The Philippine National Privacy Commission (NPC) has launched a nationwide public consultation process to inform forthcoming guidelines on biometric data processing, marking a key move to strengthen privacy protections amid the country’s growing adoption of digital identity technologies.
The initiative aims to develop comprehensive regulations governing the collection, use, storage, and deletion of biometric data, including fingerprints, facial recognition, iris scans, and other unique physiological or behavioral identifiers. The NPC is actively soliciting input from individuals, organizations, technology providers, and privacy advocates to ensure the rules are practical, enforceable, and responsive to both rights and innovation.
This move comes amid surging enthusiasm for digital ID systems in the Philippines, where more than 84 million National IDs are now accessible through the eGovPH app. Biometric authentication is already widely deployed in sectors such as banking, social services, and telecommunications. However, technical issues—including data entry errors and registration delays—have affected accessibility and accuracy in some cases.
“To create responsive regulations, the NPC requests inputs on your experiences, issues, and concerns on the processing of biometric data,” the Commission said in its call for participation. The guidelines will cover key areas such as standards for securing and storing biometric information, requirements for obtaining informed consent, policies for data retention and deletion, protocols for individual access and correction rights, and enforcement mechanisms to prevent unauthorized use or disclosure.
The guidelines will also reinforce existing provisions under the Data Privacy Act of 2012, which classifies biometric data as sensitive personal information subject to heightened protections. Organizations that process such data are required to register with the NPC and comply with ongoing reporting and monitoring obligations.
In support of these efforts, the NPC has taken several proactive steps. In December 2024, it launched the Compliance and Security Monitoring Command Center (CSMCC), a centralized facility to oversee data privacy compliance across sectors, including the processing of biometric data. In March 2025, the NPC and the Insurance Commission jointly issued an advisory promoting the use of privacy-enhancing technologies (PETs) in high-risk sectors to mitigate potential harms from biometric and other personal data processing.
Earlier this year, the NPC issued a public warning regarding unauthorized iris scanning schemes that offered cryptocurrency in exchange for biometric data. The Commission clarified it does not endorse such practices and urged the public to verify the legitimacy of any entity collecting biometric information.
The consultation also comes as the Philippine legislature considers amendments to the Data Privacy Act that would define biometric data more clearly, strengthen penalties for violations, and set clearer rules for data sharing and cross-border transfers. These legislative developments are expected to influence the eventual scope and enforcement of the biometric guidelines.
Sources: MLex, Hunton Privacy Blog
—
April 24, 2025 – by the ID Tech Editorial Team
