Data Privacy Act briefing urges wider awareness

1 of 2

By Mariela Angella Oladive

Legal practitioners gathered on Friday, Dec. 5, at the Casa Real Social Hall in Iloilo City for an executive briefing on the Data Privacy Act (DPA), aimed at clarifying key provisions of the law and addressing persistent misconceptions about its implementation.

The session brought together members of the Integrated Bar of the Philippines–Iloilo Chapter, the Ateneo Law Alumni Association Inc. (ALAAI), and other local stakeholders.

In a lecture titled “Demystifying Data Privacy for Legal Professionals: An Executive Briefing,” resource speaker Atty. Jon O. Bello, a leading authority in data privacy and regulatory compliance, discussed the law’s core principles, common compliance gaps, and challenges driven by digital transformation.

In an interview, Bello emphasized that the DPA applies to every Filipino “from the moment we are born,” yet confusion remains—especially among professionals handling sensitive data.

“One of the biggest misconceptions is that you need consent for everything,” he said. “Hospitals, schools, employers and service providers often assume they must secure consent for all data processing, when in fact the law provides several other legal bases—such as medical treatment, contractual necessity or legitimate interest.”

This misunderstanding, he noted, has led to lapses in compliance and inconsistent practices across institutions.

“We need to assist lawyers so they can be good advisors to their clients,” he added. “Since this is a relatively new law, there is still a lot of confusion on how to properly exercise the right to privacy.”

He also cited rapid technological developments as a key complication in privacy governance.

“Privacy converges with technology—and technology always changes,” he said. “Artificial intelligence, for instance, creates new challenges. It collects so much data about a person. It is a totally different anima compared to before. It has changed the rules of the game, so to speak, in terms of privacy protection.”

While the DPA was enacted in 2012, Bello noted that meaningful implementation only began after the establishment of the National Privacy Commission (NPC) in 2016.

“There is still limited legal literature on this law, yet it is one of the most significant in our daily lives because it affects everyone,” he stressed.

Meanwhile, ALAAI Chapter President Atty. Aloysius De La Cruz said the event was organized in response to growing concerns over compliance gaps in local institutions.

“I am personally worried that many hospitals and educational institutions still do not have a Data Protection Officer,” he said, warning that violations carry serious consequences—including penalties of up to 3 percent of gross annual income and imprisonment of up to seven years.

He added that the event also aimed to educate other stakeholders, as data privacy affects all sectors.

“We are well aware that this [DPA] needs to be disseminated, and in the process, we should help other practitioners and stakeholders take this into careful consideration,” he said.