NPC Issuance Wiki

NPC Advisory Opinion No. 2018-063 — Review of Consent Form

Issued Advisory Opinion

Text

23 October 2018

Re: REVIEW OF CONSENT FORM

Dear [Redacted]:

We write in response to your request to review the Armed Forces and Police Savings and Loan Association, Inc. (AFPSLAI) Data Privacy Consent Form template.

We wish to emphasize that there is no requirement under the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR) and issuances of the NPC to have the various consent forms reviewed and approved by the NPC. Nonetheless, we take this opportunity to elucidate the concept of consent under the DPA and how this may be operationalized.

Section 3(b) of the DPA defines consent of the data subject as any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so.

The EU General Data Protection Regulation (GDPR) offers further interpretation on consent:

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.1

Based on the discussions above, it is evident that the consent contemplated by the law is an express consent wherein the data subject voluntarily assents to the collection and processing of personal information, rather than an implied or inferred consent.

Likewise, consent should be specific. The limitation emphasizes that consent cannot be overly broad for this would undermine the very concept of consent. For instance, a “bundled” consent will generally not suffice as the data subject is not empowered to make a true choice.

The following are our observations for your consideration:

Discussion

Purposes of Processing Personal Data

AFPSLAI requires the consent of the members for the following:

a. AFPSLAI operations [e.g. membership profile, accounts management, loans management, billing & collection, and other business operations]; b. research and business development or other initiatives to further improve or update product lines or service delivery; c. for promotions or marketing initiatives through mail, email, fax, SMS, telephone, or any other means of communication; d. collection of loans and receivables, past due and written-off accounts; and e. payment of loan proceeds and other disbursements.

All of the above are enumerated and combined in a single paragraph. As mentioned, consent, where required, should be specific. Having an enumeration of each and every purpose of the processing in a single paragraph, while providing for specificity, still fails to provide the data subject with a genuine choice as he or she will still be bound to sign off on the entire provision in toto.

Note also that the basis of the lawful processing of some of the above items is not consent. Rather, it may be processing of personal information that is necessary and is related to the fulfillment of a contract or in order to take steps at the request of the data subject prior to entering into a contract,2 or may be necessary for compliance with a legal obligation,3 or necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed.4

For sensitive personal information, the processing is provided for by existing laws and regulations,5 or necessary to achieve the lawful and noncommercial objectives of public organizations and their associations6 (for non-stock savings and loan associations), or necessary for the establishment, exercise or defense of legal claims.7

Hence, a separate consent need not be obtained for purposes which do not require consent of the members.

We note that there is also a statement in the form that the consent shall automatically expire ten (10) years from the last transaction. There may be a need to clarify what will happen to the personal information after the expiration of the consent, i.e. will this serve as a retention period as well, in addition to the disposal of records based on existing laws and internal policy?

We emphasize that where applicable, such as in cases where the period of processing can be reasonably ascertained at the time of collection, a PIC may specifically provide for the period of validity of a consent obtained from a data subject. It is worth noting that the limitation merely emphasizes that consent cannot be overly broad and perpetual, for this would undermine the very concept of consent, as defined in the law.

Personal Data Collected

The listing of personal data (personal information and sensitive personal information) being processed was also provided in the form, but it is necessary to determine which personal data is processed for what particular purpose, following the general data privacy principles of transparency, legitimate purpose and proportionality.

For instance, the information on beneficiary/ies such as name, age, birthdates, addresses, and sources of funds may not be necessary and proportional for the processing in relation to promotions or marketing initiatives of AFPSLAI.

Also, considering the proportionality principle and practicing data minimization, there is a need to re-evaluate if indeed, all of the listed personal data is absolutely necessary for AFPSLAI’s processing activities. We reiterate that personal information must be adequate and not excessive in relation to the purposes for which they are collected and processed.8

In order to make this determination, the conduct of a privacy impact assessment (PIA) is necessary. Please refer to NPC Advisory No. 2017-03 on Guidelines for Privacy Impact Assessments for further information. This is available at our website at https://privacy.gov.ph/wpcontent/files/attachments/newsltr/NPC_AdvisoryNo.2017-03.pdf.

Privacy Notice

The provisions of the draft form may actually form part of the privacy notice of AFPSLAI. A privacy notice is a statement made to a data subject that describes how the organization collects, uses, retains and discloses personal information.9 A privacy notice is sometimes referred to as a privacy statement, a fair processing statement or sometimes a privacy policy.

This document is an embodiment of the observance of the data privacy principle of transparency and upholding the right to information of data subjects. Being a mere notice, it is emphasized that the privacy notice is not equivalent to consent. Obtaining consent from the data subject for the purposes of processing his or her personal data is a different requirement altogether.

Footnotes

  1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC [General Data Protection Regulation] 2016 O.J. (L 119), Recital 32. ↩

  2. Data Privacy Act of 2012, § 12 (b). ↩

  3. Id., § 12(c). ↩

  4. Id., § 12(f). ↩

  5. Id., § 13(b). ↩

  6. Id., § 13(d). ↩

  7. Id., § 13(f). ↩

  8. Id., § 11(d). ↩

  9. IAPP, Glossary of Privacy Terms, available at https://iapp.org/resources/glossary/#paperwork-reduction-act-2 ↩

Backlinks