Notice | Understanding Your Data Privacy Rights | pid#13582 – Polytechnic University of the Philippines

Don’t Just Sign and Forget: Understanding Your Data Privacy Rights

We’ve all been there: you walk into an event, a seminar, or a meeting, and the first thing you’re asked to do is sign an attendance sheet. Often, it’s just your name and signature. Sometimes, they ask for a bit more – age, gender, contact number, or even company. We scribble down our details, barely glancing at the small print (if there’s any!), and move on.

But what happens to that data after you’ve signed? And more importantly, does the organization have the right to use it for anything they please?

The short answer, thanks to the Data Privacy Act of 2012 (Republic Act No. 10173) in the Philippines, is a resounding NO.

Your Name is Not Just a Name – It’s Personal Information

Let’s clarify something fundamental: your name, your signature, your age, your contact number – all of these are considered Personal Information under the Data Privacy Act. Even your first name, when collected in a specific context (like an event attendance list), can often be used to identify you directly or indirectly.

This means that whenever an organization collects this information from you, they are processing your personal data, and they are bound by law to handle it responsibly and transparently.

The Problem: When “Attendance” Becomes “Research” (or something else entirely)

Imagine you sign an attendance sheet where the privacy notice (if it even exists!) only states that your data is for “event attendance purposes.” Simple enough, right? You expect your name to be checked off, perhaps used for a certificate, or to verify participant numbers.

But what if, unbeknownst to you, that same attendance sheet, with your name and other details, is later used for a completely different purpose – say, for an internal “research project,” to build a marketing database, or even shared with third parties for unrelated purposes?

This is where the violation occurs.

Under the Data Privacy Act, organizations must adhere to strict principles, two of which are crucial here:

Transparency: You have the right to know what data is being collected from you and why.
Purpose Limitation: Your data must only be collected for a declared, specified, and legitimate purpose. It cannot be processed or used for any other purpose that is incompatible with what was originally declared, unless you provide new, informed consent.

If an organization collects your name for “attendance” but then uses it for “research” without clearly stating this research purpose upfront and getting your consent for that specific use, they are in direct violation of these principles.

It Doesn’t Matter How Much Data Was Collected

Some might think, “Oh, it was just my name, that’s harmless.” But this is a misconception. Whether they collected just your name, or your name, age, sex, and email, the principle remains the same. Processing any Personal Information for an undisclosed or unauthorized purpose is a breach of trust and a violation of the law.

Your Rights as a Data Subject

As a Filipino citizen, you are a Data Subject, and you have powerful rights under the DPA, including:

Right to Be Informed: To know what data is being collected and why.
Right to Object: To withhold consent or object to the processing of your data.
Right to Access: To request a copy of the personal data an organization holds about you.
Right to Damages: To be compensated for any damages you suffer due to unlawful data processing.

What Can You Do?

If you suspect an organization has misused your personal information collected from an attendance sheet (or any other source):

Review the Privacy Notice: Check if the stated purpose aligns with how you believe your data is being used.
Ask Questions: Don’t hesitate to ask the event organizers about their data retention policies and how your data will be used.
File a Complaint with the NPC: The National Privacy Commission (NPC) is the government body responsible for enforcing the Data Privacy Act. You can file a formal complaint with them, providing all evidence you have (e.g., the attendance sheet, the privacy notice, any communication, proof of misuse).

The penalties for organizations found guilty of processing personal information for unauthorized purposes are significant, including substantial fines and imprisonment for responsible individuals.