NPC Issuance Wiki

NPC 22-117: CJJ vs. JJS and JB

Issued Decision

Decision Text

CJJ,

Complainant,

-versus-

JJS and

JB,

Respondents.

x----------------------------------------------------x

DE JESUS, D.P.C.;

Before the Commission is a Complaint filed by CJJ (Complainant) against JJS and JB (collectively, “Respondents”) for alleged violation of Sections 31 (Malicious Disclosure) and 32 (Unauthorized Disclosure) of the Republic Act. No. 10173, otherwise known as the “Data Privacy Act of 2012” (DPA).

Facts

In her Complaints-Assisted Form (CAF), which was received by the Commission on 23 May 2022, the Complainant alleged that Respondent JJS, a “reporter” of GNN TV48.2 NAGA, disclosed her “personal information” during his “[Facebook (FB)] LIVE COVERAGE VIDEO” on 05 April 2022.1

According to the Complainant:

“Anunthorized [sic] disclosure of my personal information, he mentioned my complete name and address twice po. kahit alam niya na sexual harassment at VAWC ang case ko, kaya ko pinadakip suspek…”2

Complainant further alleged that:

”… pero diko po akalin reporter lalo magpapahiya sa pgkatao ko po. kasi may mga menor de edad po akong anak na pinuprotektahan ko kaya po ako humingi ng tulong police pra mhuli ang suspek akla kopo ngg gabu ng April 4 2022 ay tpos na ang aking propblema hindi ko akalin na gigisingin ako ng aking kaibigan para sabihin na nasa news ako ng GNN TV48.2 NAGA.”3

As a result thereof, the Complainant allegedly experienced sleepless nights and severe embarrassment.4 According to her, she contacted the “cyber office” to report the matter, and waited for two (2) days for Respondents to remove the video, but “walang aksyon ginawa [sina] JJS at JB.”5

The Complainant also shared that she personally went to speak with and beg JJS to remove the video at 9:00 A.M. on 05 April 2022.6 According to Complainant:

“…pumayag naman po itong reporter na ito na ttawagan nya daw po agad ang kanyang technician/wrtier na iedit na alisin ang pangalan at address ko at inasahan ko nman pero binocked lng ako sa content na yun di nila ginawa isang lingo po bago nila inalis.”7

The Complainant further shared that JJS seemed angry in his reply through “messenger.”8 This allegedly prompted her to formally report the broadcast to the cybercrime or WCPD (presumably referring to the Women and Children’s Protection Desk) in Naga City, who gave her the form to file the instant complaint.9

When asked for reliefs prayed for, the Complainant in her CAF ticked the box for “Others” and explained:

“Para sa sarili ko din po katahimikan at para maitayo ko din sarili kong dangal na sinira pa lalo ng mali din na pagsiwalat ng report. at hindi na din po, maulit sa iba ang ginawa nito. At mabigyan leksyon at tamang aksyon po itong kaso na ito.”10

In support of her allegations, the Complainant attached as evidence a screenshot of her messenger conversation with JJS.11 While a copy of the alleged Facebook (FB) Live Coverage of GNN TV48.2 Naga (Asintado sa Radyo) was listed in her CAF as attachment thereto, the same was not initially available in the records of this case.12

In an Order dated 30 May 2022, the Commission, through its Complaints and Investigation Division (CID), required the Respondents to file their verified comments within fifteen (15) days from receipt thereof and the parties to appear virtually for a Preliminary Conference on 20 July 2022 and 17 August 2022.13

On 14 July 2022, JB complied with the said Order and submitted his Verified Comment dated 13 July 2022.14 Meanwhile, JJS submitted his Verified Comment dated 11 July 2022 on 15 July 2022.15

In their Verified Comments, both JB and JJS pointed out that the subject “FB Live Coverage Video,” which was mentioned in her complaint was not appended by the Complainant thereto.16 As such, Respondents posited that it resulted in “the absence of said supporting evidence in the Complaint sent to and received by [them].”17

Further, both Respondents “vehemently” denied the allegations of violation of the DPA, particularly Section 31 (Malicious Disclosure) and Section 32 (Unauthorized Disclosure).18

First off, Respondents argued that none of the elements of Section 31 (Malicious Disclosure) are present in this case.19 According to Respondents, they are not a personal information controller (PIC) or a personal information processor (PIP), or an official, employee, agent of a PIC or a PIP as defined by the DPA.20

Both Respondents also alleged that they are, by profession, “Broadcaster/Radio Commentator connected with 106.3 Energy FM under the segment, Asintado News and Asintado sa Radyo, among others.” As such, they maintained that they do not “control the collection, holding, processing or use of personal information.”2122 Accordingly, they were also not “outsourced by a PIC for the processing of personal data pertaining to a data subject.”23 At most, according to the Respondents, they only “broadcast or publish news or information about recent and/or important events.”24

With regard to the second element of Section 31, Respondents argued that “the complaint is bereft of any allegation, more so, evidence, of bad faith or malice,” therefore, they believed that the second element, as well as the others, are absent and inexistent in this case.25

Anent their contention that they did not violate Section 32 (Unauthorized Disclosure), Respondents argued that, as discussed above, they are not a PIC or a PIP or an official, employee, agent of a PIC or a PIP, as such, “the charge of Unauthorized Disclosure also fails to hold water.”26

According to Respondents, they are not covered by the DPA “as its scope is limited by Section 4 thereof,” which reads:

SEC. 4. Scope. – This Act applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing including those personal information controllers and processors who, although not found or established in the Philippines, use equipment that are located in the Philippines, or those who maintain an office, branch or agency in the Philippines subject to the immediately succeeding paragraph: x x x27

