Philippine Travel FeesIndependent fee guide
Menu

New and proposed fees

Traveller data, privacy law and the CAISS proposal

Last checked 19 October 2026 · 9 official or direct sources

The public CAISS project memorandum describes a centralized system holding passenger, passport, travel, biometric, watchlist and risk data for the Bureau of Immigration 4. It requires government ownership of national watchlists and compliance with government cybersecurity and data-protection rules 4. The public document does not name a final production data-centre location or publish a signed data-processing agreement. Philippine law still requires lawful purpose, proportionality, security, data-subject rights and contractor accountability 1,23. BI says privacy safeguards remain under review 7.
Core law
Republic Act 10173, the Data Privacy Act of 2012 1
Regulator
National Privacy Commission 1
Core principles
Transparency, legitimate purpose and proportionality 1,2
CAISS data
Passenger, travel-document, biometric, watchlist and risk data 4
Minimum live access in project specification
Five years, subject to BI or government policy 4
Minimum backup period in project specification
Ten years, subject to BI or government policy 4
Current status
Privacy and cybersecurity safeguards remain part of BI review 7

What data CAISS proposes to process

The BI project memorandum calls for advance passenger information and passenger name records from carriers. Those records can include identity, passport, itinerary, seat, baggage and booking data. The platform would connect them to entry and exit events and immigration processing 4.

The specification calls for facial and fingerprint biometrics, identity matching, national and international watchlists, traveller profiles, risk scores and secondary-screening results. It seeks identity continuity across repeat trips and changes in travel documents 4.

The proposed background-data function includes facial similarity searches across a very large index of public images from websites, social media, news, registries and other public sources. The instructions for system demonstrations warn that open-source results may be incomplete or inaccurate 4,5.

What Philippine privacy law requires

Republic Act 10173 applies to government and private-sector processing of personal information. It requires transparency, a legitimate purpose and proportionality. Data must be adequate and relevant, but not excessive, and retained only as long as needed for the stated purpose or another lawful basis 1.

Sensitive personal information has extra protection. The law places responsibility on the head of a government agency for security and makes a government contractor handling sensitive records subject to the Act. Outsourcing work does not remove the government's legal duties 1,2.

The current NPC security circular applies to both personal information controllers and processors. It calls for a registered data-protection officer, registered processing systems, privacy impact assessment, a privacy-management program, access controls, training and business-continuity measures 3.

Your rights as a data subject

The Data Privacy Act and its rules give a data subject rights to be informed, object, access information, correct inaccurate data, and seek blocking or erasure when legal conditions are met. The rules require notice about what data is collected, why it is processed, how it is processed and who may receive it 1,2.

Some rights can operate differently when government processes data for a statutory law-enforcement or regulatory function. That does not cancel the general duties of lawful processing, security and accountability 1,2.

A traveller who believes personal data was processed unlawfully may file a complaint with the National Privacy Commission. The NPC can investigate compliance and issue orders under the Act and its rules 1,2.

Safeguards stated in the project documents

The CAISS memorandum says integrations must use strong authentication, authorization, encryption, audit logs and secure interfaces. It requires the communications network to meet government cybersecurity and data-protection requirements 4.

The document requires role-based access for watchlist administration and government ownership and control of national watchlist content. It calls for access controls in data centres, control rooms and server rooms, plus logs that can support security investigations 4.

The same memorandum sets at least five years of live access to core system records and at least ten years of backups, subject to a different BI or government policy. Those proposed periods are technical requirements in a procurement document. A final privacy notice should state the lawful retention schedule for each data type 4,1.

Storage location and outside access

The public memorandum refers to national and site-level data-centre facilities, centralized records and secure links between border points. It does not identify a final production hosting address, name every operator with access or publish a signed cross-border transfer rule 4.

The document states that data from the proposed digital travel credential would be transmitted to government for eligibility and risk checks. It says the traveller application must display terms of use and privacy policies 4.

A public claim that all data will stay at a named place needs a final contract, system design or official privacy notice that says so. Those documents are not part of the cited public record. The exact production storage map, subcontractor list and access matrix are not confirmed here.

Concerns and the government's response

House Resolution 1064 asks for an inquiry into CAISS data-privacy and national-security risks, private participation in border functions and the proposed user fee. The resolution remains pending with the House Committee on Justice. Its questions are not findings that a breach or violation occurred 6.

BI said on 2 June 2026 that its review would test the adequacy of privacy and cybersecurity safeguards, transparency and accountability. On 24 September, Commissioner Viado said CAISS still had no final decision and could be revised, deferred or not pursued 7,8.

The project documents record planned controls. The House resolution records formal concerns. BI's open review means neither the safeguards nor the concerns should be presented as a settled final outcome.

What happens after a serious data breach

NPC guidance says mandatory notification can apply when sensitive data or identity-fraud information is acquired by an unauthorized person and the incident creates a real risk of serious harm. Biometric data and identity-document copies are among the examples 9.

When mandatory notification applies, the controller must notify the NPC and affected people within 72 hours after knowledge or reasonable belief that the breach occurred. The notice must explain the nature of the incident, affected data, measures taken and help available to the person 9,2.

The duty remains with the personal information controller even when a processor or contractor handles the system. Contracts, monitoring and incident plans must support that accountability before a border platform goes live 2,3.

Common questions

Would CAISS collect biometrics?

Yes. The project specification includes facial and fingerprint biometrics, identity matching and traveller risk assessment 4.

Does the public record confirm the exact data-centre address?

No. It refers to national and site-level facilities but does not publish a final production hosting map 4.

Would a private contractor be outside Philippine privacy law?

No. The Act and its rules impose duties on contractors and processors, and the government controller keeps accountability 1,23.

Can CAISS use public social-media images?

The specification calls for searches of public sources including social media. Its test rules warn that results can be incomplete or inaccurate 4,5.

Has the National Privacy Commission approved the final CAISS design?

No final NPC approval is identified in the cited public record. BI says privacy safeguards remain part of its continuing review 7,8.

When must a serious breach be reported?

NPC guidance requires notice within 72 hours when the legal conditions for mandatory notification are met 9.

Fees change. Check your e-ticket's tax lines and the official site before you travel. Spotted an error? Email [email protected] with the official link.

Evidence

Sources

9 links
  1. 1National Privacy Commission: Republic Act 10173, Data Privacy Act of 2012 (accessed 19 October 2026)
  2. 2National Privacy Commission: Implementing Rules and Regulations of the Data Privacy Act (accessed 19 October 2026)
  3. 3National Privacy Commission: NPC Circular 2023-06, Security of Personal Data (1 December 2023)
  4. 4Bureau of Immigration: CAISS Project Information Memorandum (27 February 2026)
  5. 5Bureau of Immigration: Instructions to Challengers for CAISS (27 February 2026)
  6. 6House of Representatives: House Resolution 1064 status and title (accessed 19 October 2026)
  7. 7Bureau of Immigration: Border system modernization project still under review and consultation (2 June 2026)
  8. 8Bureau of Immigration: Viado says CAISS still under evaluation, no final decision yet (24 September 2026)
  9. 9National Privacy Commission: Breach Reporting guidance (accessed 19 October 2026)

Related