Atty. Maria Angela T. Mercado
In today’s digital age, social media has become an integral part of our daily lives. Our social media feeds now function as digital windows that enable us to showcase our, and peer into others’, curated lives.
Among other forms of social media content, vlogging has exploded in popularity. Short for “video blogging”, vlogging transforms everyday moments into content that is typically uploaded to public accounts across various platforms like YouTube, TikTok, X, Meta, and Instagram. From travel diaries to street interviews, the camera is almost always rolling.
But as vlogging continues to gain traction and mainstream adoption, so do issues over privacy, consent, and the ethical boundaries of filming in public spaces. Everyday scenes can easily feature unwitting bystanders, license plates, home addresses, other personal and private information, or sensitive conversations. These raise crucial questions about what vloggers can lawfully capture and post online.
To address these well-founded concerns, the National Privacy Commission (NPC) issued Circular No. 2025-01, or the “Guidelines on the Processing of Personal Data collected Using Body-Worn Cameras” (the “Circular”) on May 26, 2025. The Circular provides extensive guidelines on the processing of personal data collected using Body-Worn Cameras (BWCs) and Augmented Recording Devices (ARDs), such as mobile devices and portable cameras. While the Circular applies broadly, including law enforcement, security personnel, and other sectors that use BWCs and ARDs, it notably covers vloggers and content creators who use these devices in their video production.
When does the Circular apply?
The Circular applies to vloggers when BWCs or ARDs are used to capture content that includes personal data, and such content is uploaded, posted, published, or shared online. While the Circular does not expressly distinguish between public and private account settings, vloggers may still be subject to the guidelines regardless of their accounts’ privacy settings. This is because the Data Privacy Act (DPA) protects personal data from the moment it is recorded or stored, even if the content is only shared with a limited audience.
Under the Circular, a BWC refers to an electronic camera that is physically worn by a person, capable of recording, storing, and processing audio-visual footage. While commonly associated with law enforcement or security personnel, BWCs are also increasingly used in content creation and live vlogging. Meanwhile, an ARD pertains to a broader category of devices that includes any camera-equipped electronic device aside from a BWC that can record and process audio-visual content. These can be handheld, worn, or attached to a person, and include everyday gadgets like smartphones, digital cameras, GoPros, smartwatches, and even smart glasses.
On the other hand, the DPA defines personal information/data as any information from which the identity of an individual:
- Is apparent,
- Can be reasonably and directly ascertained by the entity holding the information, or
- When put together with other information would directly and certainly identify an individual.
What are the key obligations for vloggers under the Circular?
Under the Circular, vloggers and other individuals using BWCs or ARDs must adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality.
Transparency requires that data subjects, or individuals whose personal data are recorded or processed, be made aware that they are being recorded, why their data is being processed, and how they can exercise their rights. When vloggers film themselves in public or semi-public spaces, potentially capturing bystanders’ audio-visual information, they must ensure that data processing is fair, lawful, and respectful of individual rights. To this end, the Circular provides specific guidance to help vloggers comply:
- Where appropriate, like when interviewing or directly engaging with specific individuals, vloggers must provide adequate information before recording begins. They must notify the individuals that the footage may be uploaded, posted, published, or shared online, and inform them how they may exercise their rights under the DPA.
- Vloggers must also maintain a clear and accessible privacy notice on all their online platforms. This should include instructions on how data subjects may exercise their rights, including the right to object, the right to erasure, and the ability to request the takedown of specific posts.
- Where the technology is available, vloggers are expected to use tools that can mask or blur the images of bystanders, especially of children and other vulnerable individuals, to safeguard their privacy.
Meanwhile, legitimate purpose is satisfied when vloggers have a valid legal basis for processing personal data. In most cases, vloggers may rely on Section 12(f) of the DPA, but if sensitive personal information is captured, vloggers must meet the stricter requirements under Section 13 of the DPA, which generally require explicit consent or a specific legal exemption.
Lastly, proportionality requires vloggers to collect and use only the personal data necessary for their content. They must avoid excessive or intrusive footage, especially involving individuals who are not the intended subjects of the vlog.
Failure to abide by these requirements exposes erring vloggers to criminal, civil, and administrative liability under the DPA, its Implementing Rules and Regulations, and related NPC issuances. This includes potential fines, imprisonment, or sanctions, depending on the nature and gravity of the violation.
Conclusion
As the lines between content creation and personal privacy continue to blur, vloggers must ensure that they approach their craft creatively, carefully, and more importantly, lawfully. They must be reminded that with influence comes responsibility.
By adhering to the principles of transparency, legitimate purpose, and proportionality, vloggers can hit that sweet spot between storytelling and accountability. In an age where anyone can be caught on cam, responsibility rests with the person behind the lens.
Maria Angela T. Mercado is a Junior Associate and a member of the Firm’s Corporate and Mergers & Acquisitions (M&A), Technology, Media, and Telecommunications (TMT), Banking and Finance, Data Privacy, Cybersecurity and Artificial Intelligence (AI), and Environment, Social, and Governance (ESG) Departments. Angela handles corporate and regulatory compliance and advisory matters for clients in the fintech, venture capital, emerging technology, and other highly regulated industries. Angela also has experience in various data privacy compliance work for multinational companies, conglomerates, and start-ups.
