Under Republic Act No. 10173, or the Data Privacy Act of 2012, individuals whose personal information is collected, stored and processed are called “data subjects.”
They are accorded rights and may invoke the law against abuses committed by the receiver of data, also called “personal information controller.”
Right to be informed
Data subjects should be informed before the processing of their data. Information such as the purpose, scope and method, recipients and period of data processing should be relayed to the data subject.
Right to object
Data subjects should be allowed to withhold consent, especially in cases of any amendment to their personal data.
Right to access
A data subject can demand access to her personal data that were processed as well as the names of the recipients of the data, manner and sources from which the data were obtained.
Right to erasure or blocking
Data subjects can withdraw or order the destruction of their data from the personal information controller’s system as long as there is substantial proof that the data are false, outdated, unlawfully obtained or are being used for an unauthorized purpose.
Right to damages
The data subject should be compensated for any harm or loss due to false, incomplete or unlawfully obtained unauthorized use of personal data.
These rights can be invoked by the heirs and assigns of the data subject who had passed away or is incapacitated, except when personal data are processed for scientific and statistical research, or criminal and administrative investigation. —INQUIRER RESEARCH
Source: RA 10173