Empowering Filipinos for a Secure Digital Future

AS WE BECOME MORE AND MORE DEPENDENT ON DIGITAL TOOLS, SO DO WE BECOME MORE EXPOSED TO DANGERS TO OUR PERSONAL INFORMATION, INCLUDING SECURITY BREACHES, CYBERATTACKS, AND PRIVACY VIOLATIONS. NATIONAL PRIVACY COMMISSION CHAIRMAN JOHN HENRY D. NAGA IS AT THE FOREFRONT OF EFFORTS TO PROTECT FILIPINOS IN THIS DIGITAL AGE BY ADVOCATING FOR STRONGER POLICIES, INNOVATIVE FRAMEWORKS, AND WIDESPREAD AWARENESS OF DIGITAL PRIVACY.

National Privacy Commission (NPC) Chairman John Henry D. Naga joined the agency as one of the deputy privacy commissioners in 2019. His appointment came at a challenging time, as the pandemic, which reshaped the landscape of data privacy. COVID-19 brought not only a rapid digital evolution but security concerns as well. This unusual time was also an opportunity for development and growth for Naga. It deepened his commitment to taking on the responsibility of protecting every Filipino's data privacy.

 A JOURNEY ROOTED IN PUBLIC SERVICE

Naga’s journey in public service began long before he entered NPC. He started as a provincial board member in Masbate, serving for two terms from 2007-2013. Though he did not dream of following in his parents’ footsteps as public servants, for he wanted to create his own, the path he was taking was still in this direction. His experience as a board member strengthened his passion to serve. “I realized that being an agent of change and helping our kababayans (countrymen) is something I truly cared about,” he says, adding that this feeling grew stronger as he continued to work for the people’s welfare.

After serving as a provincial official, Naga was appointed as an assistant secretary of the then-newly established Department of Information and Communications Technology (DICT) in 2016, his first ever position in the national government. He explains that although he was already committed to pursuing a career in public service, his appointment to DICT was unexpected. He is prouder because he was one of the DICT officials who played a pivotal role in initiating the important work of advancing our National ICT Development Agenda (NICTDA).

Naga says that his experience as lawyer and provincial board member developed in him the integrity and strong commitment to serve. “Indeed, this principle transformed the commission into a world-class leader, partner-regulator, and data subject rights defender,” he stresses. His legal background and experiences in handling high profile cases in labor, telecommunications, and corporate law, as well as his stint in local legislation he says, prepared him for his roles in DICT and NPC not only in interpreting and performing adjudicatory functions under the Data Privacy Act (DPA) but effectively enforcing the law and making sure that its provisions are complied with.

The shift from local legislative work to executive work at the national level, according to Naga, helped him have a well-rounded approach to governance. Having to perform these two different roles broadened his understanding of policymaking and implementation, enabling him to enforce the law while ensuring that he still caters to the needs of Filipinos. Asked if he has plans of going back to electoral politics, he says, “I am not fully closing my door to any possibilities that may come my way. But, for now, my focus is staying in the NPC.”

 A JOURNEY OF CHALLENGES Naga’s entry into DICT came with a set of challenges. Aside from starting in a new role and environment in DICT at the time, he also needed to build a team that he trusted to help him work things out for his new role. It was challenging to find people who shared the same vision as his, but he was able to come up with a dependable team that helped him with his work in DICT. However, since he is young, another challenge was to establish authority over older colleagues that he works with. “I slowly altered their perspectives through building mutual trust and confidence,” he  explains.

At NPC, Naga is faced with the challenging task of balancing two fundamental aspects of the Data Privacy Act (DPA) of 2012: safeguarding the privacy rights of Filipinos and ensuring that companies comply with the law. The law allows companies to process personal information as long as they adhere to the guidelines outlined in the DPA. The solution, according to him, is simple—just go back to what NPC’s mandate is: protect every Filipino’s right to privacy, and make sure that those who violated the law will be dealt with accordingly. Naga says that the NPC diligently exercises its powers against any party found to have violated the DPA, and the commission ensures that it performs its obligations to Filipino citizens. The commission, he says, ensures that they comply with their mandate, taking on their accountability and adhering to the best global standards. The mandatory registration of subscriber identity modules (SIMs) under Republic Act 11934, also known as the SIM (Subscriber Identity Module) Registration Act, which started on December 27, 2022, and ended on September 30, 2023, was implemented to combat crimes using mobile communications. But this also raises some concerns with regard to violations of data privacy because of some requirements on personal information. Although SIM registration is under the jurisdiction of the National Telecommunications Commission (NTC) as enforcer of RA 11934, NPC, through its Compliance and Monitoring Division, plays a crucial role in monitoring and conducting on-site visits to telecommunications companies to ensure that they follow strict security measures on SIM registration data.

