Know Your Rights: Your Data Is Not Just Data

AI can read it, summarize it, analyze it, and sometimes get it wrong. But who gets to use your personal information—and what can you do about it?

Let's start with something ordinary.

You receive a document. Maybe it's your medical result. Maybe it's your résumé. Maybe it's a screenshot of a conversation, an employee list, your child's school record, or a customer database.

You want AI to help. So you upload it.

“Summarize this.” “Make this easier to understand.” “Find the problem.”

A few seconds later, you get an answer. Amazing. Convenient. Productive.

But there is a question almost nobody asks:

What exactly did I just give the AI?

And perhaps an even more important one:

Was I actually allowed to give it?

Welcome to the part of AI that isn't as fun as generating pictures of yourself as a superhero: Data privacy. And in the Philippines, this isn't simply a matter of being polite online—it is a matter of law.

🧠 AIWhyLive Explains — What Is Data Privacy?

In simple terms, data privacy is about having reasonable control over how information about you is collected, used, stored, shared, and processed.

The Philippines has the Data Privacy Act of 2012, Republic Act No. 10173, which protects the fundamental right to privacy while also recognizing the need for information to flow for innovation and growth.

The law isn't saying “Never collect data.” It recognizes that modern life needs data—hospitals, banks, schools, government agencies, and businesses all need information to function. Now, AI processes information too. The goal isn't to stop information from moving; the goal is to make sure it is handled properly.

You're Probably Already a Data Subject

The law uses a term you should know: Data subject. That's you.

Your name, address, contact details, location, and employment info are all personal information. But some information is even more sensitive:

Your health information
Your education records
Certain government-issued identifiers
Your genetic or sexual-life information

The Philippine privacy framework gives sensitive personal information additional protection because of the greater risks associated with its misuse. So that medical document you casually uploaded to an AI tool? That's not just “a PDF”—it contains sensitive personal information.

The Privacy Problem Nobody Thinks About

Here's a common workplace scenario: Someone has 500 customer records and wants AI to summarize them. So they upload the spreadsheet. Easy, fast, efficient.

But stop for a second. Who are those 500 people? Did they know their information would be processed by that AI system? Where is it going? Who can access it?

The Philippine Data Privacy Act requires personal information controllers to follow principles including transparency, legitimate purpose, proportionality, accuracy, and accountability. Just because technology makes something possible doesn't automatically make every use of the data appropriate.

“But I Gave My Consent”

Consent matters, but it isn't a magic word that makes every possible use of your information automatically acceptable. Philippine privacy rules recognize several lawful bases for processing, including contractual necessity, legal obligations, vital interests, and legitimate interests.

That's why “I clicked Agree” is not the entire privacy story. Privacy is about: What data? For what purpose? How is it processed? Who receives it? How long is it kept? What rights do I have?

Your Eight Rights Are Worth Knowing

The National Privacy Commission identifies key rights of data subjects under the Data Privacy Act:

Right to Be Informed: You have a right to know if your data is processed, why, how, and who receives it.
Right to Access: You can ask what specific personal information a company actually holds about you.
Right to Correct Your Data: Under the DPA, you can dispute inaccurate personal information. If an AI system relies on bad data, garbage in means garbage out.
Right to Object: You can object to certain processing based on consent, legitimate interest, profiling, or automated processing.
Right to Erasure or Blocking: You can ask for your personal info to be removed or restricted under applicable conditions.
Right to Data Portability: Your data isn't supposed to become permanently trapped inside someone else's system.
Right to File a Complaint: The National Privacy Commission (NPC) handles data protection concerns and complaints.
Right to Damages: The law recognizes a right to damages in appropriate circumstances when rights are violated.

Here's the AI Twist: When the AI Is Wrong About You

Imagine an AI system evaluates applicants or assesses risks based on personal data. If the underlying data is incorrect, the AI doesn't know that—it processes the bad information and produces a very confident, yet entirely wrong conclusion.

The NPC's Advisory No. 2024-04 addresses the application of the Data Privacy Act to AI systems. Privacy obligations don't disappear just because someone added the letters "AI" to a workflow. Accountability doesn't vanish just because processing was outsourced to a technology provider.

The Screenshot You Just Uploaded Might Be More Valuable Than You Think

When you screenshot a bank transaction, medical result, passport, or private conversation and drop it into an AI tool, you are technically processing personal information through another system.

Proportionality matters. If AI only needs the text of an email, don't upload a document containing your full name, home address, phone number, and ID numbers. Crop, redact, and give the AI the minimum necessary information.

🍗 Lechon Manok — “It's Just a Screenshot!”

Filipino internet culture has a dangerous sentence: “It's just a screenshot.”

No. That screenshot contains your name, phone number, medical history, account numbers, or private chats. And now you've uploaded it to an AI tool because you wanted to make a message sound more professional.

Congratulations. You just handed a very sophisticated system information you wouldn't casually hand to a stranger on a jeepney. The stranger might not care to read it—the AI definitely can.

🐘 Elephant in the Room — What If AI Goes Rogue?

Let's ask the question few people dare to ask: What if AI goes rogue?

Not movie-style killer robots. The realistic version is much more boring—and much more dangerous:

An AI system misunderstands instructions or accesses data it shouldn't.
It makes thousands of automated decisions before humans realize something is wrong.
It exposes sensitive personal records or creates false profiles at scale.

The answer isn't panic; it's building better boundaries. Organizations need accountability, permissions need limits, and important decisions require human oversight. A system doesn't have to hate you to harm you—it can simply misunderstand the objective.

👦 ELI12 — If You Wouldn't Shout It in Public, Think Before You Upload It

Imagine standing on a chair in a crowded mall and shouting your medical history or bank account number. You wouldn't do it.

Now imagine that same data sitting inside your phone. You see an AI button, and you tap upload. The phone makes privacy feel invisible, but the real-world consequences are entirely tangible.

The Most Important Privacy Question in the AI Era

Before you paste something into an AI tool, pause and ask yourself:

“If this information became public tomorrow, what would happen?”

If it could hurt someone, stop. Remove what isn't necessary, anonymize what you can, and understand the tool you are using.

Your data is not just data. It is part of your identity, your history, your health, and your life. Know your rights, check your permissions, and remember: Convenience is not the same thing as permission.

Enjoyed this breakdown? Follow for more practical, human-first insights at aiwhylive.com.