Text
28 September 2020
Re: LOSS OF CUSTOMER DOCUMENTS
Dear [Redacted],
We write in response to your various communications received by the National Privacy Commission (NPC). Upon further evaluation, the Office of the Privacy Commissioner, as recommended by the Complaints and Investigation Division (CID), endorsed the same to the Privacy Policy Office for the issuance of an advisory opinion in accordance with NPC Circular 16-04, specifically Section 4, which states that the failure to comply with the requirements of this Section shall cause the matter to be evaluated as a request for an advisory opinion.
We understand that your brother applied for a transfer of ownership of his landline phone and internet accounts, both with Globe Telecom, Inc. (Globe), to you. In so doing, you and your brother were required to accomplish application forms for the transfer and submit certain documents.
Specifically, the forms required the following personal information: 1) name, 2) address, 3) contact number, and 4) signature. The documents required to be submitted included copies of your Social Security System (SSS) ID and pay slip.
Based on the screenshots you provided, only the landline phone account was transferred under your name. This prompted you to file a complaint with the Globe store in Trinoma. However, as you stated in your query, you discovered that the documents containing your personal information were missing. You then wrote a letter to the store’s manager regarding the matter. You also further elevated the matter to Globe’s customer care representative (CCR) through their customer hotline on Facebook Messenger, but to no avail as your complaint went unheeded.
In one of the screenshots of your conversation with Globe’s CCR, you stated that Globe’s improper handling of your application led to the loss of the documents containing your personal information, which might be a violation of Section 27 (a) of the Data Privacy Act of 2012 (DPA), which penalizes improper disposal of personal information.
Discussion
Violations of the DPA; Improper Disposal; Personal and Sensitive Personal Information
The specific acts penalized under the abovementioned provision are to knowingly or negligently dispose, discard, or abandon the personal information in an area accessible to the public or has otherwise placed the personal information in its container for trash collection.
We point out that the documents you claim to have been lost includes a copy of your SSS ID, which contains sensitive personal information. As defined under the DPA, sensitive personal information refers to personal information issued by government agencies peculiar to an individual which includes social security numbers. Thus, the scenario may fall under Section 27 (b) instead, which provides for the penalty when sensitive personal information is involved.
Nevertheless, a careful reading of Section 27 (b) will show the following essential elements of improper disposal:
- The accused knowingly or negligently disposed, discarded, or abandoned the information of the data subject;
- The information disposed was sensitive personal information; and
- The area of disposal was accessible to the public or has otherwise placed the personal information of an individual in its container for trash collection.
In this scenario, it seems that the above elements were not adequately proven.
Obligations of a Personal Information Controller; Security Measures; Data Protection Officer
However, it bears stressing that Globe, as a personal information controller (PIC), must adopt reasonable and appropriate organizational, physical, and technical safeguards to protect personal data, which includes securing physical documents and forms of customers, and ensuring that these are all properly accounted for.
It is also expected to train all pertinent employees, as well as third party service providers, as to the proper handling of personal data, and to have institutionalized policies and procedures in place to efficiently address these types of data subject concerns. Further, these safeguards shall ensure the availability, integrity, and confidentiality of the personal data being processed, and shall protect said personal data against any accidental or unlawful destruction, alteration, and disclosure, as well as against any other unlawful processing.
With this, you may raise the matter to Globe’s data protection officer with the following contact details:
Address: Globe Telecom, Inc., The Globe Tower, 32nd Street corner 7th Avenue, Bonifacio Global City, 1643 Taguig City, Metro Manila, Philippines Email: privacy@globe.com.ph
If afterwards there is still no resolution on your concern, you may opt to complete and submit a sworn complain-affidavit, together with sworn affidavit/s of witnesses should there be any, and any other evidence that you want the Commission to consider, as requested by the CID in 2017, to elevate this inquiry into a full-fledged complaint.
Please refer to our website to download a copy of the Complaints-Assisted Form (CAF) available at https://www.privacy.gov.ph/complaints-assisted/.
This opinion is rendered solely on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner