NPC Issuance Wiki

Guidelines on Consent (Circular No. 2023-04)

Issued Circular

Issuance Text

NPC Circular No. 2023 - 04

DATE: 07 November 2023

SUBJECT: GUIDELINES ON CONSENT

WHEREAS, Section 7 of the DPA provides that the National Privacy Commission (NPC) is charged with the administration and implementation of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA), which includes ensuring the compliance by personal information controllers (PIC) with the provisions of the Act, and carrying out efforts to formulate and implement plans and policies that strengthen the protection of personal information, sensitive personal information, and privileged information (collectively, personal data), in the country in coordination with other government agencies and the private sector;

WHEREAS, under Section 9 of the Implementing Rules and Regulations of the DPA (IRR), the NPC is mandated to, among others, develop, promulgate, review, or amend rules and regulations for the effective implementation of the DPA;

WHEREAS, Sections 12 and 13 of the DPA enumerate the various criteria for lawful processing of personal data which includes the consent of the data subject;

WHEREAS, consent of the data subject refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the processing of personal data about or relating to him or her, and evidenced by written, electronic, or recorded means. Consent may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so;

WHEREAS, consent is the most commonly used criterion for processing personal data and the NPC has determined the need to further elaborate on its concept and usage;

WHEREFORE, in view of the foregoing, the NPC hereby issues this Circular to provide guidelines on the use of consent as a lawful basis for processing personal data.

SECTION 1. Scope and Purpose. This Circular shall apply to all personal information controllers (PICs) engaged in the processing of personal data based on the consent of the data subject.

This Circular shall provide guidance on what constitutes valid consent, and how it shall be obtained and managed in compliance with the DPA and its IRR.

This Circular is limited to the requirements of consent in relation to the processing of personal data. Nothing in this Circular shall be construed as modifying the existing general legal framework on obligations and contracts under the provisions of the Civil Code of the Philippines and other applicable laws and regulations.

SECTION 2. Definition of Terms. Terms used in the DPA and its IRR, as amended, are adopted herein. In addition, whenever used in this Circular, the following terms are defined as follows:

  • A. “At set-up notice” refers to a privacy notice shown before a data subject installs a mobile application or a software;
  • B. “Consent fatigue” refers to a situation where consent questions are no longer read, as a result of multiple consent requests received by a data subject on a daily basis that require answers or decisions;1
  • C. “Context dependent notice” refers to a privacy notice activated by certain aspects of the data subject’s context, such as location or persons who will have access to the information or warnings about potentially unintended settings;
  • D. “Deceptive Design Patterns” refer to design techniques embedded on an analog or digital interface that aim to manipulate and deceive a data subject to perform a specific act relating to the processing of their personal data. This includes “Dark Patterns”;
  • E. “Just-in-time notice” refers to a privacy notice that provides information on how personal data will be processed at the point in time when the PIC is about to process such information;
  • F. “Layered Privacy Notice” refers to a short privacy notice that provides key privacy information and directs the data subject to more detailed information on the personal data required by the PIC, as well as the processing of such information, in accordance with Section 34(a)(2) of the IRR, as amended;
  • G. “Minimum specific information” refers to the least amount of information specific to a particular processing activity that must be disclosed to the data subject at the point where they are asked to give consent. This pertains to key information such as the identity of the PIC, its Data Protection Officer (DPO), and a brief description of how the information will be processed;2
  • H. “Research” refers to an activity that aims to develop or contribute to knowledge that can be generalized including theories, principles, relationships, or any accumulation of information using scientific methods, observation, inference, and analysis.3

GENERAL DATA PRIVACY PRINCIPLES

SECTION 3. Transparency. A PIC shall ensure that the data subject is aware of the nature, purpose, and extent of the processing of personal data. This includes the risks and safeguards involved, the identity of the PIC, the rights of the data subject, and how these rights can be exercised. Transparency empowers the data subject to make informed choices, and where applicable, to have reasonable control over the processing of their personal data, and to hold a PIC accountable based on the information provided at the time the data subject gave their consent.

