NPC Issuance Wiki

NPC Advisory Opinion No. 2017-050 — Consent in an Employment Contract

Issued Advisory Opinion

Text

29 August 2017

Re: CONSENT IN AN EMPLOYMENT CONTRACT

Dear [Redacted],

This pertains to your query received by the National Privacy Commission (NPC) on 02 August 2017 regarding consent of the data subject. Specifically, you are asking on consent given by an employee in relation to contract for employment.

At the outset, please note that the giving of consent does not amount to waiver of your rights under the Data Privacy Act of 2012 (DPA). It only means that you agree to the collection and processing of your personal information.

Under Section 3(b) of the DPA, and Section 3(d) of its Implementing Rules and Regulations (IRR), consent of the data subject refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. As such, when you give your consent to the processing it will not necessarily bar you from exercising your rights as a data subject under the DPA.

With regard to the phrase “but not limited to,” its inclusion in the employment contract does not mean that such stipulations amount to blanket consent. An elementary rule in statutory construction provides that when general words accompany an enumeration of particular cases, such words only apply to cases of the same kind as those expressly mentioned.1 For instance, “work-related requirements” in the employment contract should refer to those having the same purposes as those enumerated, i.e., it should be work-related. It does not amount to you consenting to the use of your personal information for any and all purposes.

The employment contract that is the subject of your inquiry is reasonable and acceptable under the DPA. The law provides for instances when processing of personal and sensitive personal information, which may include collection, use, disclosure, and outsourcing thereof, is permitted under the law.2 Consent of the data subject to the processing is only one of the instances.

A Personal Information Controller (PIC), such as your employer, can also process personal information when it is necessary and is related to the fulfillment of a contract with the data subject,3 such as a contract for employment. This would include computation and payment of salaries and other benefits, determination of career movements, facilitation of work-related requirements, and outsourcing of human resource management functions.

Another instance is when the processing of personal information is necessary for compliance with a legal obligation to which the personal information controller is subject4 and when processing is provided for by existing laws and regulations.5 This would include compliance with statutory and regulatory requirements of national government agencies, to which your employer is subject to.

In fact, consent in the abovementioned instances may not even required by the DPA, since the processing would fall under another criteria for lawful processing.

Note also the special cases where the DPA is not applicable on certain specified information, i.e. information necessary in order to carry out the functions of public authority. Hence, the processing of your personal data as an employee in compliance with labor and tax laws are actually outside of the scope of the DPA, to the minimum extent necessary to achieve the specific purpose, function, or activity of the public authority.

For your reference.

Very truly yours,

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. City of Manila v. Entote, G.R. No. L-24776, June 28, 1974 ↩

  2. See: RA No. 10173, §12 and 13 ↩

  3. RA No. 10173, §12(b) ↩

  4. Id., §12(c) ↩

  5. Id., §13(b) ↩

Backlinks