NPC recognizes that working with other government agencies is needed to safeguard data privacy. Strong collaboration with various government agencies, especially law enforcement and regulatory bodies, is needed to ensure that every Filipino citizen’s personal data remains protected amid the threats caused by digital evolution. The commission forged partnerships with the Philippine Competition Commission, DICT, and, recently, the Insurance Commission on December 4, 2024. These agreements foster a united approach in enforcing data protection policies and responding to privacy concerns. They signed memoranda of agreement with these agencies to empower Filipinos and the country through inter-agency partnerships. NPC also issues advisory opinions on organizations and data subjects that have privacy concerns. This action is the commission’s way to show that it is accessible to every Filipino facing privacy issues. Naga emphasizes that the DPA is a strong foundation for protecting Filipinos' privacy rights, especially amid the ever-evolving threats in the digital world. However, he also underscores the need for vigilance against rising privacy risks and stresses that the DPA, along with other relevant privacy protection laws, must continue to evolve. “The DPA focuses on regulating the processing of personal data and holding organizations accountable for breaches. However, the digital landscape is constantly changing, with emerging technologies such as artificial intelligence, deepfake technology, and sophisticated cyberattacks creating new vulnerabilities. The DPA, while comprehensive for its time, may not adequately address these novel challenges without continuous updates and enhancements,” Naga stressed, adding that there are equally significant threats and issues in the digital world that are not under the scope of DPA, like cybercrime, e-commerce fraud, and misinformation. DPA only focuses on privacy and data protection, but other areas of digital safety are governed by separate laws like the Cybercrime Prevention Act and regulations for online transactions. “This fragmented approach can leave gaps in protection and enforcement, underscoring the need for a more integrated and adaptive framework to address the complex realities of the digital world,” he stresses.

Naga focused on transitioning to digital and modern services during his first year as Privacy Commissioner, aligning with the Marcos administration’s goal of fully embracing digitization. NPC launched the Data Breach Notification Management System that streamlines the submission and tracking of personal data breach notifications and annual security incident reports. The commission also introduced the NPC Registration System, an online platform that provides a secure and seamless portal, enabling both government and private entities to register their data protection officers and data processing systems with the NPC. These two systems are part of NPC’s initiatives to simplify compliance for personal information controllers and processors under the Data Privacy Act of 2012 (DPA). They are also regarded as pioneering solutions for compliance, since this is the first of its kind against other data privacy authorities.

EMPOWERING DIGITAL FILIPINOS NPC believes that it is essential that Filipinos be educated and empowered with necessary knowledge to safeguard their data privacy; that is why it always gives importance to these efforts. The agency has created mechanisms that will effectively equip Filipinos with knowledge, skills, and resources that can promote responsible digital citizenship. It ensures that their awareness campaign will reach even the unserved and underserved areas in every region.

Filipinos’ level of awareness about data privacy is relatively low, but it has significantly improved from 13 percent in 2017 to 25 percent in 2021, based on the survey conducted by NPC. It only shows that the majority of Filipinos are still unaware of the law and their rights when it comes to protecting their personal data or information. Naga admits that NPC has limited resources and manpower, but the situation is not an excuse for them to expand their reach to strengthen public awareness. The commission has been visiting provinces and far-flung areas doing face-to-face privacy awareness activities. The Kabataang Digital campaign targets the youth and promotes compliance with the DPA among small and medium enterprises. In addition to traditional media press releases, NPC has bolstered its online presence by leveraging various social media platforms to disseminate information on how the public can safeguard their data privacy rights. The commission even has a webcast series titled Privacy in the Spotlight, where data privacy experts and professionals talk about data privacy and protection. NPC plans to establish regional offices to expand its reach and services. “These efforts underscore our commitment to building a culture of data privacy awareness and compliance across the country,” he says.

MILESTONES IN DATA PRIVACY

Naga is proud that since he took on the leadership of NPC in 2022, the commission has achieved various milestones in upholding data privacy. “Every achievement has been a memorable one. Year after year, we  consistently exceeded expectations in fulfilling our mandate. I have been proud of our global and local recognitions,” he states.

