customers and survey participants, which however, are covered under the definition of personal information under the Data Privacy Act of 2012, such as marital status, age, and gender, but will not include the names. Will this not be covered by the Data Privacy Act of 2012?

Skylar

***

Dear Skylar,

Both Regulation (EU) 2016/679, which repeals the 1995 EU Directive upon which the Data Privacy Act of 2012 (DPA) is based on, recognizes that the principles of data protection should not apply to anonymous information. Information is anonymous when such information does not relate to an identified or identifiable natural person; or is personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.

Stated another way, anonymized data, where the data would not directly and certainly identify an individual, such as through their names, is not considered as personal information and thus, falls outside of the ambit of the DPA.

In this connection, it has to be ensured that the data provided is genuinely anonymized data without any identifiers. The company should also not have access to the complete records including personal data that has not been anonymized, otherwise, regardless if the processing of personal information results in anonymized data, such will not be exempted from the coverage of the DPA.

(NATIONAL PRIVACY COMMISSION PRIVACY POLICY OFFICE ADVISORY OPINION NO. 2017-27)

Atty. Kathy Larios