NPC Issuance Wiki

NPC Advisory Opinion No. 2023-019 — Disclosure of Customer Personal Information Upon Request of Another Customer

Issued Advisory Opinion

Official opinion tags

Text

17 October 2023

Re: DISCLOSURE OF AN INDIVIDUAL CUSTOMER’S PERSONAL INFORMATION UPON THE REQUEST OF ANOTHER INDIVIDUAL CUSTOMER.

Dear [Redacted],

We respond to your request for an Advisory Opinion on the captioned matter.

Discussion

You inform that G-Xchange, Inc. (GCash) received a request from one of its individual customers for the home address of another individual customer (Recipient). The requesting customer (Sender) allegedly intended to transfer money from her Land Bank of the Philippines (LBP) account to her GCash account through PesoNet. But she mistyped her registered mobile number which resulted in the money being received by another individual (Recipient) who also happens to be a GCash user. The Sender then requested GCash for the Recipient’s name and home address to resolve the situation. In its desire to balance the interest of both data subjects, GCash responded by providing the Sender only with the Recipient’s name and registered email address.

However, the Sender deemed the email address as insufficient and insisted that GCash divulge the Recipient’s home address. The Sender claims that the purpose for such request is to be able to send a copy of her complaint against the Recipient who allegedly failed to return the funds to her.

GCash hesitates to accede to the Sender’s request considering that it already provided the name and email address of the Recipient. Further, it is GCash’s position that the Sender’s right to access does not include the disclosure to her of the Recipient’s home address.

Thus, you ask if the refusal of GCash to provide the recipient’s home address is justified under the Data Privacy Act of 2012 (DPA) and other relevant issuances.1

Processing based on legitimate interest

For perspective, it is worth mentioning that an investigation concerning the failure to return funds erroneously sent to a recipient may be considered as an investigation for purposes of fraud prevention. In the current matter, the Recipient was not entitled to the money that was sent to him or her. Accordingly, the Recipient has the obligation to return the money to the Sender.2 Since the Recipient failed to do so, the Sender would necessarily have to investigate and gather data to protect her rights through the filing of a complaint to recover the money. Hence, the Sender has a legitimate interest to conduct her investigation and process personal data necessary to rectify the alleged fraud committed upon her.

Section 12(f) of the DPA allows the processing of personal information when the same is necessary for purposes of the legitimate interests pursued by the personal information controller or by a third party to whom the personal information is disclosed.3

The United Kingdom’s Information Commissioner’s Office has crafted a three-part test in assessing a claim of legitimate interest as lawful basis for the processing of personal information, thus:

  1. Purpose test – The existence of a legitimate interest must be clearly established, including a determination of what the particular processing operation seeks to achieve;
  2. Necessity test – The processing of personal information must be necessary for the purpose of the legitimate interest pursued by the personal information controller or third party to whom personal information is disclosed, where such purpose could not be reasonably fulfilled by other means; and
  3. Balancing test – The fundamental rights and freedoms of data subjects must not be overridden by the legitimate interests of the personal information controller or third party, considering the likely impact of the processing on the data subjects.4

In MAF v. Shopee,5 the National Privacy Commission (NPC) adopted the three-part test above and provided the following conditions for processing based on legitimate interest:

Processing based on legitimate interest requires the fulfillment of the following conditions: (1) the legitimate interest is established; (2) the processing is necessary to fulfill the legitimate interest that is established; and (3) the interest is legitimate and lawful and it does not override the fundamental rights and freedoms of data subjects.

Applying the foregoing to the current matter, it appears that while the Sender was able to establish her legitimate interest, the scenario presented do not appear to satisfy the other two (2) requirements. To elaborate, the Sender’s established legitimate interest is to recover the amount that was wrongfully sent to the Recipient. However, the disclosure of the Recipient’s home address is not completely necessary for the Sender to file a complaint since Section 16, Rule 14 of the Rules of Court allows for the service of summons when a defendant’s whereabouts are unknown.

In addition, it cannot be said that the disclosure of the home address would be proportional to the legitimate interest sought to be protected since the Sender was already provided with the name and registered email address of the Recipient. Such information will permit the Sender to pursue her available remedies. To allow the disclosure of the home address in the given scenario would unnecessarily tilt the balance of rights in favor of the Sender which may possibly result in extreme detriment to the Recipient. It must be borne in mind that the Recipient is also a data subject who possesses privacy rights as well.

The Civil Code of the Philippines prohibits persons from prying into the private lives of other individuals,6 thus:

Every person shall respect the dignity, personality, privacy and peace of mind of his neighbors and other persons and that the act of prying into the privacy of another’s residence and meddling with or disturbing the private life or family relations of another, though it may not constitute a criminal offense, shall produce a cause of action for damages, prevention and other relief:

(1) Prying into the privacy of another’s residence; (2) Meddling with or disturbing the private life or family relations of another; (3) Intriguing to cause another to be alienated from his friends; (4) Vexing or humiliating another on account of his religious beliefs, lowly station in life, place of birth, physical defect, or other personal condition. (Underscoring supplied)

In Spouses Hing v. Choachuy, Jr.,7 the Supreme Court had the chance to elaborate on the right to privacy under the context of Article 26 (1) of the Civil Code. Thus, it was held:

The right to privacy is the right to be let alone.

The right to privacy is enshrined in our Constitution and in our laws. It is defined as “the right to be free from unwarranted exploitation of one’s person or from intrusion into one’s private activities in such a way as to cause humiliation to a person’s ordinary sensibilities.” It is the right of an individual “to be free from unwarranted publicity, or to live without unwarranted interference by the public in matters in which the public is not necessarily concerned.” Simply put, the right to privacy is “the right to be let alone.”

The Bill of Rights guarantees the people’s right to privacy and protects them against the State’s abuse of power. In this regard, the State recognizes the right of the people to be secure in their houses. No one, not even the State, except “in case of overriding social need and then only under the stringent procedural safeguards,” can disturb them in the privacy of their homes. (Internal citations omitted).

In sum, the Recipient’s right to privacy in his or her home is afforded protection under the Constitution and the law. This includes the right to be secure in his or her own abode or physical space at any time.

In view of the foregoing, it appears that the Sender was not able to clearly establish her legitimate interest to the home address of the Recipient. Since there is no other lawful criterion to serve as basis for the processing of personal information, Gcash need not disclose the same to the Sender in this instance.

Data subject request limited to own personal data

It is also necessary to clarify that the Sender’s request for the Recipient’s home address cannot be considered as a data subject request. As contemplated by law, data subject requests are only limited to details on the processing of the personal information of the data subject himself/herself. These requests do not extend to personal information concerning another data subject.

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

For your reference.

Very truly yours,

(Sgd.) FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office

Footnotes

  1. Tags: special cases; law enforcement; lawful processing; investigations. ↩

  2. Article 22, Civil Code of the Philippines. ↩

  3. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, § 12(f) (2012). ↩

  4. See generally, Data Privacy Act of 2012, § 12 (f); United Kingdom Information Commissioner’s Office (ICO), What is the ‘Legitimate Interests’ basis?, available at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/. ↩

  5. National Privacy Commission, MAF v. Shopee Philippines, Inc. NPC 21-167 (Sept. 22, 2022). ↩

  6. Article 26. Civil Code of the Philippines. ↩

  7. Spouses Bill and Victoria Hing v. Alexander Choachuy Sr. and Allan Choachuy, G.R. No. 179736, June 26, 2013. ↩

Backlinks

  • No backlinks found