What is the main purpose of the Data Privacy Act of 2012? 
a. To restrict all access to personal data
b. To promote open data sharing
c. To protect the fundamental right to privacy
d. To control digital commerce  Which of the following is considered personal information?a. A generic email address
b. A statement of opinion about whether
c. A person home address
d. A random alphanumeric codeSensitive personal information includes:a. A generic email address
b. A statement of opinion about whether
c. A person home address
d. A random alphanumeric codeThe term “processing” includes:
a. Reading
b. Recording
d. All of the above
c. Destruction
Which entity is primarily responsible for enforcing the Data Privacy Act?
a. Department of Information and Communication Technology
b. National Privacy Commission
c. Office of the President
d. Bureau of Internal Revenue The data subject refers to:
a. A person or company that owns a system
b. The person whose personal data is being processed
c. A government agency collecting taxes
d. An anonymous sourceThe lawful basis for processing personal data includes:a. Consent
b. Legal obligation
c. Legitimate interest
d. All of the abovePersonal information controller refers to:
a. The software used in processing
b. The person or organization controlling the processing of personal data
c. The person installing CCTV
d. An automated machineWhat is the general penalty for unauthorized processing of sensitive personal information:
a. 1-3 months imprisonment
b. 6 months to 2 years
c. 1-6 years and a fine
d. No penalty at allA privacy impact assessment (PIA) is used to:
a. Protect copyrights
b. Prevent hacking
c. Assess and minimize risk in processing personal data
d. Increase advertisement revenueWhich of the following is NOT a right of the data subject?a. Right to be informed
b. Right to access
c. Right to obtain profit from data
d. Right to objectConsent must be:
a. Implied only
b. Freely given, specific, informed, and evidence-based
c. Signed digitally only
d. Forced for convenienceThe right to erasure or blocking is also known as the:
a. Right to know
b. Right to redress
c. Right to be forgotten
d. Right to data sharingWho has the burden to prove that consent was validly obtained?
a. The data subject
b. National Privacy Commission
c. The personal information processor
d. The personal information controllerThe right to damages means:
a. The government pays the fines
b. A data subject may sue for privacy violations
c. The controller is always exempt
d. All privacy cases are criminalWhen is consent NOT required under the law?
a. For marketing
b. For statistical research with anonymization
c. For fundraising
d. For data resaleWhen is consent NOT required under the law?
a. For marketing
b. For statistical research with anonymization
c. For fundraising
d. For data resaleThe withdrawal of consent:
a. Is not allowed once given
b. Automatically erases all data
c. Does not affect processing already based on legal obligations
d. Nullifies all prior lawful processingA data subject can request access to their data:a. Only after 1 year
b. Anytime, unless limited by law
c. Never
d. Only with a court orderA Personal Information Processor (PIP) is: 
a. The person running a privacy seminar
b. One who processes data on behalf of a controller
c. The head of IT
d. The same as a controllerData must be retained:a. Indefinitely
b. As long as necessary for the purpose
c. For at least 20 years
d. Until deleted by IT staffWhat is data minimization?
a. Encrypting all data
b. Collecting only what is necessary
c. Avoiding security
d. Removing all files monthlyWhen must a data breach be reported to the NPC? 
a. Within 5 days
b. Within 72 hours
c. Immediately
d. Within 1 yearWho is primarily responsible for implementing a privacy management program? 
a. The barangay
b. The school principal
c. The organizations Data Protection Officer
d. The IT vendorA data privacy manual should contain:a. The floor plan of the office
b. Procedures for processing, breach, and security
c. Salary records
d. Sales dataBreach notifications is required if the breach:
a. Only affects 1 person
b. Involves sensitive personal data with risk of harm
c. Is from another country
d. Involves junk emailsLogging or recording data access is considered part of:a. Legal compliance
b. Technical safeguard
c. Ethics training
d. All of the aboveThe DPO should report directly to:
a. HR only
b. The head of agency or organization
c. IT department
d. Legal internUnauthorized disclosure of personal data is punishable by:a. A warning only
b. Imprisonment and fine
c. Social media ban
d. NPC memoAccessing personal information without authority is called:
a. Breach of contract
b. Unauthorized access
c. Intentional leakage
d. Human errorThe penalty for intentional processing without lawful basis includes:
a. 1-3 years only
b. Dismissal from work
c. 1-3 years and 500,000 fines
d. Administrative memoThe maximum penalty for malicious disclosure of sensitive personal info is:a. 3 years
b. 5 years
c. 6 years
d. 7 yearsWho can file a complaint for data privacy violation?
a. Then NPC only
b. The media
c. The affected data subject
d. The IT administratorIn criminal prosecution under the DPA, who investigates the offense? 
a. DOST
b. NPC
c. NBI or PNP
d. DICTIn civil suits, which court has jurisdiction over privacy-related claims?
a. Barangay Hall
b. Family Court
c. RTC
d. OmbudsmanPublishing data online without permission may be a violation of:
a. Copyright Law only
b. Data Privacy Act
c. Internet Code
d. Civil Service LawFailure to register as a data controller when required can result in:
a. Criminality liability
b. NPC audit
c. Database access ban
d. License revocationA person who falsifies consent or fabricates data processing authority is liable for:
a. Civil liability only
b. Administrative complaint
c. Both criminal and civil liability
d. No violationEssay 39

Question
Identify at least two (2) to three (3) data privacy issues present in the scenario below. Cite the applicable provisions of the Data Privacy Act of 2012 (RA 10173). 
A shopping mall installs facial recognition cameras at all entrances. These cameras collect facial data from all individuals entering the premises. However, no signage, consent forms, or privacy notices are posted or made available to the public. PLEASE ANSWER THEM CORRECTLY, DONT MISS ANTHYTHING PLEASE MAKE IT SURE THE ANSWER IS CORRECT, THAT IS MY FINAL EXAM I WANT IT TO BE PERFECT PLEASEEE HEL ME WITH THIS, I TRUST YOU ON THIS PLEASEE!!!!!!!!!!!!! I LOVE YOU