777JILI Consent Form: Five Tests for a Sign-Up Tick-Box
RA 10173 Section 3(b) calls consent a freely given, specific, informed indication of will, and NPC Circular 2023-04 adds that it can be withdrawn at any time and without cost.
Key facts and contents
- 777JILI Data Breach
- NPC Circular 16-03 defines a personal data breach as a security breach that leads to loss, alteration, unauthorized disclosure or access, and gives the controller 72 hours to notify the Commission and, where the conditions are met, you.
- 777JILI Data Subject Rights
- RA 10173 Sections 16 and 18 and the IRR's Section 34 give a data subject eight rights: to be informed, to be furnished the information, access, object, rectification, erasure or blocking, damages, and data portability.
- 777JILI Privacy Notice
- The IRR of RA 10173, Section 34(a)(2), lists nine items you are to be told before your personal data enters a system or at the next practical opportunity, from a description of the data to your right to complain to the Commission.
A consent form is the place where your agreement to a collection of personal information is recorded, and on a sign-up page it is usually a single tick-box. Philippine law sets a short list of tests that a tick-box has to pass, and you can run them yourself before you press the button.
What RA 10173 means by consent
RA 10173 §3(b) says consent of the data subject refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about or relating to him or her. It says consent shall be evidenced by written, electronic or recorded means. NPC Circular 2023-04, “Guidelines on Consent”, dated 07 November 2023, turns each of those words into a section, and the IRR’s Rule IV §19(a)(1) adds that consent must be time-bound to its declared purpose and that consent given may be withdrawn.
The five tests, one section each
| Word in §3(b) | Circular 2023-04 section | What it asks of the tick-box |
|---|---|---|
| Freely given | §7 | A genuine choice, with no pressure or adverse consequence for refusing |
| Specific | §8 | Granular purposes; no vague or blanket statement |
| Informed | §9 | Information a reader of the target audience can understand |
| Indication of will | §10 | A clear assenting action; consent can never be assumed |
| Evidenced | §11 | Written, electronic or recorded; no preference among the three |
Reading a tick-box in four checks
Run these in order, and stop at the first one that fails.
- Is the box empty until you act? Section 10(A) says non-response or implied consent is not valid consent.
- Are the purposes listed separately? Section 8 says unrelated purposes are presented as a list that you can pick from, and §8(B) says consent to processing not necessary for the goods or services should not be bundled with them.
- Can you read it in your own language? Section 9(A) points the controller to the most suitable language or dialect for the intended data subject.
- Does it say what the processing is for, and who gets the data? That is the content of the privacy notice items, which must reach you before the box does its work.
Consent and marketing messages
Circular 2023-04 §14 says processing for direct marketing may require consent in certain instances. Where consent is the basis and is withdrawn, §14(C) says a controller cannot claim legitimate interest to continue, and that your right to withdraw consent and object is absolute in that case. So treat marketing as its own question:
- Look for a separate tick for promotional messages, apart from the tick for the service.
- Leave it empty if you want no promotions, since §8(B) says unneeded processing is not to be a condition of the service.
- If you tick it, expect to withdraw later through the same control, per §13(B).
Withdrawing consent
Section 13 says consent can be withdrawn at any time and without cost to the data subject, subject to limits in law, regulation or contract. If no other lawful basis justifies continued processing, the controller must stop without undue delay, end the processing including services relying on the consent, and delete the personal data. Section 13(B) says the same interface used to give consent, such as a log-in account, should be the one used to withdraw it.
| Step | What to do | Section |
|---|---|---|
| 1 | Find the page where you gave consent and look for the same control | §13(B) |
| 2 | Withdraw in writing if no control exists, and keep a copy | §13 |
| 3 | Ask what withdrawing ends, since §13(C) requires information on its scope and consequences | §13(C) |
| 4 | Follow up with a request under your data subject rights if the data remains | RA 10173 §16(e) |
When the consent you gave goes stale
Section 21 of Circular 2023-04 says consent generally remains valid as long as the information given about scope, purpose, nature and extent still holds true. If those change considerably, §21(A) says the original consent is no longer valid and new consent is to be obtained on the updated information. Match the change to the effect:
| What changed after you ticked | Effect under §21 |
|---|---|
| Nothing about scope, purpose, nature or extent | Consent generally remains valid |
| Any of those changed considerably | The original consent is no longer valid; new consent is to be obtained |
FAQ
Is a pre-filled or silent consent form valid?
NPC Circular 2023-04 Section 10(A) says consent can never be assumed, and that non-response or implied consent does not constitute valid consent. A clear assenting action is expected.
Can a website bundle all its purposes into one tick?
Section 8 of the circular says consent must be granular, with the list of purposes shown so you can select which you agree to, and that vague or blanket consent is invalid.
How do I take my consent back?
Section 13 says consent can be withdrawn at any time and without cost to the data subject, and §13(A) says withdrawing must be as easy as, if not easier than, giving it.
Can a form make me give up my right to complain?
Section 20 of the circular says a waiver by a data subject of data privacy rights, including the right to file a complaint, is void.