In a patriarchal society, misogyny and violence against women and the LGBTQIA+ community finds its way into nearly every facet of our lives. Digital spaces are not immune; the damaging experiences that women, queer and transgender people face in their day-to-day lives manifests itself online as well, and it does real harm. In a world that is becoming more and more reliant on ICTs, we need to consider how online gender-based violence impacts those with marginalized genders, and what we can do to prevent the damage.

In order to fight the gender-based violence that women and other vulnerable sectors face online, we can start by recognizing that the internet has immense potential for empowerment. When women, queer and transgender people employ the internet as a means of creating space for themselves and others like them, slowly but surely the misogynistic nature of digital landscapes can be broken down. The Feminist Principles of the Internet (FPI) can help; these principles are a collection of statements that look at internet rights through a gender and sexual rights-minded lens. Organized by Association for Progressive Communications, the principles are a collective effort written by groups of advocates working in women’s, sexual, and internet rights in 2014 and 2015. These principles serve as a living framework that is constantly evolving. There are currently seventeen principles that touch on a broad range of issues related to the rights of marginalized genders online; as a whole their purpose is to provide a framework for women’s and LGBTQAI+ empowerment, movements and realization of rights online.

When we adapt and apply these principles in our own feminist practice, they can serve as a fantastic tool to combat online gender-based violence. In the fall of 2018, Foundation for Media Alternatives (FMA) ran a series of workshops on FPI for students at University of the Philippines and Far Eastern University. FMA’s goal in running these workshops is to introduce young feminist leaders to FPI, and challenge them to consider how they can contextualize and apply the principles in their own communities. There is a need to run FPI workshops, as this information can serve as an excellent framework for women and LGBTQIA+ people working to bring their feminism online. The creation of a safe space allowed participants to share their experiences and exchange knowledge while exploring feminism in the digital sphere.

The FPI workshops generated a great deal of interesting, engaging discussions that allowed participants to dig into the intricacies of feminist practices online. The results were fantastic; participant reviews show that the workshops were successful in delivering relevant, concise content in an effective and well-informed way. The workshops began by outlining and describing the FPI, and continued by having participants critically engage with the principles through discussion and activities.

A broad range of topics and experiences were brought up during the workshops. Participants were particularly interested in discussing access to information about sexual and reproductive health rights, the sexist and systemic erasure of women’s work, and the importance of being in community with fellow feminists both on and offline. Participants at the University of the Philippines also had a rich conversation about pornography through a gendered and feminist lens. They discussed the fact that porn can be an empowering industry for women and queer people, while also acknowledging that some porn is made by exploiting human trafficking victims. They discussed consent, bodily autonomy, and women-directed porn. Ultimately, participants challenged each other to see porn as a complex industry and profession by bringing to light just how nuanced the topic is. This type of critical knowledge exchange is enriching; it allows participants to confront their own biases, and in effect, become better equipped to apply FPI in a mindful and intersectional way.

In collectively engaging with FPI through these workshops, participants were able to broaden their understanding of feminism, and go home with tools they can use to tackle online gender-based violence. This is a critical step towards ensuring that women and LGBTQIA+ people have the resources they need to create spaces for themselves and for movements online, and challenge states and corporations that surveil and control the internet. These are tools that they can not only use themselves, but ones they can share with their own communities to incite broader discussions about creating a feminist internet.

About the author: Ali Watson is an intern from Canada working at FMA. She has an undergraduate degree in History, Religious Studies and Gender Studies, and a strong interest in issues related to gender and sexual diversity. Before interning at FMA, Ali worked with an NGO focused on empowering women and children, and a sexual education centre that works to make information on sexual and reproductive health widely accessible.

Originally published at www.fma.ph on November 27, 2018.

The Tools We Need to Fight Online Gender-Based Violence was originally published in Foundation for Media Alternatives on Medium, where people are continuing the conversation by highlighting and responding to this story.

Transparency and accountability are two foundational principles of democracy. As such, they are well entrenched in the Philippine Constitution, which provides for the right of Filipinos to hold the government and public officials accountable for any or all of their mistakes or shortcomings.