One of NPC’s most significant accomplishments is its appointment as the first-ever fee-funded secretariat of the Global Privacy Assembly (GPA), following a unanimous vote by the executive committee. This designation automatically makes NPC a member of the GPA Executive Committee, further enhancing its international presence.

The commission was also nominated at the GPA Global Privacy and Data Protection Awards 2023 under two categories: the Kabataang Digital Program under Education and Public Awareness and the Data Breach Notification Management System under Innovation. The GPA Awards 2024 nominated the commission's Privacy in the Spotlight Webcast in the Education and Public Awareness category. In addition, NPC strengthened its visibility and compliance in displaying the NPC Seal of Registration in more than 170,000 establishments nationwide and in 103 locations across 20 countries worldwide, including Singapore, Taiwan, Japan, South Korea, Hong Kong, the United States of America, Canada, the Bahamas, the United Kingdom, Italy, Qatar, the United Arab Emirates, Brunei, Malaysia, Bahrain, Kuwait, Saudi Arabia, Guam, the Northern Marianas Island, and Australia. “To parallel these achievements, we are exhibiting the same level of excellence within our organization. The NPC is dedicated and committed to maintaining the highest standards of governance and financial management in serving the Filipino people,” Naga emphasizes. For three consecutive years, NPC has received an unmodified opinion from the Commission on Audit. “This audit opinion in favor of the NPC is a testament to the solid commitment and dedication of our NPC workforce in the judicious use of public resources,” he shares. Moreover, the commission also received its third International Organization for Standardization 9001:2015 certification as part of NPC’s commitment to an exceptional quality management system.

Together with DICT Secretary Ivan John Uy, Naga was also recognized as one of the Outstanding Public Servants of the Year during the 1st Data Privacy Conference, organized by the Rotary Club of Santa Rosa and the Organization of Data Privacy Professionals, Inc. NPC was also given the Outstanding Digital Campaign Award in the Best Long-Form Campaign category for its flagship initiative, “Privacy in the Spotlight” Webcast, during the Parangal: Gawad ng Kahusayan sa Komunikasyong Pampubliko Awards program by the Presidential Communications Office.

CHARTING A DIGITAL LEGACY

Since his appointment in 2022, Naga has focused on upholding and protecting the data privacy rights of Filipinos, especially the vulnerable members. He also adopted the leadership style he gained from DICT, which is empowering employees to have a voice in the organization. “These principles served as my guide in leading the National Privacy Commission with integrity, competence, and unwavering commitment. I make sure that I encourage diversity in perspectives and collaborative efforts to achieve success in our work,” he emphasizes.

According to Naga, he aligns with the current Philippine government's vision and policy direction, which emphasizes trust, transparency, and the delivery of effective public service. “I endeavor to maintain the highest standards of governance in serving the Filipino people and contribute to transforming the country into a Bayang Digital, Bagong Pilipinas (Digital Nation, New Philippines).”

As the Privacy Commissioner and Chairman of the NPC, Naga envisions a future where the commission stands as a world class regulator and catalyst of Filipinos’ privacy rights—an institution that serves Filipinos with integrity and passion for public service.

He reminds Filipinos that while it is recognized that technology is a powerful tool that unlocked endless potentials and created amazing transformations in the world, the people must be wary that since it continues to evolve, it brings more threats to data privacy. “The NPC alone cannot strengthen the culture of privacy. Organizations must assist us in upholding the fundamental human right to privacy. Likewise, we need empowered digital citizens who are armed with knowledge in terms of their data privacy rights. Recognizing the importance of data privacy in navigating and fully embracing this constantly evolving digital world will enable us to achieve all these goals,” he points out.

Naga emphasizes the crucial need to raise awareness about data privacy and security to empower citizens and strengthen the nation. This is the focus of his leadership at NPC: guiding and educating Filipinos, including data subjects as well as personal information controllers and personal information processors. He encourages every Filipino citizen and organization to help NPC in achieving its goal because the task of strengthening the culture of privacy in the Philippines are attainable if everyone is empowered. Everyone's high awareness of their data privacy rights can help achieve this goal.

THE NPC ALONE CANNOT STRENGTHEN THE CULTURE OF PRIVACY. ORGANIZATIONS MUST ASSIST US IN UPHOLDING THE FUNDAMENTAL HUMAN RIGHT TO PRIVACY. LIKEWISE, WE NEED EMPOWERED DIGITAL CITIZENS WHO ARE ARMED WITH KNOWLEDGE IN TERMS OF THEIR DATA PRIVACY RIGHTS.