ONCE upon a time, there was a princess who grew up not knowing she was one. Her mother died soon after she was born and her father married a woman with two stepdaughters, who took turns ordering the princess around until she was nothing more than a slave. They called her Cinderella, because she was so busy with work that she had little time to look after herself, and was always grimy with the kitchen soot.
One day there was a ball held to introduce to the Prince the eligible women in the Kingdom so that he could choose who among them to marry. Cinderella's stepsisters mocked and taunted her for wanting to go to the ball too, and in the end, locked her up in her room. Cinderella's fairy godmother freed her, dressed her up in a stunning gown, and turned a mouse and a pumpkin into a coachman and a coach to take her to the ball, and home.
The Prince fell in love with her but she disappeared after the last dance, leaving no trace except for one glass shoe. So the Prince went from house to house, asking every woman to fit the shoe, saying he would marry whomever the shoe fits.
When he came to Cinderella's house the stepsisters tried it on and when it didn't fit, said there was no other maiden in the house. They had locked Cinderella in her room. But Cinderella managed to escape just as the Prince was about to leave.
"I'd like to try it on," she said. The shoe fit.
Just as the Prince realized that the grimy Cinderella in front of him was the dazzling Princess he had danced with, Cinderella's stepmother said, "You can't do that. That's a violation of the Data Privacy Law, for you took her personal data without my consent. As her stepmother and her guardian, I own her data."
"But it's about me; it's my personal data," Cinderella said. "I should own it."
The Data Privacy Law talks about the rights of Data Subjects to access their data, to modify and even have it deleted. In the case of a minor, who has the right to exercise the rights of the data subject? What if the minor disagrees with the guardian? Can the guardian insist on the modification, deletion, or blocking of a minor's personal data without consent from the data subject herself?
But did the Prince collect personal data from Cinderella? It was her glass shoe, that she left behind and which he took, that was used to identify her. Is shoe size "personal information"?
I would argue that in this case, it is. The Data Privacy Act of 2012 defines personal information as "any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information or when put together with other information would directly and certainly identify an individual." The Prince used Cinderella's shoe size -- actually, her shoe -- to identify her.
Under the Data Privacy Act, data subjects are the people from whom the personal data-personal and sensitive personal information-are collected. The law does not say who has the right to exercise the data subject's rights -- the right to correct, make a copy of, and object to processing, among others -- when a minor disagrees with the guardian. Under Philippine civil laws, minors have limited rights, but the law also provides that whatever decision is made should be in the interest of the minor. In this case, if Cinderella were minor, would it be in her interest to marry the Prince, or not? This is a theoretical situation, and there are no right or wrong answers. It will depend on how one will argue one's position and the laws on which those arguments will be based.
***
Dana Batnag heads the policy and risk management section in the data privacy office of a private company. She may be contacted at yourdataprotectionofficer@protonmail.com.