The signing of Executive Order (EO) №2 (s. 2016) significantly enhanced such right by operationalizing freedom of information (FOI) in the executive branch of the government. Citizens can now ask national government agencies (NGAs) and even local government units (LGUs) to provide relevant information relating to their respective mandates and functions, including:

1. research studies and statistics collected

2. raw data (including GIS and surveys)

3. public records and documents (including memorandums and project briefs)

4. transactions conducted

5. copies of adjudications rendered

6. Statements of Assets, Liabilities, and Net Worth(SALNs) of public officials

And since government-held data is also invaluable to research and policymaking, CSOs that regularly advocate for the passage of bills can now also support their cause with data from the ground collected by no less than the government itself.

To gain access to government-held data, citizens may write to the concerned agencies or make use of an e-portal specifically established for FOI purposes. The online platform is meant to minimize the hassle of a paper-based procedure, thereby encouraging more public-government engagements.

A so-called FOI request must be addressed by a government agency or unit within a period of fifteen (15) working days. If not satisfied with the response by the agency, the requesting party may choose to file an appeal.

According to a report by the Foundation for Media Alternatives (FMA), there have already been journalists who were able to come up with stories that made use of information obtained via the FOI system.

Nonetheless, advocates are quick to note that EO №2 is still not the comprehensive FOI mechanism that they have long been pushing for. Unlike a law passed by Congress, an executive order is limited in scope and is easily stricken down should a later administration prove cold to the idea. They also point out the many different kinds of information that are considered exempt from its current coverage, such as:

1. information involving national security and international relations

2. confidential information under banking and finance laws

3. official documents classified as confidential

4. information covered by Executive privilege

FOI and Data Protection

Another justifiable reason for denying an FOI request is if it’s necessary to protect an individual’s personal data. This is especially the case if accessing such information is not related,in any way, to the objective of a request. Naturally, this exemption is itself subject to limitations so as not to allow its use by government officials for circumventing the law, or defeating its purpose.

Just the same, some agencies have still ended up improperly invoking the country’s Data Privacy Act (DPA) when refusing to disclose information or in making significant redactions to records that do end up getting released.

For example, in August 2017, the SALN records of 28 Cabinet members were released by Malacañang Records Office (MRO) for public scrutiny. In doing so, however, the MRO withheld significant portions of the records, citing the data privacy law as basis.

The public outcry that ensued prompted a dialogue between the concerned government units (i.e., Civil Service Commission, National Privacy Commission, and MRO) and the media. That, in turn, resulted in the disclosure of some of the redacted information and a commitment from the government to work towards a more balanced approach to the FOI system moving forward.

If anything, the case emphasized that while protecting an individual’s privacy is important, the willingness of the State to release information to the public is just as critical if transparency and accountability in government is to be fully realized. Confidentiality should not be invoked as a blanket excuse to keep the public in the dark about the inner workings of their government.

The Way Forward

Despite its imperfections, one cannot deny that EO №2 is a transparency tool that was previously unavailable to the people. One should still make use of its benefits, no matter how limited. At the very least, people can use it to help determine:

1. which government officials should be held responsible for problematic or corruption-laden projects or programs

2. what priorities are being pursued by the government

3. where people’s taxes are being spent on

4. what public documents should the people be entitled to access and review

At the end of the day, public participation ably led by civil society remains the key to establishing good governance. It is only through the concerted effort of all stakeholders will elected and tenured public officials be constantly put on notice that the people are keeping a close watch over their activities and policies while they are in power. Without this, no amount of transparency could ever ensure true government accountability.

Revisiting FOI was originally published in Foundation for Media Alternatives on Medium, where people are continuing the conversation by highlighting and responding to this story.

(Organizations and individuals may sign. Post a comment here or email jpacis@fma.ph and indicate the name you want included in the statement. Deadline: September 26, 2018)

We, the undersigned, as civil society organizations and concerned citizens of the Philippines, express our grave concern for the recent proceedings regarding the promulgation of the Implementing Rules and Regulations (IRR) of Republic Act №11055, or the Philippine Identification System (PhilSys) Act.

During the weekend of September 22, the Philippine Statistics Authority (PSA) posted on its website the draft IRR of the PhilSys Act. On Monday, September 24, the PSA announced the schedule of the PhilSys IRR public consultations: which were to be held later that same day in Metro Manila and the following day (September 25) in Cebu and Davao.
There are no indications that further consultations will be carried out. Neither are there any reports that civil society and/or the private sector were approached, consulted, or involved in the actual drafting of the Rules. Instead, the Rules are expected to be approved and signed within mere days of the two-day consultation mentioned.

