Text
29 August 2017
Re: USE OF POP-UPS FOR INFORMATION ON THE USE OF COOKIES
Dear [Redacted],
This has reference to your inquiry to the National Privacy Commission (NPC) received on 4 August 2017, via AskPriva. You specifically asked if information about the use of cookies in pop-ups format is still required by the Data Privacy Act (DPA) of 2012 even if it is already stated in the privacy policy.
While the inclusion of privacy policy is necessary to demonstrate adherence to the data privacy principle of transparency and uphold the right to information of the data subjects, the law does not provide for a specific format or approach for the personal information controller (PIC) or personal information processor (PIP) to adopt on how this should be properly manifested.
Instead, the law sets out a general principle, under Section 18(a) of the Implementing Rules and Regulations (IRR) of the DPA (2012), to wit:
“Section 18. Principles of Transparency, Legitimate Purpose and Proportionality. The processing of personal data shall be allowed subject to adherence to the principles of transparency, legitimate purpose, and proportionality.
a) Transparency. The data subject must be aware of the nature, purpose, and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of personal information controller, his or her rights as a data subject, and how these can be exercised. Any information and communication relating to the processing of personal data should be easy to access and understand, using clear and plain language.”
From the foregoing guidelines, it is upon the discretion of the PIC or PIP if such incorporation of additional means of informing the data subjects through pop-ups in the website, would still be beneficial in complying with the DPA, and upholding data subjects’ rights. We only wish to emphasize that the statement of the privacy policy should be adequate, accessible, and comprehensible.
Furthermore, it is our belief that each PIC and PIP are in the best position to determine the best mechanism to show their adherence to the principle of transparency given their unique circumstances.
This being said, the use of pop-ups, while not required, may serve as notice to data subjects that is immediately accessible. In using pop-ups, the PIC or PIP must also be mindful of user experience, and how pop-ups should not detract from the functional use of the website.
For your reference.
Very truly yours,
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman