Are Cookie Banners required under Philippine Data Privacy Laws?

Are Cookie Banners Required under Philippine Data Privacy Laws.

Different jurisdictions, different laws – this is the problem which the realm of International Law has attempted to cushion. In a bricks and mortar setting, the issues between conflicting provisions of laws from different countries is less of an issue. However, in the realm of International Law, the situation can be much more complex. There are many legal systems and many different laws enforced by each individual country. The situation is further complicated when trying to navigate the various international treaties which have been put in place between different nations.

In the borderless realm of the internet and cyberspace, there is even more confusion. A website in Asia can be accessed through a browser operated in the European Union. This is when problems arise. Thus, it is vital to note the little nooks and crannies of navigating through the world of laws from different countries, especially when you are operating your business in cyberspace.

For purposes of this article, we clarify a common requirement, which in some countries, may render a business operating without one illegal. At least, insofar as the Philippines is concerned, you do not need cookie banners or preference centers. If your website does not have a cookie banner, and you operate primarily in the Philippines, you are of course in luck. Also, in the Philippines, you do not need to have a preference center. If your website does not have a preference center and you operate primarily in the Philippines, you are also course in luck. In some countries however, these things are required by law.

The Data Privacy Act does not mandate or require the use of cookie banners or preference centers, so long as the data subject was sufficiently appraised of the processing and collection of his personal data, and his/her consent was secured in the manner required by the law and its IRR.

In their Advisory Opinion No. 2017-047, the Data Privacy Commission expounded on the use of cookie banners and pop-ups as such:

“While the inclusion of privacy policy is necessary to demonstrate adherence to the data privacy principle of transparency and uphold the right to information of the data subjects, the law does not provide for a specific format or approach for the personal information controller (PIC) or personal information processor (PIP) to adopt on how this should be properly manifested.

Instead, the law sets out a general principle, under Section 18(a) of the Implementing Rules and Regulations (IRR) of the DPA (2012), to wit:

x  x  x  x

From the foregoing guidelines, it is upon the discretion of the PIC or PIP if such incorporation of additional means of informing the data subjects through pop-ups in the website, would still be beneficial in complying with the DPA, and upholding data subjects’ rights. We only wish to emphasize that the statement of the privacy policy should be adequate, accessible, and comprehensible.

This being said, the use of pop-ups, while not required, may serve as notice to data subjects that is immediately accessible. In using pop-ups, the PIC or PIP must also be mindful of user experience, and how pop-ups should not detract from the functional use of the website.” (Emphasis supplied)

Therefore, the Data Privacy Law does not mandate the use of cookie banners or preference centers if the data subject was sufficiently appraised of the company’s data privacy policy, and the general principles enumerated under Section 18, Rule IV of the Data Privacy Act’s IRR are met in its privacy policy.

Of course, while not required, it is suggested as a best practice to have a cookie banner or preference center. While not required in the Philippines, your customers or clients might be from the nations of the world, where such is a legal requirement.

As they say, better safe than be sorry.

About Nicolas and De Vega Law Offices

If you have issues on data privacy or information technology law or   corporate law, commercial law, corporate or commercial litigation, or civil or other criminal law-related issues,  we can help you. Nicolas and de Vega Law Offices is a full-service law firm in the Philippines.  You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines.  You may also call us at +632 84706126, +632 84706130, +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com.

SEARCH