ReSA – THE REVIEW SCHOOL OF ACCOUNTANCY
E-COMMERCE, DATA PRIVACY & EASE OF DOING BUSINESS RFBT-15
15. Where is the place of receipt of electronic data messages or electronic documents if the addressee has no place of business?
A. Place which has the closest relationship to the underlying transaction
B. Principal place of business
C. Habitual residence
D. Place where the server is located
16. Which government agency is empowered to promulgate rules and regulations for the implementation of the Electronic
Commerce Act?
A. Department of Trade and Industry (DTI)
B. Department of Transportation and Communication (DOTC)
C. Department of Information and Communications Technology (DICT)
D. Supreme Court (SC)
17. First Statement: Where the requires that any action referred to contract of carriage of goods be carried out in writing or by
using a paper document, that requirement is met if the action is carried out by using one or more electronic data messages
or electronic documents.
Second Statement: The "usual place of residence" in relation to a body corporate, means the place where it is incorporated
or otherwise legally constituted.
A. Only the first statement is true.
B. Only the second statement is true.
C. Both of the statements are true.
D. None of the statements is true.
18. On March 1, 2019, Donald, through a text message, offered to sell his land to Hillary for P10,000. Hillary accepted Donald’s
offer by sending an email to Donald on March 2, 2019, which Donald was able to read on March 3, 2019. On March 4, 2019,
wondering if Donald received her email, Hillary sent a text message to Donald signifying once again her acceptance of
Donald’s offer, to which Donald immediately replied, “K”. Is there an enforceable contract of sale?
A. Yes, because the offer and the acceptance in electronic form satisfy the requirement that a sale of land be in writing.
B. Yes, because a contract of sale of land is enforceable whether executed in writing or not.
C. No, the offer and the acceptance were not reduced into writing.
D. No, there was no valid contract at all.
19. On March 1, 2019, Donald, through a text message, offered to sell his land to Hillary for P10,000. Hillary accepted Donald’s
offer by sending an email to Donald on March 2, 2019, which Donald was able to read on March 3, 2019. On March 4,
2019, wondering if Donald received her email, Hillary sent a text message to Donald signifying once again her acceptance
of Donald’s offer, to which a recipient (Donald’s wife) immediately replied, “Sorry, but Donald just died a few hours ago”.
Is there a perfected contract of sale?
A. No, because Hillary’s acceptance was not made in a text message.
B. No, because Donald has already died and can no longer perform any contractual obligation.
C. Yes, because the knowledge of Donald’s wife of Hillary’s acceptance through a text message on March 4, 2019 perfects
the contract since she is a legal heir of Donald.
D. Yes, because the email Hillary sent on March 2, 2019 signifying her acceptance was read by Donald on March 3, 2019.
20. On March 1, 2019, Donald, through a text message, offered to sell his land to Hillary for P10,000. Hillary accepted Donald’s
offer by sending an email to Donald on March 2, 2019, which Donald was able to read on March 3, 2019. On March 4,
2019, wondering if Donald received her email, Hillary sent a text message to Donald signifying once again her acceptance
of Donald’s offer, to which Donald immediately replied, “K”. When was the contract of sale of land perfected?
A. March 1, 2019 C. March 3, 2019
B. March 2, 2019 D. March 4, 2019
1 A 6 B 11 D 16 A
2 B 7 A 12 A 17 C
3 C 8 D 13 A 18 A
4 D 9 B 14 A 19 D
5 A 10 C 15 C 20 C
DATA PRIVACY ACT
1. It refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent
or can be reasonably and directly ascertained by the entity holding the information, or when put together with other
information would directly and certainly identify an individual.
A. Data subject
B. Personal information
C. Privileged information
D. Sensitive personal information
2. It refers to any and all forms of data which under the Rules of Court and other pertinent laws constitute privileged
communication.
A. Data subject
B. Personal information
C. Privileged information
D. Sensitive personal information
3. First Statement: DPA applies to the processing of all types of personal information and to any natural and juridical person
involved in personal information processing including those personal information controllers and processors who, although
not found or established in the Philippines, use equipment that are located in the Philippines, or those who maintain an
office, branch or agency in the Philippines, except when DPA is not applicable, subject to the requirements of extraterritorial
application.
