NPC Issuance Wiki

NPC Advisory Opinion No. 2018-050 — Cold Calls and Emails

Issued Advisory Opinion

Text

16 October 2018

Re: COLD CALLS AND EMAILS

Dear [Redacted]:

We write in response to your query received by the National Privacy Commission (NPC) via email. In your inquiry, you disclosed that majority of your activities as a salesman rely on making cold calls and sending cold emails to prospective clients. A potential customers’ contact information is commonly obtained from publicly available sources, such as calling cards from events, exhibits and expos and the internet. Another method of acquiring contact information is through a speculation of email addresses based on established patterns.

You now request guidance on the legality of cold calls and emails in relation to Republic Act No. 10173,1 otherwise known as the Data Privacy Act of 2012 (DPA), given that the targeted individuals have not specifically given their consent to the use of their personal information for marketing of your products or services.

Discussion

Publicly Sourced Personal Data Protected under the DPA

Before all else, we note that “it is a misconception that publicly accessible personal data can be further used or disclosed for any purpose whatsoever without regulation.”2 In Section 4 of the DPA, the law specifies special cases where certain information may fall outside of its scope but only to the minimum extent necessary to achieve the specific purpose, function or activity.3 As it is not recognized as a special case, publicly sourced personal data fall under protection of the DPA.

Even though personal information of potential clients are obtained from publicly available sources, marketers employing such methods become personal information controllers (PICs) who must meet the requirements under the law. Marketers are bound by the provisions on criteria for lawful processing of personal, sensitive personal and privileged information provided by the DPA.

Direct Marketing as a Legitimate Interest

Calls and emails made directly to a potential customer without prior contact or lead, also known as cold calls and emails, are common direct marketing practices in the Philippines employed by companies, organizations and individuals for the offering or advertising of goods or services. Our own privacy law defines direct marketing as “communication by whatever means of any advertising or marketing material which is directed to particular individuals.”4

Some activities involved in direct marketing, such as collection of potential clients’ names, their contact details and email, business or home addresses, the storage of such information and the calling and emailing by sales representatives, involve the processing of personal data. Marketers, in their capacity as PICs, must then comply with the provisions of the law, including adherence to the data privacy principles of transparency, legitimate purpose and proportionality. The law further provides that a PIC must have a legitimate purpose for the processing of personal data, the criteria of which are specifically enumerated in Sections 12 and 13 thereof.5

In case the processing does not fall under any of the criteria enumerated under the law, consent given by the data subject should ideally be the basis of lawful processing of personal information for marketing purposes.6 For processing to be lawful, consent must have been given by the data subject prior to the collection, or if prior consent was not obtained, it should be given as soon as practicable and reasonable.7

Gathered from your inquiry, personal information was already processed upon collection of the prospective client’s name and contact details. Thus, prior consent was not obtained. However, marketers may consider, with caution, legitimate interest as the basis of processing.

In the assumption that only personal information and not sensitive personal information is involved, Section 12 (f) of the DPA may apply to this particular situation of direct marketing, viz:

The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.8

Furthermore, as our DPA is influenced by the 1995 EU Data Protection Directive and discussions on the EU General Data Protection Regulation (GDPR),9 the latter’s pronouncement on direct marketing holds significance. Recital 47 of the GDPR, in connection with Article 6(1)(f)10 which is substantially the same as the above provision of the DPA, states: “… The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.”11

Thus, legitimate interests of a PIC may be considered as the lawful basis for making cold calls and emails to prospective clients. This notwithstanding, it cannot be said that direct marketing may always constitute legitimate interest.12 Lawful processing of personal information on the ground of legitimate interest still depends on the particular circumstances.13

Legitimate Interests Three-part Test

Before a PIC may present legitimate interests as the basis for the processing of personal information for marketing activities, a three-part test must first be conducted.14 The PIC must satisfy the following:

  1. Purpose Test – is there a legitimate interest behind the processing?
  2. Necessity Test – is the processing necessary for that purpose?
  3. Balancing Test – is the legitimate interest overridden by the individual’s interests, rights or freedoms?15

The DPA does not specifically provide which matters to consider in deciding whether a PIC’s purpose counts as legitimate interest. Direct marketing activities which do not contravene any established law or ethical standards or practices may be considered as legitimate purpose.16 The PIC must have a declared and specified purpose, not merely relying on vague or generic business interests, there must be some clear and specific benefit or outcome in mind.17 As much as it can be argued that there are legitimate interests to be pursued, the PIC must next demonstrate that the processing is necessary and proportionate for the purposes of the identified legitimate interest.18 Lastly, the PIC must determine whether the processing may be overridden by the fundamental rights and freedoms of the data subject and the impact of such processing on the data subject.19

In gauging whether interests of the individual may override the legitimate interests of the PIC, Recital 47 of the GDPR sheds some light thereon:

At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place. The interests and fundamental rights of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect further processing.20

Thus, the reasonable expectation of the data subject on the purpose for processing of his or her personal information at the time of its collection becomes a crucial consideration. Legitimate interests will likely be applicable where a PIC has a relevant and appropriate relationship with the data subject, such as when direct marketing is addressed to existing clients or employees.21 In the absence of a pre-existing relationship, the PIC must demonstrate that the processing can be reasonably expected, particularly if the personal information was collected and obtained from a third party.22

In this situation, the questions for the sales representatives who may opt for cold calls and emails then are:

  1. What is the specific purpose or business objective that may be achieved by cold calls and emails?
  2. Is this necessary and proportionate to his business objective?
  3. Is there a possibility that the business interest of the marketer may override the individual interests and rights of the potential customer?
  4. Did the data subject or potential customer expect further processing for a purpose different from that when his or her personal information was first collected or processed?
  5. What, if any, is the impact of cold calls and emails on the individual or the data subject?

It may be argued that the individuals who gave their calling cards in events or expos may have expected calls or emails only from those individuals or organizations to whom they directly gave their contact information. For those individuals whose contact information are found online, they may have expected that their information will be used only for the purposes of such website or platform, e.g. job search and application. Further, such individuals may have reasonably expected that there will be no further processing of their information. Thus, a cold call or email from an entirely different organization or individual for marketing of different products or services may be considered an intrusion of their right to data privacy. Notwithstanding, each case should always be evaluated depending on the surrounding circumstances.

We wish to emphasize that legitimate interest is not intended to be a broad justification for all purposes assumed by PICs. The NPC, on its own determination, may evaluate whether legitimate interest is the proper basis for the specific processing, considering the interpretation clause under Section 38 of the DPA, where the law is liberally interpreted in a manner mindful of the rights and interests of the data subject.

Right to Information and Right to Object

Should the PIC be able to justify its legitimate interests, the DPA specifically provides that the data subject has the right to object and to withhold consent in relation to processing for direct marketing.23

In making cold calls and emails, marketers should be accountable, open and transparent in making said calls or emails. To achieve these, the potential customer must be apprised of the identity of the sales representative, the PIC or company he or she represents and the purpose of the call and email.24 The PIC, through their sales representatives, should also be able to communicate the source from which the contact details of potential customers were obtained, and the reasons for pursuing the direct marketing call. Direct marketers should also be able to give the individual the choice to allow or object to resume the call or the use of their personal data, and to assure that the data subject has the right to object at any given time should they wish to. Should the individual object at the initial contact done by the PIC, the PIC should immediately cease further direct marketing activities and any further kind of processing on the personal data of the individual, including storage and disclosure. The record on the individual’s personal data should be destroyed.

Furthermore, sales representatives as accountable PICs should maintain appropriate measures which shall ensure the integrity and security of the personal data collected. Upon the conclusion of the purpose for processing, the collected personal information should be disposed of in accordance with the law. Finally, the PIC shall uphold the rights of the data subjects as provided by the DPA.25

This advisory opinion is based on the limited information provided in the questions, and may vary based on additional information or when the facts are changed or elaborated. Please be advised that the NPC may issue further guidelines on this matter.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. Office of the Privacy Commissioner for Personal Data, Hong Kong, Guidance Note - Guidance on Use of Personal Data Obtained from the Public Domain, August 2013, available at https://www.pcpd.org.hk/english/publications/files/GN_public_domain_e.pdf (last accessed May 31, 2018). ↩

  3. See Data Privacy Act of 2012, § 4. ↩

  4. Data Privacy Act of 2012, § 3 (d). ↩

  5. Id. §§ 12-13. ↩

  6. Id. § 12 (a). ↩

  7. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 21 (a) (2016). ↩

  8. Id. § 12 (f). ↩

  9. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) Official Journal of the European Union, Vol. L119 (4 May 2016). ↩

  10. GDPR, Article 6 (1)(f) provides: (f) processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party except, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. ↩

  11. See GDPR, Recital 47. ↩

  12. Information Commissioner’s Office, UK, When can we rely on legitimate interests?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/when-can-we-rely-on-legitimate-interests/#marketing_activities (last accessed May 31, 2018). ↩

  13. Id. ↩

  14. Id. ↩

  15. Information Commissioner’s Office, UK, What is the ‘legitimate interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ (last accessed May 31, 2018). ↩

  16. Information Commissioner’s Office, UK, What is the ‘legitimate interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ (last accessed May 31, 2018). ↩

  17. Id. ↩

  18. Id. ↩

  19. Id. ↩

  20. GDPR, Recital 47. ↩

  21. Information Commissioner’s Office, UK, What is the importance of reasonable expectations?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/?template=pdf&patch=16 (last accessed August 14, 2018). ↩

  22. Id. ↩

  23. Implementing Rules and Regulations of the Data Privacy Act of 2012, § 34 (b). ↩

  24. Office of the Privacy Commissioner for Personal Data, Hong Kong, Guidance Note - New Guidance on Direct Marketing, January 2013, available at https://www.pcpd.org.hk/english/publications/files/GN_DM_e.pdf (last accessed May 31, 2018). ↩

  25. See Data Privacy Act of 2012, § 16. ↩

Backlinks