Lastly, Respondents argued that even assuming that the charges made by the Complainant hold water, the complaint filed by herein Complainant warrants dismissal for allegedly failing to exhaust remedies as required by Section 2 of the 2021 Rules of Procedure of the Commission.28

Both Respondents attested that the Complainant did not inform them in writing about her concern.29 Despite that, however, according to Respondents, they “timely and appropriately acted on the concern of the Complainant.”30

They emphasized the representation made by Complainant in her CAF regarding the removal of the subject video, which says “isang lingo bago po nila inalis,” and contended that they “not only responded but more importantly took timely and appropriate action on the concern of the complainant within the fifteen (15) day period provided in Section 2, Rule II of the 2021 Rules of Procedure of the National Privacy Commission.”31

After noting the submissions of the Respondents, the first preliminary conference for this case was held on 20 July 2022.32 During the said preliminary conference, only the Complainant was present.33 As such, the CID issued an Order dated 20 July 2022, directing Respondents to furnish Complainant with a copy of their Verified Comments, and resetting the preliminary conference on 17 August 2022.34

On 25 July 2022, an Entry of Appearance with Manifestation was filed by Atty. M G S. O (Atty. O) as counsel of Respondents.35 Atty. O manifested that the Respondents did not receive the link for the conference, hence their failure to attend the same.36 The CID acknowledged the said Entry of Appearance with Manifestation in an Order dated 29 July 2022.37

On 17 August 2022, the second Preliminary Conference for this case was held.38 During this conference, Respondents, Atty. O manifested that Respondents have “not received a copy of the video footage or Facebook Live that was submitted by the the Complainant, and for this reason, Respondents [were] not able to fully answer the complaint.”39 Hence, Complainant was required to submit a copy of the video recording of the Facebook Live within five (5) days from the conduct of the conference.40

Also, during this conference, Atty. O proposed the following issue for resolution in this case: Whether or not the respondents are covered by the Data Privacy Act given that the respondents are journalists and that the information was used for journalistic purposes.41 Meanwhile, since the Complainant was not assisted by counsel, she did not propose any issues.42

When asked if she would be willing to explore the possibility of settlement, the Complainant expressed her willingness.43 However, Atty. O manifested that there was nothing to settle since the Respondents had already removed the subject video within a week upon the request of the Complainant.44 As such, this case was not referred to mediation.45

Lastly, the CID, during the second preliminary conference, ordered the parties to submit their respective memoranda within fifteen (15) calendar days from 22 August 2022, or until 6 September 2022.46

In compliance with the above Order, the Complainant, on 24 August 2022, furnished the Commission and the Respondents with a copy of the subject Facebook Live video.47

On 25 August 2022, Respondents filed a Manifestation with Motion alleging the failure of the Complainant to comply with the CID’s Order to submit a copy of the subject Facebook Live Video and requesting the CID to reiterate its earlier directive to the Complainant to furnish Respondents copy of the said video and granting them fifteen (15) days to file their Memoranda reckoned from the date the Complainant furnished Respondents copy of the video recording.48

On 31 August 2022, the CID issued an Order noting the submission of Complainant dated 24 August 2022 and Manifestation with Motion filed by Respondents on 25 August 2022.49 Respondents were given fifteen (15) calendar days from receipt thereof to file their Memoranda.50

On 06 September 2022, the Complainant filed her Memorandum dated 02 September 2022.51

In her Memorandum, Complainant narrated that on 05 April 2022, at around 6:30 A.M., she was awakened by one EML, who told her to see an ongoing live streaming on Facebook in the program ASINTADO SA RADYO GNN TV 48.52

While watching the live stream, Complainant alleged she “saw and heard JJS and JB [Respondents] were in tandem reporting maliciously and indecently informations to the public stating that somebody BLOW JOB (BJ) a man that was caught by the police after the said malefactor was entrapped.”53

According to the Complainant, JJS asked JB in public “who the victim of sexual harassment and VAWC was.”54 Allegedly, both Respondents mentioned Complainant’s name, age, and address “without authorization from the latter.55

The Complainant, in her Memorandum, posited that “the fact that [R]espondents are broadcasters[,] or journalist[s] as they prefer them to be called[,] does not give them any license to violate the law on Privacy.”56

According to the Complainant, “the information provided by Respondents in Facebook…that Complainant … filed a case for sexual harassment and [VAWC] has blowjob a male who was subjected to arrest by authorities, is a communication or information … not protected by law.”57

As explained by Complainant, the information disseminated by the Respondents were sourced from the Police Blotter Report, which is protected from publication because it contains personal information “that if communicated publicly would naturally result to embarrassment and besmirched reputation…”58

Additionally, the Complainant argued that “Respondents fall under the definition of [PIC] because they are persons who use personal information which they have derived from Police Blotter.”59 According to Complainant, “[t]hey have processed the information from the Police Blotter by virtue of their acts performed upon personal information which includes: collection, recording or use of the data information…”60

Complainant further argued that the information involved in this case are privileged, considering that she is a victim of sexual harassment and VAWC and the law protects these information from public disclosure.61

For their part, Respondents submitted their Joint Memorandum on 12 September 2022.62

In their Joint Memorandum, Respondents reiterated the defenses previously raised in their Verified Comments and requested the dismissal of the complaint.63 According to Respondents, “[t]he video recording submitted by the Complainant proves that the information subject of the present case has been used for journalistic purposes, having mentioned during the conduct of delivering local news reports and updates in the segment Asintado sa Radyo | Asintado News.”64 Respondents also pointed out that Complainant admitted in her Complaint that Respondents are both journalists or reporters.65

