Last review date: 7 January 2025
Yes.
The restrictions or requirements are as follows:
☒ qualified right not to be subject to a decision based solely on automated decision making, including profiling – for example, only applicable if the decision produces legal effects concerning them or similarly significantly affects them
☒ right to information / transparency requirement
☒ right to request human review of the automated decision making
☒ other
Data subjects have a right to be informed about whether their personal data is being processed, or will be processed, including any automated decision-making and profiling activities.
Likewise, the data subject has the right to object and withhold consent for the processing of their data for direct marketing, automated processing, or profiling purposes.
Furthermore, PICs are required to implement mechanisms that allow data subjects to question and contest automated decisions, especially when such decisions pose a significant risk to their rights and freedoms.
Last review date: 7 January 2025
Yes.
The following are the exceptions:
- The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract
- When necessary for compliance with a legal obligation applicable to the PIC
- When the data subject provides consent
Last review date: 7 January 2025
☒ Enforcement activity under existing privacy law
Last review date: 7 January 2025
Yes
If yes, please provide brief details and a link.
The NPC recently issued Advisory No. 2024-04, which provides guidance on the responsible development and deployment of AI systems that process personal data.
The NPC likewise issued Circular No. 2022-04, requiring the registration of personal data processing systems including the notification regarding automated decision-making or profiling.
Further, the NPC issued Circular No. 2023-04 on the guidelines of consent, requiring the PICs engaged in profiling and automated processing to inform the data subject of these activities and provide specific details before or at the next practical opportunity. PICs should obtain the consent of the data subject when automated processing is the sole basis for a decision that has legal effects or may significantly affect the data subject. They must also ensure safeguards against the harms of extensive profiling, such as discriminatory outcomes and infringement on the right to fair treatment.
Last review date: 7 January 2025
☒ Draft legislation in progress
☒ Non-binding guidance or principles issued or in progress
If yes, please provide brief details and a link.
As mentioned above, the NPC recently issued Advisory No. 2024-04, which provides guidance on the responsible development and deployment of AI systems that process personal data.
Further, there are certain draft legislations in Congress aimed at ensuring that personal data collected through Artificial Intelligence is protected in accordance with the DPA. Pending bills include: