Privacy Policy Office Advisory Opinion No. 2018-013
Privacy Policy Office Advisory Opinion No. 2018-013
18 April 2018
This refers to your inquiry received by the National Privacy Commission (NPC) via email.
You sought for clarification on the compliance of an insurance company with the
requirements of Republic Act No. 10173,1 otherwise known as the Data Privacy Act of 2012
(DPA) and its Implementing Rules and Regulation (IRR), in relation to a privacy policy
submitted by the said insurance company pursuant to the requirement under Insurance
Commission (IC) Circular Letter (CL) No. 2014-47 - Guidelines on Electronic Commerce of
Insurance Products. A copy of the privacy policy is attached herewith as Annex “A.”
In addition, you mentioned that since this transaction is done electronically, and the customer
will just click the agree/disagree portion provided for in the online transaction, you ask if this
is considered compliant with the DPA.
At the outset, it must be clarified that the submitted “privacy policy” should be referred to as
the company’s privacy notice. A privacy notice is a statement made to a data subject that
1An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the
Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes, “Data Privacy Act of 2012”
(15 August 2012).
Having stated that, there is also a need to determine and clarify the distinction between
privacy policy and securing the consent of the data subject for the processing of his or her
personal information.
Being a mere notice, it is emphasized that the privacy policy or notice is not equivalent to
consent. This document is an embodiment of the observance of the data privacy principle of
transparency and upholding the right to information of data subjects.
The principle of transparency adhered to by the DPA dictates that the data subject must be
aware of the nature, purpose, and extent of the processing of his or her personal data,
including the risks and safeguards involved, the identity of personal information controller,
his or her rights as a data subject, and how these can be exercised.4 Any information and
communication relating to the processing of personal data should be easy to access and
understand, using clear and plain language.5
Thus, in line with the right to information of the data subject, personal information controllers
(PICs) are required to apprise the data subject of the following:
On the other hand, obtaining consent from the data subject for the purposes of processing his
or her personal data is a different requirement altogether.
Consent of the data subject refers to any freely given, specific, informed indication of will,
whereby the data subject agrees to the collection and processing of his or her personal,
sensitive personal, or privileged information.
When the processing of personal information is based on consent, the PIC must obtain the
consent in relation to the declared purpose for processing. The consent must likewise be
evidenced by written, electronic or recorded means.6
We reiterate that the mere posting of a PIC’s privacy policy or notice and requiring the
consumers to agree thereon via the online platform does not equate to obtaining the consent
In addition, we refer to the IC’s CL No. 2014-47 which provides for the requirement for
consumers’ consent as follows:
8.6 When consumer's consent to the collection, use and disclosure of personal
information is required, and cannot reasonably be implied, such consent shall be:
(a) Provided separately from consent to other terms and conditions of the
insurance contract; and
(b) Provided through a clearly worded, online opt-in process.
8.7 The consent of the consumer may also be included in the application or
executed in a separate paper form.” (underscoring supplied)
From the foregoing, the insurance company’s privacy policy conforms to the requirements of
the DPA and need not be revised.
Nonetheless, the IC may direct the insurance company to create a separate form or opt-in
process in the online transaction for securing the consent of the consumers to the processing
of his or her information, if consent is the proper basis for processing personal data.
Noted by: