The Data Privacy Act of 2012 is the law the protects all types of individual data.
Two things you need to know about the law. First, it protects information about an individual, so corporate information, like the corporate name or the SEC registration number are excluded. Two, the term personal data is not mentioned in the law. Rather, the law refers to three types of individual information:
- Personal Information,
- Sensitive Personal Information, and
- Privileged Information
Personal information is any piece of information that identifies an individual or when put together with other pieces of information would directly and certainly identify an individual. Examples are the face and name of a person.
How about an address or a cell phone number? Because the definition includes any piece of information that when put together with other pieces of information would directly identify an individual, these are considered personal information.
Sensitive personal information refers to specific information about an individual: his race, health, education, ethnic origin, marital status, age, color, religion, philosophical, or political affiliations, social security number, license and passport numbers, and tax returns. It also includes information about any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the court’s sentence. And any information established as classified by an executive order or an act of Congress.
Privileged information refers to any and all forms of data that are deemed privileged under the Rules of Court and other pertinent laws. An example here is the attorney-client privilege or the information that a client shares with his lawyer.