To further show that they are journalists or reporters, Respondents alleged that they are “employed at 106.3 Energy FM, a radio station, and as journalists and reporters, are tasked with providing news reports and updates under the segment Asintado sa Radyo | Asintado News.”66

It is the Respondents’ position that being journalists and/or reporters, the DPA does not apply to them as provided in Paragraph 2, Section 4 thereof.67

Meanwhile, in order to disprove allegations that they intended to humiliate Complainant, Respondents averred that a viewing of the video recording would show that they were “plainly delivering news on air.”68 According to Respondents, “[n]o comment prejudicial to or that would tend to disgrace the Complainant was heard to have been said by the Respondents.”69

Further in their Joint Memorandum, Respondents reiterated their arguments that they are neither PICs nor PIPs, hence the first element of Sections 31 and 32 are lacking in this case.70

Respondents explained that as journalists their functions do not include processing or use of personal information and they did not instruct another to collect, hold, process, use, transfer or disclose personal information.71 As such, they could not be considered as PICs or PIPs.72

To support its allegations that there was no Malicious Disclosure in this case, Respondents also claimed that they did not disclose unwarranted or false information, as their news reports are “based on the interview made from and public records of the Philippine National Police stationed in N C.”73

Furthermore, Respondents averred that there was no bad faith or malice on their part “as they are only faithfully performing their duties as journalists and reporters which is to bring to the public local and national news reports and updates.”74

Lastly, Respondents, in their Joint Memorandum, also reiterated their argument that the complaint should be dismissed for failure of the Complainant to exhaust remedies as provided in Section 2, Rule II of the 2021 Rules of Procedure.75

According to Respondents, “[t]he fact that the Complainant did not inform [them] of her concern” and that they “took timely and appropriate action…in less than fifteen (15) days…” warrant the dismissal of the instant Complaint.76

Having received all the memoranda of the parties, a Notice dated 09 January 2024 was issued informing them that the case has been submitted for decision of the Commission.77

Issues

  1. Whether the instant Complaint should be dismissed for failure of the Complainant to exhaust remedies;

  2. Whether Respondents should be held liable for violation of Section 31 (Malicious Disclosure) of the DPA;

  3. Whether Respondents should be held liable for violation of Section 32 (Unauthorized Disclosure) of the DPA; and

  4. Whether Respondents are exempted from the application of the DPA by reason of journalistic exemption under Section 4 of the DPA.

Discussion

I. The Complaint should not be dismissed despite the failure of the Complainant to exhaust remedies.

Section 2, Rule II of the 2021 NPC Rules of Procedure provides:

Section 2. Exhaustion of remedies. – No complaint shall be given due course unless it has been sufficiently established and proven that:

  1. [T]he complainant has informed, in writing, the personal information controller (PIC), personal information processor (PIP), or concerned entity of the privacy violation or personal data breach to allow for appropriate action on the same; and

  2. [T]he PIC, PIP, or concerned entity did not take timely or appropriate action on the claimed privacy violation or personal data breach, or there is no response from the PIC, PIP, or concerned entity within fifteen (15) calendar days from receipt of written information from the complainant.

The NPC may waive any or all of the requirements of this Section at its discretion upon (a) good cause shown, properly alleged and proved by the complainant; or (b) if the allegations in the complaint involve a serious violation or breach of the Data Privacy Act of 2012, taking into account the risk of harm to the affected data subject, including but not limited to:

i. when there is grave and irreparable damage which can only be prevented or mitigated by action of the NPC;

ii. when the respondent cannot provide any plain, speedy or adequate remedy to the alleged violation; or

iii. the action of the respondent is patently illegal.78 (Emphases and Underscoring Supplied)

Based on the above-cited provision, two (2) requirements must be first established before a complaint is given due course, to wit:

  1. The complainant must have informed in writing the PIC, PIP, or concerned entity about the privacy violation or personal data breach; and

  2. The PIC, PIP, or concerned entity did not take timely or appropriate action on the claimed privacy violation or personal data breach, or there is no response from the PIC, PIP, or concerned entity within fifteen (15) calendar days from receipt of written information from the complainant.79

Clearly, in the instant case, the Complainant failed to inform the Respondents in writing regarding the alleged privacy violation. While a review of the case records would reveal that the Complainant informed JJS about her complaints when she personally went to speak with and beg him to remove the video at 9:00 A.M. on 05 April 2022, nothing in her CAF shows that she actually notified JJS, as well as JB, in writing about their alleged violation.80 According to Complainant:

“pinuntahan ko si JJS nakiusap ako ng personal at ngmakaawa April 5 9am pumayag naman po itong reporter na ito na ttawagan nya daw po agad ang kanyang technician/wrtier na iedit na alisin ang pangalan at address ko at inasahan ko nman pero binocked lng ako sa content na yun di nila ginawa isang lingo po bago nila inalis.”81

Additionally, the Respondents were correct in pointing out that based on the Complainant’s own statement in her CAF, it is clear that the subject video was taken down only within one (1) week – a period shorter than that prescribed in Section 2, Rule II of the 2021 NPC Rules of Procedures during which the PIC, PIP, or concerned entity should take timely or appropriate action on the claimed privacy violation or personal data breach.82 As such, both the first and second requirements of Section 2 as quoted above, are absent in this case.