  • A. Specific information. At the minimum, the following information should be provided in a concise statement: description of the personal data to be processed, the purpose, nature, extent, duration, and scope of processing for which consent is used as basis, the identity of the PIC, the existence of the rights of the data subject, and how these rights can be exercised.
  • B. Timing. Such concise information should be provided at the moment when consent is obtained (e.g., at set-up, just-in-time, context-dependent). Further information or additional details should be made available to the data subject by means of a Layered Privacy Notice (i.e., use of a link to the detailed information on the processing).
  • C. Clarity. A PIC shall use clear, plain, consistent, and straight-forward language when providing information to the data subject. A PIC must not use vague4 or blanket wording, convoluted information, technical jargon, confusing terminologies, double negatives, and deliberately providing information in a circuitous manner. Providing the data subject with information that is difficult to understand, long-winded, or complex is inconsistent with informed consent.
  • D. Form. The following clarifications and distinctions are made on these forms or statements:
    1. Privacy Statement. It is a general statement on a PIC’s personal data processing practices across the entire organization.
    2. Privacy Policy. It is a set of policies that governs a PIC’s personal data processing practices. It provides guidance to internal relevant parties (e.g., officers, employees) involved in any personal data processing activity. It is also referred to as a “Privacy Manual.”
    3. Privacy Notice. It is a unilateral statement that contains essential information on a specific processing activity of a PIC that involves the data subject.
      • a. A PIC should use clear and plain language in its privacy notice.5 Information on how the personal data will be processed must be easily apparent to the data subject. The information should be provided in the simplest manner possible and avoid using complex sentences or language structures.6 The use of layman’s terms is encouraged to ensure that the data subject understands the processing, but not at the risk of miscommunicating the technical and complex concepts.7 In cases where consent is obtained manually, the notice may be presented in a comprehensive manner, taking into account the medium used for presentation (e.g., printed notices). For electronic processing of personal data where the surrounding circumstances and particular medium utilized may limit the manner in which a notice is presented, a link to a more comprehensive notice should be readily available.
      • b. The information provided in a privacy notice should be concrete and definite. It should not be phrased in abstract or ambivalent terms, or leave room for different interpretations. Provisions that use vague, circuitous, or overbroad language do not conform with the principle of transparency. Thus, a PIC should examine if an average member of the target audience will understand the information in the privacy notice provided to them.
      • c. A PIC shall convey the appropriate privacy notice for the specific processing activity before the processing takes place or at the next practical opportunity. The information must be provided in a manner that is easy to access, taking into consideration user experience and user interface. This shall be done by posting a Layered Privacy Notice that embodies the minimum specific information for purposes of transparency. The privacy notice embodying the minimum specific information should direct the data subject to additional and detailed information relevant to the particular processing activity that will be done at that point in time;
      • d. A PIC may use creative options such as dynamic or interactive infographics, auditory notices through announcements or pre-recorded audios, or short videos. The information may also be delivered by a scripted spiel delivered on or before entry into the system. A PIC may also use any similarly creative options that can help the data subject easily understand the processing of their personal data.
    4. Consent Form. It should contain all the information required in a privacy notice and indicate that consent is the lawful criteria for processing relied on. Consequently, it must contain a PIC’s proposal to the data subject asking the latter to consent to the processing of personal data pursuant to the terms stated in the consent form. The data subject’s acceptance of the provisions of the consent form creates a contract between the data subject and a PIC on the terms of processing of the personal data.
    5. When required. The requirement of having a privacy statement and notice is separate and distinct from obtaining the consent of the data subject in an appropriate consent form or its equivalent for the lawful processing of personal data.
      • a. General rule. A privacy notice is required in any instance of processing, whether based on consent, other lawful criteria for processing under Sections 12 or 13 of the DPA, or where processing is under a special case pursuant to Section 4 of the DPA.
      • b. Exception. When a consent form already provides the essential information relating to the specific processing activity that enables the data subject to make an informed decision, a separate privacy notice on that specific processing is no longer necessary.
  • E. Accessibility of information. Information on the processing of personal data must be easy to access and understandable. The information must be readily available, and in a language or dialect that an average member of the target audience can understand.
  • F. Accountability. A PIC shall be held responsible for the information it provides to the data subject to obtain consent for the processing of personal data. Insufficiency of the information provided by a PIC to the data subject may render the consent given invalid.

