777JILI Privacy Notice: The Nine Items Before You Sign Up
The IRR of RA 10173, Section 34(a)(2), lists nine items you are to be told before your personal data enters a system or at the next practical opportunity, from a description of the data to your right to complain to the Commission.
Key facts and contents
- 777JILI Consent Form
- RA 10173 Section 3(b) calls consent a freely given, specific, informed indication of will, and NPC Circular 2023-04 adds that it can be withdrawn at any time and without cost.
- 777JILI Data Breach
- NPC Circular 16-03 defines a personal data breach as a security breach that leads to loss, alteration, unauthorized disclosure or access, and gives the controller 72 hours to notify the Commission and, where the conditions are met, you.
- 777JILI Data Subject Rights
- RA 10173 Sections 16 and 18 and the IRR's Section 34 give a data subject eight rights: to be informed, to be furnished the information, access, object, rectification, erasure or blocking, damages, and data portability.
The page you are asked to read before you hand over your details is the privacy notice, and Philippine rules list what has to be on it. This page turns that list into a two-minute read. It sits beside the personal information pillar, which explains what each item is protecting.
The nine items, from the IRR
The IRR of RA 10173 states in §34(a)(2) that you are to be notified and furnished with the information below before the entry of your personal data into the controller’s processing system, or at the next practical opportunity. RA 10173 §16(b) carries the same list in eight numbered items; the IRR adds the basis of processing when consent is not the basis. The table pairs each lettered item with the question to put to a page.
| IRR §34(a)(2) item | What the item says | Question to put to the page |
|---|---|---|
| (a) | Description of the personal data | Does it name each field it asks for? |
| (b) | Purposes, including direct marketing, profiling or statistical purposes | Is marketing listed as its own purpose? |
| (c) | Basis of processing when not consent | Does it say why it may process without a tick? |
| (d) | Scope and method | Does it say what is done with the data? |
| (e) | Recipients or classes of recipients | Does it name who else receives it? |
| (f) | Methods for automated access, with the logic involved | Is there any automated decision on you? |
| (g) | Identity and contact details of the controller | Is there a named entity and a way to reach it? |
| (h) | The period for which the information will be stored | Is there a storage period? |
| (i) | Your rights, including to lodge a complaint before the Commission | Does it mention the NPC? |
A two-minute read, in order
Set a clock if it helps; five passes are enough.
- Open the notice from the address bar you typed, not from a link in a message. Check the entity named under (g) is the one whose page you are on.
- Search the page for “store”, “retain” or “period” and find item (h). A notice with no period fails the check on one line.
- Search for “share”, “partners” or “third part” to find the recipients under (e), and count them.
- Look for marketing under (b). NPC Circular 2023-04 §14 says direct marketing may require consent in certain instances, so it is worth a separate tick.
- Find your rights under (i) and the line that names the NPC. The full list of data subject rights shows what each right lets you ask for.
Which items the law lets a page skip
The proviso in RA 10173 §16(b) says the notification does not apply in three cases:
- The information is needed under a subpoena.
- The collection is for obvious purposes, including when necessary for a contract or service between the collector and the data subject.
- The information is collected and processed as a result of a legal obligation.
The IRR’s §34(b) uses the same three exceptions for the right to object. They explain why a short form may carry a short notice.
What to keep, and what a change means
Save a copy of the notice on the day you sign up:
- Screenshot the page with the address bar showing.
- Note the time.
- Store both with the e-mail or message you received.
RA 10173 §16(b) says information supplied to you on these matters shall not be amended without prior notification, so your saved copy is the baseline against which a change is measured. IRR §34(b) says you are to be notified and given an opportunity to withhold consent to changes or amendments.
When the notice and the facts disagree
Three comparisons show a gap:
- If your details reach a stranger, set that against item (e), the recipients you were told about, and against what the controller later says in its breach notice items.
- If the storage period in item (h) has passed, RA 10173 §16(e) lets you ask for blocking, removal or destruction where the data is no longer necessary for the purposes it was collected.
- Before any complaint, the NPC’s 2021 Rules of Procedure, Rule II §2, ask you to write to the entity first and wait fifteen (15) calendar days before a complaint is given due course.
FAQ
Is a privacy notice required before I give my details?
RA 10173 Section 16(b) says you are to be furnished the listed information before the entry of your personal information into the system, or at the next practical opportunity. The proviso excepts subpoenas, obvious purposes such as a contract or service, and legal obligations.
Does the law say a privacy notice must exist as a document?
The IRR's Section 34(a)(2) names the information you are to be furnished and does not define privacy notice as a term. The page or screen that carries those items is what readers call the notice.
Can a notice change after I have signed up?
RA 10173 Section 16(b) says information supplied on these matters shall not be amended without prior notification of the data subject. IRR Section 34(b) adds an opportunity to withhold consent to changes.
How long may my details be kept?
Item (h) of IRR Section 34(a)(2) is the period for which the information will be stored. A notice that is silent on it is missing an item.