Text
03 October 2017
Re: OFFENSES UNDER THE DATA PRIVACY ACT OF 2012
Dear [Redacted],
This is with reference to your query received by the National Privacy Commission (NPC) on 11 August 2017 regarding offenses under the Data Privacy Act of 2012 (DPA). Specifically, you asked the following questions:
a. Does the exception on personal information originally collected from residents of foreign jurisdiction1 bar Business Process Outsourcing (BPO) companies based in the Philippines from filing cases against its employees or agents who commit violations of the Act involving personal information of foreign citizens?
b. If the personal information of foreign citizens was processed illegally by an agent of the BPO, what is the remedy?
c. Will the BPO be able to institute a complaint for and in behalf of the account holders/owners of the information against said employee for violations of the Act? If not, what is the remedy?
d. If yes, may the complaint be instituted directly with the courts or will Rule II, Section 4 of NPC Circular 16-04 on exhaustion of remedies apply?
The exception on personal information originally collected from residents of foreign jurisdictions would not be a bar for prosecution of violations of the DPA.
The Implementing Rules and Regulation (IRR) of the DPA provides that the non-applicability of the law does not extend to personal information controllers (PIC) or personal information processors (PIP), who remain subject to the requirements of implementing security measures for personal data protection. Further, the processing of information shall be exempted from the requirements of the law only to the minimum extent necessary to achieve the specific purpose, function, or activity.2
Thus, BPOs, as PICs and/or PIPs, are still obligated under the DPA to implement security measures to protect personal data that they process as well as comply with other provisions of the DPA. Consequently, when one of its agents or employees commits a violation of the law, even where personal information of foreign citizens is involved, such agent or employee may be held liable.
Further, the territoriality principle in criminal law, in relation to Article 14 of the New Civil Code, provides that penal laws and those of public security and safety shall be obligatory upon all who live and sojourn in Philippine territory, subject to the principle of public international law and to treaty stipulations. Since the act consisting a violation of the DPA was done within the Philippines, it will be Philippine law that will apply.
If the personal information of foreign citizens were processed illegally by an agent of the BPO, the affected data subject may file a complaint with the Complaints and Investigation Division of the NPC.
However, no complaint shall be entertained by NPC unless:
a. the complainant has informed, in writing, the personal information controller or concerned entity of the privacy violation or personal data breach to allow for appropriate action on the same;
b. the personal information controller or concerned entity did not take timely or appropriate action on the claimed privacy violation or personal data breach, or there is no response from the personal information controller within fifteen (15) days from receipt of information from the complaint; and
c. the complaint is filed within six (6) months from the occurrence of the claimed privacy violation or personal data breach, or thirty (30) days from the last communiqué with the personal information controller or concerned entity, whichever is earlier.
Nevertheless, the NPC may waive any or all of the abovementioned requirements, at its discretion, upon good cause shown, or if the complaint involves a serious violation or breach of the DPA, taking into account the risk of harm to the affected data subject.3
As a rule, it should be the data subject who shall file a complaint for violation of his or her rights. Section 3 of NPC Circular No. 16-04 provides that persons who are the subject of a privacy violation or personal data breach, or who are otherwise personally affected by a violation of the Data Privacy Act, may file complaints for violations of the Act. However, a duly authorized representative may file the complaint, provided, that the circumstances of the authority must be established. Thus, it should be the affected account holders who should file the complaint unless, the BPO is authorized to do so by the foreign client.
As an alternative, the BPO may file the complaint as the person subject of a privacy violation or a personal data breach, not as a data subject, but as a PIP. “Person” may refer to both natural and juridical persons. The complaint may be brought as a violation of any of the provisions of the Data Privacy Act, where the PIC or PIP has been directly affected.
The National Privacy Commission, mandated to administer and implement R.A. No 10173, has the primary jurisdiction on matters that involve violations of the Data Privacy Act, and matters that relate to privacy and personal data protection. The BPO, however, is not precluded from availing of other remedies in existing laws, such as remedies under R.A. No. 10175 when applicable, or the Civil Code for breach of contract and other relevant provisions, in accordance with established Rules of Procedure.
This opinion is based on the limited information provided, and may change depending on the particular circumstances of the case.
For your reference.
Very truly yours,
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman