The NPC said ris scans are considered sensitive personal information under the Data Privacy Act of 2012. If misused or stolen, they can lead to identity theft and fraud.