NPC Issuance Wiki

NPC Advisory Opinion No. 2020-041 — Legality of Spamming and Its Effects on Data Privacy

Issued Advisory Opinion

Official opinion tags

Text

30 October 2020

Re: LEGALITY OF SPAMMING AND ITS EFFECTS ON DATA PRIVACY

Dear [Redacted],

We write in response to your request for an Advisory Opinion received by the National Privacy Commission (NPC) to provide clarification and guidance on the legality of spamming given the provisions of the Cybercrime Prevention Act of 2012, Philippine Supreme Court decision in Disini, Jr. vs. Secretary of Justice and the different views of government and private entities on spamming.

Discussion

In your letter, extensively outlined are the following laws, Philippine Supreme Court decisions, and issuances from different government agencies relative to spamming:

• Republic Act No. 10175 or otherwise known as the Cybercrime Prevention Act of 2012 which states in Section 4 on Cybercrime Offenses particularly:

Sec. 4. Cybercrime Offenses. — The following acts constitute the offense of cybercrime punishable under this Act:

xxx xxx xxx

(c) Content-related Offenses:

xxx xxx xxx

(3) Unsolicited Commercial Communications. — The transmission of commercial electronic communication with the use of computer system which seek to advertise, sell, or offer for sale products and services are prohibited unless:

(i) There is prior affirmative consent from the recipient; or

(ii) The primary intent of the communication is for service and/or administrative announcements from the sender to its existing users, subscribers or customers; or

(iii) The following conditions are present:

(aa) The commercial electronic communication contains a simple, valid, and reliable way for the recipient to reject. receipt of further commercial electronic messages (opt-out) from the same source;

(bb) The commercial electronic communication does not purposely disguise the source of the electronic message; and

(cc) The commercial electronic communication does not purposely include misleading information in any part of the message in order to induce the recipients to read the message.

• In the 2014 case of Disini, Jr. vs. Secretary of Justice,1 the Philippine Supreme Court, in ruling Section 4 (c) (3) of the Cybercrime Prevention Act of 2012 as unconstitutional, stated that unsolicited commercial communications or spams are legitimate forms of expression, viz:

“But, firstly, the government presents no basis for holding that unsolicited electronic ads reduce the “efficiency of computers.” Secondly, people, before the arrival of the age of computers, have already been receiving such unsolicited ads by mail. These have never been outlawed as nuisance since people might have interest in such ads. What matters is that the recipient has the option of not opening or reading these mail ads. That is true with spams. Their recipients always have the option to delete or not to read them.

To prohibit the transmission of unsolicited ads would deny a person the right to read his emails, even unsolicited commercial ads addressed to him. Commercial speech is a separate category of speech which is not accorded the same level of protection as that given to other constitutionally guaranteed forms of expression but is nonetheless entitled to protection. The State cannot rob him of this right without violating the constitutionally guaranteed freedom of expression. Unsolicited advertisements are legitimate forms of expression.”2

• The Bangko Sentral ng Pilipinas (BSP), in its Memorandum No. M-2015-017,3 reminded the banks and its affiliates and subsidiaries about the prohibition against push messages or unsolicited text messages. The Memorandum cites the National Telecommunication Commission (NTC) Circulars issued in 2005 and 2009.4

You stated in your letter that you further made an examination on the country’s biggest ISP and Telecommunication providers’ policies which reveal they all prohibit spamming.

Thus, you now seek the Commission’s opinion and stand on the following:

  1. What is the clear unequivocal position of the NPC with respect to the legality or illegality of spamming?

  2. What are the disadvantages of spamming on the data privacy rights and digital identities of Philippine netizens?

Legality of unsolicited commercial communications

Unsolicited commercial communications or “spam” is not illegal as stated by the Supreme Court decision in Disini, Jr. v. Secretary of Justice where the Court decriminalized the pertinent provision under the Cybercrime Prevention Act of 2012 that makes it a punishable act.

Further, Article 8 of the New Civil Code of the Philippines provides that “judicial decisions applying or interpreting the laws or the Constitution shall form a part of the legal system of the Philippines.”5 Thus, the Supreme Court decision decriminalizing unsolicited commercial communications holds true and should be respected until it is overturned by the Court itself. Furthermore, the law and decisions by the High Court interpreting the Constitutions and laws have greater authority than administrative issuances.

As a government agency bound to uphold the Constitution and existing laws, rules and regulations, the Commission abides by the ruling of the Supreme Court in Disini, Jr. v. Secretary of Justice and thus, treats unsolicited commercial communications as legitimate forms of free expression.

The Data Privacy Act of 20126 (DPA) was enacted to protect the processing of individuals’ personal data and requires that the processing shall be in made in accordance with its provisions, its Implementing Rules and Regulations and other existing laws, rules and regulations. It does not prohibit unsolicited commercial communications per se, rather, it sets the limit and reasonable guidance how these may be made while protecting the data privacy rights of individuals.

While the content of unsolicited commercial communications is legal as pronounced by the Supreme Court, the manner through which they are delivered, especially the use of personal data to obtain contact information, is still under the scope our privacy law.

As such communications are well under the scope of the DPA, any processing of personal data for the purposes of sending unsolicited commercial communications should be in accordance with the provisions of the DPA, its IRR, NPC issuances as well as other existing laws, rules and regulations. Senders of unsolicited commercial communications must have a valid legal ground for processing under Section 12 or 13 of the DPA, where appropriate, and effectively become personal information controllers (PICs) who must uphold data subject’s rights and fulfill specific requirements on security measures for the protection of personal data laid down by the law and its IRR.

Thus, the surrounding circumstances of the sending out of these unsolicited commercial solicitations or spam are factors to consider whether the processing is indeed lawful under the provisions of the DPA.

Effects of spamming on data privacy rights and digital identities

As for the disadvantages of spamming on the data privacy rights and digital identities of Philippine netizens, one of the apparent effects of it are the loss of the right to object or withhold consent by the data subject whose personal data has already been processed. For entities and individuals who resort to anonymous sending of unsolicited commercial communication, they deprived the data subjects the right to be informed as well as their right to give consent to the processing of their personal data for direct marketing.

Spamming through emails or other means of electronic communication can also lead to profiling. The simple act of opening of an email can give an indication of the user’s preference, through the cookies stored in the user’s computers with unique identifiers, later on enabling advertising networks to target and deliver advertisements based on individual interests.

In view of the foregoing, the Commission reminds businesses, organizations, and individuals to keep in mind that they become PICs when they process personal data of individuals for sending out unsolicited commercial communication.

As PICs they are responsible in complying with the provisions of the DPA as well as upholding the data subject rights.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

Footnotes

  1. Disini, Jr. v. Secretary of Justice, G.R. Nos. 203335, 203299, 203306, 203359, 203378, 203391, 203407, 203440, 203453, 203454, 203469, 203501, 203509, 203515 & 203518, 727 PHIL 28-430 (2014). ↩

  2. Id. Citation omitted. ↩

  3. Bangko Sentral ng Pilipinas, Prohibition against push messages or commonly known as unsolicited text messages, Memorandum No. M-2015-017 (March 25, 2015). ↩

  4. See National Telecommunications Commission Memorandum Circular 03-03-2005-A (March 15, 2005), as amended by Memorandum Circular 04-07-2009 (July 4, 2009). ↩

  5. An Act to Ordain and Institute the Civil Code of the Philippines, [CIVIL CODE OF THE PHILIPPINES], Republic Act No. 386, Art.8, (1949). ↩

  6. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

Backlinks

  • No backlinks found