Text
26 October 2018
Re: AYALA REWARDS CIRCLE
Dear [Redacted],
We write in response to your request for guidance on the applicable rules and guidelines that have been issued on the requirement for obtaining consent relative to the loyalty programs offered to members of the Ayala Group Club, Inc., under the name and style Ayala Rewards Circle (ARC).
We understand that some queries were received by ARC from its members seeking clarification on the conditions necessitating an organization to reobtain consent, in lieu of a prior notice where changes have been made to the terms and conditions of the program, particularly where such changes are merely formal in nature and intended for the data subjects’ better comprehension of ARC’s processing activities.
ARC is of the opinion that the consent of the individual members need not be obtained anew in relation to the revised terms and conditions.
Discussion
Ayala Rewards Circle
We understand that the ARC is a conglomerate-wide recognition program that aims to better serve the premium clients of the Ayala group – AC Automotive (Ayala-owned Honda, Isuzu, Volkswagen dealerships), Ayala Land Inc., Bank of the Philippine Islands, and Globe Telecom.1 It is a members-only program which is valid for five years and subject for review and renewal by the ARC management.2 Members enjoy benefits such as:
- Access to 24/7 domestic and international concierge services;
- Priority handling at BPI branches Preferred lanes and select Globe stores;
- Special deals and discounts from Ayala-owned Honda, Isuzu and Volkswagen dealerships;
- Ayala property promos and exclusive room rates at Ayala Hotels and Resorts;
- Privileges from local and international dining, shopping and leisure partners; and
- Invites to exclusive events both here and abroad.3
ARC Terms and Conditions of Membership
Section 3.11 of the 2013 ARC Terms and Conditions provides as follows:
3.11 I fully understand and acknowledge that in order for AGCC to provide and maintain the Program and for me to continue enjoying the rewards/benefits of said Program, AGCC will need to collect, process, record, organize, store, update, retrieve, consult, use and/or consolidate all information about me to determine suitable promotions, activities, and products that I can participate in or avail of. For this purpose, I hereby authorize AGCC to obtain updated information about me from the Bank of Philippine Islands (BPI), Globe Telecom, Ayala Land, and other AGCC affiliates, subsidiaries and Partners under an obligation of confidentiality, and to process, use, store, disclose and share such information for the purpose of implementing the Program, as well as for marketing, communication and research purposes. I expressly authorize BPI, Globe Telecom, Ayala Land, and other AGCC affiliates, subsidiaries and Partners, to disclose and share, from time to time, to AGCC, any and all information relating to me as appearing in their records, files and databases, including, but not limited to, those relating to my personal information, account information and dealings with them. In this connection, I hereby waive my rights under the confidentiality and data privacy laws of the Philippines and other jurisdictions, and agree to hold BPI, Globe Telecom, Ayala Land and other AGCC affiliates, subsidiaries and Partners, free and harmless from any and all liability that may arise from, or in connection with, the collection, processing, recording, updating, consolidation, disclosure, sharing, use and storage of information relating to me, my accounts and dealings, pursuant to, and in compliance with, the authorization conferred by me under these Terms and Conditions.
This is followed by the following statements:
____ I have carefully read and understood the foregoing Terms and Conditions and my signature below signifies my express conformity and agreement thereon. ____ I do not accept the foregoing Terms and Conditions and opt not to join the AGCC Program.
Signature above printed name
Date signed
We understand that the above Terms and Conditions was amended in October 2017, and the above provision is now covered under Sections 3.11 and 3.12., to wit:
3.11 To maintain and implement the Program in connection with its marketing, communication, analysis and research objectives and for me to continue enjoying the rewards, privileges and benefits thereof, I acknowledge and agree that Ayala Group Club, its directors, officers, employees, service providers, authorized representatives and agents (collectively, the “Ayala Group Club”):
- will collect, obtain, use, store, process and consolidate (collectively, “process” or “processing”) information about me (including my Personal Data, contact details, demographic information and account details) to determine suitable promos, events, activities, products and services that I can participate in or avail; and
- may outsource the processing thereof to service providers, whether within or outside the Philippines, with my consent herein given.
3.12 By continuing with my ARC membership or by availing of the rewards/privileges/benefits of the Program, I authorize Ayala Group Club, its related companies (including member-companies), assignees and their respective outsourced service providers to use, share and disclose my information for any or all of the following purposes:
- To facilitate the administration, provision, implementation and monitoring of my rewards, benefits and privileges as ARC member;
- To contact or reach out to me through phone calls, mail, email, SMS and e-commerce platforms or any other type of electronic facility which the Ayala Group Club may deem appropriate and provide me with marketing or promotional information and materials relating to promos, events, activities, products and services which I may find interesting;
- To develop, enhance and provide improvements/upgrades in its systems and business processes, including but not limited to data analytics and automated processing;
- To carry out and implement the Program promos, events, activities, products and services which I avail of or participate in from time to time.
For any or all of the foregoing purposes, I expressly authorize, from time to time, under an obligation of confidentiality: (i) the Bank of the Philippine Islands, Globe Telecom, Ayala Land, Inc., other Ayala Group Club members, their respective subsidiaries and affiliates (collectively, the “Ayala Group of Companies”) and the marketing and promotional partners and third parties, whether within or outside the Philippines (the “Program partners”), to disclose and share to Ayala Group Club my information as appearing in their respective records; and (ii) for the Ayala Group Club to process my updated information obtained from the Ayala Group of Companies and the Program partners. I agree to inform Ayala Group Club of any changes relating to my information through its support@ayalarewardscircle.com.
The foregoing constitutes my express consent under the applicable confidentiality and data privacy laws of the Philippines and other jurisdictions and I agree to hold the Ayala Group Club, the Ayala Group of Companies, the Program partners and their respective authorized representatives and outsourced service providers free and harmless from any and all liabilities, claims, damages, suits of whatever kind and nature, that may arise in connection with the implementation and compliance with the authorization conferred by me under these Terms and Conditions.
I acknowledge that I have received, read, and understood the Program requirements and the foregoing Terms and Conditions and Privacy Policy, and that a representative of Ayala Group Club has fully explained to me the same. By signing below, I am agreeing to the foregoing Terms and Conditions of Membership.4
Lawful Processing of Personal Data; Consent and Contract as Criteria for Lawful Processing
There are several criteria for processing personal and sensitive personal information provided for under Sections 12 and 13 of Republic Act No. 10173,5 known as the Data Privacy Act of 2012 (DPA).
Processing of personal information may be based on consent, contract, legal obligation, legitimate interest, among others. Similarly for sensitive personal information, the processing thereof may be based on consent, law or regulation, legal claims, among others.
As to the consent of the ARC members to the October 2017 Terms and Conditions, we note that there is a statement in the last paragraph – “xxx By signing below, I am agreeing to the foregoing Terms and Conditions of Membership.” We assume that these Terms and Conditions were duly sent to all ARC members and in effect, those who signed the document agreed to the new terms and conditions.
Nonetheless, we wish to reiterate the definition of consent as follows:
Consent of the data subject refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so.
Further, the IRR states that when consent is required, it must be time-bound in relation to the declared, specified and legitimate purpose.6 The time-bound element does not necessarily mean that a specific date or period of time has to be declared. Thus, for instance, declaring that processing will be carried out for the duration of a contract between the PIC and the data subject may be a valid stipulation.
Also, as long as the purpose, scope, method and extent of the processing remain to be the same as that disclosed to the data subject when consent was given, the consent remains to be valid.
Hence, considering that only formal changes were made in the 2017 ARC Terms and Conditions, and that no changes were made which affects the purpose, scope, method and extent of the processing of personal data, the consent given under the 2013 ARC Terms and Conditions remains to be valid.
Transparency; Rights of Data Subjects to Be Informed and to Object
The principle of transparency mandated by the DPA dictates that the data subject must be aware of the nature, purpose, and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of personal information controller, his or her rights as a data subject, and how these can be exercised.7 Any information and communication relating to the processing of personal data should be easy to access and understand, using clear and plain language.8
Thus, in line with the right to information of the data subject, personal information controllers (PICs) are required to apprise the data subject of the following:
- Description of the personal data to be processed;
- Purposes for processing, including: direct marketing, profiling, or historical, statistical or scientific purpose;
- Basis of processing (legal or statutory mandate, contract, etc.)
- Scope and method of processing;
- Recipient/classes of recipients to whom the personal data are or may be disclosed;
- Identity and contact details of the Personal Information Controller;
- Retention period; and
- Existence of rights as data subjects.
The above may be operationalized through a privacy notice. A privacy notice is a statement made to a data subject that describes how the organization collects, uses, retains and discloses personal information.9 It is sometimes referred to as a privacy statement, a fair processing statement or sometimes a privacy policy.10
Having stated that, there is also a need to determine and clarify the distinction between privacy policy and securing the consent of the data subject for the processing of his or her personal information.
Being a mere notice, it is emphasized that the privacy policy or notice is not equivalent to consent. This document is an embodiment of the observance of the data privacy principle of transparency and upholding the right to information of data subjects.
Lastly, we note the last paragraph of Section 16(b) of the DPA which states that any information supplied or declaration made to the data subject shall not be amended without prior notification of data subject. This is to be read in connection with the right to object under Section 34(b) of the IRR which in turn states that the data subject shall also be notified and given an opportunity to withhold consent to the processing in case of changes or any amendment to the information supplied or declared to the data subject.
This opinion is being rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) LEANDRO ANGELO Y. AGUIRRE Officer-in-Charge and Deputy Privacy Commissioner for Data Processing Systems
Footnotes
-
ARC, About Ayala Rewards Circle, available at https://www.ayalarewardscircle.com/about/, (last accessed: 10 August 2018). ↩
-
Id. ↩
-
Id. ↩
-
ARC, Terms and Conditions of Membership, available at https://www.ayalarewardscircle.com/terms-and-agreement/ (last accessed: 10 August 2018). ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission and for other Purposes [DATA PRIVACY ACT OF 2012], Republic Act No. 10173 (2012). ↩
-
Id. § 19 (a) (1). ↩
-
Rules and Regulations implementing RA No. 10173 (IRR), § 18 (a). ↩
-
Id. ↩
-
IAPP, Glossary of Privacy Terms, available at https://iapp.org/resources/glossary/#paperwork-reduction-act-2 ↩
-
Id. ↩