SECTION 4. Legitimate Purpose. Prior to the commencement of the processing activity, a PIC shall determine and declare the specific purpose of processing and shall ensure that such purpose is not contrary to law, morals, good customs, public order, or public policy.

  • A. A PIC shall identify at the outset all the purposes for the processing of personal data which must not be contrary to law, morals, or public policy. In communicating these purposes to the data subject, a PIC commits that these specified and declared purposes define the bounds of the consent given.8
  • B. When a PIC revises its terms and conditions, retaking of consent is not necessary if the purpose, scope, method, and extent of processing remains to be the same as that disclosed to the data subject at the time consent was given.

SECTION 5. Proportionality. A PIC must ensure that the proposed processing of personal data is adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.

  • A. As a general rule, personal data shall be processed only if the purpose of the processing could not be reasonably fulfilled by other less intrusive means.
  • B. A PIC may process additional personal data if the data subject validly consents to the additional processing prior to the collection of the personal data or as soon as practicable and reasonable.
    1. Processing additional personal data for the purpose of availing goods or services or enhancing services is allowed when such additional personal data and act of processing is proportional to the additional purpose.
    2. Consent for processing additional personal data for additional purposes must be embodied in the appropriate agreements that clearly indicate all the elements of valid consent.
  • C. When the processing is based on another lawful criteria, a PIC need not obtain the consent of the data subject for such processing: provided, that the requirements of such other lawful criteria are met under Section 12 or 13 of the DPA.
  • D. A PIC must limit the collection of personal data to what is directly relevant and necessary to accomplish a specified purpose. Thus, a PIC must only ask for consent to process personal data that is directly relevant and necessary for the specified and declared purpose.

SECTION 6. Fairness. A PIC shall ensure that personal data is processed in a manner that is neither manipulative nor unduly oppressive to the data subject.

  • A. To determine fairness in processing of personal data based on consent, the following factors must be considered:
    1. The purpose of the processing;
    2. The amount of personal data collected;
    3. The specific processing to be conducted on the personal data;
    4. The manner by which the information on the processing is conveyed to the data subject;
    5. The manner of collection of the personal data;
    6. The free will of the data subject when providing consent;
    7. The manner by which the data subject gives their consent; and
    8. The retention period of the personal data processed.
  • B. The processing of personal data for purposes other than those for which the personal data were initially collected may be allowed.
    1. Consent for processing of personal data for other purposes shall not be required when (i) the further processing is within the data subject’s reasonable expectation on the purpose, scope, manner, and extent of the processing of personal data; and (ii) the purpose of further processing is compatible with the original purpose for which the personal data were initially collected and communicated to the data subject.
    2. In assessing the compatibility of the purpose of the further processing with the original purpose, a clear and reasonable link between the further processing with the original purpose should be established. In addition, the impact of the further processing to the data subject should be considered.
  • C. Consent for processing for additional purposes is required when the purpose is incompatible with the original purpose for which the personal data were initially collected, or is beyond what a data subject may reasonably expect in relation to the purpose, scope, manner, and extent of the processing of personal data.

SECTION 7. Freely given. A data subject must have a genuine choice and control over their decision to consent to the processing of their personal data.9

Consent is not freely given in instances where there is any element of pressure, intimidation, possibility of adverse consequences for refusal to give consent, or any other inability to exercise free will by the data subject.

  • A. Deceptive Design Patterns. A PIC shall not use deceptive methods or any form of coercion, compulsion, threat, intimidation, or violence in obtaining the consent of the data subject. In accordance with Section 5(B) of this Circular, however, incentivizing consent by offering benefits to the data subject and similar actions of a PIC shall not be automatically construed as a deceptive method, coercion or compulsion that renders the consent as not freely given. The Commission may make such determination on a case-to-case basis.
  • B. Public authorities. Generally, public authorities process personal data based on the applicable provisions of Section 4 on special cases, and Sections 12 (c), (d), (e) and 13 (b), (c), (f) of the DPA which relate to the performance of their public functions, or the provision of public services based on law or regulation. Where the processing falls under the aforementioned bases, the consent of the data subject is not necessary.
    1. Public authorities cannot undertake additional processing contemplated by law or regulation by obtaining consent if the primary basis for the processing of personal data is compliance with law or regulation.
    2. The use of consent as a lawful basis for processing by public authorities is permissible under the DPA and may be appropriate when the processing activity is not related to, or an extension of any processing required by law or regulation. In such cases, the requisites for valid consent must be complied with.
  • C. Contract of adhesion. A contract of adhesion is a contract where one party imposes a ready-made form of contract on the other party.10 A contract of adhesion is valid under the Philippine legal system. Thus, consent given to a contract of adhesion that contains provisions on the processing of personal data shall likewise be valid for such processing:11 provided, that all of the following conditions are complied with:
    1. The contract of adhesion must contain all the information necessary to demonstrate transparency;
    2. The processing of personal data must be necessary and for a legitimate purpose;
    3. The processing should not be excessive in relation to the fulfillment of obligations contemplated in the contract; and
    4. The manner of the processing is fair and lawful.

SECTION 8. Specific. A PIC must ensure that the data subject provides specific consent to the specific and declared purposes of the processing of personal data.

Consent must be granular. In cases where personal data is processed for multiple but unrelated purposes, a PIC shall present to the data subject the list of purposes and allow the data subject to select which purposes they consent to, instead of requiring an all-inclusive consent to the processing for multiple purposes.

  • A. If processing personal data is necessary to provide the goods or services sought to be availed of, a PIC must provide information about that specific processing and include such in the terms and conditions for the provision of the goods or service. Such information should form part of what the data subject consents to.12
  • B. Consent to processing that is not necessary for the provision of goods or services should not be bundled with or made a condition for the provision of the goods or the services. In cases where there is additional processing on the collected personal information for an additional purpose, a PIC must ensure that the consent for such processing is given by the data subject separately.
  • C. Vague or blanket consent is prohibited. Consent given based on vague or blanket statements is invalid consent.

SECTION 9. Informed. A PIC should provide to the data subject all relevant information that is necessary for the data subject to make an informed decision.13 Such information must be easily understood by an average member of the target audience to ensure that the data subject has sufficient understanding of what they are consenting to.14

  • A. Appropriate information. Prior to obtaining consent, a PIC shall ensure that it provides the appropriate information to the data subject, taking into account the most suitable language or dialect for the intended data subject, in accordance with Section 3(E) of this Circular. It shall explain such information in detail to the data subject if the same is unclear.

    The information to be provided to the data subject shall be such information that is appropriate and relevant at that point in time, in relation to the personal data processing activity requiring consent.

  • B. Consent fatigue. If the data subject finds themselves overwhelmed by numerous and lengthy forms and notices, then there is a risk that the consent will be improperly given. Consent fatigue undermines the purpose of obtaining consent as it desensitizes the data subject and causes them to ignore the requisites for valid consent.

    1. In order to avoid consent fatigue, a PIC must properly identify the lawful basis for processing prior to the collection of personal data. If the processing falls under another lawful basis under the DPA, then a request for consent is unnecessary.
    2. A PIC shall minimize the risk of consent fatigue of its target data subjects.