These hasty proceedings do not constitute sufficient public consultation. They do not speak well of the administration’s sincerity in fomenting a more inclusive approach to policy-making.

We wish to emphasize that the PhilSys Act, including its IRR, will directly impact the identity of every Filipino and resident alien, as well as all rights that flow from such identity. A mechanism of such reach and significance warrants genuine participation of those it purports to serve. It demands consultation that gives voice to all sectors of society. Such engagement is the kind envisioned by no less than the Philippine Constitution itself:

The right of the people and their organizations to effective and reasonable participation at all levels of social, political, and economic decision-making shall not be abridged. The State shall, by law, facilitate the establishment of adequate consultation mechanisms. (Section 16, Article XIII)

Accordingly, a hasty, exclusionary, and undemocratic handling of public consultations for a law as monumental as the PhilSys IRR is in direct defiance of this Constitutional right.

We, the undersigned, therefore call on the PSA and the other members of the PhilSys Policy and Coordination Council to delay the promulgation of the PhilSys IRR, and extend the period for public consultations so as to allow for broader, and more meaningful participation of the public in this important rule-making process. Only under these conditions can a truly fair and rights-based identification system be established.

URGENT CALL FOR SIGNATURES: Joint Statement Regarding the Philippine Identification System Act… was originally published in Foundation for Media Alternatives on Medium, where people are continuing the conversation by highlighting and responding to this story.

Big Data is a breakthrough technology for a lot of companies. It has allowed them to facilitate the real-time processing of massive data sets they have collected from various sources in order to significantly enhance their businesses. A major contributing factor has been the development of tools and techniques (e.g., data visualization, data analytics, and machine learning) which have paved the way for its application in a diverse range of fields and industries.

Today, we enjoy a lot of the benefits of Big Data use. This, however, should not be taken as a license to do away with other things of equal value (if not more) such as the people’s fundamental rights and freedoms. Throughout history, bargains like that have never ended up well.

With power comes responsibility

There are now many ongoing discussions regarding the responsible use of Big Data, albeit probably not as extensive yet as those exploring ways to make such use more efficient and broader in scope. This has to change.

While it is understandable for businesses and governments to want to tap into the technology’s considerable potential, they cannot turn a blind eye to the risks its adoption entails. Despite its undeniable benefits, it would be the height of irresponsibility to ignore such risks.

Truly, there is a need to define the boundaries that Big Data should be allowed to traverse, especially when concerning personal data. Questions have to be asked:

· What is (and isn’t) considered personal data in when dealing with Big Data?

· Who owns the collected data?

· What is the legal basis for collecting personal data used in Big Data Analytics?

· Who is accountable for protecting collected data sets?

Other initiatives should include:

· Developing tools with a “Privacy by Design approach”. Privacy and Big Data are not mutually exclusive concepts, for it is possible to pursue the different applications of Big Data without compromising the privacy of individuals. In recognizing this, Big Data proponents should design systems that proactively uphold privacy in order to create a default safety net that protects people from any unintended breach of their privacy. They should come up with mechanisms that respect the rights of data subjects, and place great emphasis on the security and integrity of data.

· Conducting Privacy Impact Assessments. Anticipating risks and potential issues that may arise can help determine the type and extent of security measures that need to be in place in order to ensure privacy and security in Big Data systems. This can be done via privacy impact assessments (PIAs). As a result, data leaks could be preventedor at least their impact is substantially mitigated. On top of that, PIAs also demonstrate that the entities behind Big Data systems exercise due diligence in going about their businesses.

· Giving Life to Data Privacy Principles. Parties involved in Big Data use must observe the data privacy principles enshrined in practically all data privacy laws. This means upholding transparency, legitimate use, and proportionality in their data processing activities. Other principles like data minimization, accountability, and data security must also be implemented.

· Implementing security measures (e.g., anonymization, pseudonymization, etc.). Whenever possible, security measures must be embedded all throughout the lifecycle of information as it is processed by Big Data systems. They may consist of anonymization or pseudonymization techniques, or the adoption of encryption technologies. Together, they all serve to mitigate any potential harm resulting from the identification of specific individuals and the misuse of their information.