However, Section 2, Rule II of the 2021 NPC Rules of Procedure provides exceptions to the requirement of exhaustion of remedies. The latter part of the said section provides:

The NPC may waive any or all of the requirements of this Section at its discretion upon (a) good cause shown, properly alleged and proved by the complainant; or (b) if the allegations in the complaint involve a serious violation or breach of the Data Privacy Act of 2012, taking into account the risk of harm to the affected data subject, including but not limited to:

i. when there is grave and irreparable damage which can only be prevented or mitigated by action of the NPC;

ii. when the respondent cannot provide any plain, speedy or adequate remedy to the alleged violation; or

iii. the action of the respondent is patently illegal.83 (Emphasis supplied)

As previously ruled by the Commission in NPC 19-030 and NPC 19-132:

This Commission recognizes that it is afforded with a broad range of powers to implement its mandate such as the power to waive the requirements of its Rules of Procedure. However, there are two alternate factors to be taken into account should it decide to waive the requirements of the aforementioned section: (a) good cause shown, properly alleged and proved by the complainant; or (b) if the complaint involves a serious violation or breach of the DPA, taking into account the risk of harm to affected data subjects.84

Notably, Respondents in this case, who claim to be reporters or journalists, allegedly disclosed, while delivering a news report online, the complete name, age, and address of the Complainant, who is a victim of sexual harassment and VAWC.85 Respondents allegedly disclosed said information maliciously and indecently to the public, stating that Complainant performed a sexual act in favor of a man who was caught by the police in an entrapment.86

The Complainant alleged that due to this, she experienced sleepless nights and severe embarrassment.87

In VVC v. CJB,88 the Commission waived the procedural technicalities and gave due course to the complaint and explained that it would be unreasonable to require the complainant to exhaust the remedies as the respondent cannot provide a plain, speedy, or adequate remedy to the alleged violation against the complainant because the personal data has already been released to third parties.89 Thus:

“The alleged privacy violation supposedly resulted from the disclosure of VVC’s sensitive personal information to third parties without her consent. To require VVC to first exhaust her remedies with CJB would be unreasonable. CJB is not in a position to provide any plain, speedy, or adequate remedy to the alleged violation against VVC since the PDS has already been released to third parties. The Commission reiterates that the requirement to exhaust available remedies does not contemplate exercises in futility that only delay justice for data subjects whose rights are supposedly violated.”90 (Emphasis supplied).

Considering, therefore, that the Respondents can no longer provide a plain, speedy, and adequate remedy since Complainant’s personal data had already been disclosed to the radio station’s listeners, and the allegations in the complaint involve serious violation of the DPA as well as the consequent risk of harm to the affected data subject, the Commission finds it appropriate to waive the requirements under Section 2, Rule II of the 2021 NPC Rules of Procedure. Hence, despite the failure of the Complainant to exhaust remedies in this case, the Commission deems it necessary to exercise its authority and adjudicate the case on its merits.

II. Respondents are not liable for Malicious Disclosure under Section 31 of the DPA.

Section 31 of the DPA provides:

Section 31. Malicious Disclosure. – Any personal information controller or personal information processor or any of its officials, employees or agents, who, with malice or in bad faith, discloses unwarranted or false information relative to any personal information or personal sensitive information obtained by him or her, shall be subject to imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).91

Therefore, the requisites of Malicious Disclosure are:

  1. The perpetrator is a personal information controller or personal information processor or any of its officials, employees, or agents;

  2. The perpetrator disclosed personal or sensitive personal information;

  3. The disclosure was with malice or in bad faith; and

  4. The disclosed information relates to unwarranted or false information.92

Both Respondents, in their Verified Comment to the Complaint and Joint Memorandum, “vehemently” denied the allegation that they violated Section 31 (Malicious Disclosure) of the DPA.93

Respondents argued that none of the elements of Section 31 (Malicious Disclosure) are present in this case.94 Initially, according to Respondents, the first element of Section 31 is not present because they are not a PIC or PIP, or an official, employee, agent of a PIC or a PIP as defined by the DPA.95

Respondents alleged that they are, by profession, “Broadcaster/Radio Commentator connected with 106.3 Energy FM under the segment, Asintado News and Asintado sa Radyo, among others,” who only “broadcast or publish news or information about recent and/or important events.”96 As such, Respondents believe that they do not “control the collection, holding, processing or use of personal information.”97

Section 3(h) of the DPA defines a PIC as “a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.”98

In this case, Respondents acted as PICs when they collected, held, used, and disclosed the personal data, such as the name, age, and address, of the Complainant, which they allegedly gathered from interviews and records of the PNP Naga City.99

Clearly, Respondents’ argument that they are not PICs because they are just Broadcasters/Radio Commentators, who do not “control the collection, holding, processing or use of personal information” is thus misplaced.100

With regard to the second requisite of Section 31 that the perpetrator disclosed personal or sensitive personal information, it is undisputed in this case that Respondents disclosed the name, age and address of the Complainant, as well as the fact that she was a victim of sexual harassment, during an ongoing live streaming on Facebook of their program ASINTADO SA RADYO GNN TV 48.101

Personal information is defined as any information from which the identity of an individual is apparent or can be reasonably and directly ascertained, or when put together with other information would directly and certainly identify an individual.102

Meanwhile, Section 3(l) of the Data Privacy Act (DPA) 2012 defines sensitive personal information:

l. Sensitive personal information refers to personal information:

  1. About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;

  2. About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;

  3. Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns, and

  4. Specifically established by an executive order or an act of Congress to be kept classified.103

The name, age, and address of the Complainant that were disclosed by Respondents in this case are undeniably personal information while an individual’s age as well as facts relating to her sexual life are considered sensitive personal information.104 Hence, the second requisite is present.