  • C. Just-in-time and Layered Notices. The usage of just-in-time and layered notices in presenting the relevant information to the data subject shall be the default format.

SECTION 10. An indication of will. Consent must be expressly given through a clear assenting action that signifies agreement to the specific purposes of the processing of personal data as conveyed to the data subject at the time consent was given.15

  • A. Implied consent. Consent can never be assumed. Non-response or implied consent does not constitute valid consent. “Implied consent,” for the purposes of this Circular, refers to consent given by action or inaction which is only inferred from the surrounding circumstances when it was given.
  • B. Action of the data subject. Assenting actions are those that indicate agreement to processing activity as described in the information provided by the PIC. A PIC must provide clear information to the data subject on what a particular action means prior to requesting for the data subject’s consent.
  • C. Continued use of service. Provided that all the elements of consent are present, and the PIC provides the data subject with information on the processing of personal data for a specific service, the continued use of the PIC’s specific service is an assenting action signifying consent.

SECTION 11. Evidenced by written, electronic, or recorded means. A PIC must ensure that the consent obtained from a data subject is evidenced by written, electronic, or recorded means. Any of the three formats may be adopted by a PIC. There is no preference among the different formats.

SECTION 12. General Considerations. A PIC shall obtain the consent of the data subject in a manner that complies with all the requisites for valid consent.16 A PIC may also acquire consent from a data subject’s lawful representative, or an agent specifically authorized for that specific purpose.

  • A. A PIC must be able to demonstrate, with sufficient evidence, that the data subject has consented to the processing of personal data for the particular purpose. While there is a requirement to be able to demonstrate that the PIC has obtained consent, this should not in itself lead to additional or excessive personal data processing. A PIC should only keep enough data to show that consent was obtained in relation to a specific processing.17
  • B. Any evidence, in accordance with the Rules of Court, shall be sufficient, provided that the following are established:
    1. The information on the processing of personal data presented to the data subject;
    2. The PIC provided the data subject with the information on personal data processing at the time the consent was given; and
    3. The data subject performed an act to signify their consent in relation to the information they were provided.

SECTION 13. General Considerations. Consent can be withdrawn at any time and without cost to the data subject, subject to certain limitations as may be provided for by law, regulation, or contract. Should a data subject choose to exercise the right to withdraw consent to the processing and if there is no other lawful basis justifying the continued processing, a PIC is obliged to stop the processing without undue delay, terminate any processing activity including the provision of services relying on that consent, and delete the personal data.

  • A. A PIC shall ensure that withdrawing consent is as easy as, if not easier than, giving consent. A PIC is obliged to implement simple procedures to enable the data subject to exercise the right to erasure, including to suspend, withdraw or order the blocking, removal, or destruction, of personal data from the PIC’s repository. When the right to erasure is exercised, a PIC may employ manual or technical means for the effective management of the consent withdrawal across all its personal data processing systems.
  • B. A PIC shall avoid utilizing or switching to another interface for the sole purpose of consent withdrawal since this would require undue effort from the data subject unless it will result in an easier manner to withdraw consent.18 Where consent is obtained or recorded via electronic means through a mouse-click, swipe, or keystroke, the data subject should be able to withdraw the consent as easily as, if not easier than, it was given.19 The use of a service-specific user interface for obtaining consent (e.g., application or a log-in account) should also be the one used for withdrawing consent.20
  • C. A PIC shall provide the data subject with adequate information on the scope and consequences of the withdrawal of consent at the beginning of the processing and at that point when the consent is to be withdrawn. This includes informing the data subject of any further processing of personal data, its purposes, and the corresponding lawful bases relied on for those other purposes.
  • D. Where consent is withdrawn by the data subject, the withdrawal shall not affect the lawfulness of the processing before the withdrawal of such consent.
  • E. A PIC shall determine and implement a reasonable retention period for personal data after the data subject withdraws consent, taking into account the other lawful bases for processing, industry best practices or standards, and other relevant factors.