· Ensuring that mechanisms that allow for the exercise of data subject rights are in place. It is ultimately the Individual (i.e., data subject) that ought to have control over how information his or her information will be used and processed. Big Data enthusiasts should acknowledge this. Accordingly, they should implement mechanisms that accommodate people who wish to exercise their rights over their personal data, such as asking companies to delete their personal data in the latter’s custody.

What to expect

In the end, no one is suggesting that Big Data use should be inhibited — let alone, discarded completely. Rather, what is hoped is to see it constantly improve, but in a consistently responsible manner. Among other things, it should not be at the expense of the individual’s right to privacy.

To be sure, there are many successful Big Data initiatives to date that reflect a proper balance. In moving forward, it is these experiences that ought to be replicated in other quarters. This way, the technology is truly made to benefit the people.

If you’re interested in knowing more about this subject, you can read the briefing paper prepared by the Foundation for Media Alternatives HERE.

Dealing with Big Data was originally published in Foundation for Media Alternatives on Medium, where people are continuing the conversation by highlighting and responding to this story.

Data privacy may be described as the right of an individual to be free from any unauthorized use or access of his or her personal information. This is achieved via a variety of documentary, physical, and/or technical means.

To ensure that data privacy is upheld in any given organization, there has to be at least one person responsible for carrying out such a task.In many countries, he or she is called a data protection officer (DPO).

A DPO oversees the data processing systems of an organization. He or she also promotes and enforces privacy and data security standards set by laws and other related regulations. If a breach occurs, the DPO must see to any applicable reportorial duties the organization may have to observe.

With such a wide range of tasks, a person planning to be a DPO must develop certain skills integral to the job. If you’re one such person, here are five (5) essential habits that will help you become an efficient and effective DPO:

Familiarize yourself with all applicable laws and regulations

Knowledge, as they say, is power. In the field of data privacy,this means you need to acquaint yourself with all applicable data privacy or data protection laws, including Republic Act № 10173, also known as the Data Privacy Act of 2012, its Implementing Rules and Regulations, and other issuances of the National Privacy Commission (NPC).With the recent implementation of the European Union’s General Data Protection Regulation (GDPR), companies that do business with EU entities or those that handle personal data of EU citizens also need to consider the implications of this new law to their operations.

Make it a habit to check if there are new policies, too, including changes to existing ones.Do not get overwhelmed with so much information — something that is bound to happen if you only study your laws when absolutely necessary.

Maintain an accurate map of your organization’s security measures

Whether it’s data protection policies or technical measures like encryption and security systems, you need to map out all existing security measures of your organization that relate to personal data.Having charts that outline information process flows can be extremely useful, too, especially when trying to dealing with security incidents or data breaches.With such charts, you are able to respond better to unforeseen issues that may arise or threaten the integrity of your information systems.A regular review and audit of these security measures will also ensure that your security infrastructure is equipped to handle newer and potentially more dangerous threats.

Document all data privacy issues raised and the actions taken to address them

If monitoring all concerns of an organization that relate to data privacy is a core responsibility of a DPO, documentation is indispensable to that endeavor. Creating logs of all privacy issues encountered helps in developing measures aimed at preventing such issues from recurring in the future. Knowing what interventions were applied — and their effectiveness — will also prove invaluable when coming up with more modern and better solutions.

For this endeavor, start by developing monitoring forms that takes into account all critical information that need to be recorded on a regular basis (i.e., daily, weekly, monthly, etc.). As a bare minimum, it may be used later on as demonstrable proof of the organization’s effort to comply with the DPA.

Be proactive in identifying the vulnerabilities of your organization’s data processing systems

Prevention is the more effective and more sustainable approach when dealing with data breaches and other security incidents, as opposed to addressing them when they’ve already happened. With this, you need to be proactive when seeking out the vulnerabilities and weaknesses of your organization’s data processing systems. Conducting regular Privacy Impact Assessments (PIA)usually accomplishes this.

Some would argue that PIAs are too costly, especially for smaller organizations who may not have as many resources as their larger peers. While this may be true (although there are cost-efficient ways of doing it, as well), PIAs actually cost a lot less, compared to the alternative — dealing with the damage left by a major data breach.

The fifth habit worth developing is checking out other informative articles at the Foundation for Media Alternative’s blog. Bookmark it to keep abreast of all trends and hot topics regarding data privacy in the Philippines, and even around the world.

5 Essential Habits a Data Protection Officer Should Develop was originally published in Foundation for Media Alternatives on Medium, where people are continuing the conversation by highlighting and responding to this story.

