Text
23 September 2025
Re: PROCESSING OF PRIVATE ONLINE CONVERSATIONS AND PHOTOGRAPHS IN SCHOOL DISCIPLINARY PROCEEDINGS
Dear [Redacted],
We respond to your request for an Advisory Opinion on behalf of your client, Mr. [Redacted], a student of [Redacted] (“the College”). The request seeks guidance on the data privacy implications of certain acts allegedly committed by school officials and fellow students, including the acquisition and use of screenshots from private Facebook Messenger group chats (“GCs”), and the filing of a complaint for sexual harassment before the Committee on Decorum and Investigation (“CODI”) using said screenshots as evidence.
Based on your submission, the private GCs were created by your client and several classmates for personal, non-academic exchanges, and were not part of any official school online learning platform. Within these chats, your client reportedly shared accounts of his personal activities and friendly interactions with female friends. A misunderstanding between your client and one classmate in January 2025 allegedly led to the sharing, in February 2025, of screenshots of the private GCs to other students without his consent. These images were later presented by certain classmates to the College’s CODI in support of a sexual harassment complaint against him. On 28 April 2025, CODI dismissed the case for lack of merit; the School President later affirmed the dismissal while asserting the college’s jurisdiction over online student conduct when both parties are members of the institution, even if unrelated to school activities.
In your request, you specifically raise the following issues:
- Whether or not the College breached your client’s rights to privacy by accessing, monitoring, and intruding on his private activities in online conversations, especially in the FB messenger Group Chats (GCs), which is not officially used for online learning by the school, without his consent.
- Whether or not the College may monitor/access all digital spaces or online platform used by its students without their consent.
- Whether the sharing of screenshots of the GC by certain classmates to others, without your client’s consent, constitutes a violation of the Data Privacy Act of 2012 (DPA).
- What charges (civil/criminal) can your client file against the student, who committed unauthorized processing and disclosure of our private conversation?
- Can your client retrieve damages (moral, actual, etc.) from this issue?
Discussion
Processing of private online conversations by educational institutions; Lawful basis; Protection of Lawful Rights and Interests; Establishment, Exercise, or Defense of Legal Claims
Section 3(g) of the Data Privacy Act of 2012 (“DPA”) defines personal information as any information from which an individual’s identity is apparent or can be reasonably ascertained. Where such information relates to a person’s education or alleged sexual conduct, it may qualify as sensitive personal information under Section 3(l).
As clarified in NPC Advisory Opinion No. 2020-043, screenshots of online conversations will only come under the scope of the DPA if personal data is involved, i.e., if the conversation/screenshot itself allows for the identification of the parties. The Advisory further noted that if it is simply the content of the conversation, with names and other identifiers redacted or cropped out of the screenshot, it might not be within the scope of the DPA. In your case, the screenshots at issue contain personally identifying content and were presented in the context of a sexual harassment complaint, thus placing them within the definition of sensitive personal information.
In receiving and reviewing these screenshots in CODI proceedings, the College engaged in processing as defined under Section 3(j) of the DPA. Processing of sensitive personal information is generally prohibited, except under the limited grounds enumerated in Section 13, such as seeking the data subject’s consent, compliance with a legal obligation, and protection of lawful rights and interests.
Disciplinary proceedings within an educational institution may be characterized as protection of lawful rights and interests, or for the establishment, exercise or defense of legal claims for purposes of Section 13(f). Where processing is necessary and proportionate to the determination of the complaint, the institution may rely on Section 13(f) as the lawful basis. This interpretation is supported by NPC Advisory No. 2024-02, which clarified that Section 13(f) may be invoked by institutions exercising adjudicatory or disciplinary authority, provided that the processing is necessary to the establishment, exercise, or defense of legal claims in relation to its constitutional or statutory mandate. Under Section 4 of the same Advisory, processing is ‘necessary’ when it is ‘adequate, relevant, suitable, and not excessive in relation to such legitimate purpose. The College must demonstrate that reviewing these specific conversations was essential to determining the merits of the sexual harassment complaint.
More importantly, it appears that the College received the screenshots as evidence submitted by the complainant and formed part of the complaint, rather than actively monitoring private communications. This distinction is crucial under data protection analysis — the institution processed information provided to it through a formal complaint mechanism, and not through unauthorized surveillance. As such, the College may be considered to have lawfully processed personal data pursuant to Section 13(f) of the DPA.
Scope of the College’s authority to monitor or access students’ digital spaces without consent
The College, however, must still apply data protection principles — notably that the processing must still adhere to the principles of transparency, legitimate purpose, and proportionality. The DPA does not provide blanket authority for PICs, including schools, to monitor all digital activity of their data subjects. Such monitoring must be anchored on a lawful basis under Sections 12 or 13 of the Act and must comply with the principle of proportionality. The NPC, through its Education Sector Advisory No. 2020-1 on online learning, has cautioned that personal data processed through unofficial tools or social media platforms entails significant risks, and that submissions via such platforms are discouraged. The Advisory further reminds that processing of personal data in social media must always have a legitimate purpose and comply with the principles of proportionality and transparency. While issued in the context of online learning, these principles underscore the Commission’s general approach that personal data disclosed or processed in social media spaces does not escape the protections of the DPA.
