Fundamentals of the Data Privacy Act: Penalties and Third-Party Risks

Aside from unauthorized access or intentional breach, the Data Privacy Act lists down unauthorized processing, accessing personal information due to negligence, improper disposal of personal information, concealment of security breaches, malicious disclosure, and unauthorized disclosure as prohibited acts which may result in either fine, imprisonment or both. This highlights the value of a good and clear “privacy notice”, “privacy policy” and consent form; and the need for personal information controllers to manage third-party risks through a properly-executed outsourcing agreement.