Philippines: Adopted NPC guidelines on the issuance of identification (ID) cards to data subjects (NPC Circular No. 2023-03)

On 7 November 2023, the National Privacy Commission (NPC) adopted guidelines on the issuance of identification (ID) cards to data subjects (NPC Circular No. 2023-03). The guidelines apply to all personal information controllers (PICs) in the private sector issuing ID cards to their respective data subjects. The guidelines provide information on the processing of personal data when issuing ID cards, specifying that it should be compliant with the proportionality principle. In particular, the ID cards should collect and process only essential personal data required for the purpose of identification and if they contain additional features, the additional personal data should be reasonable and necessary for the specific functions of the card. Finally, the PICs are required to implement security measures to safeguard the data stored. In case of non-compliance, the PICs face civil, criminal, and administrative penalties. The circular enters into force 15 days following its publication, and the PICs are required to implement the measures 120 calendar days after it enters into force.