Data Privacy Act IRR Secs. 34 and 48 — automated decision-making: logic disclosure, NPC notification and the consent bar
Binds Personal information controllers and personal information processors within the scope of the Act and Rule II of the IRR, including entities not established in the Philippines that use equipment located in the country or maintain an office, branch or agency here. The Section 48 notification duty binds any controller whose automated processing becomes the sole basis for a decision significantly affecting a data subject; the Section 34 transparency and objection rights bind all controllers. Impact tier: all entities.. The Implementing Rules and Regulations of Republic Act No. 10173 (Data Privacy Act of 2012) carry the Philippines' operative automated-decision regime. Section 34 gives the data subject a right to be informed whether personal data are processed 'including the existence of automated decision-making and profiling', and requires the controller to furnish, before entry of the data into the processing system or at the next practical opportunity, the methods used for automated access together with 'meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject' (Sec. 34(a)(f)); the same section carries a right to object to processing 'including processing for direct marketing, automated processing or profiling', and a right of access to 'information on automated processes where the data will, or is likely to, be made as the sole basis for any decision that significantly affects or will affect the data subject'. Section 48 adds a filing duty and a substantive bar: a controller carrying out wholly or partly automated processing operations must notify the National Privacy Commission once the automated processing becomes the sole basis for making decisions about a data subject and the decision would significantly affect that subject, submitting the purpose of processing, the categories of data and data subjects, the consent forms or manner of obtaining consent, the recipients, the retention period, the 'methods and logic utilized for automated processing', the decisions that would be made on the basis of the processed data or that would significantly affect the rights and freedoms of the data subject, and the name and contact details of the data protection officer; and 'no decision with legal effects concerning a data subject shall be made solely on the basis of automated processing without the consent of the data subject'. Section 16(c)(6) of the Act itself carries the statutory root of the access right.
Commencement is computed from the face of the instrument. IRR Section 72 provides that the Rules take effect fifteen days after publication in the Official Gazette; the Rules were promulgated by the National Privacy Commission on 24 August 2016 and published in the Official Gazette on 25 August 2016, which places entry into force on 9 September 2016. IRR Section 67 gave controllers one year from that date to register their data processing systems or automated processing operations subject to notification, so that window closed on 9 September 2017 and the Section 48 duty is now fully exigible. The parent statute, Republic Act No. 10173, was approved on 15 August 2012 and took effect fifteen days after newspaper publication under its Section 45. Note the division of labour between statute and rules: RA 10173 Sec. 16(c)(6) grants only access to information on automated processes used as the sole basis for a significant decision, while the consent bar on solely-automated decisions with legal effects and the meaningful-information-about-the-logic requirement appear only in the IRR, at Secs. 48 and 34 respectively. Asian peer of cn-pipl-art24, kr-pipa-art37-2-adm and id-uu27-adm: like Indonesia and Korea it is already in force, and like Korea it reaches the logic of the decision, but unlike Korea it grants no express right to human re-processing — the Philippine mechanism is a consent gate plus a regulator filing rather than a post-hoc review right. Text read at the National Privacy Commission's own publication of the IRR and cross-checked against the Supreme Court E-Library copy (elibrary.judiciary.gov.ph/thebookshelf/showdocs/2/70735), which carries the identical Secs. 34, 48, 67 and 72. officialgazette.gov.ph returns HTTP 403 to non-browser clients, so the NPC copy is cited.
Stated maximum penalty — IRR Section 65 subjects violations of the Act, the Rules and Commission issuances to compliance and enforcement orders, cease and desist orders, a temporary or permanent ban on processing, or fines under a schedule published by the Commission. That schedule is NPC Circular No. 2022-01 (Guidelines on Administrative Fines, 8 August 2022): each infraction of a data subject right under Sec. 16 of the DPA affecting more than 1,000 data subjects is a grave infraction carrying 0.5 per cent to 3 per cent of the annual gross income of the preceding year, and 1,000 or fewer affected subjects is a major infraction carrying 0.25 per cent to 2 per cent, with total administrative fines capped at PHP 5,000,000. Criminal liability under Chapter VIII of the Act runs separately for the enumerated offences, for example unauthorised processing of personal information at one to three years' imprisonment and a fine of PHP 500,000 to PHP 2,000,000 under Sec. 25(a).