Text
27 April 2021
Re: POSTING OF PHOTO IN A SOCIAL MEDIA PLATFORM WITHOUT CONSENT
Dear [Redacted],
We write in response to your email seeking advice from the National Privacy Commission (NPC) which was initially docketed as a complaint. Upon evaluation, the Office of the Privacy Commissioner endorsed the matter to the Privacy Policy Office for the issuance of an advisory opinion.
We understand that a certain individual took an intimate photo of you and your partner while dining in a restaurant and then proceeded to post it in a social media platform together with a derisive caption.
We understand further that you discovered that your photo was posted through a mutual friend who saw the same. You now ask for advice on the possibility of filing a case against the individual as you felt offended with the posting of your photo without your consent.
Discussion
Privacy in a public place; privacy in the digital environment
According to the United Nations High Commissioner for Human Rights report, privacy can be considered as the presumption that individuals should have an area of autonomous development, interaction and liberty, a “private sphere” with or without interaction with others, free from State intervention and from excessive unsolicited intervention by other uninvited individuals.1
Further, the report enunciates that in the digital environment, informational privacy covering information that exists or can be derived about a person and the decisions based on that information, is of particular importance, and the protection of the right to privacy extends to public spaces and information that is publicly available.2
Accordingly, a person’s data privacy rights do not cease even when one is in a public space. In NPC Advisory Opinion No. 2018-051,3 the following advice was given regarding persons who may have been candidly and secretly photographed and whose photos were then posted online:
“The act in the given scenario may be considered as unauthorized processing, depending on circumstances of the case. The DPA penalizes persons who process personal information without the consent of the data subject, or without being authorized under the Act or any existing law. This is subject to other provisions of the DPA. x x x
In cases like these, the affected data subject is entitled to suspend, withdraw or order the blocking, removal or destruction of his or her personal information upon discovery and substantial proof that the personal information is unlawfully obtained, used for unauthorized purposes or are no longer necessary for the purposes for which they were collected. x x x.”
As discussed above, data subjects should be able to exercise their rights under the Data Privacy Act of 20124 (DPA). Kindly refer to NPC Advisory No. 2021-01 for further guidance on this matter.
Finally, we note that based on our records, you were not able to submit the required documentation to elevate your inquiry into a full-fledged complaint. If you wish to pursue the case and file a complaint, you may visit our website to download a copy of the Complaints- Assisted Form (CAF) available at https://www.privacy.gov.ph/complaints-assisted/.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Footnotes
-
United Nations High Commissioner for Human Rights, The right to privacy in the digital age, available at https://www.ohchr.org/Documents/Issues/DigitalAge/ReportPrivacyinDigitalAge/A_HRC_39_29_EN.docx (last accessed 26 April 2021). ↩
-
Id. ↩
-
National Privacy Commission, NPC Advisory Opinion No. 2018-051 (Oct. 5, 2018). ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