3 Data Privacy Complaints sent through direct and intermediary channels on professional contest joiners blacklist

Sent three (3) data privacy complaints through direct and intermediary channels where one is already addressed through employee sanction. Waiting for results from 2 others. This is in connection with the blacklist of professional online contest joiners.

Lessons learned and how can you spot data privacy violations:

1. Revelation of names and contact information. People's names and contact information are private. They should never be misused.
2. The information from #1 belongs to the companies in a business relationship. Employees should not even brag that they are in a possession of a list as they are indirectly violating company's confidentiality of information owned or in possession of.
3. If the information or data belongs from a previous employment, a person should not be in possession of it anymore as that constitutes data theft especially if shared that proves possession of such information.
4. The revelation of a business trade practice of an employer (past or present) should not be disclosed as that violates employee-employer contractual relationship. It also shows that you can't be trusted.
5. Lastly, if you care about the people around you, the values that your company represent (and if your action is "unbecoming" of it), provoking people to commit an illegal action anchoring on your powerful client-supplier relationship is grave abuse of authority.

Policies to note of:

• DTI-DAO 8 requires the protection of personal data in an information and communication system. The leakage of data, such as names and contact information, is a violation of this (Section 6 to 8). 
• It also violates the Consumer Act of the Philippines that has stated application on e-commerce transactions. Section 8 reminds entities of data privacy importance. Furthermore, the definition of e-commerce in our country refers to both commercial and non-commercial transactions.
• Data privacy breaches can be held accountable for violation of the E-Commerce Law (Section 32, 33 c & d).

Companies should note the following to protect itself from these occurrences:

1. Employee contract clearly explaining the meaning of "confidential information". The mere fact we have glitches today only shows that a lot of employees don't understand the gravity of this. 
2. Instill data privacy policies in your organization, implement it, and make it compliant under DTI-DAO 8.
3. Make employees sign a non-disclosure agreement for every project handled and a release document at the end of it fully understanding what can be and can't be disclosed.
4. Have clear sanctions on data privacy violations and be ready to sue if necessary to protect your company's reputation.

I pray that a satisfactory sanction shall be given by these companies involved against their employees who violated online contest joiners data.


I won't be posting names of people and companies involved. Only recording of lessons learned hoping that this will never happen again.

Registry of Online Contest Managers

With the issues surrounding DTI Sales Promotion Permit for online campaigns and efforts made by some to create a blacklist of professional online contest joiners, it is good to know that a lot recognizes the responsibility of a contest organizer to ensure that the rules are tight enough and managed well so it won't be abused by aggressive participants.

Voluntary listing of Online Contest Managers and Contractors

I am thinking that perhaps an online registry can be created, initially on a voluntary-basis, where online contest managers, either in-house or outsourced, are listed. These are the actual people who can be doing the following at the minimum:

1. Involved in crafting contest guidelines.
2. Manage the day-to-day operations and monitoring of the contest to ensure it complies with the mechanics.

A person, in order to be of good standing, can be based on the following:

1. Minimal complaints from contest joiners when a contest goes out of line or the contest manager violate the rules of its own contest. To be in a listing, it will require recommendation from x number of parties. To be removed from the listing, it will require x number of complaints which were found to be true after investigation.
2. Respect for personal data of those who joined online contest. DTI-DAO 8 requires the protection of personal data in an information and communication system. The leakage of data, such as names and contact information of undesirable contest joiners, is a violation of this (Section 6 to 8). It also violates the Consumer Act of the Philippines. Leakage of data reflects poor enforcement of data privacy provision of the companies whose contest they have manage or of the entities they have worked or currently working for. It will be disappointing if these companies won't take any action for such. They can even be held accountable for violation of the E-Commerce Law (Section 32, 33 c & d).

Admittedly, there is no perfect online contest manager. Mistakes get committed and effort is taken to correct them or make sure the lessons get applied to future contest handled. However, I began thinking that somehow this specific segment needs to be looked at more cautiously especially when #2 just happened lately.

Blacklist Professional Online Contest Joiners

Got a call from a prospective client requesting for a proposal to manage an online contest. He had one handling his campaigns in the past. Some went pretty well while some turned a bit messy due to participants gaming the system. Usually this occurs when the winner of a particular contest gets chosen based on the highest number of "like" votes especially if done via Facebook.