Absent a legal obligation or a demonstrable connection to the school’s legitimate interests that meets the proportionality test, indiscriminate monitoring of all students’ online spaces may constitute unauthorized processing. However, we wish to remind that determinations about whether a specific act of monitoring is lawful should be made on a case-by-case basis, taking into account the facts and the proportionality of the measure.
Data privacy implication of sharing private group chat screenshots; Processing in connection with personal, family, or household affairs
On the question of whether the classmates’ capture and disclosure of screenshots constitutes unauthorized processing under the DPA depends on their role and purpose when they processed the personal data. The act of capturing and sharing GC screenshots with third parties constitutes processing under the DPA. Whether such processing is lawful will depend on the presence of a valid basis under Sections 12 or 13.
As noted in NPC Advisory Opinion No. 2020-043, a crucial consideration is whether the processing was done in connection with personal, family, or household affairs under Section 3(h)(2) of the DPA. If so, such processing may be generally excluded from the DPA’s scope. However, depending on the attendant circumstances, the taking of screenshots and their transmission to third parties may not fall under this exclusion.
Where individuals who are not acting in a purely personal or household capacity collect, use, or disclose personal data of others, they may be considered PICs or personal information processors under the DPA, and thus subject to its obligations.
If the processing goes beyond purely personal, family, or household affairs, then it may no longer fall within the exemptions contemplated by the DPA. In such a case, the processing would have to be assessed under Sections 12 or 13 to determine if it constitutes lawful processing. Thus, if the sharing here was done to initiate disciplinary proceedings, it is arguable that the personal data was no longer confined to a purely personal activity and may fall within the scope of the DPA. Even then, the processing may still be permissible if it falls within the applicable exceptions, as earlier discussed.
Reasonable expectation of privacy in digital communications
An additional consideration in analyzing the circumstances involves the concept of reasonable expectation of privacy in digital communications. This concept, recognized across various areas of law including constitutional and administrative contexts, may provide relevant guidance in assessing privacy-related claims in digital spaces.
The Supreme Court in Cadajas v. People acknowledged that digital communications may carry reasonable expectations of privacy, though such expectations must be evaluated against the specific circumstances of each case. The determination of whether a reasonable expectation of privacy exists depends on various factors that must be assessed on a case-by-case basis.
In the context of private group chats, several factors may be relevant to this analysis: (1) the nature and settings of the communication platform; (2) the number and relationship of participants; (3) the purpose and context of the communications; and (4) any indications of consent to broader disclosure. Conversely, factors that may limit privacy expectations include the inherent characteristics of digital communications, including the technical possibility of screenshots and forwarding, and the degree of control users can reasonably expect over shared digital content.
Whether the circumstances here would support a finding of reasonable expectation of privacy is ultimately a factual determination that can only be made in the course of an investigation upon the filing of an actual complaint before the NPC. Accordingly, it would be premature for us to make such a determination at this stage, especially since this could be one of the issues for resolution should your client pursue a complaint.
Legal remedies for unauthorized disclosure of private conversations; Criminal penalties; Civil liability; Damages
Violations of the Data Privacy Act of 2012 (DPA) may give rise to liability depending on the circumstances of the case. Under Section 25, unauthorized processing of personal information is considered a punishable act. This generally covers instances where processing is carried out: (a) without the consent of the data subject; (b) without being anchored on any of the lawful criteria under Section 12; or (c) in a manner inconsistent with the declared, specific purpose of the processing. Section 26 similarly classifies the unauthorized processing of sensitive personal information as a punishable act. Here, liability may arise when such information is processed: (a) without the data subject’s consent; or (b) absent compliance with any of the stricter conditions for lawful processing set out under Section 13. In both cases, the essential element is the lack of a lawful basis for the processing.
Possible violations arising from the alleged disclosure of the screenshots may be assessed under the Data Privacy Act of 2012 (DPA), which falls within the jurisdiction of the NPC. Should you believe that injury was sustained as a result of such disclosure, you are not precluded from exercising your right to file a complaint and seek indemnification under the DPA. As to potential civil or criminal actions under other laws, these fall outside the NPC’s jurisdiction, and we cannot make a conclusive determination on their applicability to your scenario.
Finally, it must be emphasized, consistent with the Supreme Court’s ruling in Cadajas v. People, that while the constitutional right to privacy is broader than the scope of the DPA, not all violations of privacy amount to a violation of the DPA. To establish criminal liability under the Act, the statutory elements must be proven beyond reasonable doubt. Similarly, civil liability requires competent proof of actual injury or damage sustained.
Given that the Commission has only the facts provided by one party, we cannot make a conclusive finding of liability or entitlement to damages. Such determinations must be made by the appropriate court or tribunal after full proceedings.
Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
For your reference.
Very truly yours,
(Sgd.) VIDA ZORA G. BOCAR OIC-Director IV, Privacy Policy Office