Know the law before you post

If you want to post images, audio and videos of other people, you need to read the law on data privacy first.

The National Privacy Commission (NPC) recently came out with a circular for bodyworn cameras which also affects vloggers and, actually, anyone else who uploads photos and videos on social media.

NPC Circular 2025-01, dated May 26, 2025, applies to personal information controllers and processors (PICs) and (PIPs) who use bodyworn cameras (BWCs) and Alternative Recording Devices (ARDs). Once the jargon has been decoded, however, it appears the circular applies to anyone using recording devices to take videos and then upload those videos on the internet.

By definition, an ARD is any electronic device capable of recording images, audio, or video,  and which may be worn, held, or attached to a person. The NPC notes in the circular that “this includes, but is not limited to, digital cameras, mobile phones, action cameras, smart watches or smart eyeglasses, and other similar devices.”

Since the law considers an individual a PIC if he or she processes personal information independently, the circular may also apply to individuals using mobile phones to record pictures, voices, or videos, with some exemptions.

Processing for “purely personal, family, or household affairs” is exempted under the law; the circular defines these to be “uses that are not intended for profit or commercial gain and where footages are not uploaded, posted, published or otherwise shared online.”

But how does one know when the recording is exempt?

The NPC said the following factors may be considered: the personal data was disseminated to an indefinite number of people; the processing may have an adverse impact on the rights and freedoms of the data subjects; and the processor had no personal, family, or household relationship with the data subjects.

This implies that taking pictures, audio and videos of strangers, even in public places, now requires the one making the recording to ask consent from those strangers, especially if the recording might put the data subjects in a compromising situation.

Section 3 (B) of the circular specifically mentions vloggers, and requires them to inform their data subjects, prior to recording, that the footage will be shared online and how they may exercise their rights as data subjects. Vloggers are also required to mask images of bystanders in their footages.

Section 3 (C), however, states that when other people process personal data “for purposes other than law enforcement, police operations, or security,” they shall be “subject to the same requirements on having a lawful basis for processing, adherence to the general principles of privacy, implanting safeguards, and upholding data subject rights.”

This means that even when someone does not think of him or herself as a vlogger, if the recordings made were not for purposes of law enforcement, police operations, or security, then the one who took the images, audio, or videos must keep the personal data safe, inform data subjects of their rights, and follow data privacy principles.

Otherwise what? “The processing of personal data in violation of this Circular shall carry criminal, civil, and administrative liability pursuant to the provisions of the [Data Privacy Act], its [Implementing Rules and Regulations], and related issuances of the NPC,” the Circular says.

In short: one can still take pictures, but not upload it on social media. If you’re going to upload it on the world wide web, it’s safer to get consent from those whose pictures you’re taking. Consent has to be documented, so you better make sure you have proof that consent was given; it has to be informed, so you have to tell what you’re doing and why, and what their rights are as data subjects.

In other words, if you want to post about other people, read the data privacy law first.