RapidPass.ph FAQs on Data Privacy

1. What personal information will be collected from me when I apply for RapidPass?

Personal information is defined under Philippine data privacy laws as any information through which the identity of an individual (a) is apparent, or (b) can be reasonably and directly ascertained by the individual or entity holding the information, or (c) would directly and certainly identify an individual when put together with other information. The personal information to be collected from you when you apply via RapidPass are the following:

  1. full name of applicant (for individual registration), full name of company personnel (for company registration);
  2. Authorized Person Outside of Residence (APOR) Type;
  3. plate number/conduction number of vehicle;
  4. contact information (email address, mobile number);
  5. workplace information (name of company, ID type, and ID number);
  6. address of origin and destination;
  7. government Identification Document (ID) Type: driver’s license, GSIS/SSS, UMID, PAG-IBIG, PhilHealth, Passport, Postal ID, PRC, PWD, Senior Citizen, TIN, Voter’s ID 
  8. Government ID  number;
  9. reason for getting RapidPass. 

For RapidPass Checkpoint app, the following information are being collected:

  1. Device’s International Mobile Equipment Identity (IMEI).
  2. Mobile Number of issued devices by DOST. 

In addition, Google Analytics automatically gathers the HTTP request of the user, browser/system information and first-party cookies.  See details of data collected by Google Analytics in this Google Analytics Guide

2. Why do you need this data from me?

We are collecting this information for the following purposes:

  1. To verify your identity and travel purpose when you apply for registration;
  2. To issue a valid QR code that is electronically tied to your personal information and that will facilitate your travel through checkpoints and quarantine areas;
  3. To ensure the accuracy and integrity of your records every time your RapidPass QR Code is scanned at a checkpoint;
  4. To facilitate communication with you; 
  5. To provide adequate security against fraud and abuse;
  6. To Measure website traffic and improve performance of the RapidPass Platform. 
  7. To improve and update the Platform and its Services; and 
  8. To provide safety and security, as  may be required by law or as may be necessary.
  9. To restrict the installation of Checkpoint Apps on specific devices issued by DOST, hence IMEI  is collected.

3. Who owns the data collected from the users of RapidPass?

DICT, as personal information controller, owns the data collected from you. However, this data will be deleted after the purpose for processing (i.e., facilitating travel during community quarantine) is fulfilled, and DICT may not process it further for a different purpose, unless it asks for and secures your consent.

For more information please see the response to “What will happen to RapidPass when the Community Quarantine is lifted?”, “What will happen to my personal data when the Community Quarantine is lifted and RapidPass is made open source?” and “What are my rights as data subject and how may I get in touch with you to exercise my rights as a data subject under the Data Privacy Act?”

4. Where and how will my data be stored? Are there any security measures (e.g., encryption protocols) in place for the storage or retention of my data?

Your data will be stored remotely and  encrypted at rest in SOC 1, SOC2, and SOC3, in an ISO 27001 certified data center (Microsoft Azure) accessible only to the developer, DevConnect Philippines Inc., or “DEVCON”. In addition, DEVCON servers will be under the continuous monitoring of the Department of Information and Communications Technology (DICT) and will be periodically subject to continuous Vulnerability Assessment and Penetration Testing (VAPT).

For more information on security measures implemented by RapidPass please read RapdiPass Data Privacy Policy. 

5. Who will be able to view, use, or access the personal information that I provide?

DEVCON, as a personal information processor, will be able to access, view, and use your data in the course of operating and maintaining the RapidPass platform for the duration of the Enhanced Community Quarantine. DICT, as a personal information controller, will also be able to access the data collected from you as stored in DEVCON’s database. Additionally, in the course of the rendition of services, your information may be shared to relevant government agencies assigned by IATF to approve the Authorized Persons Outside of Residence (APOR). These agencies are responsible for verifying, validating and approving which of the applicants will be given the RapidPass. 

The RapidPass system ensures that the data collected is subsequently anonymized for use. Upon scanning, personnel of the Philippine National Police (PNP),the Armed Forces of the Philippines (AFP), the Department of National Defense (DND), or the Department of Interior and Local Government (DILG) who are stationed at the checkpoint will only be able to view your Name,  QR Code, Control Number, and Plate Number/Conduction Sticker. 

Note that your personal identifiable information is only shared in cases where disclosure is mandatory under relevant laws or immediate medical attention is required or instances when you agree to such disclosure. We will never share, sell or otherwise disclose your personal information to third parties outside of those enumerated above, except in instances when you have given your consent to such transfer or disclosure.

6. Can PNP or AFP personnel collect additional information at the checkpoint to validate my RapidPass?

PNP, AFP, or DILG personnel may still require that you present valid ID/s for the purpose of verifying your identity. While RapidPass serves to facilitate passage through checkpoints, the stationed personnel have the discretion to rely on RapidPass alone or seek further verification.

7. Does having a valid RapidPass ID allow me to skip temperature checks at checkpoints?

No, you are still required to undergo a temperature check at the checkpoint.

8. What will happen to RapidPass Platform when the Community Quarantine is lifted?

DEVCON shall contribute RapidPass to the public domain via the Apache Software (ASF) open source license. This means that the code used to build the RapidPass platform — and not the personal data of its users — shall be made accessible to the public via the Internet. This means that anyone, even other government agencies in the Philippines or other developers and developer communities around the world, can emulate or build on what RapidPass has achieved.

9. What will happen to my personal data when the Community Quarantine is lifted and RapidPass is made open source?

DEVCON shall delete all users’ personal data collected and shared. DEVCON ensures that these are destroyed so as to prevent further processing by any other entity. No copies of your data shall be shared with the PNP, AFP, DND, and DILG, , any other government agency, and third-party service providers. The data privacy laws forbid other entities and even government agencies from using your data for any other purpose, without your consent.

10. Can the data I provide to RapidPass be used after the Community Quarantine, e.g. for law enforcement or any other purpose?

No, that is outside the scope of the purpose that you originally consented to.

11. Which entity handles and maintains the servers of RapidPass?

RapidPass servers are maintained by DEVCON, a non-profit organization, the developer of the RapidPass platform. 

For more information, please see the response to “Where and how will my data be stored? Are there any security measures (e.g., encryption protocols) in place for the storage or retention of my data?”

12. What are my rights as a data subject and how may I get in touch with you to exercise my rights as a data subject under the Data Privacy Act?

If you have any questions, concerns, or disputes regarding our Privacy Policy, or should you wish to get in touch with us to exercise your right to access your data, withdraw your consent to the collection and processing of your personal information, or to implement correction, modification, or erasure of your personal information, you may get in touch with us through the means provided below: 

DICT
information@dict.gov.ph
8-920-0101 local 1004
C.P Garcia Ave., Diliman, Quezon City, Philippines 1101

DCTx RapidPass.ph Team
[email protected]