Anent the third and fourth elements of Section 31, which requires disclosure was with malice or in bad faith, and the disclosed information relates to unwarranted or false information.105

The Supreme Court has defined “malice” as that which “connotes ill will or spite and speaks not in response to duty but merely to injure the reputation of the person defamed and implies an intention to do ulterior and unjustifiable harm.”106 As to bad faith, it “implies a conscious and intentional design to do a wrongful act for a dishonest purpose or some moral obliquity.”107

Section 1 of Rule 131 of the 2019 Amendments to the Revised Rules on Evidence provides:

Section 1. Burden of proof and burden of evidence. Burden of proof is the duty of a party to present evidence on the facts in issue necessary to establish his or her claim or defense by the amount of evidence required by law. Burden of proof never shifts.

Burden of evidence is the duty of a party to present evidence sufficient to establish or rebut a fact in issue to establish a prima facie case. Burden of evidence may shift from one party to the other in the course of the proceedings, depending on the exigencies of the case.108 (Emphasis supplied.)

Meanwhile, Section 6 of Rule 133 of the 2019 Amendments to the Revised Rules on Evidence reads:

Section 6. Substantial Evidence. In cases filed before administrative or quasi-judicial bodies, a fact may be deemed established if it is supported by substantial evidence, or that amount of relevant evidence which a reasonable mind might accept as adequate to justify a conclusion.109 (Emphasis supplied.)

Therefore, in administrative proceedings pending before quasi-judicial agencies, such as the NPC, substantial evidence is required to establish a claim for violation of the DPA.

In DOH v. Aquintey, the Supreme Court has held that it is the party who alleges a fact that has the burden of proving it.110 In Eyana vs. Philippine Transmarine Carriers, Inc., the Supreme Court ruled that a party alleging a critical fact must support his allegation with substantial evidence, and any decision on an unsubstantiated allegation cannot stand as it will offend due process.111

In this case, other than an allegation that the disclosure made by the Respondents was malicious, the Complainant failed to prove by substantial evidence that such disclosure was indeed attended by malice or bad faith. Moreover, it is settled that bad faith is never presumed and it is a question of fact and is evidentiary such that the records must first bear evidence of malice before a finding of such may be made.112 Further, the Commission noted that the facts in this case were undisputed. Respondents, in their Verified Comments, even admitted disclosing Complainant’s information on their radio show.113 To the Commission, these information were unwarranted as it goes beyond what is necessary to be disclosed in the purview of news reporting. As such, the third and fourth elements are absent.

Finding that not all elements of Section 31 are present in this case, Respondents cannot be held liable for Malicious Disclosure.

III. Respondents are liable for Unauthorized Disclosure under Section 32 of the DPA.

Section 32 of the DPA provides:

SEC. 32. Unauthorized Disclosure. – (a) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).

(b) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party sensitive personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from three (3) years to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00). (Emphasis supplied)114

To determine whether there is Unauthorized Disclosure, the following requisites must concur:

  1. The perpetrator is a personal information controller or personal information processor;

  2. The perpetrator disclosed information;

  3. The information relates to personal or sensitive personal information;

  4. The perpetrator disclosed the personal or sensitive personal information to a third party;

  5. The disclosure was without any of the lawful basis for processing, consent or otherwise, under Sections 12 and 13 of the DPA; and

  6. The disclosure is neither malicious nor done in bad faith or the information disclosed is not unwarranted or false information.115

All these elements for violation of Section 32 of the DPA are present in this case.

As to the first element, as discussed above, Respondents are considered PICs as defined under the DPA.

The second element is also met, as Respondents disclosed during an ongoing live streaming on Facebook of their program ASINTADO SA RADYO GNN TV 48, the name, age, and address of the Complainant, along with the fact that she was subjected to sexual harassment.116

The third element is also present, as it has already been established that the information involved in this case pertains to personal information and sensitive personal information of the Complainant such as her name, age, and address, along with the fact that she was subjected to sexual harassment.117

Regarding the fourth element, again, in arguing that they are plainly delivering news on air as journalists, the Respondents admitted having disclosed the Complainant’s personal data during an ongoing live streaming on Facebook of their program ASINTADO SA RADYO GNN TV 48, which means disclosure of Complainant’s personal data to the viewers of the Respondents’ program.118 Therefore, the fourth element is present.

As to the fifth element, Section 32 of the DPA should be read together with Sections 12 and 13 on the criteria for lawful processing of personal and sensitive personal information. To justify processing of such information, one must satisfy the criteria set forth in Sections 12 and 13.

Section 12 of the DPA reads:

SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

(a) The data subject has given his or her consent;

(b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract;

(c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;

(d) The processing is necessary to protect vitally important interests of the data subject, including life and health;

(e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or

(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.119

Meanwhile, Section 13 provides:

SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

(a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing;

(b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;

(c) The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing;

(d) The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, That such processing is only confined and related to the bona fide members of these organizations or their associations: Provided, further, That the sensitive personal information are not transferred to third parties: Provided, finally, That consent of the data subject was obtained prior to processing;

(e) The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured; or

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.120

In this case, it was sufficiently established that Respondents have no lawful basis for processing and the Complainant has not given her consent to disclose her personal data. Notably, the disclosure does not fall within the other criteria for lawful processing of personal and sensitive personal information as provided under Sections 12 and 13 of the DPA. Thus, the Commission finds the fifth element present in this case.

With regard the last element, it must be stressed that the distinction between Malicious Disclosure (Section 31) and Unauthorized Disclosure (Section 32) hinges, among others, on whether there is evidence of malice or bad faith and whether the disclosed information relates to unwarranted or false information, such that the presence thereof would make the act a violation of Section 31 instead of Section 32.

