On November 7, 2023, the National Privacy Commission (NPC) published, following its public consultation, the NPC Circular No. 2023-04 Guidelines on Consent. In particular, the Circular applies to personal information controllers (PICs) engaging in the processing of personal data based on the consent of the data subject.

Transparency

The Circular provides that PICs must ensure that data subjects are aware of the nature, purpose, and extent of processing of their personal data, including:

• specific information, such as the personal data to be processed, the purpose, nature, extent, duration, and scope of processing for which consent is used as a legal basis, the identity of the PIC, the existence of the rights of the data subject, and how these rights can be exercised;
• timing: information should be provided at the moment when consent is obtained; and
• clarity: PICs should use clear, plain, consistent, and straightforward language when providing information to the data subject.

Forms and statements

The Circular explains the differences among various forms and statements. For instance, the Circular details that a privacy statement corresponds to a general statement of a PIC's personal data processing activities, while a privacy policy is a set of policies that governs a PIC's personal data processing practices for internal parties, e.g., employees.

Elements of consent

The Circular also stipulates elements of consent, including that it must be:

• freely given;
• specific;
• informed;
• an indication of will; and
• evidenced by written, electronic, or recorded means.

In addition, the Circular establishes general considerations for obtaining and withdrawing consent. Finally, the Circular also outlines considerations for using consent as a legal basis for the processing of personal data for direct marketing, data sharing, research, publicly available information, and profiling and automated processing.

You can read the Circular here.