GUIDELINES ON SPECIFIC PROCESSING ACTIVITIES

SECTION 14. Direct Marketing. Processing for direct marketing purposes may require consent in certain instances.

  • A. When processing is limited to personal information, a PIC may consider direct marketing as a legitimate interest under Section 12 (f) of the DPA and the processing will not require the consent of the data subject. The PIC must conduct an assessment whether direct marketing falls under its legitimate interest. If the result of the assessment reveals otherwise, the PIC may process personal information based on consent.
  • B. A PIC shall obtain the consent of the data subject for direct marketing in cases where the nature of the processing would significantly affect the rights and freedoms of the data subject.
  • C. If the basis for processing is consent and the consent is withdrawn, a PIC cannot claim legitimate interest to continue processing. The rights of the data subject to withdraw consent and to object to the processing, in this case, is absolute.

SECTION 15. Data sharing. Where data sharing is based on consent, a PIC shall ensure that the data subject is provided with specific information regarding the data sharing arrangement and that the data subject specifically and knowingly consents to such data sharing and the purpose of the data sharing arrangement.

  • A. Each affected data subject shall be provided with the relevant information before their personal data is shared or at the next practical opportunity, through a consent form or its equivalent, including the identities of the PICs who are parties to the data sharing arrangement, when already known. Otherwise, the categories of recipients should be provided at the outset: provided, that further details should be made available to the data subject through an appropriate privacy notice.
  • B. Where consent was obtained by one PIC who is a party to a data sharing arrangement, the other PIC may rely on such consent given: provided, that all parties to the sharing arrangement shall be accountable for upholding the exercise of the rights of the data subjects.
  • C. The records related to the data sharing arrangement shall contain the proof of consent obtained from the data subject, including the date and time it was obtained or withdrawn, where applicable.

SECTION 16. Research. Processing of personal data for research purposes shall comply with the requirements of applicable laws, regulations, and ethical standards,21 including but not limited to, obtaining an informed consent from the data subject, unless the processing may be justified by other lawful criteria provided under the DPA or as a special case under Section 4 of the DPA.

  • A. The DPA grants the processing of personal data for research purposes with flexibility, as the law recognizes that research is critical to nation-building and serves the interest of the public, especially if the same is conducted by government agencies, non-governmental organizations, academic institutions, or similar entities.
  • B. If obtaining consent before the gathering of information will affect the results of the research, a PIC should obtain the consent of the data subject within a reasonable time from the conclusion of the gathering of relevant information. The consent should be to validate the prior collection of information and for the further processing of the information collected.
  • C. The conduct of research does not always require obtaining of consent in the following instances:
    1. Research conducted through observation of public behavior does not require consent unless the research will disclose the personal data of the observed research subjects.
    2. The conduct of research where the end results will be anonymized and will only disclose the general demographic of the research subjects does not require the consent of the data subject.
  • D. Certain rights of the data subject may also be limited according to the standards prescribed by the PIC where such limitation is necessary to maintain research integrity.

SECTION 17. Publicly available information. The fact that the data subject provided personal data in a publicly accessible platform does not mean that blanket consent has been given for the use of their personal data for whatever purposes. Any processing of publicly available information must still find basis under Sections 12 and 13 of the DPA.

SECTION 18. Profiling and automated processing. A PIC shall inform the data subject of the existence and specific details of the profiling or automated processing of personal data before its entry into the processing system of the PIC, or at the next practical opportunity.

  • A. PICs engaged in any wholly or partly automated processing operations are required to notify the Commission, pursuant to the Circular on the notification regarding automated decision-making or profiling, and the data subject, in accordance with Section 16(c)(6) of the DPA;
  • B. A PIC shall ensure that there are safeguards against the harms of extensive profiling such as discriminatory outcomes and infringement on the right to fair treatment; and
  • C. A PIC shall obtain the consent of the data subject when automated processing is the sole basis for a decision that produces legal effects on or may significantly affect the data subject.

