The right to be informed

An individual had been involved in an incident inside and outside a Manila restaurant where his wallet was stolen. He also suffered minor injuries in the incident. He requested access to the restaurant CCTV footage relating to himself, saying he wants to see all details surrounding the incident and possibly figure out a way to recover his wallet. He tried to personally speak to the manager but was referred to the security guard. After a few days of following up on his request, he was finally informed that the establishment would not provide him any data. This infuriated him and, upon going back to the restaurant, he demanded his right to view the footage or else he would create a scene. He was told that, as per their security policy, no “outsider” is allowed to enter areas in their establishment designated only as “for employees only”. As a compromise, the manager said they will give him a record of the footage using the customer’s handheld gadget.

To protect your privacy, the Philippine data privacy law explicitly require organizations to notify and furnish you the following information before they enter your personal data into any processing system (or at the next practical opportunity at least):

• Description of the personal data to be entered into the system

• Exact Purposes for which they will be processed (such as for direct marketing, statistical, scientific etc.)

• Basis for processing, especially when it is not based on your consent

• Scope and method of the personal data processing

• Recipients, to whom your data may be disclosed

• Methods used for automated access by the recipient, and its expected consequences for you as a data subject

• Identity and contact details of the personal information controller

• The duration for which your data will be kept

• You also have to be informed of the existence of your rights as a data subject.

• In recording a conversation or interview with someone, it is enough to verbally ask for a direct consent from an individual data subject. If the subject yields, it would be useful to also mention as part of the recorded conversation that the subject knows the conversation is being recorded and that you asked and were given the consent. It would even be better if you could get the subject to verbally confirm his consent.

• Banks involved in phone banking tell their callers that the conversation with their call center agent would be recorded, and that proceeding with the call is indication of their consent. This practice is considered sufficient notice.

• Websites resort to publishing a Privacy Notice page, which essentially accomplishes the same thing. Similar privacy notices should be made in public establishments equipped with security CCTVs.

• Whenever anyone is making an audio or video recording of you, or even just taking your pictures, you have a right to know, and you must always be given the chance to opt out when you don’t feel comfortable.

• A salesman may be collecting detailed personal data about you and your family without your permission, under the pretext of targeting you as a prospective customer to tailor-fit their offerings to your individual needs. This, by itself, may be potentially beneficial to you. But since your personal privacy and safety becomes potentially at risk, you have a right to be informed if you are being individually targeted in a sales campaign like this.