Empowering the Data Subject
For the past months, we at the National Privacy Commission have been working both as advocates and enforcers of the Data Privacy Act. Making sure that organizations that handle our data are aware of their responsibilities, however, is only half the task. To truly cultivate data privacy and security, the public must be made aware of their rights which the law has defined for them as---data subjects.
A data subject is an individual whose personal information is processed. In this day and age this means practically each one of us is a data subject . That is why, whenever I speak in front of data controllers and processors, I always remind them to wear two hats during my talk: one as data controller or processor and as a data subject. After-all, even if they belong to the business of processing the personal data of others, at the end of the day, everyone is basically a data subject. Truly, in contemplating the Data Privacy Act, the old maxim, “Do not do unto others what you don’t want done unto you”, rings relevant.
We at the National Privacy Commission have started to receive complaints from citizens. They are still coming in trickles. But we expect the figure to rise as citizens learn more about their rights as data subjects through our intensified public awareness campaign. After all, knowing your rights and standing up for them are the first steps to protect yourself and collectively build a culture protective of privacy. All of us should realize that through these rights, we regain control of our data.
First of these is the right to be informed whether your data will be, is being or was processed. At the same time, you should be notified of the description, purpose, basis and scope of the personal data processing, among others. To further let you know and verify the lawfulness of the processing, you have the right to reasonable access to your data.
You also have the right to object to the processing of your data, including processing for direct marketing, automated processing or profiling. Consent may be withheld in case of any amendment in the information supplied to you.
If the data held about you is inaccurate, you may dispute and correct it. With substantial reason, you may exercise your right to suspend, withdraw or order the blocking, removal or destruction of your data from organizations’ filing system. You may be indemnified for damages caused by inaccurate and unlawfully obtained data, along with unauthorized use.
For you to be in full control of your data, you have the right to data portability. This allows you to obtain and electronically move, copy or transfer your data in a secure manner, for further use.
As I always say, information has become the new currency running in the veins of the global economy. Your personal information has become your 21st century asset. And If you liken it to money, then, surely, you would want to exercise control over this type of asset.
The Data Privacy Act brings back control of personal information to the individual. It signals the dawn of the age of empowerment of the data subject.