Text
11 September 2017
Re: CONSENT
Dear [Redacted],
This pertains to your query received by the National Privacy Commission (NPC) on 24 August 2017 seeking clarification on the interpretation of consent in relation to as defined under the Data Privacy Act of 2012 (DPA).
Specifically, you sought to clarify whether the law requires consent to be written, as evidenced through electronic or recorded means, or consent can be in written form, electronic form, or recorded means.
We affirm the latter part of your statement expressing consent may be evidenced by written form, electronic form or recorded means.
The EU General Data Protection Regulation (GDPR) offers further interpretation on the concept of consent, to wit:
Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.1
As can be gleaned from the foregoing, it is clear that any of the (3) formats provided may be adopted by the personal information controller (PIC) to demonstrate that the data subject has consented to the processing his or her personal data.
Regarding consent through recorded means or consent given through a duly recorded oral statement, the PIC is also allowed to present any other types of evidence (i.e., object, documentary, electronic evidence) that may validate the existence and content of the said recording. Note that, pursuant to the Rules of Procedure of the Commission, the Rules of Court shall apply suppletorily whenever practicable and/or convenient, given the circumstances.2
As per the Rules of Court, objects, when proffered as evidence, are those addressed to the senses of the court. When an object is relevant to the fact in issue, it may be exhibited to, examined or viewed by a court.3 Documentary evidence, on the other hand, consists of writing or any material containing letters, words, numbers, figures, symbols or other modes of written expression offered as proof of their contents.4
There are also the Rules on Electronic Evidence which apply to electronic documents or electronic data messages offered or used in evidence.5 An electronic document refers to information or the representation of information, data, figures, symbols or other modes of written expression, described or however represented, by which a right is established or an obligation extinguished, or by which a fact may be proved and affirmed, which is received, recorded, transmitted, stored, processed, retrieved or produced electronically. It includes digitally signed documents and any print-out or output, readable by sight or other means, which accurately reflects the electronic data message or electronic document. The term “electronic document” may be used interchangeably with “electronic data message.”6
Audio, photographic and video evidence of events, acts or transactions are likewise admissible provided that they are shown, presented, or displayed to the court, and identified, explained or authenticated by the person who made the recording or by some other person competent to testify on the accuracy thereof.7 Subject to the same conditions, a recording of a telephone conversation or ephemeral electronic communication may also be admitted in court.8
For your information.
Very truly yours,
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
General Data Protection Regulation, Recital 32 ↩
-
NPC Circular 16-04 – Rules of Procedure dated December 15, 2016, §32 ↩
-
Rules of Court, Rule 130, §1 ↩
-
Id., §2 ↩
-
A.M. No. 01-7-01-SC - Rules on Electronic Evidence dated July 17, 2001, Rule 1, §1 ↩
-
Id., Rule 2, §1(h) ↩
-
Id., Rule 11, §1 ↩
-
Id., Rule 11, §2 ↩