Having discussed above that malice or bad faith is not present in this case, and disclosed information relates to unwarranted or false information, it follows that the last element of Section 32 is, therefore, present. Hence, the Commission finds Respondents liable under Section 32 (Unauthorized Disclosure) of the DPA.

III. Respondents are not exempted from the application of the DPA.

A. The Scope and Limitations of Journalistic Exemption

In their Joint Memorandum, the Respondents argued that the DPA does not apply to the processing of personal information for journalistic purposes, referencing paragraph 2 of Section 4 of the DPA and Section 5(b), Rule II of the IRR of DPA.121 The Respondents contended that:

  1. The video recording submitted by the Complainant proves that the information subject of this present case has been used for journalistic purposes, having been mentioned during the conduct of delivering local news reports and updates in the segment Asintado sa Radyo | Asintado News.

  2. Moreover, as admitted by the Complainant in her complaint, the Respondents are both journalists or reporters. The video recording submitted by the Complainant, which the Respondents here adopt as their exhibit, proves the fact that the Respondents are journalists and reporters. They are employed at 106.3 Energy FM, a radio station, and as journalists and reporters, are tasked with providing news reports and updates under the segment Asintado sa Radyo | Asintado News. x x x”122

Unmistakably, the Respondents cannot be exempted from the application of the DPA by claiming that they are journalists and that the use and disclosure of the Complainant’s information was for journalistic purposes. Section 4(d) of the DPA provides that:

SEC. 4. Scope – This Act applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing including those personal information controllers and processors who, although not found or established in the Philippines, use equipment that are located in the Philippines, or those who maintain an office, branch or agency in the Philippines subject to the immediately succeeding paragraph: Provided, That the requirements of Section 5 are complied with.

This Act does not apply to the following:

xxx

(d) Personal information processed for journalistic, artistic, literary or research purposes; x x x ”123

Meanwhile, Section 5(b), Rule II of the IRR of the DPA states that:

Section 5. Special Cases. The Act and these Rules shall not apply to the following specified information, only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned:

xxx

b. Personal information processed for journalistic, artistic or literary purpose, in order to uphold freedom of speech, of expression, or of the press, subject to requirements of other applicable law or regulations;

xxx

Provided, that the non-applicability of the Act or these Rules do not extend to personal information controllers or personal information processors, who remain subject to the requirements of implementing security measures for personal data protection: Provided further, that the processing of the information provided in the preceding paragraphs shall be exempted from the requirements of the Act only to the minimum extent necessary to achieve the specific purpose, function, or activity.”124

Section 5(b), Rule II of the IRR provides that the exemption from the DPA requirements applies solely to “the minimum extent necessary to achieve the specific purpose, function, or activity concerned.”125

Likewise, the same provision provides that the exemption is made “in order to uphold freedom of speech, of expression, or of the press, subject to the requirements of other applicable law or regulations.”126

Therefore, the exemption under Section 4(d) of the DPA, in relation to Section 4 of the IRR, is not absolute. It applies only to the personal information being processed and not to the entities involved in the processing, i.e. the PIC or PIP.127 These entities remain subject to the requirements of the DPA and compliance with the primary obligations of the PIC or PIP.

In other words, the natural or juridical entity processing the specified personal information remains to be covered by the DPA and other relevant issuances of the Commission.128

The non-applicability of the DPA does not extend to the duties and responsibilities of the entity or organization as a PIC or PIP, such as the duty to uphold the rights of data subjects, adhere to the data privacy principles, to designate a data protection officer, and to ensure the implementation of security measures to protect personal data, among others.129

Clearly, the Respondents cannot be excused from the application of the DPA by simply arguing that they are journalists and that the use and disclosure of the Complainant’s information was for journalistic purposes because the exemption applies only to a minimum extent necessary to achieve the specific purpose, function, or activity concerned and only for specific purposes, such as to uphold freedom of speech, of expression, or the press, as discussed above.130

Furthermore, the Respondents’ manner of reporting is completely contrary to Section 11(d) of the DPA which provides that “personal information must be adequate and not excessive in relation to the purposes for which they are collected and processed”.131 Simply put, the processing of personal information must be appropriate, relevant, suitable, and necessary, such that it is not excessive in relation to the declared and specified purpose.132

Additionally, when reporting as regards victims of sexual abuse, their circumstances and identities must be kept confidential, as established by the Journalist’s Code of Ethics.133 These guidelines, mandate, among others, that Filipino journalists refrain from writing reports that will adversely affect an individual’s reputation.134

B. Respondents Violated the DPA in relation to Section 44 of R.A. 9262 (Anti-Violence Against Women and Their Children Act)

Furthermore, as shown above, while the processing of personal information for journalistic purposes is an exemption from the application of the DPA, it remains “subject to the requirements of other applicable law or regulations.”135

As such, even if journalistic exemption under the DPA is applied, it does not absolve the Respondents from complying with other applicable laws, such as the Republic Act 9262 or the “Anti-Violence Against Women and their Children Act.”

Section 44 of R.A. 9262 provides:

SECTION 44. Confidentiality. – All records pertaining to cases of violence against women and their children including those in the barangay shall be confidential and all public officers and employees and public or private clinics to hospitals shall respect the right to privacy of the victim. Whoever publishes or causes to be published, in any format, the name, address, telephone number, school, business address, employer, or other identifying information of a victim or an immediate family member, without the latter’s consent, shall be liable to the contempt power of the court.

Any person who violates this provision shall suffer the penalty of one (1) year imprisonment and a fine of not more than Five Hundred Thousand pesos (P500,000.00). ”136

While the Respondents’ job as journalists is to deliver daily local or national news to their viewers and listeners, clearly, they have violated the confidentiality rule provided under R.A. No. 9262 when they disclosed the Complainant’s name, age and address, as well as the circumstance in which she was involved.137

Moreover, personal information must be processed fairly and lawfully.138 The PIC cannot violate any law in the process of accomplishing its legitimate interest.139

Therefore, the Respondents cannot be exempt from the provisions of the DPA and its IRR simply by asserting that they are journalists and that the use and disclosure of personal and sensitive personal information served journalistic purposes.

IV. Complainant is entitled to Nominal Damages

Section 16(f) of the DPA entitles data subjects to be indemnified for any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information.140

Section 37 of the DPA also provides that restitution for any aggrieved party shall be governed by the provisions of the New Civil Code.141

Moreover, Section 6 of NPC Circular 2024-01 grants the Commission the authority to award indemnity in cases related to personal data protection or the rights of the data subject, with the indemnity amount to be determined in accordance with the provisions of the Civil Code.142

In relation to the above provisions, Article 2221 of the New Civil Code provides:

Art. 2221. Nominal damages are adjudicated in order that a right of the plaintiff, which has been violated or invaded by the defendant, may be vindicated or recognized, and not for the purpose of indemnifying the plaintiff for any loss suffered by him.143

Nominal damages are also awarded “where a legal right is technically violated and must be vindicated against an invasion that has produced no actual present loss of any kind or where there has been a breach of contract and no substantial injury, or actual damages whatsoever have been or can be shown.”144

Based on the foregoing and considering the Commission’s findings that Respondents disclosed Complainant’s personal data without her consent and with no authority under the DPA or other laws, in violation of her rights as a data subject, the Commission finds that the award of nominal damages to Complainant is warranted.

WHEREFORE, premises considered, the Commission:

  1. FINDS that Respondents JJS and JB violated Section 32 (Unauthorized Disclosure) of the DPA;

  2. AWARDS Nominal Damages in the amount of Php 75,000.00 in favor of Complainant CJJ; and

  3. FORWARDS this Decision and a copy of the pertinent case records to the Secretary of Justice and RECOMMENDS the prosecution of the Respondents for violation of Section 32 (Unauthorized Disclosure) of the DPA.

SO ORDERED.

City of Pasay, Philippines. 17 September 2024.

NERISSA N. DE JESUS Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

Copy furnished:

CJJ Complainant

JJS JB Respondents

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Complaints-Assisted Form received by the Commission on 23 May 2022. ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. ↩

  6. Id. ↩

  7. Id. ↩

  8. Id. ↩

  9. Id. ↩

  10. Id. ↩

  11. Id. ↩

  12. Id. ↩

  13. Order dated 30 May 2022. ↩

  14. Verified Comment of Respondent JB dated 13 July 2022. ↩

  15. Verified Comment of Respondent JJS dated 13 July 2022. ↩

  16. Verified Comment of Respondent JB dated 13 July 2022, and Verified Comment of Respondent JJS dated 13 July 2022. ↩

  17. Id. ↩

  18. Id. ↩

  19. Id. ↩

  20. Id. ↩

  21. Id. ↩

  22. Id. ↩

  23. Id. ↩

  24. Id. ↩

  25. Id. ↩

  26. Id. ↩

  27. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 § 4 (2012). ↩

  28. Verified Comment of Respondent JRB dated 13 July 2022, and Verified Comment of Respondent JJS dated 13 July 2022. ↩

  29. Id. ↩

  30. Id. ↩

  31. Id. ↩

  32. Order dated 20 July 2022. ↩

  33. Id. ↩

  34. Id. ↩

  35. Entry of Appearance with Manifestation dated 25 July 2022. ↩

  36. Id. ↩

  37. Order dated 29 July 2022. ↩

  38. Order dated 17 August 2022. ↩

  39. Id. ↩

  40. Id. ↩

  41. Id. ↩

  42. Id. ↩

  43. Id. ↩

  44. Id. ↩

  45. Id. ↩

  46. Id. ↩

  47. Complainant’s Email dated 24 August 2022. ↩

  48. Manifestation with Motion dated 25 August 2022. ↩

  49. Order dated 31 August 2022. ↩

  50. Id. ↩

  51. Complainant’s Memorandum dated 02 September 2022. ↩

  52. Id. ↩

  53. Id. ↩

  54. Id. ↩

  55. Id. ↩

  56. Id. ↩

  57. Id. ↩

  58. Id. ↩

  59. Id. ↩

  60. Id. ↩

  61. Id. ↩

  62. Respondents’ Joint Memorandum dated 12 September 2022. ↩

  63. Id. ↩

  64. Id. ↩

  65. Id. ↩

  66. Id. ↩

  67. Id. ↩

  68. Id. ↩

  69. Id. ↩

  70. Id. ↩

  71. Id. ↩

  72. Id. ↩

  73. Id. ↩

  74. Id. ↩

  75. Id. ↩

  76. Id. ↩

  77. Notice dated 09 January 2024. ↩

  78. National Privacy Commission, 2021 Rules of Procedure of the National Privacy Commission [NPC 2021 Rules of Procedure], Rule II, § 2 (28 January 2021). ↩

  79. Id. ↩

  80. Complaints-Assisted Form received by the Commission on 23 May 2022. ↩

  81. Id. ↩

  82. Verified Comment of Respondent Jerome R. Bries dated 13 July 2022, and Verified Comment of Respondent JJS dated 15 July 2022. ↩

