AT A GLANCE:

NPC Circular No. 2025-01 requires personal information controllers (PICs) and personal information processors (PIPs) to protect recordings obtained through body-worn cameras (BWCs) and alternative recording devices (ARDs). The required measures cover personnel training, access control, device features, encryption, retention periods, and secure disposal.

In Part II, we discussed the data privacy obligations of vloggers who use BWCs or ARDs to record individuals and share footage online. This part discusses the security measures required under NPC Circular No. 2025-01, including how recordings must be protected, retained, and disposed of.

What security measures must PICs and PIPs implement?

Under Section 4 of NPC Circular No. 2025-01, PICs and Personal Information Processors (PIPs) shall implement reasonable and appropriate organizational, technical, and physical safeguards, considering the need to maintain confidentiality, integrity, and availability of personal data collected through BWCs or ARDs. 

These safeguards shall include the following:

1. Training of relevant personnel

Section 4(A) of NPC Circular No. 2025-01 indicates training of relevant personnel as one of the safeguards, to wit: 

“A. Providing for the conduct of comprehensive trainings or seminars for all relevant personnel on the proper use of BWCs or ARDs:

1. Training materials shall include discussions on the right to data privacy, data protection policies, general data privacy principles, rights of the data subjects, and compliance with due process requirements as provided by law;

2. Training materials shall also include a discussion of administrative, civil, and criminal penalties under the DPA; and 

3. Trainings shall be properly documented and conducted at least once a year: provided, that a similar training shall be provided during the onboarding or orientation of newly hired personnel.”

2. Regulation of access to recordings

Section 4(B) of NPC Circular No. 2025-01 provides that only authorized personnel may access recordings. PICs must establish an access control policy specifying the procedures for accessing recorded data. Access must be covered by a security clearance or similar authorization, a copy of which must be filed with the PIC’s data protection officer.

The Circular also requires the relevant Supreme Court rules, Philippine National Police (PNP) guidelines, and applicable NPC guidance on data subject rights to be considered. Requests for access by recorded individuals and third parties must follow the applicable NPC guidelines on Closed-Circuit Television (CCTV) Systems or subsequent issuances of the Commission.

3. Required technical features of BWCs and ARDs

Section 4(C) of NPC Circular No. 2025-01 prescribes technical features designed to preserve the integrity and reliability of recordings. These include:

1. Recordings in a standard, open, non-proprietary format that can be played using freely available software.
2. Export of recordings in their original file format without loss of quality or associated metadata.
3. Protection against editing, deletion, and overwriting before transfer, subject to the conditions stated in the Circular.
4. Date, timestamp, and location data that can be exported with the imagery and read by third-party software.
5. A visual recording indicator clearly visible to those being recorded.

4. Protection during storage and transmission

Section 4(D) of NPC Circular No. 2025-01 requires recordings to be safeguarded during storage and transmission using appropriate encryption software.

5. Policies for downloading, transmitting, and storing recordings. 

Under Section 4(E) of NPC Circular No. 2025-01, PICs and PIPs must establish a policy governing the downloading, transmission, and storage of recordings on another device. This policy is also intended to facilitate access requests from data subjects.

How long may recordings be retained?

Section 4(F) of NPC Circular No. 2025-01  requires recordings to be retained only for as long as necessary to fulfill the purposes for which the data was obtained. It provides different retention considerations for law enforcement and public authorities and for other persons or entities using BWCs or ARDs, as follows:

1. Law enforcement and public authority. Recordings that are necessary for pending investigations, prosecutions, or cases with judicial or quasi-judicial bodies, or to be used for training PNP personnel11 may continue to be processed in accordance with the applicable criteria for lawful processing under Sections 12 and 13 of the DPA or the special cases under Section 4 of the DPA, and retained for a longer period, subject to appropriate safeguards. This provision shall not be construed as limiting or denying data subject access requests which have been made before the lapse of the thirty (30)-day period.

2. Retention of recordings by other persons or entities using BWCs or ARDs. Recordings made by persons or entities shall be retained for thirty (30) calendar days or as may be provided for in other laws or regulations that may require its retention.

How must recordings be disposed of?

Section 4(F)(3) requires recordings shall be disposed of in a secure manner that would prevent unauthorized further processing. The storage media must be electronically wiped, including back up data, to ensure that recordings are permanently erased and beyond recovery.

Read more:

• National Privacy Commission guidelines on the use of body-worn cameras and alternative recording devices: Data Privacy obligation of Vloggers (Part II)

Click here to subscribe to our newsletter

Alburo Alburo and Associates Law Offices specializes in business law and labor law consulting. For inquiries regarding legal services, you may reach us at info@alburolaw.com, or dial us at (02)7745-4391/ 09175772207/ 09778050020.

All rights reserved.