Text
18 April 2018
Re: PRIVACY POLICY AND CONSENT OF DATA SUBJECTS
Dear [Redacted],
This refers to your inquiry received by the National Privacy Commission (NPC) via email. You sought for clarification on the compliance of an insurance company with the requirements of Republic Act No. 10173,1 otherwise known as the Data Privacy Act of 2012 (DPA) and its Implementing Rules and Regulation (IRR), in relation to a privacy policy submitted by the said insurance company pursuant to the requirement under Insurance Commission (IC) Circular Letter (CL) No. 2014-47 - Guidelines on Electronic Commerce of Insurance Products. A copy of the privacy policy is attached herewith as Annex “A.”
We understand that upon evaluation conducted by the IC Regulation Enforcement and Prosecution Division and Information Systems Division, the submitted privacy policy of that insurance company is not compliant with the DPA for the reason being that the company shall be disclosing personal information of their customers to third party entities without the required customers prior written approval.
In addition, you mentioned that since this transaction is done electronically, and the customer will just click the agree/disagree portion provided for in the online transaction, you ask if this is considered compliant with the DPA.
Discussion
Privacy Policy vs. Consent
At the outset, it must be clarified that the submitted “privacy policy” should be referred to as the company’s privacy notice. A privacy notice is a statement made to a data subject that describes how the organization collects, uses, retains and discloses personal information.1 A privacy notice is sometimes referred to as a privacy statement, a fair processing statement or sometimes a privacy policy.2
Having stated that, there is also a need to determine and clarify the distinction between privacy policy and securing the consent of the data subject for the processing of his or her personal information.
Being a mere notice, it is emphasized that the privacy policy or notice is not equivalent to consent. This document is an embodiment of the observance of the data privacy principle of transparency and upholding the right to information of data subjects.
The principle of transparency adhered to by the DPA dictates that the data subject must be aware of the nature, purpose, and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of personal information controller, his or her rights as a data subject, and how these can be exercised.3 Any information and communication relating to the processing of personal data should be easy to access and understand, using clear and plain language.4
Thus, in line with the right to information of the data subject, personal information controllers (PICs) are required to apprise the data subject of the following:
- Description of the personal data to be processed; 2. Purposes for processing, including: direct marketing, profiling, or historical, statistical or scientific purpose; 3. Basis of processing (legal or statutory mandate, contract, etc.) 4. Scope and method of processing; 5. Recipient/classes of recipients to whom the personal data are or may be disclosed; 6. Identity and contact details of the Personal Information Controller; 7. Retention period; and 8. Existence of rights as data subjects.
On the other hand, obtaining consent from the data subject for the purposes of processing his or her personal data is a different requirement altogether.
Consent of the data subject refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of his or her personal, sensitive personal, or privileged information.
When the processing of personal information is based on consent, the PIC must obtain the consent in relation to the declared purpose for processing. The consent must likewise be evidenced by written, electronic or recorded means.5
We reiterate that the mere posting of a PIC’s privacy policy or notice and requiring the consumers to agree thereon via the online platform does not equate to obtaining the consent of the data subject for purposes of processing his or her personal information as required under the law. While consent may be obtained through electronic means, the fact that the data subject must agree to a privacy policy or notice fails to meet the requirement of a meaningful consent. A “bundled” consent, for instance, will generally not suffice as the data subject is not empowered to make a true choice.
In addition, we refer to the IC’s CL No. 2014-47 which provides for the requirement for consumers’ consent as follows:
8.5 Insurance providers shall not, as a condition of sale, require consumers to consent to the collection, use or disclosure of personal information beyond that is necessary to complete the sale.
8.6 When consumer’s consent to the collection, use and disclosure of personal information is required, and cannot reasonably be implied, such consent shall be:
(a) Provided separately from consent to other terms and conditions of the insurance contract; and (b) Provided through a clearly worded, online opt-in process.
8.7 The consent of the consumer may also be included in the application or executed in a separate paper form. (underscoring supplied)
From the foregoing, the insurance company’s privacy policy conforms to the requirements of the DPA and need not be revised.
Nonetheless, the IC may direct the insurance company to create a separate form or opt-in process in the online transaction for securing the consent of the consumers to the processing of his or her information, if consent is the proper basis for processing personal data.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes, “Data Privacy Act of 2012” (15 August 2012). ↩
-
IAPP, Glossary of Privacy Terms, available at https://iapp.org/resources/glossary/#paperwork-reduction-act-2 ↩
-
Id. ↩