Section 20 deals with the security of personal information that should be implemented through reasonable and appropriate organizational, physical and technical measures. Section 21 mandates that the information controller is accountable for any transfer of personal information and Section 22 attaches this responsibility and accountability to the heads of agencies in the government. The agency cannot just use any standard recognized by the ICT industry–it must, in fact, be recommended by the NPC. If it was given after March 2016 or none at all, then Bautista has an escape route. However, such measure failed because the standard recognized by the ICT industry was not recommended by the NPC!

Source: Manila Times January 13, 2017 15:43 UTC