Data privacy Act of 2012

What is the main purpose of the Data Privacy Act of 2012 (RA 10173)?

• To allow government agencies to collect personal data freely

• To regulate the processing of personal data and protect individual privacy
  

• To make all personal information publicly available

• To require citizens to register all their personal information with the government

  
  

Answer explanation

The Data Privacy Act of 2012 aims to protect personal data by regulating its collection, processing, and handling, ensuring that individuals’ privacy rights are upheld.

Which of the following is NOT one of the key principles of data privacy?

• Transparency

• Proportionality

• Data Monetization

• Legitimate Purpose

Answer explanation

The key principles of data privacy are Transparency, Legitimate Purpose, and Proportionality. Data monetization (selling personal data for profit) is a violation of privacy laws.

What government agency is responsible for enforcing the Data Privacy Act in the Philippines?

• Department of Information and Communications Technology (DICT)

• National Privacy Commission (NPC)

• Philippine National Police (PNP)

• Cybercrime Investigation Office

Answer explanation

The National Privacy Commission (NPC) is the regulatory body responsible for enforcing the Data Privacy Act, ensuring compliance, and investigating data privacy violations.

What is considered "Personal Information" under the Data Privacy Act?

• Employee ID number only

• Any data that identifies an individual, such as name, address, and contact details

• Government financial records

• Anonymous survey responses

Answer explanation

Personal Information refers to any data that can identify an individual, including names, addresses, phone numbers, and identification numbers.

What is "Sensitive Personal Information"?

• Information that can be shared with anyone

• Basic contact details like phone numbers

• Data related to race, health, religion, political beliefs, or criminal records

• Public information found on social media

Answer explanation

Sensitive Personal Information includes details about an individual’s race, ethnicity, health, religious beliefs, political affiliations, or criminal history, which require higher protection levels.

Which of the following is a violation of data privacy laws?

• Collecting data with the individual’s consent

• Using personal information for the stated purpose only

• Sharing an employee's personal data without consent or legal basis

• Securing personal data with encryption and access controls

Answer explanation

Personal data should not be shared without the individual’s consent or a valid legal reason. Unauthorized disclosure violates the Data Privacy Act.

What should you do if you receive a suspicious email asking for confidential data?

• Reply immediately and provide the requested information

• Ignore it and delete the email

• Report it to the IT department or Data Protection Officer (DPO)

• Forward it to a friend for advice

Answer explanation

Phishing emails are designed to trick users into revealing sensitive data. Reporting them to IT security or the DPO helps prevent cyberattacks.

What is the role of a Data Protection Officer (DPO) in a government agency?

• Monitoring compliance with the Data Privacy Act

• Handling and responding to data breaches

• Conducting privacy training for employees

• All of the options

Answer explanation

A DPO ensures compliance with privacy laws, monitors data protection measures, and handles privacy-related incidents in an organization.

What is a data breach?

• A legal way of sharing personal information

• Any incident where personal or sensitive data is accessed, disclosed, or stolen without authorization

• A government program for storing citizen data

• The process of collecting personal information with consent

Answer explanation

A data breach occurs when confidential information is exposed, accessed, or stolen without authorization, posing risks to individuals’ privacy and security.

What should a government employee do if they suspect a data breach in their agency?

• Ignore it and wait for someone else to report it

• Try to fix it without telling anyone

• Report it immediately to the agency's Data Protection Officer (DPO)

• Announce it on social media for transparency

Answer explanation

Reporting a suspected data breach to the DPO ensures that the agency can investigate and take necessary action to contain and resolve the issue.