Philippines: Data Sovereignty Concerns Escalate Over Cross-Border Access to Government Databases (May 2026)

A civic organization advocating for Philippine data sovereignty, Flag Maharlika, has formally asked the National Privacy Commission (NPC) to investigate the Land Transportation Office (LTO) over alleged data privacy and national security risks involving its driver's license system.

The complaint centers on Dermalog, a foreign technology provider previously contracted by the LTO. According to the group's letter to NPC Commissioner Johann Carlos Barcena:

"The LTO's own Management Information Division reportedly concluded in a 2020 report that Dermalog had 'access and control' over the modules. The same report allegedly warned that the situation posed a potential national security threat because driver's license cards could be printed beyond the direct control of the Philippine government."

The group also raised concerns that "certain system functions allegedly required assistance from personnel based outside the Philippines, raising questions regarding cross-border access to sensitive personal information of Filipino motorists."

The LTO database contains highly sensitive information including names, addresses, photographs, biometric identifiers, signatures, government-issued identification numbers, and driver's license classifications. Under the Data Privacy Act, government agencies acting as personal information controllers must implement organizational, physical, and technical safeguards to protect personal information from unauthorized access, disclosure, misuse, or transfer.

Flag Maharlika has requested that the NPC: (1) require public disclosure of entities with administrative access to driver's license systems; (2) determine whether cross-border processing or foreign access to Filipino motorists' personal information occurred; and (3) recommend administrative or criminal action if violations are established.

This case signals growing civil society scrutiny of cross-border data access in government IT systems and may shape the NPC's approach to data sovereignty enforcement. The LTO and Dermalog had not issued statements at the time of reporting.