NPC issues new circular on registration requirements on the down-low

Dr. George Berkely, Anglican bishop and philosopher once asked, “If a tree falls in a forest and no one is around to hear it, does it make a sound?” Well, if the NPC uploads a new circular but does not announce it, was the circular issued?

That is the question that I was pushing around in my mind yesterday when I came upon an uploaded copy of NPC Circular 2022-04 on the Registration of Personal Data Processing System, Notification Regarding Automated Decision-Making or Profiling, Designation of Data Protection Officer, and the National Privacy Commission Seal of Registration. The Circular was dated 05 December 2022 but it was in a folder for 2023 uploads (I could see this in the URL). And yet, there was no press release from the NPC on the issuance and I could not find any mention of it as well online.

So. Was the Circular actually issued? When would it be effective?

I finally found the answer when I made an unrelated query to the NPC. It appears that the Circular was published in newspapers of general circulated on 27 December 2022 (Caveat: I have not also confirmed this as I have not gotten my hands on a print copy of a 27 December newspaper. For example, the Philippine Daily Inquirer only posts its frontpage online). Section 42 of said Circular states that it takes effect fifteen (15) days after publication in the Official Gazette or two (2) newspapers of general circulation. Fifteen days from 27 December 2022 falls on 11 January 2023. This means the Circular is effective today.

And yet there is no public announcement yet from the NPC. The Circular provides a transitory period of 180 days within which personal information controllers and personal information processors need to complete their data processing system and DPO registration. I am guessing that the NPC will probably time the announcement of the issuance to when the NPC registration portal goes live.

In the meantime, we wait for confirmation on the Circular.