PrivacyCheck: Automated Data Privacy Act audits for local government websites and forms

Problem Statement

LGUs collect more personal data online every year through ayuda registrations, scholarship applications, business permit portals, vaccination and health forms, and job fairs. Many of these run on Google Forms, outdated CMS sites, or vendor-built apps. Under the Data Privacy Act of 2012 (RA 10173) and National Privacy Commission (NPC) rules, LGUs must appoint a Data Protection Officer, post privacy notices, collect only necessary data, secure their systems, and report breaches. Most LGU DPOs are staff with other jobs and no technical training. Common problems include forms with no privacy notice, forms that ask for unnecessary sensitive information (religion, full medical history, ID photos), pages without HTTPS, and exposed spreadsheets. Several government data leaks have made headlines, and these hurt public trust in digital government.

Proposed Solution

PrivacyCheck LGU is a web app where a DPO enters the LGU’s domains and form links. It runs only non-intrusive, passive checks on public pages; it does not hack or penetration-test:

• Crawling and form discovery: finds pages and forms (including Google Forms and Microsoft Forms) that collect personal data.
• Privacy notice analysis: an LLM reads each notice and checks it against DPA and NPC requirements (purpose, legal basis, retention, data subject rights, DPO contact).
• Over-collection detection: an LLM classifies each form field (e.g., “Religion,” “Blood type,” “Mother’s maiden name”) and compares it with the form’s stated purpose, flagging fields that look unnecessary or sensitive.
• Security hygiene: HTTPS/TLS, security headers, exposed directories, public spreadsheet links, outdated CMS versions, and third-party trackers.

The output is a scored dashboard, plain-language fixes (“Alisin ang ‘Religion’ sa scholarship form; hindi ito kailangan sa layunin”), auto-generated privacy notice templates in Filipino and English, and a downloadable report formatted for NPC compliance documentation.

Target Market

• Primary users: LGU Data Protection Officers and IT/ICT offices in provinces, cities, and municipalities (about 1,700 LGUs), plus over 42,000 barangays that increasingly use online forms.
• B2G buyers: DILG (for LGU compliance programs), DICT, the NPC (for sector-wide compliance monitoring), SUCs, and public hospitals.
• B2B: Schools, clinics, cooperatives, and SMEs with the same DPA obligations. It can also be offered as a white-label tool for privacy consultants.

How AI Is Used

• LLM compliance reasoning: Reads unstructured privacy notices in English, Filipino, or mixed language and maps them to DPA and NPC requirements. Regex can’t tell whether a notice actually explains the purpose and retention period.
• Field classification and purpose-matching: Decides whether “Mother’s maiden name” is needed for a basketball league sign-up. This requires understanding context, which fixed lists can’t do.
• Remediation generation: Writes tailored fix steps and privacy notice drafts that a non-technical DPO can use right away.
• Vision model (optional): Reads screenshots and scanned PDF forms posted on Facebook pages, which are common in LGUs.
• Risk prioritization: Combines findings into a risk score so DPOs with limited time fix the most important things first.

PLDT / Smart / ePLDT / Rokid Angle

• ePLDT: A natural fit with ePLDT’s cybersecurity and managed security services. PrivacyCheck can be the entry-level product that leads to SOC monitoring, secure hosting, and data center migration for LGUs.
• PLDT Enterprise: Bundle it with LGU connectivity and cloud deals as a “Digital Governance Compliance” package and use it as a door-opener for B2G sales.
• Smart: Send an SMS alert to the DPO when a new form without a privacy notice appears or when an SSL certificate is about to expire.
• Rokid: Low relevance. Not core to this idea.

Demo Scenario (3 minutes for judges)

1. Show a realistic mock LGU website the team built (“Bayan ng San Isidro”), with a scholarship Google Form asking for religion, a full medical history, and a photo of the parents’ IDs, and no privacy notice.
2. Enter the domain in PrivacyCheck LGU. Live crawl progress shows 12 pages and 3 forms found.
3. Results: a compliance score of 42/100. Red flags include “No privacy notice on Scholarship Form,” “Over-collection: Religion, Medical History not needed for stated purpose,” “Contact page served over HTTP,” and “Public Google Sheet link detected.”
4. Click Fix. It generates a Filipino/English privacy notice tailored to the scholarship form and a trimmed field list.
5. Export the NPC-ready PDF report. Then re-scan the fixed mock site and the score jumps to 88/100.
6. Close with: “Every LGU has a DPO on paper. PrivacyCheck gives them a tool to do the job.”

30-Hour Build Plan

Suggested stack: Python (Playwright/Scrapy crawler), FastAPI, Gemini or other LLM, Mozilla Observatory-style header checks, React dashboard, WeasyPrint for PDF reports. Public data / APIs: Data Privacy Act (RA 10173) and its IRR, NPC circulars and advisories (privacy.gov.ph), the NPC privacy notice guidance, OWASP security header guidelines, public LGU websites (passive read only), and DICT cybersecurity guidelines.

Risks & Privacy Notes

• Legal and ethical scanning: Do only passive checks on public pages. Get written authorization from the LGU before scanning, and never attempt logins or exploits. This complies with the Cybercrime Prevention Act (RA 10175).
• LLM misjudgment: Present results as recommendations, not legal opinions. The DPO makes the final decision, and each finding links to the relevant DPA or NPC provision.
• Data Privacy Act 2012: The tool never submits forms or collects the personal data that users entered. If it finds an exposed spreadsheet, it records only the URL and that it is exposed, not the contents.
• Clause 24 / competition rules: The demo uses a mock LGU site the team built. No real personal or confidential data goes into AI tools.
• Coverage limits: Can’t audit backend databases or internal apps. This is stated clearly in the report.

AI Use Disclosure (draft)

PrivacyCheck LGU uses an LLM (e.g., Google Gemini) to evaluate privacy notices, classify form fields, assess whether data collection is proportionate to the stated purpose, and draft remediation text and privacy notices. AI coding assistants helped scaffold the crawler and dashboard. The DPA/NPC checklist, scoring weights, and mock LGU site were designed by the team, and all generated recommendations were reviewed by team members against the actual law and NPC guidance.

Rubric Scoring