On May 9, 2023, the National Privacy Commission (NPC) requested public comments on Draft Circular - Guidelines on Consent (the Draft Circular).

In particular, the Draft Circular applies to personal information controllers (PICs) engaging in the processing of personal data based on the consent of the data subject.

Transparency

The Draft Circular provides that PICs must ensure that data subjects are aware of the nature, purpose, and extent of processing of their personal data, including:

• specific information – such as the personal data to be processed, the purpose, nature, extent, duration, and scope of processing for which consent is used as a legal basis, the identity of the PIC, the existence of the rights of the data subject, and how these rights can be exercised;
• timing – information should be provided at the moment when consent is obtained; and
• clarity – PICs should use clear, plain, consistent, and straightforward language when providing information to the data subject.

Form

• Form – the above information should be provided in a:
  • privacy statement – a general statement of a PICs personal data processing activities;
  • privacy policy – a set of policies that governs a PICs personal data proceccing practices for internal parties; and
  • privacy notice – that contains essential information on a specific processing activity of a PIC that involves a data subject, with requirements including:
    • clear and plain language;
    • information to be concrete and definitive;
    • convey the appropriate privacy notice for the specific processing or transaction before the processing is to take place; and
    • use creative options such as dynamic or interactive infographics.
• Consent form – to include all information required in the privacy notice and indicate that the lawful criteria for processing relied on is consent.
• Timing – the privacy statement and notice is separate and distinct from obtaining the consent of the data subject in a consent form.
• Accessibility – information of processing of personal data must be easy to access and understandable.
• Accountability – PICs must be held responsible for the information provided to the data subject for the processing of personal data.

Elements of consent

The Draft Circular also stipulates elements of consent including that it must be:

• freely given;
• specific;
• informed;
• an indication of will; and
• evidenced by written, electronic, or recorded means.

In addition, the Draft Circular establishes general considerations for obtaining and withdrawing consent. Finally, the Draft Circular also outlines considerations for using consent as a legal basis for the processing of personal data for direct marketing, data sharing, research, publicly available information, and profiling and automated processing.

The Draft Circular enters into effect 15 days after its publication.

Public comments may be submitted to [email protected] until June 9, 2023.

You can read the Draft Circular here.