Text
14 August 2017
Re: REQUEST FOR ADVISORY OPINION ON THE VALIDITY OF
AN IMPLIED FORM OF CONSENT
Dear [Redacted],
This pertains to your request for advisory opinion dated 20 July 2017, which sought to clarify whether an implied consent is considered valid under Republic Act No. 101731, also known as the Data Privacy Act of 2012 (DPA).
Both the DPA (Section 3(b)) and the Implementing Rules and Regulations of the DPA (Section 3(c)) define consent of the data subject as:
“Consent of the data subject” refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of his or her personal, sensitive personal, or privileged information. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of a data subject by a lawful representative or an agent specifically authorized by the data subject to do so.
Based on the provision above, it is evident that the consent contemplated by the law is an express consent wherein the data subject voluntarily assents to the collection and processing of personal information, rather than an implied or inferred consent resulting from the data subject’s inaction or continued use or availment of services offered by a particular entity. In your letter-request, you mentioned and cited a privacy policy/notice which states:
“By continuing to avail of XXX XXX XXX products and services:
- You explicitly authorize XXX XXX XXX, its employees, duly authorized representatives, related companies and third-party service providers, to use, process and share Personal Data needed in the administration of your XXX XXX XXX;
- You consent to XXX XXX XXX using your contact details, demographic information and accounting details to contact you with marketing or promotional information regarding financial products and studies/surveys to be conducted by XXX XXX XXX via phone calls, mail, email, SMS or any type of electronic facility; and,
- You consent to XXX XXX XXX using your Personal Data for purposes of providing services to you or for other reasonable purposes which are related to the services it provides or improvements/upgrades in its systems and business processes, including but not limited to data analytics and automated processing.
Please take the time to read our Privacy Policy Statement available at this link HERE to know more about.
- The purposes for collecting and processing Personal Data;
- The parties with whom XXX XXX XXX may disclose and share your Personal Data;
- The risks of processing and data security measures in place to protect you against these risks;
- Your rights as data subjects, i.e., your right to be informed, to object, access, correct or block your Personal Data, right to data portability, right to file a complaint and right to damages; and,
- How long your information will be processed and retained.
You can visit or click the Philippines link at the bottom of the web page for more information. [URL link provided].
This authorization and consent are as valid as a signed document and will continue to have effect throughout the duration of your coverage under your policy/plan, or existence of your account(s), and/or until expiration of the retention limit set by laws and regulations from account disclosure, and the period set until destruction or disposal of records, unless withdrawn in writing or withheld due to changes in the information supplied by the Company.”
The privacy policy above of the particular company unequivocally demonstrates an implied consent from its clients or data subjects in general.
The NPC would like to reiterate that implied or inferred consent is not recognized in this jurisdiction. The entity, as personal information controller or personal information processor must never assume the data subject’s consent for any activity involving his or her personal information, most especially, sensitive personal information, unless circumstances permit the processing of personal or sensitive personal information without consent, pursuant to the DPA and the IRR. In cases where consent is not required, a privacy notice would be sufficient.
Also, the definition of consent indicates three requirements, namely: freely given, specific, informed indication of will. The first requirement – freely given, is absent, considering that the data subject did not do any overt act of giving its consent. The second and third requirements – specific and informed indication of will, are likewise lacking due to the blanket statements used by the entity in authorizing the related companies and third-party service providers to use, process and share the personal data under the custody of the particular entity, the use of personal data without indicating the exact purpose/s, the retention period of personal data and mode and means of destruction of data.
Considering that the approval of the data subject is implied, there lacks any evidence of such approval by written, electronic or recorded means, which is required by law.
We likewise refer to Recital 32 of the REGULATION (EU) 2016/679 or the General Data Protection Regulation (GDPR) for additional guidance on consent:
“Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.”
As to your proposed approach in securing consent from your existing and future/new subscribers, the NPC deems the proposed time or period when consent will be secured for both the PostPaid and Prepaid subscribers to be in line with the principles laid down by the law and the IRR – prior to the collection or as soon as practicable and reasonable.2
Indeed, for new Postpaid Subscribers, the personal information controller must secure the express consent of the subscriber at the point of application, while for existing Postpaid Subscribers, by sending them an updated privacy policy and consent form.
In the event that existing subscribers fail to respond and give their consent, you can only continue providing services that are directly related to the subscription contract, and not for further processing for any other reason not clearly specified in the original subscription contract.
On the other hand, for Prepaid Subscribers, the prepaid number will only be associated and linked to the exact individual subscriber upon activation and use of specific products or services, thus, consent must be obtained as a consequence of the activation or subscription and further transactions that involve personal data of subscribers.
For your reference.
Very truly yours,
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
AN ACT PROTECTING INDIVIDUAL PERSONAL INFORMATION IN INFORMATION AND COMMUNICATIONS SYSTEMS IN THE GOVERNMENT AND THE PRIVATE SECTOR, CREATING FOR THIS PURPOSE A NATIONAL PRIVACY COMMISSION, AND FOR OTHER PURPOSES, “Data Privacy Act of 2012” (15 August 2012). ↩
-
Implementing Rules and Regulations of the Data Privacy Act, §21(a). ↩