Text
14 August 2017
Re: DATA PRIVACY ACT AND FORCE MAJEURE
Dear [Redacted],
This pertains to your query received by the National Privacy Commission (NPC) on 05 June 2017, via email.
As per your email, you sought clarification as to whether a personal information controller (“PIC”) or personal information processor (“PIP”) is exempt from liability in case of breach arising from force majeure or Acts of God.
A cursory reading of the Data Privacy Act of 2012 (“DPA”) would reveal that “(t)he personal information controller must implement reasonable and appropriate organizational, physical and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing”1 and “(t)he personal information controller shall implement reasonable and appropriate measures to protect personal information against natural dangers such as accidental loss or destruction, and human dangers such as unlawful access, fraudulent misuse, unlawful destruction, alteration and contamination.”2 However, the law is silent as to its application when an act falls under the category of a force majeure or fortuitous event.
The DPA imposes civil and criminal liability upon its violation. Civil liability may be in the form of fine and damages.
Article 1174 of the New Civil Code states that “Except in cases expressly specified by the law, or when it is otherwise declared by stipulation, or when the nature of the obligation requires the assumption of risk, no person shall be responsible for those events which could not be foreseen, or which, though foreseen, were inevitable.” (Emphasis ours)
The Supreme Court opined that the elements of a fortuitous event are: “(a) the cause of the unforeseen and unexpected occurrence, must have been independent of human will; (b) the event that constituted the caso fortuito must have been impossible to foresee, or if foreseeable, impossible to avoid; (c) the occurrence must have been such as to render it impossible for the debtors to fulfill their obligation in a normal manner, and; (d) the obligor must have been free from any participation in the aggravation of the resulting injury to the creditor.”3 Absent any of the foregoing requisites, the person is liable for the damage.
Instances of fortuitous events are “an act of God, or natural occurrences such as floods or typhoons, or an act of man such as riots, strikes or wars. However, when the loss is found to be partly the result of a (sic) person’s participation whether by active intervention, neglect or failure to act the whole occurrence is humanized and removed from the rules applicable to a fortuitous event.”4
Thus, while the DPA does not directly exculpate a PIC or PIP from liability in case of breach arising from force majeure, we can look at the Civil Code as the general guiding law. The code imposes liability on the person for his failure to act or negligence during the occasion of force majeure. The DPA also directs the responsibility on the PIC or PIP to ensure that organizational, technical and physical measures are in place to anticipate the effects of fortuitous events. The PIC or PIP is only exempted from responsibility upon positive showing of the security measures taken. Failing which, the PIC or PIP will be liable for any resulting damage.
With respect to the criminal aspect, the DPA is also silent. However, we can be guided by the principle that in special penal laws, criminal intent is not necessary. Any violation of the DPA would merit criminal conviction regardless of the actor’s good faith or lack of intent. The Supreme Court elucidates this principle, viz:
“When the crime is punished by a special law, as a rule, intent to commit the crime is not necessary. It is sufficient that the offender has the intent to perpetrate the act prohibited by the special law. Intent to commit the crime and intent to perpetrate the act must be distinguished. A person may not have consciously intended to commit a crime; but did intent to commit an act, and that act is, by the very nature of things, the crime itself. In the first (intent to commit the crime), there must be criminal intent; in the second (intent to perpetrate the act) it is enough that the prohibited act is done freely and consciously.”5
The DPA, being a special penal law, does not admit of good faith or lack of intent as a valid defense. Verily, a closer examination of the crimes enclosed under the DPA would show that volition or negligence is an essential ingredient. The crime cannot be committed without the attendant human element (either by will or through negligence). Thus, the PIC or PIP shall be criminally liable upon violation of any of the crimes prescribed by the law.
For your reference.
Sincerely,
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman