Definition of personal information

Personal Information is defined in the Act as ‘any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.’

The Act, in addition to defining ‘Personal Information’ that is covered by the law, also expressly excludes certain information from its coverage. These are:

• information about any individual who is or was an officer or employee of a government institution that relates to the position or functions of the individual, including:
• the fact that the individual is or was an officer or employee of the government institution;
• the title, business address and office telephone number of the individual;
• the classification, salary range and responsibilities of the position held by the individual; and
• the name of the individual on a document prepared by the individual in the course of employment with the government.
• information about an individual who is or was performing services under contract for a government institution that relates to the services performed, including the terms of the contract, and the name of the individual given in the course of the performance of those services;
• information relating to any discretionary benefit of a financial nature such as the granting of a license or permit given by the government to an individual, including the name of the individual and the exact nature of the benefit;
• Personal Information processed for journalistic, artistic, literary or research purposes (intended for a public benefit);
• information necessary in order to carry out the functions of a public authority which includes the processing of personal data for the performance by the independent, central monetary authority and law enforcement and regulatory agencies of their constitutionally and statutorily mandated functions. Nothing in this Act shall be construed as to have amended or repealed Republic Act No. 1405, otherwise known as the Secrecy of Bank Deposits Act; Republic Act No. 6426, otherwise known as the Foreign Currency Deposit Act; and Republic Act No. 9510, otherwise known as the Credit Information System Act ("CISA");
• information necessary for banks and other financial institutions under the jurisdiction of the independent, central monetary authority or Bangko Sentral ng Pilipinas to comply with Republic Act No. 9510, and Republic Act No. 9160, as amended, otherwise known as the Anti-Money Laundering Act and other applicable laws; and
• Personal Information originally collected from residents of foreign jurisdictions in accordance with the laws of those foreign jurisdictions, including any applicable data privacy laws, which is being processed in the Philippines.

Definition of sensitive personal information

"Sensitive Personal Information" is defined in the Act as Personal Information:

• about an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;
• about an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offence committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns, and specifically established by an executive order or an act of Congress to be kept classified.