The breach was a significant wake-up call. It highlighted the importance of data privacy and the need to take seriously the provisions of the country’s first comprehensive data protection law: Republic Act №10173, also known as the Data Privacy Act of 2012 (DPA). Sure, it did not have to be at the expense of millions of Filipinos whose personal data were compromised.But come to think of it, how receptive would the country be, right now, to data privacy had it not been for the fallout left by that massive breach?

Today, Filipinos are interested in data privacy. Companies and government agencies are also more wary of the vulnerabilities of their data processing systems out of fear of falling victim to the next major leak.

Here are a few other takeaways from Comeleak:

• Despite efforts by government institutions,like the Bangko Sentral ng Pilipinas, to mitigate the risks the breach gave rise to, the public still needs to keep a watchful eye on any attempt to misuse their personal data. This should also be the case for government agencies and companies in the private sector who will be the obvious target of impostors and fraudsters using the compromised data.
• An increase in impersonation and/or identity theft incidents is among the likely consequences of the data breach.
• Whatever negative effect the breach had originally, it increased exponentially after copies of the compromised databases were leaked online. While attempts were made to remove such databases and links thereto from cloud storage services and torrent sites,respectively, it is impossible to know at this point if copies were successfully downloaded prior to the takedowns, and how many.
• Some of the personal data compromised can be used to figure out access to various online accounts via password recovery mechanisms and similar measures. Among those at risk are: (1) social media and email accounts; (2) subscriptions, plans, and online shopping accounts with linked credit card details; (3) online banking accounts; and (4) credit card and bank account numbers for “replacement”.

For privacy and information security advocates, the momentum generated by Comeleak in terms of fostering public awareness regarding data privacy and the many uses of emerging technologies should not be wasted. People should be more circumspect when giving out their personal data, while government agencies and private sector companies should also be more careful in securing the information they collect and process.

There are signs that the ripple effect of that event is already beginning to die down. This should not be allowed to continue. If a data breach as big as Comeleak will not be enough to encourage better data protection among Filipinos, one can only wonder if something every will.Organizations in both the public and private sector should do their part, too. They should espouse accountability over the personal data under their custody and the data processing systems they own and manage. They should do everything within their means to secure those data and those systems.Should that fail, they ought to address any breach or security incident with care and dispatch, while seeing to the welfare of the affected individuals. Only a consistent multi-stakeholder approach will ensure a more secure world for personal data.

For more information about the breach, the Foundation for Media Alternatives (FMA) recently released a paper providing a brief narration of how it unfolded, as well as its implications on the field of data protection here in the country.

Lessons from Comeleak was originally published in Foundation for Media Alternatives on Medium, where people are continuing the conversation by highlighting and responding to this story.

This article was originally posted at GMA News Online

A little over two years ago, in the run-up to the 2016 national elections, a massive data breach earned the Philippines an unenviable place in the global spotlight. The headlines then said it all: Personal data of 55 million Filipino voters exposed! 55M people at risk! PH suffers biggest breach involving government-held data!

All those headlines, provocative and incendiary, were enough to work everyone into a frenzy: privacy practitioners, IT specialists, law enforcement agents, politicians, and just about everyone with a social media account. They all had something to say. There was no shortage of self-proclaimed experts willing to speak their minds before anyone and everyone with the time to spare. They talked, they opined, they surmised, over and over again, until public attention — one of the more fleeting things in life — was no more. People appeared to no longer care. They seemed to have moved on.

This May, Filipinos will be heading to the polls again. This time, to vote for their barangay and Sangguniang Kabataan officials. It’s an ideal time to recall that fateful incident, not only to remind ourselves that that story is far from over, but also to emphasize anew the importance of data protection. After all, before this current Facebook controversy that’s in everyone’s crosshairs, Comeleak was (to Filipinos, at least) the first real opportunity to confront the notion that the use (and misuse) of personal data can negatively impact democracy, or at least one of its fundamental pillars. It would be a pity to put that to waste.

