777JILI Data Subject Rights: The Eight You Can Use

These are the data subject rights that a website owes you once it holds your information, written down in RA 10173 and its Implementing Rules and Regulations (IRR). The full picture of what counts as personal information comes first; this page takes each right in turn and says how to put it to use. Section numbers are given as the texts print them.

The eight data subject rights, side by side

1. The right to be informed

RA 10173 §16(a) entitles you to be informed whether your personal information shall be, is being or has been processed, and IRR §34(a)(1) adds automated decision-making and profiling.

1. Write one line to the entity: is my information processed, and for what?
2. Keep the reply with the date it came.

2. The right to be furnished the notice items

Section 16(b) lists eight items due before your information enters the system, or at the next practical opportunity; the IRR’s §34(a)(2) lists nine, running from a description of the data to your right to lodge a complaint before the Commission.

1. Read the notice items page for the two-minute method.
2. Write down which item is missing and ask for it.

3. The right to access

Section 16(c) gives reasonable access, upon demand, to eight things: the contents processed, the sources, the recipients’ names and addresses, the manner of processing, the reasons for disclosure, automated processes, the date of last access and modification, and the identity and address of the controller.

1. Number those eight in your request.
2. Ask for a reply to each number.

4. The right to object

IRR §34(b) lets you object to processing, including direct marketing, automated processing or profiling. The controller then stops unless the data is needed under a subpoena, the purpose is obvious, as with a contract or service, or a legal obligation applies.

1. State what you object to, and from which date.
2. Ask for confirmation that processing has stopped.

5. The right to rectification

Section 16(d) lets you dispute an inaccuracy and have the controller correct it immediately, unless the request is vexatious or otherwise unreasonable. Third parties who received the data are informed on reasonable request.

1. Name the field and give the right value.
2. Attach proof and ask who was told of the correction.

6. The right to erasure or blocking

Section 16(e) lets you suspend, withdraw or order blocking, removal or destruction on discovery and substantial proof that the data is incomplete, outdated, false, unlawfully obtained, used without authority or no longer necessary. The IRR’s §34(e)(1)(d) adds a ground: you withdraw consent or object, and no other legal ground exists.

1. Cite the ground and attach the proof.
2. For withdrawal, read the consent form checks first.

7. The right to damages

Section 16(f) entitles you to be indemnified for damages sustained through inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of your data. The NPC’s Rule II §3 asks a complaint to state every relief sought.

1. List each loss with its proof.
2. For a leak, follow the data breach notice rules first.

8. The right to data portability

Section 18 gives you, where information is processed by electronic means in a structured and commonly used format, a copy in an electronic or structured format that allows further use. The IRR’s §36 repeats it.

1. Ask in writing for the copy.
2. Name a format you can open.

Using any right

Whichever right you use, write to the entity first and keep its reply. The NPC’s 2021 Rules of Procedure, Rule II §2, treat fifteen (15) calendar days from receipt with no response as the point at which a complaint can proceed, and the NPC may waive the step for good cause.

1. Send your letter and note the date.
2. Count fifteen (15) calendar days.
3. File the form the NPC’s complaints page describes.