- Can I use publicly available personal data like those found on Facebook?
No. While it’s true that the owner made his data freely available to the public, it does not mean that you have permission to use it for your own purpose. In Advisory Opinion No. 2017-41, the National Privacy Commission says:
[E]ven if the data subject has provided his or her personal data in a publicly accessible platform, this does not mean he or she has given blanket consent for the use of his/her personal data for whatever purposes.
- Are visitor logbooks covered by the Data Privacy Act?
Yes. Visitor logbooks contain, at the very least, the names and signature of visitors, which are personal information. To comply with the law, please have a privacy notice, collect only the information you need, and of course secure the logbook—closed it, if no one is registering. If possible, cover the earlier entries.
- Under the DPA, can employers still notify the public that a certain employee has left the company?
Yes. But be sure that you will only publish the necessary data, such as the employee’s name, photograph, former position, and the date of termination. This one has also been addressed by the NPC. In advisory Opinion No. 2019-024:
The basis for processing [referring to the act of publishing termination notices] may be Section 12(f) which provides for the processing that is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.
x x x
From the foregoing, while such public notices may be allowed under the DPA, we wish to emphasize the data privacy principle of proportionality, which requires that the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.
Hence, it is suggested that only the following details of the former employee be published: full name, facial image, previous designation or position in the company, and effectivity date of the employee’s separation from the company. To indicate the grounds for the employee’s separation or termination from the company, i.e., cases filed against him or her, and other additional information, i.e., home address, email address, mobile number, etc. may no longer be proportional to the primary purpose of the public notice.
- For direct marketing, can the marketer rely on implied consent? Can marketers use information for marketing communications and then just provide a free and easy mechanism to opt-out?
No. Implied or inferred consent is not recognized in the Philippines. Consent is defined under the law as freely given, specific, informed indication of will where the data subject agrees to the processing of his/her data. This consent must be evidenced by written, electronic, or other means. Marketers must not rely on a person’s inaction.