For those with failing memory, here are some important things to remember about that case, by the numbers:

• 0 — number of years the Department of Information and Communications Technology (DICT) had been in existence at the time of the data breach. As parent agency of the National Privacy Commission (NPC), it was only established in June that year.
• <1 — number of months the NPC had been in existence at the time of the data breach. It investigated the case and came up with a decision later that year. The first two members of the Commission took their oath of office on 7 March 2016.
• 2 — number of hacking groups reportedly involved in the incident (Anonymous Philippines and LulzSec Pilipinas). Incidentally, it’s the same number of individuals arrested in relation to the hack.
• 3 — number of mirror links put up by LulzSec Pilipinas when they posted online the data they supposedly stole from the Commission on Elections (Comelec).
• 4–5 — number of days it supposedly took to perpetrate the data breach.
• 5 — number of Comelec databases affected by the breach.
• 20 and 23 — ages of Paul Biteng and Jonel de Asis, respectively, when they were arrested on the charge that they were among those responsible for the breach. It is worth noting, though, that some articles claim that Biteng was also 23 at the time of his arrest.
• 28 — date in March 2016 when the National Bureau of Investigation was officially informed by the Comelec that their website was the subject of a defacement attack. There was no mention of the data breach yet.
• 340 — size of the data (in gigabytes) supposedly exfiltrated by LulzSec Pilipinas from Comelec’s databases.
• 2012 — year of enactment of the two laws (Data Privacy Act and Cybercrime Prevention Act) most-often cited in relation to the breach.
• 77,736,795 — total number of records affected by the breach. This made it the biggest data breach involving government-held data the world had seen, at that time. The previous record was held by the U.S. Office of Personnel Management, which affected 20 million citizens. Comeleak has since been eclipsed by data breaches subsequently experienced by Mexico and the U.S. (again).
• 90,000,000+ — number of Mexican voters whose personal data were exposed by a data breach that occurred just a couple of weeks after Comeleak.
• 198,000,000+ — number of U.S. voters affected by a 2017 data breach involving the database owned by conservative data firm, Deep Root Analytics.

It’s now well into the second quarter of 2018. Public outcry about Comeleak has died down, and so have the initial outbursts demanding full accountability on the part of Comelec, and the government in general. Former Chairman, Andres Bautista, is no longer with the Commission and is not even in the Philippines. He has not returned from abroad because of a supposed illness. What important lessons did that entire episode leave behind? Here are some humble suggestions:

• Filipinos need to take data privacy seriously. It took a disastrous data breach on the part of the government to put a 3-year old law on the map. The attention it generated should be sustained — enough to convince people and organizations to adopt and embed data privacy measures in their respective sectors and industries.
• There has to be a competent and independent NPC. The breach was an extraordinary test for a new agency lacking in resources. A couple of years has come to pass and now it has to be asked: Is the NPC now better equipped to handle a similar case? Has its competence in this new and specialized field of data protection improved significantly? Is its capacity mature enough to handle the more substantial and more formidable aspects of its mandate? How about its ability to set itself apart from the rest of government, including the DICT, its parent agency? NPC’s credibility as a regulator depends on its competence and independence — just like its foreign peers.
• Congress and NPC need to legislate additional data protection policies. Critics and proponents of the DPA both acknowledge that it has numerous policy gaps. Congress and the NPC need to address them. Their wisdom and expertise are important guide posts for the rest of the country.
• The government should also improve its capacity in other areas such as cybersecurity and cybercrime investigations. Data privacy is an inter-disciplinary matter. This means its effectiveness is also contingent on these other areas going through similar improvements.
• Everyone must exercise caution when dealing with data-intensive systems. The work of public authorities everywhere involve the processing of sizable amounts of personal data. It’s no different with the private sector. If there’s anything that Comeleak has shown, it’s that a responsible approach to technological advancements is imperative. Integrating them into existing data processing systems requires foresight and careful planning. With the Philippine government still keen on establishing data-hungry systems like a mandatory SIM card registration regime and a national ID system, sticking to its dated approach to information systems can only spell disaster for everyone. The NPC should fully assert its mandate here, as primary enforcer of the DPA.
• Civil society must continue promoting privacy and data protection measures in both government and the private sector. Civil society and the public at large will continue to play a major role in the country’s data privacy story. They need to call out those entities who refuse to heed the clamor for better handling and security of personal data, while giving due credit to those who do. Collaborations must always be explored, too, for it is only by having all parties work together that an effective and lasting data protection regime can be ensured.

For a more extensive account of what transpired, you may check out the briefing paper prepared by the Foundation for Media Alternatives (FMA), a non-profit civil society organization working to promote human rights in the context of ICTs.

