⭐ RA 10173 (Part 2) Flashcards
must implement reasonable and appropriate organizational, physical and technical measures intended for the protection of personal information
personal information controller
shall implement reasonable and appropriate measures to protect personal information against natural dangers
personal information controller
T/F:
The determination of the appropriate level of security under this section must take into account the nature of the personal information to be protected, the risks represented by the processing, the size of the organization and complexity of its operations, current data privacy best practices and the cost of security implementation.
T
T/F:
Security measures include safeguarding to protect its computer network against intentional, lawful or authorized usage or interference with or hindering of their functioning or availability
F;
accidental, unlawful or unauthorized usage
T/F:
Security measures include a security policy with respect to the processing of personal information.
T
T/F:
Security measures include a process for identifying and accessing reasonably foreseeable vulnerabilities in its computer networks, and for taking preventive, corrective and mitigating action against security incidents that can lead to a security breach.
T
T/F:
Security measures include regular monitoring for security breaches and a process for taking preventive, corrective and mitigating action against security incidents that can lead to a security breach.
T
T/F:
Third parties processing personal information shall implement their own security measures.
F;
The personal information controller must further ensure that third parties processing personal information on its behalf shall implement the security measures
T/F:
The employees, agents or representatives of a personal information controller who are involved in the processing of personal information shall operate and hold personal information under strict confidentiality if the personal information are intended for public disclosure.
F;
if the personal information are not intended for public disclosure
T/F:
The personal information controller shall promptly notify the Commission and affected data subjects when sensitive personal information or other information that may, under the circumstances, be used to enable identity fraud are reasonably believed to have been acquired by an authorized person.
F;
unauthorized person
T/F:
In evaluating if notification is unwarranted, the Commission may take into account compliance by the personal information controller with this section and existence of good faith in the acquisition of personal information.
T
T/F:
The Commission may exempt a personal information controller from notification where, in its reasonable judgment, such notification would be in the public interest or in the interests of the affected data subjects.
F;
such notification would NOT be in the public interest
T/F:
The Commission cannot authorize postponement of notification where it may hinder the progress of a criminal investigation related to a serious breach.
F;
The Commission may authorize postponement of notification
T/F:
Each personal information controller is responsible for personal information under its control or custody, which excludes information that have been transferred to a third party for processing.
F;
includes third party
(whether domestically or internationally, subject to cross-border arrangement and cooperation)
Who is accountable for complying with the requirements of this Act and shall use contractual or other reasonable means to provide a comparable level of protection while the information are being processed by a third party?
personal information controller
T/F:
The personal information controller shall designate an individual or individuals who are accountable for the organization’s compliance with this Act. The identity of the individual(s) so designated shall not be made known to any data subject.
TF;
shall be made known to any data subject upon request
T/F:
All sensitive personal information maintained by the government, its agencies and instrumentalities shall be secured.
T
Who shall be responsible for complying with the security requirements for all the sensitive personal information maintained by the government, its agencies, and instrumentalities?
The head of each government agency or instrumentality
T/F:
Except as may be allowed through guidelines to be issued by the Commission, the employees of the government shall have access to sensitive personal information on government property or through online facilities.
F;
no employee shall have access
(unless the employee has received a security clearance from the head of the source agency)
T/F:
Sensitive personal information maintained by an agency may be transported or accessed from a location off government property.
F;
may not be transported or accessed
(unless a request for such transportation or access is submitted and approved by the head of the agency in accordance with the guidelines)
Off-line Access:
Deadline for Approval or Disapproval
(2) business days after the date of submission of the request