However, I was caught by surprise when he mentioned about excluding "professional online contest joiners" referring to a list he got online that includes names, contact number, and other info. Excluding means their entries will be disregarded or be prevented from joining. I am wary of such an idea as it might be perceived as violation of consumer rights. Furthermore, if permits will be secured in a contest, will DTI even tolerate such a thing?

When I asked to cite names of people in the list, it irked me as some I know personally and are very active inviting me lately from coffee brand Facebook application, fan page promotion, to photography contest.

It is the contest organizer's responsibility

I disagree with the idea of tagging people as "professional contest joiners". A good contest guideline or mechanics will ensure looking into scenarios that will avoid the contest from being "game" (such as creating fake accounts to spike up likes).

There are many suggestions to minimize an online contest from being "game" by aggressive participants such as:

1. If participation of usual contest joiners is not encouraged, then add that to the rules citing those who won in the past are excluded from joining to give others a chance. (if it is legally possible to do so).
   
2. Don't have "like" votes as one of the criteria for winning. Do not allow participants to cast a like vote for themselves and/or to other entries.
3. If "likes" included, give minor credit to it. Or only those who are fans of the Page prior to contest launch shall be allowed to vote only. You can also set maximum number of votes allowed in an hour or in a day. 
4. Another way for likes or votes is to have an authentication process. Assuring each person is real and shall cast votes only once.
5. Consistency in name of participant profile online and actual winner.
6. Make your contest tough enough where winners are determined based on creativity rather than by voting. Or require more effort to cast a vote rather than just click a button or two.

If a contest fails or gets controversial due to participants accusing others of "gaming" the system and the likes, the responsibility falls on the shoulders of its contest organizer. One is expected to have think through the contest guideline if it can be abused or manipulated.

It is unfair to pass the blame to participants who only wanted to compete and win. Blacklisting professional online contest joiners is definitely not a solution.

(P.S. I agree with your comment Dexter. Added that as #10 in my politics of blogging post.)

(P.S. After answering all your comments, I thought that perhaps creating a registry of online contest managers is now necessary.)

Do businesses, bloggers, individuals need a DTI permit to run an online contest even if there is no purchase required?

There has always been an assumption that if you run a contest or promotion, online or offline, getting a Department of Trade and Industry Sales Promotion Permit (DTI Permit) is not necessary if purchase of a product or service is not required.

However, Internet and Mobile Marketing Association of the Philippines (IMMAP) board member Michael Palacios recently had a meeting with the DTI (that got additional thoughts from IMMAP members) that implies such as necessary. The organization is currently reviewing the policy to arrive at a position or conclusion to further discuss the matter.

DTI DAO 10-02 series of 2010: Addenda to DAO 2 series of 1993 or the Rules and Regulations Implementing Rep...

Minutes of IMMAP's First Consultative Meeting with the DTI:

"1) Policy is not done with DTI; they implement the Consumer Act of the Philippines
2) The Consumer Act of the Philippines was last updated in 1992.
3) Cong Luis Villafuerte is currently redrafting the Consumer Act.
4) IMMAP offers to disseminate and communicate to our member companies.
5) DTI having difficulty implementing Consumer Act of the Philippines, with respect to group buying sites.
6) DTI cited dynamic pricing (like those of budget airlines) as problematic. Speed in general was a problem.
7) Facebook is a concern. There are problems using Facebook as promo platform.
8) The Consumer Act of the Philippines covers any raffling or contest activity, whether or not there is a sales requirement component.
9) Problem of creating multiple accounts for promos. No one should be able to influence the results of a promo, said DTI.
10) DTI does not allow "likes" as a determinant of a winner, because it can be influenced by artificial likes.
11) Hypothetical Example: A Brand does a "Tell Us Your Amazing Story Using Our Brand" testimonial campaign. Each testimonial is a raffle entry for an iPhone. At no point does it say "Buy Our Brand". DTI recommendation is to get covered by a DTI Permit.
12) DTI covers any raffling activity in the Philippines, including regional activities which happen to cover the Philippines. As long as someone in the Philippines is eligible, it would need a DTI Permit.
13) Back to Facebook, IMMAP asks: is DTI enforcing Facebook guidelines? DTI Response: we require accountability for a promo. Our job is to make sure that a consumer's rights are protected. 
14) DTI: show to us that the consumer is protected. "Show to us in layman's terms and convince that everything is protected. The database, the administrator, your provisions for data protection. Don't tell us that it's Facebook."
15) IMMAP was invited to form a working group with the DTI for training and consultation.
16) IMMAP will sponsor DTI personnel, into its Certified Digital Marketer Program.
17) Online coverage is understood to be a nationwide promo.
18) DTI only has 4 people looking at online promotions.
19) Only 5 group buying/daily deals websites currently secure DTI permits.
20) DTI needs to be sure that the promo operator owns the data.
21) DTI Violations: escalating penalties to client."

