require consent as a condition of providing a product or service “beyond what is
reasonable to provide the product or service”, or obtain consent by providing “false
or misleading information” or “using deceptive or misleading practices”.
52 Indeed,
consent obtained under such circumstances is invalid.
53
Factors in determining whether it is reasonable for an organisation to require
consent as such a condition of providing a product or service include: the amount
and type of personal data sought; the purpose of the collection, use or disclosure of
the personal data; the nature of the item being provided, including whether there is
any benefit tied to the item (e.g. whether the item is being provided without monetary
payment to the organisation); and what a reasonable person would consider appropriate in the circumstances.
54
When Consent Is Not Required Consent is not required if: (a) the individual is
deemed to have given consent; or (b) an exception applies.
55
(a) Deemed Consent. An individual is deemed to have consented to the collection,
use or disclosure of his/her personal data for a purpose if the individual voluntarily
provides such data to the organisation for that purpose, and it is reasonable that the
individual would voluntarily provide the data.
56 Additionally, if the individual gives
(or is deemed to give) consent for disclosure of his/her personal data by one
organisation to another organisation for a particular purpose, he/she is deemed to
consent to the collection, use or disclosure of such data for such purpose by that other
organisation.
57
Pursuant to a public consultation in July 2017, there will be an additional category
of consent termed “Deemed Consent by Notification”.
58 This will be allowed where:
• the organisation notifies individuals of the purpose of collecting, using and
disclosing their data;
• the individual is provided a reasonable time period to opt-out but does not opt-out
within the time period; and
52 PDPA s 14(2).
53 PDPA ss 14(2)-(3).
54 PDPC Advisory Guidelines on Requiring Consent for Marketing Purposes para 5.2. For example,
“organisations may provide offers, discounts or lucky draw opportunities to individuals that are
conditional on the collection, use or disclosure of their personal data for specified purposes”. PDPC
Advisory Guidelines on Requiring Consent for Marketing Purposes para 7.2.
55 PDPA s 13.
56 PDPA s 15(1).
57 PDPA s 15(2). For instance, if an individual booking a taxicab is asked for his/her name and
telephone number in order to inform him/her of the taxicab number, and the individual voluntarily
provides such information, then the individual is deemed to have consented to the taxicab company
using his/her name and number to notify him/her when the taxicab arrives. However, the individual
is not deemed to have consented to the use of his/her name and number for other purposes, e.g. the
marketing of a limousine service run by the cab company. PDPC Advisory Guidelines on Key
Concepts para 12.24.
58 Response to Feedback on the Public Consultation on Approaches to Managing Personal Data in
the Digital Economy Part II.
314
E.-I. Ong
reasonable to provide the product or service”, or obtain consent by providing “false
or misleading information” or “using deceptive or misleading practices”.
52 Indeed,
consent obtained under such circumstances is invalid.
53
Factors in determining whether it is reasonable for an organisation to require
consent as such a condition of providing a product or service include: the amount
and type of personal data sought; the purpose of the collection, use or disclosure of
the personal data; the nature of the item being provided, including whether there is
any benefit tied to the item (e.g. whether the item is being provided without monetary
payment to the organisation); and what a reasonable person would consider appropriate in the circumstances.
54
When Consent Is Not Required Consent is not required if: (a) the individual is
deemed to have given consent; or (b) an exception applies.
55
(a) Deemed Consent. An individual is deemed to have consented to the collection,
use or disclosure of his/her personal data for a purpose if the individual voluntarily
provides such data to the organisation for that purpose, and it is reasonable that the
individual would voluntarily provide the data.
56 Additionally, if the individual gives
(or is deemed to give) consent for disclosure of his/her personal data by one
organisation to another organisation for a particular purpose, he/she is deemed to
consent to the collection, use or disclosure of such data for such purpose by that other
organisation.
57
Pursuant to a public consultation in July 2017, there will be an additional category
of consent termed “Deemed Consent by Notification”.
58 This will be allowed where:
• the organisation notifies individuals of the purpose of collecting, using and
disclosing their data;
• the individual is provided a reasonable time period to opt-out but does not opt-out
within the time period; and
52 PDPA s 14(2).
53 PDPA ss 14(2)-(3).
54 PDPC Advisory Guidelines on Requiring Consent for Marketing Purposes para 5.2. For example,
“organisations may provide offers, discounts or lucky draw opportunities to individuals that are
conditional on the collection, use or disclosure of their personal data for specified purposes”. PDPC
Advisory Guidelines on Requiring Consent for Marketing Purposes para 7.2.
55 PDPA s 13.
56 PDPA s 15(1).
57 PDPA s 15(2). For instance, if an individual booking a taxicab is asked for his/her name and
telephone number in order to inform him/her of the taxicab number, and the individual voluntarily
provides such information, then the individual is deemed to have consented to the taxicab company
using his/her name and number to notify him/her when the taxicab arrives. However, the individual
is not deemed to have consented to the use of his/her name and number for other purposes, e.g. the
marketing of a limousine service run by the cab company. PDPC Advisory Guidelines on Key
Concepts para 12.24.
58 Response to Feedback on the Public Consultation on Approaches to Managing Personal Data in
the Digital Economy Part II.
314
E.-I. Ong