(CID SS-18-045) 11 November 2018 CAROUSEL PRODUCTIONS, INC. 7, Ideal Street, Mandaluyong
Total Page:16
File Type:pdf, Size:1020Kb
Republic of the Philippines NATIONAL PRIVACY COMMISSION Ref. No. (CID SS-18-045) 11 November 2018 CAROUSEL PRODUCTIONS, INC. 7, Ideal Street, Mandaluyong, 1550 Metro Manila Attention: MR. RAMON MONZON President MS. LORRAINE SCHUCK Executive Vice President Subject: Notice to Explain Reported Disclosure of Mobile Phone Number of Miss Earth Contestant without consent, and the Company’s compliance with the Data Privacy Act Dear Mr. Monzon: I write in behalf of the National Privacy Commission, under its obligation to ensure compliance of personal information controllers with data privacy laws, and under its power to institute an investigation into any matter affecting personal information and compel or petition any entity to abide by its orders affecting data privacy. I write to inform you that we are evaluating the legality of data processing within Carousel Productions, Inc. (Carousel) considering that the Data Privacy Act of 2012 considers Carousel as a personal information controller, subject to the obligation to protect personal information consistent with the requirements of law and relevant regulations. We note with dismay that your records do not appear in our database of registered personal information controllers, and you do not have a data protection officer registered with the Commission. An examination of your online footprint, especially on the Miss Earth and Miss Earth Philippines websites does not yield any information about a duly appointed and functioning data protection officer. 5th Floor Ang Kiukok East Banquet Hall, Delegation Building, PICC, Pasay City, Metro Manila 1308 URL: http://privacy.gov.ph Email Add: [email protected] Letter to Carousel Productions, Inc. CID-SS-18-045 Page 2 of 3 x---------------------------------------------x As President, you are directly responsible for the compliance of Carousel Productions, Inc. with data privacy and protection laws. We understand that there are allegations that the mobile phone number of one of the contestants or “delegates” of the Miss Earth pageant have been disclosed without consent to a pageant sponsor.1 We understand, further, that the same delegate has made a claim that the contestants’ passports were “confiscated on the first day of competition” such that these travel documents were not made available to the contestants on demand.2 Under the Data Privacy Act,3 all personal information controllers such as yourselves must abide by principles of transparency, legitimate purpose, and proportionality. Under these principles, data subjects such as the pageant delegates have the right to be informed of every aspect of how their data is to be processed, and the right to access this data.4 In particular, the data subject has the right to know the names and addresses of the recipients of the data subject’s personal information.5 What is more, any such processing of data belonging to the pageant contestants must conform with the principle of proportionality, that is, that the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specific purpose.6 The compliance of Carousel Productions Inc., as the personal information controller, to Philippine law is not apparent to this Commission. It is unclear, for instance, if the contestants have consented to the collection of their personal information; whether they have been specifically and adequately informed how said information is processed, including to whom said information will be shared and for what purpose. Your answers will allow this Commission to develop a better understanding of the issues at hand. 1 CNN Philippines Staff, Miss Earth 2018 candidates accuse pageant sponsor of sexual harassment, lack of action from PH organizers, http://cnnphilippines.com/news/2018/11/08/Miss-Earth-2018-sexual-harassment- pageant-sponsor.html (last accessed 12 November 2018). 2 Id. 3 An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [DATA PRIVACY ACT OF 2012], Republic Act No. 10173, §11. 4 National Privacy Commission, Advisory Opinion No. 2017-004, 5 January 2017. 5 Id. 6 National Privacy Commission, Implementing Rules and Regulations of the Data Privacy Act of 2012, §18(c). Letter to Carousel Productions, Inc. CID-SS-18-045 Page 3 of 3 x---------------------------------------------x With the foregoing considerations, you are hereby required to provide the following to this Commission within five (5) days from receipt: 1. The name of your data protection officer and the NPC registration details of Carousel Productions, Inc.; 2. An explanation as to the reported disclosure of the mobile phone number of one of the Miss Earth contestants to a sponsor; 3. An explanation of the process surrounding your processing of the data of the contestants’ passports; and, 4. A copy of your privacy management program and existing policies and procedures of your company for its collection, use, access, disclosure, storage and disposal of personal data, including organizational, physical and technical security measures. Kindly send this required information on or before the deadline by courier to: COMPLAINTS AND INVESTIGATIONS DIVISION National Privacy Commission 5th Floor, Philippine International Convention Center Vicente Sotto Avenue, Pasay City 1300 Philippines Kindly include your reference number in all communication with the Commission regarding this matter. No motion for extension will be considered. A failure to respond may result in a comprehensive and thorough investigation that may very well lead to the imposition of civil, criminal and administrative sanctions. Very truly yours, ATTY. FRANCIS EUSTON R. ACERO Chief, Complaints and Investigations Division CID/lacq .