Next CSE-PPT: 14 March 2027 · Professional & Subprofessional
Civil Service Exam reviewer on the Data Privacy Act, data subject rights, breach notification, the Cybercrime Prevention Act, the E-Commerce Act, SIM registration, anti-scam laws and safe online practices.
Government offices hold large amounts of personal information, from birth records to tax files, and more services now run online. The Data Privacy Act of 2012 sets the rules for collecting and protecting personal data, while laws such as the Cybercrime Prevention Act, the E-Commerce Act and newer anti-scam laws govern online activity.
This set covers the main rules and terms, the rights of data subjects, and practical situations a public servant may face, such as handling a data breach or spotting a phishing message.
Correct answer: C. Personal information controller
The personal information controller decides what data to collect and how to use it. A processor handles the data on the controller's behalf, and the data subject is the person whose information is processed.
Read detailsCorrect answer: A. A person's health records
Sensitive personal information includes health, education, genetic or sexual life, race, ethnic origin, marital status, age, religious or political affiliations, records of offences, and government-issued identifiers such as SSS numbers and tax returns.
Read detailsCorrect answer: D. Profitability
The processing of personal information must follow the principles of transparency, legitimate purpose and proportionality. Data should be collected for a declared, lawful purpose and should be limited to what is necessary for that purpose.
Read detailsCorrect answer: B. Data portability
Data subjects have rights to be informed, to access, to object, to erasure or blocking, to rectification, to data portability, to damages and to file a complaint. Data portability lets people take their data with them in a usable format.
Read detailsCorrect answer: C. 72 hours
NPC rules require notification within seventy-two hours upon knowledge of, or reasonable belief that, a personal data breach requiring notification has occurred. Prompt notice lets people protect themselves from misuse of their data.
Read detailsCorrect answer: B. Report the incident to its data protection officer so the breach can be assessed and handled, including any required notifications
Accidental disclosure is still a personal data breach. The office should report it to its data protection officer, contain it (for example by asking the recipient to delete the file), assess the risk and, where required, notify the NPC and the affected persons within the required period.
Read detailsCorrect answer: C. 10175
RA 10175 defines and punishes cybercrimes such as illegal access, data interference, computer-related fraud and identity theft, and content-related offences such as cyber libel. It also created the Cybercrime Investigation and Coordinating Center.
Read detailsCorrect answer: D. The original author of the libellous post
The Court upheld cyber libel as constitutional only for the original author of the libellous content, and struck down the provision punishing aiding or abetting cyber libel as applied to those who merely react to, like or share it. It also struck down the takedown clause.
Read detailsCorrect answer: A. One degree higher than that provided by the law
Section 6 of RA 10175 imposes a penalty one degree higher than that provided by the Revised Penal Code or special law when the crime is committed by, through and with the use of information and communications technologies.
Read detailsCorrect answer: A. Computer-related identity theft
RA 10175 punishes computer-related identity theft: the intentional acquisition, use, misuse, transfer, possession, alteration or deletion of identifying information belonging to another, without right. Cyber-squatting refers to acquiring a domain name in bad faith.
Read detailsCorrect answer: B. Electronic Commerce Act of 2000 (RA 8792)
RA 8792 states that information shall not be denied legal effect solely because it is in electronic form, and that electronic signatures are equivalent to handwritten signatures when the law's requirements are met.
Read detailsCorrect answer: D. 11934 (2022)
RA 11934 requires users to register their SIMs with public telecommunication entities using valid IDs. It aims to deter the use of anonymous SIMs in scams and other crimes, and requires the registration data to be kept confidential.
Read detailsCorrect answer: B. Acting as a "money mule" by letting one's bank or e-wallet account be used to receive or move scam proceeds
RA 12010, the AFASA, punishes money muling, social engineering schemes such as phishing to obtain account details, and economic sabotage involving financial accounts. It also gives the BSP power to investigate such cases.
Read detailsCorrect answer: C. Taking or sharing photos or videos of a person's private area or sexual act without consent
RA 9995 punishes capturing images or videos of a person's private area or sexual act under circumstances where the person has a reasonable expectation of privacy, and copying, selling or sharing such material, even if the person consented to the recording but not its sharing.
Read detailsCorrect answer: C. E-Commerce Bureau under the Department of Trade and Industry
RA 11967 regulates online businesses, digital platforms and e-marketplaces, and created the E-Commerce Bureau under the DTI to protect consumers and handle complaints about internet transactions.
Read detailsCorrect answer: A. Phishing, and you should not click the link or share the OTP
Banks do not ask clients to share OTPs or passwords through links. Messages creating urgency and asking for credentials are typical phishing. Contact your bank through its official hotline, and report the message to the proper authorities.
Read detailsCorrect answer: A. Using a strong, unique password together with multi-factor authentication
Strong, unique passwords and multi-factor authentication make account takeover much harder. Reusing or sharing passwords means one leak can expose many accounts, and shared access also makes it impossible to tell who did what.
Read detailsCorrect answer: D. Data protection officer
The NPC requires controllers and processors to designate a data protection officer, who monitors compliance, handles data subject requests and breach incidents, and serves as the contact person for the NPC.
Read detailsCorrect answer: D. Freely given, specific and informed, evidenced by written, electronic or recorded means
Consent under RA 10173 is a freely given, specific, informed indication of will, evidenced by written, electronic or recorded means. Consent is one lawful basis; government agencies may also process data when required by law or to fulfil their mandate.
Read detailsCorrect answer: B. Department of Information and Communications Technology
The CICC coordinates the prevention and suppression of cybercrime and formulates the national cybersecurity plan. It is attached to the DICT. Cybercrime cases are investigated by units such as the PNP Anti-Cybercrime Group and the NBI Cybercrime Division.
Read details