Text
03 October 2017
Re: CONSENT IN CUSTOMER SERVICE HOTLINE
Dear [Redacted],
This pertains to your query received by the National Privacy Commission (NPC) on 11 August 2017 regarding consent of the data subject. Specifically, you are asking on consent given by a customer calling a service hotline, where it is proposed that a service hotline provider will state the following: “by calling us and having us update your information, this means that you are agreeing to our privacy policy which can be found in <>.”
Consent
Under Section 3(b) of the Data Privacy Act of 2012 (DPA), and Section 3(d) of its Implementing Rules and Regulations (IRR), consent is defined as follows:
Consent of the data subject refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so.1
From the definition provided above, it is clear that consent must be evidenced by written, electronic, or recorded means.2 Any of the three (3) formats provided may be adopted by a personal information controller (PIC) relative to the collection and processing of personal data. Nonetheless, it is worth emphasizing that, regardless of the format of the consent given by the data subject, it must be freely given, specific, and informed.3
In line with the foregoing discussion, implied, implicit or negative consent is not recognized under the law.
Privacy Policy/Privacy Notice
To clarify, a privacy notice is a “statement made to a data subject that describes how the organization collects, uses, retains and discloses personal information. A privacy notice is sometimes referred to as a privacy statement, a fair processing statement or sometimes a privacy policy.”4 Note that a privacy notice or privacy policy is not equivalent to consent. This would suffice if the processing being done are those where consent is not necessary.
Note that aside from consent, there are other criteria for lawful processing of personal data pursuant to Sections 12 and 13 of the DPA, where processing may be authorized without consent. For example, when processing of personal information is necessary/related to the fulfillment of a contract, necessary for compliance with a legal obligation, processing is provided for by existing laws and regulations, necessary to protect the life and health of the data subject or another person, among others.
Where a customer calls a service hotline to update his information, processing of personal data is limited to said purpose, i.e. for the PIC to update his information. Reference to the privacy notice is allowed, but this will not be equivalent to consent.
If the PIC would require the consent of the customer for other purposes, the customer would have to provide his express consent thereto – saying on record that he agrees, ticking a box in an online form, or submitting a signed form.
For your reference.
Very truly yours,
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman