Biometrics Consent Form (Philippines)

A Biometrics Consent Form in the Philippines evidences that consent has been freely given, identifying exactly what has been agreed to and by whom.

The Philippine Identification System Act (RA 11055, signed August 6, 2018) authorizes the Philippine Statistics Authority (PSA) to collect biometric data (fingerprints, iris scan, front-facing photograph) from all Filipino citizens and resident aliens for enrollment in the Philippine Identification System (PhilSys). The PSA's collection of biometric data under PhilSys is based on statutory authority, not individual consent. However, private employers, healthcare providers, schools, banks, and technology companies collecting biometric data for their own systems — time and attendance, logical access control, customer identity verification, medical diagnosis — must comply with RA 10173's consent requirements because their biometric collection is not authorized by a specific statute equivalent to RA 11055.

Under Section 12 of RA 10173, the processing of personal information is permitted only if not otherwise prohibited by law and the data subject has given consent or another lawful basis applies. Section 13 of RA 10173 imposes a stricter standard for sensitive personal information (which includes biometric data): processing is allowed only when the data subject has given explicit consent. The NPC has emphasized in multiple advisory opinions that biometric data deserves heightened protection because a breach can cause irreversible harm — unlike a compromised password, a compromised fingerprint template cannot be reset. Organizations failing to obtain valid consent before collecting biometric data face penalties under Section 26 of RA 10173, including criminal prosecution with imprisonment from 3 to 6 years and fines from PHP 500,000 to PHP 4,000,000. The Bangko Sentral ng Pilipinas (BSP), through Circular No. 1149 (2022), and the Securities and Exchange Commission (SEC) have also issued supplementary guidance on biometric data use in financial services and corporate governance contexts.

The NPC Circular No 16-01 mandates registration of data processing systems with the National Privacy Commission before commencing biometric collection from 1,000 or more data subjects. The Philippine Statistics Authority (PSA) under Republic Act 11055 (Philippine Identification System Act) administers the national PhilSys biometric enrollment program separately from private-sector biometric systems, which remain fully subject to RA 10173 consent requirements enforced by the NPC through its Complaints and Investigation Division.

A Biometrics Consent Form is needed in the Philippines whenever a private organization — as opposed to a government agency exercising statutory authority — proposes to enroll, collect, or process an individual's biometric data. Specific situations requiring a biometrics consent form include:

Workplace biometric attendance systems: Philippine employers commonly deploy fingerprint or facial recognition scanners for time and attendance under DOLE Labor Advisory No. 06-2020 on payment of wages. The National Privacy Commission (NPC) confirmed in Advisory Opinion 2018-016 that employee consent under RA 10173 is required before enrolling employees in such systems, even where the employer has a legitimate operational purpose.

Building access control: Office buildings, condominiums registered with DHSUD, and gated subdivisions governed by homeowners associations under RA 9904 that use fingerprint or iris scanners to control physical entry must obtain a Biometrics Consent Form from each enrolled individual prior to enrollment.

Banking and financial services KYC: Banks and e-money issuers supervised by the Bangko Sentral ng Pilipinas (BSP) use biometric facial recognition for digital onboarding under BSP Circular No. 1149 (2022). Individual consent under RA 10173 is still required for the biometric component of the Know-Your-Customer (KYC) verification process.

School and university systems: Student attendance and campus security systems require biometrics consent from the student and — for minors under 18 — the parent or guardian must countersign the consent form under RA 10173.

Healthcare and hospital systems: Hospitals and diagnostic centers using fingerprint enrollment for patient identity management and electronic health records access must obtain a Biometrics Consent Form from each patient, separate from the general hospital admission consent.

Fintech and e-commerce identity verification: Platforms collecting facial recognition data for liveness detection in selfie-based identity verification must obtain explicit biometric consent under Section 13(a) of RA 10173 before capturing and processing facial recognition templates. Failure to do so exposes organizations to NPC enforcement proceedings and potential criminal liability under Section 26 of RA 10173.

Government agencies collecting biometric data under statutory authority — such as the Department of Foreign Affairs (DFA) for passport biometrics, the Philippine National Police (PNP) for firearms licensing under RA 10591, and the Bureau of Immigration for alien registration — operate under specific statutory exemptions but must still comply with the proportionality and security requirements of RA 10173 and NPC Circular No 16-03 on personal data breach notification.

A Philippine Biometrics Consent Form must contain specific components to satisfy Republic Act 10173 and National Privacy Commission requirements for valid biometric data processing consent.

Organization identity: State the full legal name of the personal information controller, its NPC Certificate of Registration number under NPC Circular No 16-01 (mandatory for organizations processing sensitive personal information on a significant scale), principal office address, and the name, designation, and contact information of the registered Data Protection Officer (DPO) required under Section 21 of Republic Act 10173.

Description of biometric data: Specify precisely which types of biometric data will be collected — fingerprints (all ten, specific fingers, or index only), facial recognition templates processed by algorithms under ISO/IEC 19794 standards, iris scan images, voice recordings — using technical precision to enable the data subject to understand exactly what is being captured and stored.

Purpose and legal basis: State the specific purpose of biometric processing — such as employee time and attendance tracking under DOLE Labor Advisory No 06-2020 on payment of wages, or customer identity verification for Know-Your-Customer compliance under BSP Circular No 1149 (2022) — and confirm that consent under Section 13(a) of Republic Act 10173 is the legal basis, or cite the applicable statutory exception under Section 13(b) through 13(f).

Technology and security: Describe the biometric system vendor and equipment (ZKTeco, Suprema, or Innovatrics biometric terminal), whether raw biometric images or only encrypted mathematical templates are stored, the encryption standard used (at minimum AES-256 for stored biometric templates), whether biometric data will be stored on-device, on a local server, or in a cloud service, and the technical controls preventing unauthorized access consistent with NPC Advisory Opinion 2018-016.

Retention and deletion: State the period for which biometric data will be retained after the end of the employment, membership, or customer relationship. NPC Circular No 16-01 recommends deletion within 30 days of relationship termination for most biometric systems. The secure deletion method should be cryptographic erasure or physical destruction of storage media per NPC security guidelines under Section 20 of Republic Act 10173.

Data sharing: Identify any third parties receiving biometric data — including the biometric system vendor cloud platform, parent companies, payroll processors, and building management system operators — and the countries to which data may be transferred, triggering cross-border transfer safeguards under Section 21 of Republic Act 10173 and NPC Circular No 17-01 on cross-border data flows.

Data subject rights: Advise the individual of their rights under Sections 16 through 18 of Republic Act 10173 — the right to be informed, right to object, right to access, right to erasure — noting that objection or erasure may affect their ability to use the biometric-based service. The National Privacy Commission (NPC) enforces these rights through its Complaints and Investigation Division under RA 10173 Section 7.

Signature block: Capture the full name, signature, and date, and — for minors under 18 — the parent or guardian countersignature and relationship. The forms-legal.com Biometrics Consent Form (Philippines) template incorporates all NPC-required consent elements under the Data Privacy Act 2012, NPC Circular No 16-01 registration requirements, and NPC Circular No 16-03 breach notification obligations enforced by the National Privacy Commission of the Philippines. Philippine employers and organizations subject to NPC Circular No 16-01 registration obligations must implement a Privacy Management Program and appoint a Data Protection Officer before deploying any biometric attendance or access control system under Republic Act 10173.