Text
13 August 2018
Re: CONSENT FOR BUSINESS CORRESPONDENCE
Dear [Redacted],
We write in response to your inquiry received by the National Privacy Commission (NPC) regarding consent for business correspondence. Specifically, you asked if business contact information on business cards is within the scope of Republic Act No. 10173,1 otherwise known as the Data Privacy Act of 2012 (DPA), and if written consent is needed when a person offers their contact information.
Discussion
Scope of the DPA; criteria for lawful processing of personal information
The DPA applies to the processing of all types of personal information and to any natural and juridical persons involved in personal information processing.2 Business contact information on business cards is personal information which is not of a sensitive nature, and the collection thereof is considered as a processing activity.3
Processing of personal information shall be permitted when the data subject has given his or her consent, or when processing is necessary and related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract, or when it is necessary for the legitimate interest of the personal information controller (PIC), among others.4
Organizations or individuals can use and store personal information as reflected on the business cards even without consent of the data subject as long as the processing activity is part of the normal business correspondence. In this instance, processing may be considered as being pursuant to the legitimate interest of the entity or the recipient of the personal information.
Legitimate interests of the personal information controller
Section 12(f) of the DPA provides that the processing of personal information shall be permitted when the processing is necessary for the purposes of the legitimate interests pursued by the PIC or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.
Recital 47 of the EU General Data Protection Regulation (GDPR) states that legitimate interests of a controller may provide a legal basis for processing taking into consideration the reasonable expectations of data subjects based on their relationship with the controller.5
Further, the Recital stated that such legitimate interest could exist for example where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client or in the service of the controller. The existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place.6
From the foregoing, the processing of business contact information on business cards may be based on the legitimate interest of the PIC to whom such contact information was provided.
However, if the personal information will be further processed in a way not compatible with the original business purpose or beyond the data subject’s reasonable expectations on the processing of their personal data, consent may be required.
This opinion is based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), Recital 47 (2016). ↩
-
Id. ↩