Second Statement: The Data Privacy Act is applicable to Information about any individual who is or was an officer or
employee of a government institution that relates to the position or functions of the individual.
A. Only the first statement is true.
B. Only the second statement is true.
C. Both of the statements are true.
D. None of the statements is true.
ReSA – THE REVIEW SCHOOL OF ACCOUNTANCY
E-COMMERCE, DATA PRIVACY & EASE OF DOING BUSINESS RFBT-15
4. Which information is/are not covered by the Data Privacy Act?
A. About an individual who is or was performing service under contract for a government institution that relates to the
services performed
B. Relating to any discretionary benefit of a financial nature such as the granting of a license or permit given by the
government to an individual
C. Processed for journalistic, artistic, literary or research purposes
D. All of the above
5. Which information is/are not covered by the Data Privacy Act?
A. Necessary in order to carry out the functions of public authority
B. Necessary for banks and other financial institutions under the jurisdiction of the independent, central monetary
authority or Bangko Sentral ng Pilipinas to comply with RA 9510, and RA 9160, as amended
C. Originally collected from residents of foreign jurisdictions in accordance with the laws of those foreign jurisdictions,
D. All of the above
6. First Statement: The Data Privacy Act did not amend or repeal the provisions of RA 53, which affords the publishers,
editors or duly accredited reporters of any newspaper, magazine or periodical of general circulation protection from being
compelled to reveal the source of any news report or information appearing in said publication which was related in any
confidence to such publisher, editor, or reporter.
Second Statement: The Data Privacy Act applies to an act done or practice engaged within the Philippines by an entity
only and does not apply to those done and engaged outside of the Philippines.
A. Only the first statement is true.
B. Only the second statement is true.
C. Both of the statements are true.
D. None of the statements is true.
7. Which of the following is/are the functions of the National Privacy Commission?
A. Ensure compliance of personal information controllers with the DPA
B. Issue cease and desist orders, impose a temporary or permanent ban on the processing of personal information,
upon finding that the processing will be detrimental to national security and public interest
C. Compel or petition any entity, government agency or instrumentality to abide by its orders or take action on a
matter affecting data privacy
D. All of the above
8. First Statement: The National Privacy Commission shall ensure at all times the confidentiality of any personal information
that comes to its knowledge and possession.
Second Statement: The National Privacy Commission is attached to the Department of Information and Communications
Technology (DICT).
