Text
16 November 2017
Re: PLDT’S PRIVACY POLICY
Dear [Redacted],
This pertains to your request for advisory opinion received by the National Privacy Commission (NPC) on 21 August 2017, which sought to clarify whether the privacy policy of PLDT complies with Republic Act No. 10173,1 also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR)2 and relevant issuances.
In your letter-request, you have provided a portion of PLDT’s privacy policy, which also appears on their website:
PLDT GROUP PRIVACY STATEMENT
When we disclose personal information
There are a variety of circumstances where we may need to disclose or share some of the information that you have provided to us. In these cases, we ensure that your personal information is disclosed on a confidential basis, and always subject to the applicable rules and regulations of the Data Privacy Act.
We will never share, rent or sell your personal information to third parties outside of the PLDT Group of Companies except in special circumstances where you may have given your specific consent for, and as noted in this policy.
In some instances, we may be required to disclose your personal information to our agents, subsidiaries, affiliates, partners and other third party agencies as part of our regular business operations and for the provision of our products and services. This means we might share your information with:
- Our partner companies, organizations, or agencies including their sub-contractors or prospective business partners that act as our service providers, contractors, professional advisers who help us provide our products and services. For example: our couriers for bill delivery and our customer contact centers for our pre- and post-sales hotline operations;
- PLDT Group Companies, Subsidiaries, and Affiliates;
- Subject to applicable laws and regulations, law enforcement and government agencies; and
- Other companies whom you have also given consent to share your information.
Discussion
You have inquired on whether the provision above is acceptable, considering that PLDT gives no other option but to accept all, thereby constituting as a blanket authority to share client information with sister companies when you do not want to allow such sharing of information.
Please note that the privacy policy you included in your inquiry is the privacy statement of the PLDT Group of Companies. It serves as public information and data subject notification on their approach to privacy, their practices in relation to the personal data handled, and general information on their processing activities.3
The privacy policy is not equivalent to the individual consent that PLDT will obtain or have obtained from each and every client, subscriber or customer, for them to be able to process their personal information. The privacy statement published on their website does not, in any manner, amount to a blanket authority to use client data and share with other members of the group of companies, subsidiaries, affiliates, partners and third-party agencies.
While the privacy policy is acceptable, this is addressed to data subjects who are willing to provide them information.4 The privacy statement targets not just current clients but prospective customers as well, who are amendable with their privacy approach.5
In order for PLDT to validly process your personal data, the processing must adhere to the legitimate purpose principle. This means that the client is informed of the processing activities and that they have validly consented to such processing. There are of course instances where consent of client will not be necessary. For instance, if the processing is necessary to the fulfillment of the contract with the client, or when the processing is required by law. On the other hand, where processing is for purpose of data sharing with sister companies, subsidiaries or affiliates, consent of the client or the data subject should be obtained.
In the event that you, as a client of PLDT, is deprived of the liberty to exercise your rights as data subject,6 including the right to object to unauthorized processing, then you may validly raise your concern with PLDT’s Data Protection Officer. Should they fail to address your concerns, these concerns may then be raised with the National Privacy Commission.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
AN ACT PROTECTING INDIVIDUAL PERSONAL INFORMATION IN INFORMATION AND COMMUNICATIONS SYSTEMS IN THE GOVERNMENT AND THE PRIVATE SECTOR, CREATING FOR THIS PURPOSE A NATIONAL PRIVACY COMMISSION, AND FOR OTHER PURPOSES, “Data Privacy Act of 2012” (15 August 2012). ↩
-
Implementing Rules and Regulations of the Data Privacy Act (24 August 2016). ↩
-
Office of the Privacy Commissioner for Personal Data, Hong Kong: Guidance Note-Guidance on Preparing Personal Information Collection Statement and Privacy Policy Statement, available at https://www.pcpd.org.hk/english/publications/files/GN_picspps_e.pdf ↩
-
Id. ↩
-
Id. ↩