MISCELLANEOUS PROVISIONS

SECTION 19. Consent as an essential element of contracts. The processing of sensitive personal information through a contract between a PIC and a data subject is understood to be processing based on consent of the data subject under Section 13 (a) of the DPA as long as the contract entered into complies with the requirements for consent under the DPA.

SECTION 20. Waiver of the rights of the data subject. A waiver by a data subject of his or her data privacy rights, including the right to file a complaint, is void.

SECTION 21. Period for validity of consent. Generally, consent remains valid as long as the information communicated in relation to the scope, purpose, nature, and extent of the processing remains and still holds true.

  • A. If the scope, purpose, nature, and extent of the processing involved changes or evolves considerably, then the original consent given is no longer valid. A PIC shall obtain new consent in accordance with the revised or updated information on the processing of personal data.
  • B. A PIC shall determine whether it is still reasonable to treat the consent as an ongoing indication of the data subject’s current choices based on the context in which consent was originally given and the nature of its relationship with the data subject. However, consent that is clearly only intended to cover a certain period of time or a particular context will not be equivalent to an ongoing consent for all future processing of personal data.
  • C. The validity of consent shall depend on the PIC’s compliance with the general data privacy principle of transparency for the processing. The sufficiency of the disclosures made by a PIC shall be examined based on what an average member of its target audience can understand, taking into consideration the language that was used.
  • D. Obtaining consent shall not be a one-time compliance on the part of a PIC. Consent should be an actively managed choice on the part of the data subject. A PIC must offer the data subject a mechanism to exercise ongoing preference and control over the consent given.
  • E. Where a data subject enters into a contract and subsequently cancels, terminates, or unsubscribes from it, the consent given to process personal data for that purpose shall also be terminated.
    1. Processing of personal data may continue should there be another lawful basis for processing the personal data based on Section 12 and 13 of the DPA, except for direct marketing.
    2. A PIC shall have the burden of determining and proving the appropriate lawful basis to continue such processing and inform the data subject of the lawful basis for continued processing.

SECTION 22. Interpretation. Any doubt in the interpretation of any provision of this Circular shall be liberally interpreted in a manner mindful of the rights and interests of the data subject.

SECTION 23. Penalties. The processing of personal data in violation of this Circular shall carry criminal, civil, and administrative liabilities pursuant to the provisions of the DPA, its IRR, and related issuances of the Commission.

SECTION 24. Transitory Provisions. All affected PICs shall be given a period of one hundred eighty (180) calendar days from the effectivity of these Guidelines to comply with the requirements provided in Sections 3(D), 9(C), and 13 of this Circular.

SECTION 25. Separability Clause. If any portion or provision of this Circular is declared null and void, or unconstitutional, the other provisions not affected thereby shall continue to be in force and effect.

SECTION 26. Repealing Clause. All other rules, regulations, and issuances contrary to or inconsistent with the provisions of this Circular are deemed repealed or modified accordingly.

SECTION 27. Effectivity. This Circular shall take effect fifteen (15) calendar days after its publication in the Official Gazette or a newspaper of general circulation.

Approved:

SGD.
JOHN HENRY D. NAGA
Privacy Commissioner

SGD.
LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner

SGD.
NERISSA N. DE JESUS
Deputy Privacy Commissioner

Footnotes

  1. Article 29 Working Party, Guidelines on consent under Regulation 2016/679, Adopted on 28 November 2017. See also European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, Adopted on 4 May 2020, available at: https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf (last accessed on 2 February 2023). ↩

  2. Id. ↩

  3. Philippine Health Research Ethics Board Ad Hoc Committee for Updating the National Ethical Guidelines, National Ethical Guidelines for Health and Health Related Research, Introduction, p. 5 (2017). ↩

  4. JVA v. UXXX, NPC Case No. 19-498, 9 June 2020, available at: https://www.privacy.gov.ph/wp-content/uploads/2022/01/Decision-NPC-Case-No.-19-498-JVA-v.-UXXX.pdf (last accessed: 2 February 2023). ↩

  5. See JRG v. CXXX Lending Corporation, NPC Case No. 19-450, 9 June 2020, available at: https://www.privacy.gov.ph/wp-content/uploads/2022/01/Decision_NPC-19-450-JRG-v.-CXXX.pdf (last accessed: 2 February 2023). ↩

  6. NPC Case No. 19-531, 21 May 2020, (NPC 2020) (Unreported). ↩

  7. JRG v. CXXX Lending Corporation, NPC Case No. 19-450, 9 June 2020, available at: https://www.privacy.gov.ph/wp-content/uploads/2022/01/Decision_NPC-19-450-JRG-v.-CXXX.pdf (last accessed: 2 February 2023). ↩

  8. JV v. JR, NPC Case No. 17-047, 13 August 2019, available at: https://www.privacy.gov.ph/wp-content/uploads/2020/10/CID-17-047-JV-v.-JR-Decision-PSD-10Aug2020.pdf (last accessed on: 2 February 2023). ↩

  9. MNLC, Inc. v. IKP, NPC Case No. 19-528, 29 October 2020, available at: https://www.privacy.gov.ph/wp-content/uploads/2022/01/Decision_NPC-19-528-MNLC-v.-PXXX-Corporation.pdf (last accessed: 2 February 2023). ↩

  10. Dia v. St. Ferdinand Memorial Park, Inc., as cited in Cabanting v. BPI Family Savings Bank, Inc., G.R. No. 201927, 17 February 2016. ↩

  11. VVC v. CJB, NPC Case No. 19-134, 10 Dec. 2021, available at: https://www.privacy.gov.ph/wp-content/uploads/2022/04/NPC-19-134-VVC-v.-CJB-Decision-2021.12.10.pdf (last accessed: 7 February 2023). ↩

  12. In re: FLI Operating ABC Online Lending Application, NPC Case No. 19-910, 17 December 2020, available at: https://www.privacy.gov.ph/wp-content/uploads/2021/02/NPC-19-910-In-re-FLI-Decision-LYA-Final-pseudonymized-17Dec2020-.pdf (last accessed: 6 February 2023). ↩

  13. AMP v. HXXX Lending Inc., NPC Case No. 19-621, 19 November 2020, available at: https://www.privacy.gov.ph/wp-content/uploads/2022/01/Decision_NPC-19-621-AMP-v.-HXXX-Lending.pdf (last accessed: 6 February 2023). ↩

  14. JVA v. UXXX, NPC Case No 19-498, at 8. ↩

  15. JVA v. UXXX, NPC Case No 19-498, at 8. ↩

  16. Id. ↩

  17. See: European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679 Version 1.1, Adopted on 4 May 2020, available at https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf (last accessed 2 February 2023). ↩

  18. Ibid. ↩

  19. See: European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, Adopted on 4 May 2020. ↩

  20. Ibid. ↩

  21. See among others: (1) Philippine Health Research Ethics Board, National Ethical Guidelines for Research Involving Human Participants 2022, available at https://ethics.healthresearch.ph/index.php/2012-04-19-05-10-10/451-the-advance-copy-of-the-2022-national-ethical-guidelines-for-research-involving-human-participants-is-now-available and National Ethical Guidelines for Health and Health-Related Research 2017, available at https://ethics.healthresearch.ph/index.php/references; (2) DOST, DOH, CHED, and UP Manila, Joint Memorandum 2012-001 - Requirement for Ethical Review of Health Research Involving Human Participants, available at https://ethics.healthresearch.ph/index.php/2012-04-19-05-10-10/170-joint-memo-2012-001. ↩

Backlinks