Flashcards Studio

An agency named the National Data Privacy Authority (NDPA) issues Administrative Regulation NDPA-AR-2026-12, "Standards for Data Encryption and Access Controls in Private Sector Data Centers." The regulation imposes: (i) mandatory encryption of data at rest and in transit; (ii) quarterly security audits by NDPA; (iii) data retention for eight years; (iv) penalties for noncompliance; and (v) a requirement that covered entities publish annual compliance reports on their websites and submit copies to NDPA. Publication appeared only on the NDPA’s website and via an internal memo to affected entities; there was no publication in the Official Gazette or in a newspaper of general circulation. No public hearing or notice was given before adoption. The enabling statute authorizes NDPA to "prescribe rules and regulations to ensure data privacy and security" but is silent on publication and hearing requirements. A data-center operator challenges the regulation on two grounds: (a) ultra vires for exceeding the statute; (b) invalid for lack of proper publication and due process. (a) Identify the requisites for validity of quasi-legislative rules. (b) Apply these requisites to NDPA-AR-2026-12 and decide whether it is valid; explain which requisites are met or lacking and why. (c) If invalid, describe the remedy and whether severability may save any portions.