The National Privacy Commission (NPC) on January 6 said it has taken notice of media reports and user complaints regarding the “Buo ang Saya ng Pasko” Christmas campaign of Jollibee Foods Corporation (JFC) conducted on the messaging platform Viber.

In a statement, the NPC said branded marketing materials linked to the campaign, including automated greetings and digital stickers, reportedly appeared within private chat interfaces, raising concerns about the boundaries of digital marketing and the possible unsolicited processing of personal data.

The Commission said it has sought explanations from both Jollibee and Viber and is currently determining whether the implementation of the campaign involved the processing of personal data covered under the Data Privacy Act of 2012 (DPA).

Under the DPA, the NPC emphasized that personal information controllers (PICs) engaged in direct marketing must ensure that the processing of personal data is grounded on the principles of transparency, legitimate purpose, and proportionality.

The NPC added that if the campaign is found to involve personal data processing, consent must be specific and freely given, and data subjects must be informed and provided the right to object to the use of their information for direct marketing purposes.

The Commission said it will continue to evaluate the matter in accordance with the provisions of the Data Privacy Act.