  83. National Privacy Commission, 2021 Rules of Procedure of the National Privacy Commission [NPC 2021 Rules of Procedure], Rule II, § 2 (28 January 2021). ↩

  84. CL v. DDZ and DM v. DDZ, NPC 19-030 and NPC 19-132, 10 June 2021, at 5, available at https://www.privacy.gov.ph/wp-content/uploads/2023/01/NPC-19-030-and-19-132_06-10-21_CL-and-DM-vs-DDZ_Decision-Final.pdf ↩

  85. Complaints-Assisted Form received by the Commission on 23 May 2022. ↩

  86. Id. ↩

  87. Id. ↩

  88. VVC v. CJB, NPC 19-134, 10 December 2021, at 5, available at NPC-19-134-VVC-v.-CJB-Decision-2021.12.10.pdf. ↩

  89. Id. ↩

  90. Id. ↩

  91. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, chapter VIII, § 31 (2012). ↩

  92. NPC 21-031. ↩

  93. Verified Comment of Respondent Jerome R. Bries dated 13 July 2022, and Verified Comment of Respondent JJS dated 13 July 2022. ↩

  94. Id. ↩

  95. Id. ↩

  96. Id. ↩

  97. Id. ↩

  98. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, § 3 (2012). ↩

  99. Respondents’ Joint Memorandum dated 12 September 2022. ↩

  100. Id. ↩

  101. Complainant’s Memorandum dated 02 September 2022. ↩

  102. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 § 3 (g) (2012). Emphasis supplied. ↩

  103. Data Privacy Act of 2012. ↩

  104. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 § 3 (l) (2012). ↩

  105. MVC et al. v. DSL, NPC 21-010, 21-011, 21-012, 21-013, 21-014, and 21-015, at 10, available at https://privacy.gov.ph/wp-content/uploads/2023/05/NPC-21-010-to-NPC-21-015-2022.02.03-MVC-et-al.-v.-DSL-Decision-Final.pdf (last accessed 13 December 2023). ↩

  106. Delgado v. HRET, G.R. No. 219603, 26 January 2016. ↩

  107. Montinola vs. Philippine Airlines, G.R. No. 198656, 08 September 2014. ↩

  108. 2019 Amendment to the 1989 Revised Rules on Evidence, A.M. No. 19-08-15-SC, Rule 131, §1 (1 May 2020). ↩

  109. 2019 Amendment to the 1989 Revised Rules on Evidence, A.M. No. 19-08-15-SC, Rule 133, §6 (1 May 2020). ↩

  110. DOH v. Aquintey, et al., 806 Phil. 763, 772 (2017). ↩

  111. Eyana vs. Philippine Transmarine Carriers, Inc., 748 SCRA 429. ↩

  112. Pioneer Insurance & Surety Corporation v. Morning Star Travel & Tours, Inc. 763 Phil. 428, 430-431 (2015). ↩

  113. Verified Comment of Respondent JB dated 13 July 2022, and Verified Comment of Respondent JJS dated 13 July 2022. ↩

  114. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, chapter VIII, § 32 (2012). ↩

  115. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 § 32 (2012). ↩

  116. Complainant’s Memorandum dated 02 September 2022. ↩

  117. Id. ↩

  118. Id. ↩

  119. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, chapter III, § 12 (2012). ↩

  120. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, chapter III, § 13 (2012). ↩

  121. Respondents’ Joint Memorandum dated 12 September 2022. ↩

  122. Id. ↩

  123. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 § 4 (d) (2012). ↩

  124. National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, rule IV, § 5(b) (2016). ↩

  125. Id. ↩

  126. Id. ↩

  127. Id. ↩

  128. National Privacy Commission, NPC Advisory Opinion No. 2019-001 (14 January 2019). ↩

  129. National Privacy Commission, NPC Advisory Opinion No. 2017-44 (16 August 2017). ↩

  130. National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, rule IV, § 5(b) (2016). ↩

  131. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 § 11 (d) (2012). ↩

  132. National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, rule IV, § 18(c) (2016). ↩

  133. Par. 4, Journalist’s Code of Ethics, available at https://philpressinstitute.net/journalist-code-of-ethics/ (last accessed 17 October 2024). ↩

  134. Id. ↩

  135. National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, rule IV, § 5(b) (2016). ↩

  136. Republic Act No. 9262, otherwise known as the Anti-Violence Against Women and their Children Act, Sec. 44. ↩

  137. Video Evidence submitted by Complainant, 24 August 2022, 37:11 to 39:47. ↩

  138. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 § 11 (b) (2012). ↩

  139. Philippine General Hospital represented by its Hospital Director Gerardo D. Legaspi, MD and Jayvee S. Guerrero, MD v. Ramon T. Tulfo, Jr., Viola Abando Rosales, John Does, and Jane Does, NPC 18-166, at 57, (unreported). ↩

  140. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, chapter IV, § 16 (f) (2012). ↩

  141. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, chapter IV, § 37 (2012). ↩

  142. NPC Circular 2024-01, 26 January 2024, Amendments to Certain Provisions of the 2021 Rules of Procedure of the National Privacy Commission. ↩

  143. An Act to Ordain and Institute the Civil Code of the Philippines [Civil Code of the Philippines], Republic Act No. 386, book IV, chapter 3, § 3, Art. 2221 (1949). ↩

  144. Seven Brothers Shipping Corporation v. DMC-Construction Resources, Inc., G.R. No. 193914 dated 26 November 2014. ↩

Backlinks

  • No backlinks found