A. Only the first statement is true.
B. Only the second statement is true.
C. Both of the statements are true.
D. None of the statements is true.
9. Who heads the National Privacy Commission?
A. Privacy Chairman
B. Privacy Commissioner
C. Privacy President
D. Privacy Head
10. What are the two responsibilities of the Deputy Privacy Commissioners?
A. Data Processing Systems and Policies and Planning
B. Data Collection Systems and Policies and Planning
C. Data Processing Systems and Finance
D. Data Privacy Systems and Policies and Performance
19. Who appoints the officers of the National Privacy Commission?
A. DICT Secretary
B. President
C. Executive Secretary
D. DTI Secretary
20. How long is the term of a Privacy Commissioner?
A. 1 year
B. 2 years
C. 3 years
D. 5 years
21. What is/are the qualifications of a Privacy Commissioner?
A. At least 36 years of age
B. Of good moral character, unquestionable integrity, and known probity
C. A recognized expert in the field of information technology only
D. All of the above
22. A Deputy Privacy Commissioner shall enjoy the benefits, privileges, and emoluments equivalent to the rank of:
A. Secretary
B. Undersecretary
C. Assistant Secretary
23. The processing of personal information adheres to which principle/s?
A. Transparency
B. Legitimate purpose
C. Proportionality
D. All of the above
24. Who must ensure implementation of personal information principles set out in the Data Privacy Act?
A. Personal information controller
B. Personal information processor
C. Privacy Commissioner
D. Deputy Privacy Commissioner
ReSA – THE REVIEW SCHOOL OF ACCOUNTANCY
E-COMMERCE, DATA PRIVACY & EASE OF DOING BUSINESS RFBT-15
25. When is processing of personal information lawful?
A. Data subject gave his or her consent
B. When necessary or related to the fulfillment of a contract with the data subject or in order to take steps at the request
of the data subject prior to entering into a contract
C. When necessary for compliance with a legal obligation to which the personal information controller is subject
D. All of the above
26. When is processing of personal information lawful?
A. When necessary to protect the life and health of the data subject or another person, even when the data subject is
legally or physically able to express his or her consent prior to the processing
B. When necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment
institution, and an adequate level of protection of personal information is ensured
C. When not necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings,
or the establishment, exercise or defense of legal claims, or when provided to government or public authority
D. None of the above
27. First Statement: A personal information controller may subcontract the processing of personal information.
Second Statement: Personal information controllers may invoke the principle of privileged communication over privileged
information that they lawfully control or process.
A. Only the first statement is true.
B. Only the second statement is true.
C. Both of the statements are true.
D. None of the statements is true.
28. First Statement: The lawful heirs and assigns of the data subject may invoke the rights of the data subject for, which
he or she is an heir or assignee at any time after the death of the data subject or when the data subject is incapacitated
or incapable of exercising the rights of the data subject.
Second Statement: The rules on rights, its transmissibility, and portability are not applicable if the processed personal
information are used only for the needs of scientific and statistical research and, on the basis of such, no activities are
carried out and no decisions are taken regarding the data subject.
A. Only the first statement is true. C. Both of the statements are true.
B. Only the second statement is true. D. None of the statements is true.
29. In case of privacy breach, who is mandated to notify the National Privacy Commission?
A. Personal information controller C. President
B. Personal information processor D. Independent auditor
30. Except as may be allowed through guidelines to be issued by the National Privacy Commission, no employee of the
government shall have access to sensitive personal information on government property or through online facilities
unless the employee has received a security clearance from the __ of the source agency.
A. Personal information controller C. Head
B. Personal information processor D. Lawyer
31. In the case of any request submitted to the head of an agency, such head of the agency shall approve or disapprove
the request __ after the date of submission of the request.
A. One calendar day C. One business day
B. Two calendar days D. Two business days
1
32. In entering into any contract that may involve accessing or requiring sensitive personal information from __, an agency
shall require a contractor and its employees to register their personal information processing system with the National
Privacy Commission in accordance with the DPA and to comply with the other provisions of the DPA including the
immediately preceding section, in the same manner as agencies and government employees comply with such
requirements.
A. 100 or more individuals C. 1,000 or more individuals
B. 500 or more individuals D. 5,000 or more individuals
33. If the offender is a corporation, partnership or any juridical person, the penalty shall be imposed upon the __.
A. Directors C. Incorporators
B. Responsible officers D. Stockholders/Partners
34. First Statement: If the offender under DPA is a juridical person, the court may suspend or revoke any of its rights under
the DPA.
Second Statement: If the offender under DPA is an alien, he or she shall, in addition to the penalties herein prescribed,
be deported without further proceedings after serving the penalties prescribed.
A. Only the first statement is true. C. Both of the statements are true.
B. Only the second statement is true. D. None of the statements is true.
35. The __ penalty in the scale of penalties respectively provided for the preceding offenses shall be imposed when the
personal information of at least __ persons is harmed, affected or involved as the result of the punishable actions.
A. Maximum; 100 C. Minimum; 100
B. Maximum; 1,000 D. Minimum; 1,000
36. When the offender or the person responsible for the offense under DPA is a public officer as defined in the Administrative Code
of the Philippines in the exercise of his or her duties, an accessory penalty consisting in the disqualification to occupy public
office for a term __ the term of criminal penalty imposed shall he applied.
A. Same as C. Triple
B. Double D. Quadruple
37. Restitution for any aggrieved party under DPA shall be governed by the provisions of the __.
A. Code of Commerce C. 1987 Philippine Constitution
B. Data Privacy Act D. New Civil Code
38. The act of processing sensitive personal information for unauthorized purposes is punishable by:
A. 1.5 to 5 years of imprisonment and fine 500,000 to 1,000,000
B. 2 to 7 years of imprisonment and fine 500,000 to 1,000,000
C. 1.5 to 5 years of imprisonment and fine500,000 to 2,000,000
D. 2 to 7 years of imprisonment and fine 500,000 to 2,000,000
