Philippines: Adopted guidelines on personal data processing under Section 13(f) of the Data Privacy Act of 2012 clarifying the basis for processing personal data

On 12 August 2024, the National Privacy Commission of the Philippines adopted guidelines clarifying the application of Section 13(f) of the Data Privacy Act of 2012 as the basis for processing personal data. The section allows the processing of sensitive personal and privileged information when necessary for the protection of lawful rights and interests in court proceedings, or for the establishment, exercise, or defence of legal claims, or when provided to government or public authority. The guidelines aim to enable personal information controllers to rely on this provision as the basis for processing personal data and strike a balance between the need for public authorities to process personal data for their functions and mandates while safeguarding of data subjects' rights and interests. The guideline clarifies that processing must be necessary, adequate, relevant, and not excessive concerning its purpose and must comply with legal limitations. The guidelines permit data processing at preparatory stages of legal proceedings, even if no active case is present. The guideline also provides that data subjects must be informed of the processing through legal documents and service of pleadings.