NPC Issuance Wiki

NPC Advisory Opinion No. 2023-016 — Applicability of Soft Opt-In Approach in the Philippines

Issued

Text

08 September 2023

Re: APPLICABILITY OF SOFT OPT-IN APPROACH IN THE PHILIPPINES

Dear [Redacted],

We respond to your request for an Advisory Opinion on whether “soft opt-in” approach under the General Data Protection Regulation (GDPR) and the Privacy and Electronic Communications Directive 2002/58/EC on Privacy and Electronic Communications (e-Privacy Directive) is permissible in our jurisdiction.

You state in your letter that Recital 47 of the GDPR explicitly provides that “[T]he processing of personal data for direct marketing may be regarded as carried out for a legitimate interest.” On the other hand, while the general rule under the e-Privacy Directive is that opt-in consent is required before a company can engage in marketing communications, the exception is that marketing emails may be sent on an opt-out basis if the recipient’s details were collected “in the context of the sale of a product or a service.”1 You further state that the GDPR and e-Privacy Directive, taken together, have generally enabled companies located in and targeting customers within the European Union and European Economic Area to send direct marketing communications to individuals whose details were obtained by a company in the context of a sale of a product or a service, or even during negotiations in pursuit of such a purchase.

Such a method, called the “soft opt-in” approach, may be adopted by companies if the following general conditions are fulfilled:

  1. The company collects the individual’s personal information during discussions about the sale of a product or a service;
  2. At the time that their personal information was collected, the individual had not explicitly opted out of receiving other related communications from the company;
  3. The company intends to send marketing communications about its products and services, and items related to said products and services, to the individual; and
  4. The company provides a simple and free mechanism through which the individual may opt-out of subsequent marketing communications from the company.

You thus submit that while there is no equivalent provision for “soft opt-in” under the Data Privacy Act of 2012 (DPA), such an approach may be allowed as long as the conditions enumerated above are also fulfilled, and the fundamental rights and freedoms of the data subject are upheld. Moreover, the foregoing conditions set clear limits on what type of direct marketing communication a company may engage in and provide ample protection to data subjects against misuse of their personal information.

Discussion

For context, the DPA defines consent as any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her.2 Consent shall be evidenced by written, electronic or recorded means.3

Thus, consent under the DPA must be expressly given wherein the data subject voluntarily agrees to the processing of personal information. An implied, passive or negative consent does not meet the requirements of the law, including an opt-out approach wherein a data subject is merely notified of the period within which to object to the processing of his or her personal information.4

In the scenario you provided, the data subject’s personal information was collected by the company during discussions about a sale of a product or service, and such data subject has not explicitly opted-out from receiving other related communications from the company. Further, the company intends to send marketing communications to the data subject about its products or services and items related thereto. The company shall then provide a simple and free mechanism for the data subject to opt out of the subsequent marketing communications.

It, thus, appears that the consent relied upon by the company for its marketing communications will be based on the inaction of the data subject. It is worth noting that the data subject, at the time of the collection of his or her personal information, did not expressly agree to receive marketing communications from the company. Rather, there was only an absence of the data subject’s explicit opt-out from receiving marketing communications. Considering that the consent of the data subject is implied, there is no evidence of his or her assent through written, electronic or recorded means which is required under the DPA.

We reiterate that implied or inferred consent is not recognized in this jurisdiction. The data subject’s consent must never be assumed, regardless of the lack of explicit objection. It is also worth noting that the DPA, unlike the e-Privacy Directive, does not provide for a similar exception to the express consent rule. Hence, the soft opt-in approach under the e-Privacy Directive cannot be applied in the Philippine setting.

Legitimate Interest as Lawful Criterion for Marketing Communications

Since the DPA does not consider the soft opt-in approach as valid consent for purposes of marketing communication purposes, you may rely on the other lawful criteria for processing stated under Section 12 of the DPA.

In particular, legitimate interest under Section 12(f) of the DPA may be utilized as a lawful criterion. NPC discussed the elements for processing based on legitimate interest in MAF v. Shopee, Inc.,5 viz.:

Processing based on legitimate interest requires the fulfillment of the following conditions: (1) the legitimate interest is established; (2) the processing is necessary to fulfill the legitimate interest that is established; and (3) the interest is legitimate or lawful and it does not override fundamental rights and freedoms of data subjects.

For the lawful criteria of legitimate interest to apply, the foregoing conditions must be satisfied. In the current matter, the legitimate interest of the company is to be able to initiate marketing communications with potential customers to sell its products and services. As such, the company must establish: first, that the processing shall be for the sole purpose of pursuing the legitimate interest of the company, which is to be able to send marketing communications about its products and services to potential customers; second, the processing shall only be limited to the personal information necessary and proportionate to achieve its legitimate interest. Hence, only personal information which is necessary for the company to be able to contact the potential customers must be processed. Third, the processing of personal information must be done in the least intrusive way so as not to impede the rights of the data subjects.

As such, considering that all three elements are present in the current matter, Section 12(f) of the DPA is the more appropriate lawful criterion in the processing of potential customers’ personal data for direct marketing communications.

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

Please be guided accordingly.

For your reference.

Very truly yours,

(Sgd.) FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office

Footnotes

  1. Article 13(2), e-Privacy Directive. ↩

  2. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, § 3(b) (2012). ↩

  3. Ibid. ↩

  4. See NPC Advisory Opinion Nos. 2017-31 and 2017-42. ↩

  5. National Privacy Commission, MAF v. Shopee Philippines, Inc. NPC 21-167 (Sept. 22, 2022). ↩

Backlinks

  • No backlinks found