JILI365 Data Privacy Act: Your Rights Over an ID and Selfie

The Data Privacy Act is the law that decides what a company may do with the ID photo, the selfie and the details you hand over when you sign up for a casino. If a casino asks for them, the law treats you as the “data subject” and the casino as the “personal information controller”, and the rights in the Act sit with you. Reading the Act takes ten minutes and tells you exactly what to ask for.

Every section number on this page is taken from the text of Republic Act No. 10173, approved on 15 August 2012 and published on lawphil.net. Before you start a casino sign-up, you can also read how a JILI365 register step is set out so a sign-up form holds no surprises.

What the Data Privacy Act covers when a casino asks for ID

Section 4 applies the Act to the processing of all types of personal information, by any natural or juridical person involved in it. Section 3 defines the terms, and it is the definitions that tell you which of your items count and how strongly the law protects each one.

Section 3(l) says its list of government-issued information includes, but is not limited to, the examples it names, so read the full definition rather than relying on a table. Sensitive personal information carries a heavier penalty band in the Act’s penalty sections, set out below.

RA 10173 rights you can use today

Chapter IV of RA 10173 lists what you are entitled to. These are the ones that matter after you have sent a casino a photo of your ID.

1. To be informed (Section 16(a)) whether your personal information is being processed.
2. To be told the terms (Section 16(b)): what is collected, why, how, who receives it, how long it is kept and who the controller is, before the data goes in or at the next practical opportunity.
3. To reasonable access (Section 16(c)): the contents processed, the sources, the recipients and their addresses, how it was processed and when it was last accessed and modified.
4. To correct (Section 16(d)): dispute an error and have it corrected immediately, unless the request is vexatious or unreasonable.
5. To block or remove (Section 16(e)): suspend, withdraw or order blocking, removal or destruction when you have substantial proof the data is incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes or no longer necessary.
6. To damages (Section 16(f)): be indemnified for harm from inaccurate, unlawfully obtained or unauthorized use.
7. To a copy (Section 18): obtain a copy of electronically processed data in a structured, commonly used format.

Section 17 lets your lawful heirs and assigns invoke these rights after your death or if you are incapacitated. Section 19 switches some of them off for data used only for scientific and statistical research, and for processing gathered for investigations into criminal, administrative or tax liabilities.

Make a request to the casino, step by step

You do not need a lawyer for the first move. A dated, written request is the record the Commission will ask for later.

1. Find who the controller is. Section 16(b)(6) entitles you to the controller’s identity and contact details, and Section 21(b) says the person designated as accountable for compliance must be made known to you on request.
2. Write one message with your account details, the right you are using by its section number, and the exact items you mean (ID photo, selfie, activity records).
3. State the date you want a reply by, choose a reasonable one and write it down.
4. Keep copies of what you send, the date and any reply. Screenshots of the page where you sent it count.
5. If the reply refuses without reasons or does not arrive, move to a complaint.

NPC complaint: where an ignored request goes

Section 7(b) of RA 10173 makes the National Privacy Commission the body that receives complaints, investigates, facilitates settlement and can award indemnity. Section 16(b)(8) also lists the right to lodge a complaint before the Commission among the things a controller must tell you about. The Commission’s own pages on privacy.gov.ph give the current complaint form, the documents it asks for and any filing period, so take those details from there and not from a summary.

Bring the evidence you collected in the steps above: your written request, the dates, and the reply or the silence. A complaint that names the section you relied on, such as Section 16(c) for access, is easier to follow than one that says only that your data was misused.

What the penalty sections say

The Act sets prison terms and fines for controllers and their staff. These are the figures as the text gives them.

Section 33 sets 3 to 6 years and PHP 1,000,000 to 5,000,000 for a combination or series of the acts in Sections 25 to 32. A complaint about a stolen identity or a scam built on leaked data can also fall under the cybercrime law, which the RA 10175 page sets out section by section.

Where this sits among the other rules a player meets is mapped on the PAGCOR regulations map for players. For what this site does with the data you give it, read its own privacy policy for visitors.