The National Privacy Commission (NPC) recently conducted a privacy sweep and compliance check at the Shangri-La Plaza Mall. The inspection resulted in 66 citation tickets being issued to some boutiques, independent stores, and stalls within the mall for failing to meet mandatory privacy requirements.
During the checks, NPC officials noted that several establishments did not display the NPC Seal of Registration or privacy and CCTV notices prominently. These notices are required to be placed at the main entrance or in the most visible area to ensure that customers are aware of their data privacy rights.
“Registration and compliance with NPC regulations are legal obligations,” said Privacy Commissioner Atty. John Henry Naga. “We hope that our next round of on-the-spot privacy sweeps and compliance checks nationwide will find even more compliant establishments.”
Despite the citations, the NPC’s Compliance and Monitoring Division found that the majority of the businesses within the mall were largely compliant with the Data Privacy Act of 2012 (DPA) and other NPC regulations.
The compliance checks focused on establishments that collect personal data to assess their adherence to privacy laws. This initiative is part of the country’s privacy watchdog’s ongoing effort to enforce data protection standards and ensure that businesses uphold the privacy rights of their customers.
Business confidence
In response to the NPC’s findings, the Shangri-La Plaza Mall Legal Team announced that it would require all its tenants to either register their Data Processing System (DPS) with the NPC or submit a notarized Sworn Declaration and Undertaking for Exemption from Registration as a condition for leasing space.
The NPC’s privacy sweep, as stipulated under the DPA, aims to verify whether personal information controllers (PICs) or personal information processors (PIPs) operating in public areas comply with their obligations under the DPA and its Implementing Rules and Regulations (IRR). This includes adherence to NPC issuances based on available or accessible information like websites, mobile applications, and privacy notices. Non-compliance can result in administrative fines as outlined in NPC Circular 2022-01.
“We strongly urge personal information controllers to register with the NPC to ensure the protection of personal data of your data subjects, thereby fostering trust and confidence in your business,” Commissioner Naga said.
Thumbnail image from Shangri-La Plaza Mall website