Jamael Jacob is a lawyer specializing in the field of law, ICT, and human rights. He is currently the Director of the University Data Protection Office of the Ateneo de Manila University, and Policy and Legal Advisor to the Foundation for Media Alternatives. The views expressed herein do not necessarily represent or reflect the views of the organizations he is currently affiliated with.

Revisiting Comeleak, by the numbers was originally published in Foundation for Media Alternatives on Medium, where people are continuing the conversation by highlighting and responding to this story.

Last week, I took part in this side event at the Human Rights Council’s 37th ordinary session called, “Digital identity, smart cities, and other data intensive systems: the implications for the right to privacy”.

It was held at the Palais de Nations in Geneva, Switzerland, with attendees including representatives from a number of permanent missions to the United Nations, like Brazil, Germany, and Austria, which are all members of the Privacy in the Digital Age Core Group.

The event’s principal organizers were Privacy International and the Association for Progressive Communications (APC). Our group, Foundation for Media Alternatives, works regularly with both. We are, in fact, a member of APC, and we are also part of this so-called Privacy International Network.

The thrust of the forum was simple: a lot of government initiatives today involve policies and technologies that rely heavily on data. They include the development of smart cities, national ID systems, device/SIM card registration systems, and the use of big data analytics. Unfortunately, these advancements are marked by problems such as their lack of transparency and accountability mechanisms, adequate implementing policies, the availability of or access to remedies, and proper measures to inform the public as to how they actually work. These, in turn, give rise to secondary issues: (1) use of data to profile individuals, leading to discrimination (and even oppression, in some cases); (2) increase in the surveillance of individuals, including activists and journalists; and (3) exposure of certain populations to further risks after their identities are revealed. The event offered a venue for discussing these matters to the government representatives and civil society members in attendance.

Our panel was composed mainly of non-government organizations. With Deborah Brown of APC as moderator, my co-speakers were colleagues from the Digital Asia Hub (Malavika Jayaram), Privacy International (Francisco Vera), and Fundacíon Karisma (Juan Diego Castañeda). Rounding up our group was the UN Special Rapporteur on the Right to Privacy, Joseph Cannataci.

After some brief opening remarks from the Permanent Representatives of Germany and Brazil, Deborah turned the floor over to Malavika who discussed how biometric identity systems are currently being used here in Asia, and their implications on the right to privacy. Such systems are gradually being introduced across the region, presumably to provide various public services.

She was followed by Francisco whose task was to speak on the impact of smart cities on privacy and prevailing social inequalities. This recent fascination with so-called smart cities is supposedly driven by the desire of proponents to improve efficiency, sustainability, and security in both the public and private sectors.

Juan Diego, meanwhile, aired his organization’s concerns regarding the Colombian government’s plans to utilize big data for its own purposes. It was in 2016 that the government announced its efforts to design such a strategy. Last year, the draft of the strategy was published and disclosed to the public.

And then it was my turn to speak about our government’s plan to adopt a mandatory SIM card registration system. I was asked to elaborate on the impact of this proposal on the privacy rights of Filipinos, and then discuss any steps or solutions that I felt should be taken to address our concerns.

As the last speaker, the UN Special Rapporteur had the unenviable task of responding to the issues raised by all of us who preceded him. He was also asked to discuss his work briefly, and what steps he has taken, if any, to address the concerns that were brought up.

Afterwards, several questions were fielded by the audience. Quite a number revolved around one particular issue: how to keep using data intensive systems — given the benefits they offer — while making sure that they do not violate the people’s right to privacy.

In addressing the questions raised and as a part of my own talking points, I offered two suggestions that I think are relevant when dealing with data intensive systems:

The government should always provide a proper discussion forum. There has to be a time and place where all relevant issues about each system are taken up: Is it really necessary to address or solve the problems it is meant to solve? If it is, is it the best one available? If it has negative implications, what will be done in order to prevent or at least minimize such impact? These are questions that need to be answered before the system is adopted, and not after. Yes, the right to privacy is not absolute, but there is always that responsibility to make sure that whatever measure is being proposed, it should be the last resort and the least intrusive means possible.

If the decision is to adopt a data intensive system, make it compliant with international standards on data protection. A privacy be design approach should be adopted. We have all these data protection or data privacy principles that ought to be integrated by default into each data intensive system. For instance, collection should be transparent. The system should only collect those information necessary for its purposes. It should only be used for legitimate purposes. And then, of course, there is the responsibility of ensuring the security of all collected data.

As Filipinos, the consequences of not taking these suggestions seriously are grave and should not be hard to fathom. We have the 2016 COMELEC data breach to look back to. There, we had a data processing system that involved millions of personal data, with little to no safeguards in place. Many factors may have led to that incident, but not having the appropriate debates to tackle its vulnerabilities and potential threats was certainly one of them. Also, by now, that system’s failure to comply with our data privacy law is already a foregone conclusion. As part of the affected population, we owe it to ourselves to not let that happen again.

Data intensive systems are upon us was originally published in Foundation for Media Alternatives on Medium, where people are continuing the conversation by highlighting and responding to this story.

Below is a helpful infographic on some of the risks discussed in the paper:

Originally published at www.fma.ph on February 6, 2018.

INFOGRAPHIC: The Dangers of SIM Card Registration was originally published in Foundation for Media Alternatives on Medium, where people are continuing the conversation by highlighting and responding to this story.

Foundation for Media Alternatives
25 January 2018

The Foundation for Media Alternatives (FMA) expresses grave concern over the decision of Philippine authorities to shut down cell sites during huge festivities. The organization calls for transparency regarding the guidelines used by authorities before resorting to signal jamming. As advocates of human rights and communication rights, FMA believes that human rights and fundamental freedoms offline should also equally apply online. Internet shutdowns, which may come in various forms such as signal jamming, restrict people’s right to communicate.

The National Telecommunications Commission has approved the Philippine National Police’s request to shut down mobile services in time for the Dinagyang festival this coming weekend, January 27 to 28, 2018. This means that mobile features such as phone calls, short message service, and access to mobile data will not be possible in select areas. Philippine mobile operators are not new to such request. In January 2018 alone, network shutdowns were carried out at the Feast of the Black Nazarene, and at the Sinulog and Ati-atihan festivals held in Cebu and Aklan, respectively.

The first known mobile network shutdown in the Philippines was during the Papal visit in 2015. Since then, signal jamming has been frequently used as a go-to security mechanism for large events, with public safety as their primary justification. Other known cases include festivals such as Sinulog 2017, Dinagyang 2017, Hermosa 2016, MassKara 2017, Feast of the Black Nazarene 2017, and other events such as the swimsuit portion of Miss Universe 2017, and Palarong Pambansa 2017. It appears that shutting down communication networks is becoming the norm.

FMA notes the lack of evidence proving that mobile network shutdown contributes to security. The fact that bigger events such as ASEAN was conducted safely even without shutting down cell sites show that the police and authorities are capable enough to maintain security without resorting to internet or mobile network shutdown. Stripping the general public of their means to communicate restricts them from contacting emergency services, authorities, and each other; paralyzes their businesses and jobs; and further places them at risk. Sacrificing access to basic services, as well as the fundamental right to communicate, in the name of purely hypothetical benefits fails the test of necessity and proportionality.

As such, FMA calls for a clearer policy or set of guidelines for implementing these mobile network shutdowns. Authorities must be transparent in their protocol on who can ask for, when to ask for, how long, and how wide the implementation of the mobile network shutdown will be. Shutting down cell sites should only be the last resort and not the default security measure. However, when the need to resort to signal jamming arises, the public always needs to be informed, as they suffer the most from these shutdowns. Authorities must also ensure that emergency services can be accessed despite communication restrictions.

Without any transparent basis in shutting down cell sites, authorities can abuse their capability to strip the general public of their right to communicate. The masses are convinced to compromise their right to expression for their security when there is no clear need for a tradeoff. In times when authorities can easily turn off our right and access to communication, FMA urges them to #KeepItOn.

For questions, please contact Atty. Jamael Jacob or Liza Garcia at (02) 435–6684 or info@fma.ph.

About FMA: The Foundation for Media Alternatives (FMA) is a non-profit NGO in the Philippines whose mission is to assist citizens and communities — especially civil society organizations (CSOs) and other development stakeholders — in their strategic and appropriate use of the various information and communications media for democratization and popular empowerment.

Originally published at www.fma.ph on January 25, 2018.

Internet Shutdowns: A Myth of Security and Public Safety was originally published in Foundation for Media Alternatives on Medium, where people are continuing the conversation by highlighting and responding to this story.