777JILI Personal Information: What a Sign-Up Form May Ask You

Every sign-up form you meet asks for personal information, and the Philippines has one statute that says what that phrase covers and what the form owes you in return. This page lays out RA 10173, the Data Privacy Act of 2012, and the National Privacy Commission (NPC) texts that explain it. It works for any website that asks for your details, a casino’s included, and it describes no form of its own because this site keeps none.

What RA 10173 counts as personal information

RA 10173 §3(g) defines personal information as information, whether recorded in a material form or not, from which your identity is apparent or can be reasonably and directly ascertained by the entity holding it, or which would directly and certainly identify you when put together with other information. Section 3(c) calls the person described a data subject, and §3(h) calls the one who controls the collection a personal information controller.

Personal data: the IRR’s umbrella word

The Implementing Rules and Regulations (IRR), in Rule I §3(j), say personal data “refers to all types of personal information and sensitive personal information”. When a notice or a circular says personal data, it means both tiers at once. The breach rules in NPC Circular 16-03 §3(F) use the word when they name a personal data breach as a breach of security leading to accidental or unlawful destruction, loss, alteration, disclosure of or access to it.

Sensitive personal information: the four groups

RA 10173 §3(l) lists four groups of sensitive personal information:

1. race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;
2. health, education, genetic or sexual life, and any proceeding for an offense and its outcome;
3. items issued by government agencies peculiar to an individual, with social security numbers, health records, licenses and tax returns named;
4. anything an executive order or an act of Congress keeps classified.

How the fields on a sign-up form fall into those tiers

A form that asks for a full name, a mobile number, a date of birth and a photo of an ID is collecting at least two tiers. The table sorts those four examples by the Act’s own wording. It is a reading aid for any form, not a description of one.

RA 10173 §4 says the Act applies to the processing of all types of personal information and to any natural and juridical person involved in it. So the question to ask of a form is not whether the law reaches it but what each field is for.

What you are owed before you tick anything

RA 10173 §16(b) says you are to be furnished eight items before your information enters the controller’s system, or at the next practical opportunity:

1. a description of the information;
2. the purposes;
3. the scope and method of processing;
4. the recipients;
5. the methods of automated access;
6. the identity and contact details of the controller;
7. the storage period;
8. your rights, including the right to lodge a complaint with the Commission.

The privacy notice that carries those items is where you look first, and the IRR’s §34(a)(2) adds the basis of processing when consent is not the basis.

Consent comes second. NPC Circular 2023-04 builds on §3(b) of the Act: consent must be freely given, specific, informed and an indication of will, and §13 lets you withdraw it at any time and without cost. How a tick-box meets that test is the subject of the consent form checks on this site. A waiver of your data privacy rights, including the right to file a complaint, is void under Circular 2023-04 §20.

The rights you can use afterwards

Section 16 of the Act lists six rights, and §18 adds data portability. The IRR’s §34 adds a right to object. Each, with the section that grants it, is set out in the list of data subject rights.

1. To be informed, and to be furnished the §16(b) items.
2. To reasonable access.
3. To dispute inaccuracy and have it corrected.
4. To suspend, withdraw or order blocking, removal or destruction.
5. To be indemnified for damages.

When your details leak

RA 10173 §20(f) requires the controller to promptly notify the Commission and affected data subjects when sensitive personal information, or other information usable for identity fraud, is reasonably believed to have been acquired by an unauthorized person. NPC Circular 16-03, dated 15 December 2016, sets seventy-two (72) hours in §17(A) for the Commission and in §18(A) for data subjects. Section 30 of the Act punishes concealment with imprisonment of one year and six months to five years and a fine of not less than Php500,000 and not more than Php1,000,000. The steps after a data breach follow that timeline.

Where to take a complaint

The NPC’s 2021 Rules of Procedure (NPC Circular 2021-01, dated 28 January 2021) work in this order:

1. Write to the entity that holds your information and keep a copy, per Rule II §2.
2. Wait fifteen (15) calendar days from receipt for a response, which the NPC may waive for good cause.
3. File a complaint that is in writing, signed and verified, with the facts, the evidence and your reliefs, per Rule II §3.
4. Attach your earlier correspondence with the respondent, per §3(8).

The NPC’s complaints page says the form is printed, notarized and submitted in person, by courier, or by scan to complaints@privacy.gov.ph. Rule II §4 says no further action is taken until the appropriate filing fees are paid unless an exception applies. The saved texts print no amount, so ask the NPC for its fee schedule. How to word the first letter is in the complaint letter pointers.

Keep your own record on your phone

Three habits cost nothing:

1. Screenshot the notice.
2. Screenshot the box you ticked.
3. Note the time.

The phone and browser checks cover saving a page and clearing what a browser stored. If you reached a form through a page that uses the 777JILI name, the 777JILI casino hub lists what this site covers under that name, and this site’s own privacy policy says what it collects from you. Who writes these pages is on the page about this site.