This is what Michael Palacios has posted in the IMMAP Group to summarize his observation:

Hi everyone, I know that everyone has questions about whether or not we should get a DTI Permit for our online promos. Well, IMMAP sat down with the DTI and the answer IMHO is pretty much "yes". Here's why: 

The DTI is an enforcement office, and it enforces the Consumer Act of the Philippines, last updated in 1992. I am reposting below the most salient points of this Act:
========
"Sales Promotion" means techniques intended for broad consumer participation which contain promises of gain such as prizes, in cash or in kind, as reward for the purchase of a product, security, service or winning in contest, game, tournament and other similar competitions which involve determination of winner/s and which utilize mass media or other widespread media of information. It also means techniques purely intended to increase the sales, patronage and/or goodwill of a product.

Art. 116. Permit to Conduct Promotion. - No person shall conduct any sales campaigns, including beauty contest, national in character, sponsored and promoted by manufacturing enterprises without first securing a permit from the concerned department at least thirty (30) calendar days prior to the commencement thereof. Unless an objection or denial is received within fifteen (15) days from filing of the application, the same shall be deemed approved and the promotion campaign or activity may be conducted: Provided, That any sales promotion campaign using medical prescriptions or any part thereof or attachment thereto for raffles or a promise of reward shall not be allowed, nor a permit be issued thereof.

========
I'm no lawyer, but it seems like the definition of Sales Promotion is pretty encompassing, including techniques that promote patronage or goodwill (branding activities).
Of course, we should get a lawyer to make a definitive conclusion, but this is something we can all show our clients.

The DTI has released several guidelines to further clarify the implementation of the Consumer Act of the Philippines. They also released one covering online transactions.

How about bloggers?
My concern though is when bloggers start organizing contest and promotions of their own that intends to promote goodwill (brand building) for their blogs. Do we need to get a DTI Permit too?

One idea suggested by a fellow blogger is for an association to cover us and negotiate with the government to carry out its own permit system. My only challenge with this idea is that it can be questioned if the association or group is new.

Although, I think the easiest way to go about this is for a minimum standard has to be set, for online contest organized by individuals, that would necessitate a DTI permit.

(Update: 7/26/ 2011 Another factor that has to be looked upon is do we get included in an registry of online contest managers or organizers that can also track performance and any complaints received. This includes how personal data of those who join individual-organized contest is handled and not abused.)

Update:
1. RJ David of Sulit.com.ph gave interesting inputs on this topic and he said.

"We run numerous contests in Sulit.com.ph and as of now we use the following questions to guide us if we need a DTI permit or not:
1.) Do participants need to pay something to join? If yes, a DTI permit is required.
2.) Do we need to advertise through TV, print, radio and other forms of mass media outside our current online properties? If yes, a DTI permit is required."

Group buying sites

RJ David also asked the DTI about Group Buying Sites as they are also sales promotions in nature.

DTI Dialogue

If there is anything sure at the moment, the DTI has no clear guidelines on this. But to protect the consumer, especially when you get to read complaints and horror stories, perhaps it is time.

Currently coordinating with DTI on this to seek further clarification.

DTI References:

• Application Form for Sales Promo Permit for Contests
   PDF format (31 kB)
• Application Form for Sales Promo Permit for Discount
   PDF format (22 kB)
• Application Form for Sales Promo Permit for Games
   PDF format (30 kB)
• Application Form for Sales Promo Permit for Premium
   PDF format (30 kB)
• Application Form for Sales Promo Permit for Raffle
   PDF format (32 kB)
• Application Form for Sales Promo Permit for Redemption
   PDF format (25 kB)

Industry Guidelines:

• IMMAP Code of Ethics
• Ad Standards Council (ASC) Code of Ethics
• ASC Manual of Procedures
• Facebook Promotion Guidelines