Flashcards Studio

Scenario: A city government, CityConnect, runs a digital residents portal that collects names, residential addresses, contact details, utility usage data, and geolocation from residents who sign up for public services. It contracts a private analytics firm to build models for optimizing service delivery and to tailor public information campaigns. CityConnect discloses these personal data to the analytics firm without informing data subjects or obtaining consent, asserting a public-interest basis for the processing. A data subject, Renaldo Tan, requests access to all personal data CityConnect holds about him and asks that an inaccurate home address be corrected. CityConnect responds by providing only a subset of the data and redacting certain fields, arguing some data are exempt from access and that sharing with the vendor is permissible under public-interest or legitimate-interests grounds. (a) Identify the data subject rights implicated by CityConnect’s actions and the governing rule under the Data Privacy Act; (b) Explain whether CityConnect’s disclosure and partial data provision comply with RA 10173, focusing on consent or lawful basis for processing and the data subject’s access and correction rights; (c) If Renaldo files a complaint with the National Privacy Commission, what remedies and penalties may be available and what evidence would support his claim.