NPC Issuance Wiki

NPC Advisory Opinion No. 2020-043 — Disclosure of Screenshots of a Private Conversation

Issued Advisory Opinion

Official opinion tags

Text

4 November 2020

Re: DISCLOSURE OF SCREENSHOTS OF A PRIVATE CONVERSATION

Dear [Redacted],

We write in response to your request for advisory opinion received by the National Privacy Commission (NPC) concerning various questions and clarifications regarding the Data Privacy Act of 20121 (DPA), particularly the following:

Discussion

It must first be determined whether such screenshots actually involve personal or sensitive personal information (collectively, personal data).

The DPA applies to the processing of all types of personal information2 and to any natural and juridical person involved in personal information processing. Processing involves a wide set of operations performed upon personal data including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.3

It is worthy to note that the processing, i.e. sending out the screenshot to another person, will only come under the scope of the DPA if personal data is indeed involved – if the conversation/screenshot itself allows for the identification of the parties. If it is simply the content of the conversation, with names and other identifiers redacted or cropped out of the screenshot, it might not be within the scope of the DPA.

Another factor to consider is whether processing was done by the person in connection with his or her personal, family, or household affairs pursuant to Section 3(h)(2) of the DPA. In such cases, the person is not considered as personal information controller (PIC), and hence, to a certain extent, such processing is generally excluded from the scope of the DPA.

Nevertheless, depending on the attendant circumstances, the taking of the screenshot and its transmittal to a third party, may not fall under the abovementioned exclusion.

Hence, the disclosure of a private conversation involving personal data without consent of the parties involved, or without some other lawful basis for processing of personal data under the DPA, may be construed as unauthorized processing,4 but this is highly dependent on other attendant circumstances of the case as discussed above.

Question 2: What charges (civil/criminal) can I file against the person who did the unauthorized processing and disclosure of our private conversation?

Please note that the NPC advisory function is limited only to the interpretation on the provisions of the DPA. However, for the alleged violation of the informational privacy right, the same may be enforced by filing a case before the NPC, following its internal rules of procedure.

For this purpose, you may initially review our complaints process available at https://www.privacy.gov.ph/mechanics-for%20complaints/ and https://www.privacy.gov.ph/wp-content/uploads/2020/10/Complaints-Assisted-Form_fillable.pdf.

Question 3: Can I retrieve damages (moral, actual, etc.) from this issue?

The term “damages” was defined by the Supreme Court (SC) in the case of MEA Builders, Inc. v. Court of Appeals5 as the sum of money which the law awards or imposes as a pecuniary compensation, a recompense, or satisfaction for an injury done or a wrong sustained as a consequence either of a breach of a contractual obligation or a tortious act. Also, in the case of Julita Robleza v. Court of Appeals6, the SC ratiocinated why damages may be recovered, to wit:

The law on damages is merely intended to repair the damage done by putting the plaintiff in the same position, as far as pecuniary compensation can do, that he would be had the damage not been inflicted and the wrong not committed.

In this scenario, it is incumbent upon the person claiming damages that he or she suffered injury for the act complained of. The classification and award of damages that may apply in this case is highly dependent on the factual circumstances. However, if you have sustained injury arising from the alleged disclosure of the said screenshots, you are not precluded from exercising your right to file a complaint and be indemnified as provided under the DPA.

Question 4: Can I file for a Writ of Habeas Data against the person who did the screenshot, and the person who received the said screenshots?

The writ of habeas data is a remedy available to any person whose right to privacy in life, liberty or security is violated or threatened by an unlawful act or omission of a public official or employee, or of a private individual or entity engaged in the gathering, collecting or storing of data or information regarding the person, family, home and correspondence of the aggrieved party.7 It also seeks to protect a person’s right to control information regarding oneself, particularly in instances in which such information is being collected through unlawful means in order to achieve unlawful ends.8

The propriety of filing the said remedy lies on the aggrieved party based on the available evidence to support his or her claim. To reiterate, the NPC advisory function is limited only to the interpretation on the provisions of the DPA. Thus, the NPC is not a proper agency to determine the cause/s of action of a complaining party considering that the same is subject to a judicial determination on a case to case basis.

Question 5: Can such ‘illegally-obtained’ screenshots be used as evidence in filing a civil or criminal case against me?

By the recent issuance of The Revised Rules on Evidence9 (RRE) by the SC, documentary evidence is defined as “documents as evidence consists of writings, recordings, photographs, or any material containing letters, words, sounds, number, figures, symbols, or their equivalent, or other modes of written expression offered as proof their contents. Photographs include still pictures, drawings, stored images, x-ray films, motion pictures or videos.”

Similarly, the screenshots may be considered a documentary evidence based on the above rule and pursuant to the functional equivalence and non-discrimination principles under the E-Commerce Act of 200010 and the Rules on Electronic Evidence11 (REE)

Further, Section 1, Rule 11 of the REE provides that audio, photographic and video evidence of events, acts or transactions shall be admissible provided it shall be shown, presented or displayed to the court and shall be identified, explained or authenticated by the person who made the recording or by some other person competent to testify on the accuracy thereof.12

To be admissible, evidence must be competent and relevant. The former requires that the evidence is not excluded by the law or by the Rules of Court while the latter provides that the evidence has a relation to the fact in issue as to induce belief in its existence or non-existence.

Note however, that the determination of the admissibility of evidence in court is not within the purview of NPC’s mandate.13 This matter is governed by the Rules of Court and other applicable rules as discussed above.

But with respect to the provisions of the DPA, the law recognizes that personal information may be processed for legitimate interests under Section 12 (f), which may include the protection of lawful rights and interests,14 and for sensitive personal information, the same may be processed when necessary for the protection of lawful rights and interests of natural

or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority under Section 13.

Finally, for purposes of filing a case for a violation of the DPA with the NPC, the said screenshots may be used as evidence by both the complainant and the respondent, respectively.

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. Data Privacy Act of 2012, § 3(g). Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual. ↩

  3. Data Privacy Act of 2012, § 3(j). ↩

  4. Data Privacy Act of 2012, § 25. ↩

  5. G.R. No. 121484, (January 31, 2005). ↩

  6. G.R. No. L-80364, (June 28, 1989). ↩

  7. A.M. No. 08-1-16-SC, Rule on the Writ of Habeas Data (Jan. 22, 2008). ↩

  8. Rule on Writ of Habeas Data, §1. ↩

  9. A.M. No. 19-08-15-SC (October 8, 2019). ↩

  10. Republic Act No. 8792 (June 14, 2000). ↩

  11. A.M. No. 01-7-01-SC (July 17, 2001). ↩

  12. Id. ↩

  13. See: Advisory Opinion No. 2019-023 (June 13, 2019). ↩

  14. KRL v. Trinity University, National Privacy Commission CID Case No. 17-K-003 (2019). ↩

Backlinks