Text
18 December 2019
Re: RIGHT TO DELETE ACCOUNT THROUGH E-MAIL
Dear [Redacted],
We write in response to your request for advisory opinion received by the National Privacy Commission (NPC) where you seek clarification on the data subject’s exercise of the right to withdraw his or her consent and/or have his or her data deleted from the system of a personal information controller (PIC)1 in a reasonable manner such as through e-mail, which is allegedly not allowed by Cashalo unless accompanied by a signed letter of request through snail mail with two copies of valid IDs.
We understand that you sent Cashalo a request via email for deletion of your account, following the instruction provided under the Privacy Policy statement in their website. However, your request was denied until fulfillment of the requirement to submit the request to their office and provide identification, as indicated above. You claim that it is unreasonable for them to ask you to send snail mail when e-mail can be used. You further claim that you already had several cases of successful account deletion with other service providers through e-mail.
Data subjects’ rights; withdrawal of consent; procedure for the exercise of rights
Section 16 of the Data Privacy Act of 20122 (DPA) and Section 34 of its Implementing Rules and Regulations (IRR), provide for the rights of the data subjects. In particular, Section 34 (e) of the IRR states:
e. Right to Erasure or Blocking. The data subject shall have the right to suspend, withdraw or order the blocking, removal or destruction of his or her personal data from the personal information controller’s filing system.
This right may be exercised upon discovery and substantial proof of any of the following:
(a) The personal data is incomplete, outdated, false, or unlawfully obtained; (b) The personal data is being used for purpose not authorized by the data subject; (c) The personal data is no longer necessary for the purposes for which they were collected; (d) The data subject withdraws consent or objects to the processing, and there is no other legal ground or overriding legitimate interest for the processing; (e) The personal data concerns private information that is prejudicial to data subject, unless justified by freedom of speech, of expression, or of the press or otherwise authorized; (f) The processing is unlawful; (g) The personal information controller or personal information processor violated the rights of the data subject.
The personal information controller may notify third parties who have previously received such processed personal information.3
The law and the rules are silent on the procedure of the exercise the right to erasure or blocking. However, the instances wherein this right applies are enumerated, such as when the data subject withdraws consent or objects to the processing of his or her personal data.
We note that Cashalo included in its Privacy Policy posted in its website, the following procedure for the exercise of the abovementioned right of a data subject, to wit:
If you wish to exercise your right to access, correction, cancellation, portability and objection rights as described below, or for complaints and other inquiries, please send a registered letter with return receipt to 16F World Plaza Building, 5th Avenue, Bonifacio Global City, Taguig City 1634, Philippines or email hello@cashalo.com to the attention of Data Privacy Officer:
[…]
to update, correct, supplement, or delete the data, to block or render anonymous data that have been processed unlawfully, including data whose retention is unnecessary for the purpose for which such data have been collected or subsequently processed; to have a certification that the operations requested have been completed, as also related to their contents, to the entities to which the data were communicated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected; to receive the personal data concerning you and copy or transmit it to another data controller (right to data portability);4
As can be gleaned from the above, the instructions given by Cashalo indicate that the data subject has the option to send a request to the Data Privacy Officer through snail mail or e-mail in order to assert his or her rights.
Cashalo may institute additional policies especially when the need arises, such as requiring the submission of other documentation, i.e. signed letter, copies of valid identification/s, etc. as PICs equally have a responsibility to ensure the identity of the requestor in order to validate any requests before granting them.
Nonetheless, in keeping with the thrust of upholding data subjects’ rights and enabling the free exercise of these rights, any additional submissions, if absolutely necessary, should likewise be possible to be made through electronic mail as well.
The DPA places emphasis on the PIC’s compliance in addressing requests satisfactorily, without undue delay. The actual methodology to be implemented for addressing such requests, at the minimum, should be simple and not have the effect of discouraging such requests from data subjects.
This opinion is being based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
Data Privacy Act of 2012, §3(h) - Personal information controller refers to a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf. The term excludes: (1) A person or organization who performs such functions as instructed by another person or organization; and (2) An individual who collects, holds, processes or uses personal information in connection with the individual’s personal, family or household affairs. ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 34(e) (2016). ↩
-
Cashalo, Privacy Policy, available at https://www.cashalo.com/privacy-policy/ (last accessed Dec. 18, 2019). Emphasis supplied. ↩