Text
17 February 2023
Re: BLOCKING SMS WITH CLICKABLE LINKS
Dear [Redacted],
We respond to your request for an Advisory Opinion on the data privacy implication of the temporary blocking of incoming text messages or messages sent via Short Message Service (SMS) to Globe postpaid and prepaid numbers containing Uniform Resource Locators (URLs) or website links.
You inform that since 2014, Globe Telecom, Inc. (Globe) has been progressively working on improving its capabilities to combat spam and scams in its network. In response to the recent spate of spam and scam messages, the National Telecommunications Commission (NTC) issued a directive on 12 September 2022 for Globe, Dito Telecommunity Corporation, and Smart Communications, Inc. (Telcos) to block or deactivate domains, URLs, TinyURLs, Smart Links, and/or Quick Response (QR) Codes emanating from malicious sites.
On 4 October 2022, Globe met with the personnel of the National Privacy Commission (Commission) where it relayed its efforts to comply with the NTC directive and further explained its position that:
First, there is no privacy impact in the blocking of links and URLs by Globe, as it is the actual delivery of the message that is prevented from terminating at a Globe endpoint, or a Globe postpaid or prepaid mobile number. Since it is the transmission of the message that is prevented, the privacy of communications remains intact.
Second, Globe’s blocking process does not involve the reading or storing of the contents of text messages. There is no human intervention involved, save for the setting of rules and the inputting of keywords and links to be blocked. The blocking is done through automated means in compliance with Global System for Mobile Communications Association (GSMA) Standards and Guidelines.
Lastly, the only way that Globe sees the contents of spam and scam text messages are through the screenshots submitted or reported by its subscribers and partner-organizations. Globe then inputs the keywords and links for blocking based on the pattern or trend observed in the screenshots.
You thus seek clarification on whether Globe’s temporary blocking of text messages pursuant to the NTC directive is in accordance with Section 3, Article III of the 1987 Constitution and with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA) and its Implementing Rules and Regulations (IRR).
Discussion
To put things in perspective, it is necessary to revisit some basic principles under the DPA.
The DPA applies to any natural and juridical person involved in the processing of personal information, including those personal information controllers and processors who, although not found or established in the Philippines, use equipment that are located in the Philippines, or those who maintain an office, branch or agency in the Philippines.1
The DPA defines “processing” as any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.2 On the other hand, “personal information” is defined as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.3 Meanwhile, Section 3(l) of the DPA provides for an enumeration of data that are classified as sensitive personal information.
Applying the foregoing to the facts presented, it appears that there is no processing of personal data involved in Globe’s SMS-blocking activity. Hence, any determination on Globe’s compliance or non-compliance with the DPA relative to its procedures in SMS-blocking, or the constitutionality thereof, would be to engage in a purely academic discussion. Nevertheless, it is worth mentioning that Globe’s present SMS-blocking activity was triggered by a directive from the NTC. By law, the NTC is mandated to regulate the country’s telecommunications industry and issue rules and regulations to implement such mandate.4 Consequently, Globe must necessarily comply with the NTC’s directive which, in turn, enjoys the presumption of constitutionality. To overthrow this presumption, there must be a clear and unequivocal breach of the Constitution.5 Hence, a discourse on the constitutionality of Globe’s SMS-blocking activity is not only beyond our function, but it is also equivalent to us examining the constitutionality of the issuance of a co-equal branch of government.
Please be advised that this Advisory Opinion was rendered based solely on your provided information. Any extraneous fact that may be subsequently furnished to us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
Please be guided accordingly.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office