Practice question
A controller outsources lawful processing of ordinary customer information to a service provider. It claims the contract transfers every privacy responsibility away from the controller, so it need not ensure confidentiality safeguards or prevention of unauthorized use. Which response follows Section 14?
- Outsourcing automatically repeals all privacy duties.
- Only the data subjects, never controllers or processors, have obligations.
- The controller remains responsible for ensuring the required safeguards and compliance, and the processor must also comply with the Act and applicable laws.
- A contract makes unauthorized use lawful by definition.
- The controller may require the processor to ignore every statutory rule.
Legal references
- Republic Act No. 10173, Sections 3(b), 3(j), 11, 12, 13 and 14: https://lawphil.net/statutes/repacts/ra2012/ra_10173_2012.html
Answer this question in flashcards to review your response and continue practicing.