The Philippine Data Privacy Act: what it means for cookies

What is the Data Privacy Act?

Republic Act No. 10173, the Data Privacy Act of 2012 (DPA), is the Philippines' general data protection law. It was approved on 15 August 2012 and created the National Privacy Commission (NPC), an independent body that implements the Act, issues circulars and advisories, handles complaints and adjudicates cases. The implementing rules and regulations were issued in 2016. Since then the NPC has filled in the details through circulars, including Circular 2022-01 on administrative fines, issued on 8 August 2022, and Circular 2023-04 on consent, issued on 7 November 2023.

Who does the DPA apply to?

The Act applies to the processing of all types of personal information by any natural or juridical person in the government or private sector. Section 6 extends it to acts done outside the Philippines when the processing relates to personal information about a Philippine citizen or resident and the entity has a link with the Philippines, for example a contract entered into in the country, a branch, office or subsidiary there, central management and control there, carrying on business there, or holding personal information collected in the Philippines. A foreign online shop that sells to customers in the Philippines is likely to be caught.

Do cookies need consent in the Philippines?

The DPA does not mention cookies, and no NPC circular deals with them specifically. They are covered when they collect personal information, meaning information from which a person's identity is apparent or can reasonably and directly be ascertained, or that identifies a person when combined with other information.

Section 12 allows processing of personal information when at least one condition applies: consent; a contract with the person or steps at their request before one; a legal obligation; vital interests; national emergency, public order or public authority functions; or legitimate interests of the controller or a third party, unless overridden by the person's fundamental rights. Sensitive personal information, such as health or government identifiers, needs specific consent or another narrow exception (Section 13).

That leaves room for choice. Strictly necessary cookies can rely on the contract or legitimate interests. Analytics may rely on legitimate interests after an assessment. Circular 2023-04 says a controller may treat direct marketing using personal information as a legitimate interest if its assessment supports it, but must obtain consent where the processing would significantly affect the person's rights and freedoms. Cross-site advertising and profiling cookies are therefore the clearest case for consent. Whatever the basis, the person must be told about the processing, and Circular 2023-04 makes just-in-time and layered notices the default format.

What must consent look like?

Section 3(b) of the Act defines consent as a freely given, specific, informed indication of will, evidenced by written, electronic or recorded means. Circular 2023-04 adds:

• Clear assenting action. Consent must be expressly given through an action that signifies agreement to the specific purposes. Consent can never be assumed, and non-response or implied consent is not valid.
• Freely given. There must be no pressure or adverse consequence for refusing, and controllers must not use deceptive design patterns, including dark patterns, to obtain consent. Offering an incentive is not automatically deceptive.
• Specific and informed. Vague or blanket statements do not produce valid consent, and the person must receive the relevant information before agreeing.
• Easy withdrawal. Withdrawing consent must be as easy as, if not easier than, giving it. Once consent is withdrawn and no other basis applies, processing must stop and the data be deleted. A controller that relied on consent cannot switch to legitimate interests after withdrawal.
• Profiling. People must be informed of profiling or automated processing before their data enters the system.

For websites, this describes a banner with an explicit Accept action, a Reject option of equal weight, no pre-selected tracking categories and a permanent link to change the choice.

How are transfers abroad regulated?

The DPA has no adequacy system. Section 21, the principle of accountability, makes the controller responsible for personal information transferred to a third party for processing, in the Philippines or abroad. It must use contracts or other reasonable means to provide a comparable level of protection while the information is processed by the third party, and designate people accountable for compliance. Contracts with foreign analytics and advertising vendors should therefore include data protection terms.

Who enforces the DPA, and what are the penalties?

The NPC can investigate, adjudicate complaints, award indemnity, issue cease and desist orders and impose administrative fines. Under Circular 2022-01, grave infractions carry fines of 0.5% to 3% of the annual gross income of the preceding year, and major infractions 0.25% to 2%, but the total fine for a single act cannot exceed PHP 5 million. Breaching the general privacy principles or data subject rights for more than 1,000 people counts as grave, and repeat infractions are automatically grave.

The Act also creates crimes. Processing personal information without consent or other authority carries 1 to 3 years in prison and a fine of PHP 500,000 to 2 million, rising to 3 to 6 years and up to PHP 4 million for sensitive information (Section 25). A combination of offenses carries 3 to 6 years and up to PHP 5 million (Section 33), and the maximum applies when at least 100 people are affected (Section 35). For companies, the responsible officers are punished.

The NPC's best-known case is the 2016 breach of the Commission on Elections' voter database. In a decision dated 28 December 2016 it found the agency had violated the Act, ordered corrective measures and recommended the criminal prosecution of its chairman.

What should a website serving the Philippines do?

• Inventory cookies and decide the lawful basis for each; the cookie scanner lists what your pages set.
• Use a layered, just-in-time notice that explains each category.
• Ask for consent with a clear action for advertising and profiling cookies, with no dark patterns.
• Keep a record of consent, since it must be evidenced by electronic or recorded means.

The Philippines is not in Cookiequiet's default list of regulated countries, but geo-targeting is free on every plan, so you can add it to a custom list. Visitors there then see the opt-in banner with Accept all and Reject all of equal weight, and the consent log records each choice. See also Indonesia, Singapore and the GDPR.