MANILA, Philippines -- Local organizations want the breach of information systems and theft of personal information reported, a survey conducted by the Cyberspace Policy Center for Asia Pacific (CPCAP) showed.

"A surprising 94 percent favored the imposition by law of [an] obligation upon businesses to report [a] breach of security of information systems or theft or personal information," Claro Parlade, executive director of CPCAP, said in a summary of its survey that was presented to a technical working group created by the Commission on Information and Communications Technology to help Congress draft a data privacy bill.

The survey included a sample of 70 respondents representing four industry organizations, namely the Business Processing Association of the Philippines (BPAP), the IT Association of the Philippines, the Philippine Internet Commerce Society, and the American Chamber of Commerce.

The survey, a copy of which was obtained from BPAP, was done to provide a snapshot of the private sectors' understanding of data privacy, Parlade said.

The survey also studied at the scope, the desirability and form of regulation, and the government's role in data privacy regulation.

According to the survey, the local companies' concept of data privacy includes limitations on the use of government of citizens' personal data, noting that it is part of every individual's right to privacy.

Their concept also includes limitations on the collection and use of a private individual's personal data, such as name, personal circumstances and contact information, among others.

The survey revealed that local companies strongly supported comprehensive legal protection against the use of personal information by third parties, with the majority favoring a "broad and uniform" instead of "sectoral" regulation.

Asked what form of regulation they expect, the majority of the local companies surveyed believed that data privacy regulation should be in the form of a law. But at the same time, some believe that private industries should have self-regulating guidelines to protect privacy.

The companies surveyed also favored the appointment of a privacy commissioner who is tasked to ensure protection of data privacy rights.

"What is remarkable is the very strong support for vesting in that government official the power to investigate, prosecute and resolve violations of data privacy, which includes the power to impose fines and damages, as well as to publicize violations of data privacy. Similarly, there is very strong support for imposing criminal penalties for violation of data privacy rights," the survey's summary said.