Text
29 August 2017
Re: CONSENT OF OLD EMPLOYEES
Dear [Redacted],
This is with regard to your query received by the National Privacy Commission (NPC) on 10 August 2017 regarding consent under the Data Privacy Act of 2012 (DPA). Specifically, you are inquiring whether old employees need to sign a consent form, if it could be implied that they have given their consent at the time of their employment since all personal information given will be used for human resources, marketing, and government requirements.
Under Section 3(b) of the Data Privacy Act of 2012 (DPA) and Section 3(d) of its Implementing Rules and Regulations (IRR), consent of the data subject refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. It shall be evidenced by written, electronic or recorded means. As such, implied, implicit or negative consent is not recognized under the law.
As a rule, the processing of personal information is PERMITTED under the DPA when at least one of the conditions provided under Section 12 of the DPA is present:
(a) The data subject has given his or her consent;
(b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract;
(c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;
(d) The processing is necessary to protect vitally important interests of the data subject, including life and health;
(e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or
(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.
As to sensitive personal information, the processing thereof is PROHIBITED, except for any of the following cases under Section 13 of the DPA:
(a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing;
(b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;
(c) The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing;
(d) The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, That such processing is only confined and related to the bona fide members of these organizations or their associations: Provided, further, That the sensitive personal information are not transferred to third parties: Provided, finally, That consent of the data subject was obtained prior to processing;
(e) The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured; or
(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.
In the case of an employer, as a personal information controller (PIC), the processing of personal information of its employees is allowed when it is necessary and in relation to the fulfillment of an employer-employee contract. Processing may also be done for purposes of the legitimate interests pursued by the employer. Lastly, the processing is allowed when it is necessary for compliance with a legal obligation to which the employer is subject such as when required under labor laws and regulations. In the abovementioned cases, consent of the employees to the processing need not be obtained.
However, with regard to processing of sensitive personal information, consent of employees is required unless processing falls under any of the other instances provided in Section 13.
When personal data of employees is used for marketing purposes, consent is required as this is neither necessary nor related to an employer-employee contract. If consent cannot be obtained, the employer should avoid using personal information for marketing purposes.
As to personal data needed for government requirements, this falls under the special cases where the DPA is not applicable on certain specified information, i.e. information necessary in order to carry out the functions of public authority.
Hence, the processing of the employees’ personal data in compliance with labor and tax laws, among others, are actually outside of the scope of the DPA, to the minimum extent necessary to achieve the specific purpose, function, or activity of the public authority.
For your reference.
Very truly yours,
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman