In the modern corporate landscape, information is currency. Employers collect vast amounts of data on their workforce, spanning from the moment an applicant submits a resume to long after their retirement. However, in the Philippines, this collection is not a free-for-all.

The Data Privacy Act of 2012 (Republic Act No. 10173), along with its Implementing Rules and Regulations (IRR) and the circulars issued by the National Privacy Commission (NPC), establishes a stringent framework. It protects employees (the data subjects) while delineating the responsibilities of employers (the Personal Information Controllers, or PICs).

Here is a comprehensive legal overview of employee records and data privacy rights in the Philippine context.

1. The Core Classifications of Employee Data

Under RA 10173, employee records generally fall into two categories, each requiring different levels of care and legal justification for processing:

Personal Information (PI): Any information from which the identity of an individual is apparent or can be reasonably and directly ascertained. Examples include names, home addresses, personal phone numbers, and educational history.
Sensitive Personal Information (SPI): This category receives a higher tier of protection. Under Section 3(l) of the Act, SPI includes:
Age, marital status, color, and religious, philosophical, or political affiliations.
Health, education, genetic, or sexual life.
Any proceeding for any offense committed or alleged to have been committed.
Government-issued IDs (e.g., SSS, GSIS, Pag-IBIG, PhilHealth, TIN, passports).
Tax returns.

2. The General Data Privacy Principles

Employers must adhere to three foundational principles whenever they handle employee records:

Transparency: Employees must be informed of the nature, purpose, and extent of the processing of their data. This is typically achieved through a comprehensive Employee Privacy Notice.
Legitimate Purpose: Data must be collected for specified and legitimate purposes determined before collection, and cannot be used in a way incompatible with those purposes.
Proportionality: The processing of data must be adequate, relevant, suitable, necessary, and not excessive in relation to the purposes for which they are collected. (e.g., asking for an applicant’s high school grades for a senior managerial role may violate proportionality).

3. Lawful Criteria for Processing Employee Data

A common misconception is that employers always need explicit consent to process employee data. While consent is the bedrock of data privacy, RA 10173 recognizes that the employment relationship requires routine data processing.

Processing Personal Information (Section 12)

An employer can process standard Personal Information without explicit consent if it falls under any of the following:

Contractual Necessity: The processing is necessary for the fulfillment of the employment contract (e.g., processing a bank account number to credit salary).
Legal Obligation: The processing is necessary for compliance with a legal obligation (e.g., submitting data to the DOLE, SSS, PhilHealth, Pag-IBIG, or the BIR).
Legitimate Interest: The processing is necessary for the legitimate interests pursued by the employer, except where such interests are overridden by the fundamental rights and freedoms of the employee.

Processing Sensitive Personal Information (Section 13)

Processing SPI is strictly prohibited unless specific exceptions apply. In the workplace, these usually are:

Regulatory Compliance: Provided for by existing laws and regulations (e.g., keeping track of government IDs for statutory contributions, or mandatory annual physical examinations required by occupational health laws).
Protection of Vital Interests: Necessary to protect the life and health of the data subject or another person, and the data subject is legally or physically unable to express consent.
Consent: Explicit consent given by the employee prior to the processing, which must be documented.

4. The Statutory Rights of Employees

Employees do not surrender their privacy rights at the office door. Under the law, employees possess the following rights regarding their personnel files ($201$ files):

Right to be Informed

Employees have the right to know whether their personal data is being processed, what specific data is collected, the purposes of processing, and who the recipients of the data are.

Right to Access

Employees have the legal right to reasonable access to their personnel files ($201$ files). Upon a written request, employers must allow employees to view and obtain copies of their collected personal data, including performance evaluations, attendance logs, and disciplinary records.

Right to Rectification

If an employee discovers that the information held by the employer is inaccurate, outdated, or false, they have the right to demand its immediate correction, unless the request is vexatious or unreasonable.

Right to Erasure or Blocking

An employee may request the suspension, withdrawal, blocking, or destruction of their personal data if:

The data is no longer necessary for the purpose it was collected.
The data was unlawfully obtained.
The employer violated the employee's data privacy rights.

Note on Retention: This right is limited by the employer’s legal obligations. Employers are required by labor and tax laws to retain certain records (e.g., payroll, biometric data, contracts) for specific prescription periods (usually 3 to 10 years depending on the agency), even after an employee resigns or is terminated.

Right to Object

Employees can object to the processing of their data, especially if the processing is based on "legitimate interest" rather than contractual necessity or legal obligation. If an employee objects, the employer must stop processing unless they can demonstrate compelling legitimate grounds that override the employee’s rights.

Right to Data Portability

Where processing is based on consent or contract and is carried out by automated means, employees have the right to obtain a copy of their data in an electronic or structured format for their own use or to transfer it to another employer.

Right to Damages

Employees have the right to be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data, taking into account the breach of their rights as a data subject.

5. Specific Workplace Privacy Scenarios

The NPC has provided guidance on several common workplace scenarios where employee records and data privacy intersect:

Scenario	Legal Parameter & Best Practice
Background Checks	Employers may conduct background checks, but they must inform the applicant beforehand and obtain explicit consent, especially when verifying academic records, criminal histories, or credit scores with third parties.
Biometrics & Attendance	Biometric data (fingerprints, facial recognition) constitutes Sensitive Personal Information. Employers must ensure this data is encrypted, securely stored, and used strictly for attendance/security purposes, not shared with third parties without consent.
CCTV Monitoring	Permissible for workplace security and safety. However, cameras must not be placed in areas where employees have a high expectation of privacy (e.g., restrooms, changing rooms). Employees must be notified of CCTV presence through visible signage.
Workplace Surveillance	Monitoring company-issued laptops, emails, and internet usage is generally permissible under the employer's management prerogative, provided the company has a clear, written policy explicitly stating that company IT assets are subject to monitoring and employees have no expectation of privacy using them.
Disciplinary Proceedings	While employers can document infractions, publishing the names of disciplined or terminated employees on a public bulletin board or corporate chat group to "make an example" of them generally violates the principle of proportionality and causes unlawful reputational damage.

6. Employer Obligations and Compliance

To protect employee records and mitigate legal liabilities, companies operating in the Philippines must implement organizational, physical, and technical security measures:

Appoint a Data Protection Officer (DPO): Companies meeting certain employee counts or data processing thresholds are legally required to register a DPO with the NPC.
Conduct Privacy Impact Assessments (PIA): Before implementing new tools that handle employee data (e.g., new HRIS platforms or AI screening tools), a PIA must be conducted to assess risks.
Implement Data Privacy Policies: Employee handbooks should include explicit clauses on data privacy, data breach protocols, and data retention schedules.
Execute Non-Disclosure Agreements (NDAs): HR personnel, IT administrators, and payroll staff who handle the $201$ files of other employees must sign strict confidentiality agreements.
Data Breach Notification: In the event of a data breach involving sensitive personal employee records (e.g., a hack of the payroll system leaking SSS/TIN numbers), the employer must notify the NPC and the affected employees within 72 hours of discovery.

7. Penalties for Non-Compliance

Violations of the Data Privacy Act carry severe criminal and administrative penalties in the Philippines. Depending on the infraction (e.g., unauthorized processing, malicious disclosure, or concealment of security breaches), penalties can range from:

Imprisonment: 1 to 6 years.
Fines: ₱500,000 to ₱5,000,000.

Furthermore, if the offender is a corporation or a juridical entity, the penalty will be imposed upon the responsible officers (e.g., Directors, HR Directors, or the DPO) who allowed or committed the violation through gross negligence.