Decision Text
ID Y.S.,
Complainant,
-versus-
DS Bank,
Respondent.
x----------------------------------------------------x
LIBORO, P.C.:
Before this Commission is a complaint filed by ID Y.S. (Complainant) against DS Bank (Respondent) for the violation of Data Privacy Act of 2012 (DPA).
Facts
Sometime in June 2016, Complainant called Respondent’s hotline and its Collection Department to complain about the demand letters she had been receiving since March to July 2016 addressed to a certain ID L.S. with account number 0000 xxxxxxxxxxxx. One of the agents verified that the account number belonged to Complainant while another agent told her that it was a case of mistaken identity. Hence, Complainant requested that Respondent’s fraud department investigate her concern.
On 16 August 2016, Complainant filed a letter-complaint with Bangko Sentral ng Pilipinas (BSP) against Respondent regarding the issue. In reply, Respondent apologized for sending erroneous demand letters to her email address idys@yahoo.com. Further, Respondent’s agent I.J.C. informed Complainant that her email account had been removed from the account of ID L.S.
On 24 May 2017, Complainant filed the instant complaint before the Commission and alleged that she never received feedback on the internal investigation of Respondent regarding her concern.
On 30 August 2017, both parties appeared and expressed their willingness to explore the possibility of an amicable settlement. However, both parties were unable to agree on the terms and conditions of the settlement during the Discovery Conference dated 27 September and 25 October 2017.
Discussion
This case before the Commission warrants dismissal.
The crux of the complaint is the allegation by Complainant that her data privacy rights in accordance with the DPA was violated by Respondent when she received several demand letters for a credit card payment.
Justice Alicia Austria-Martinez penned that he who alleges a fact has the burden of proving it and a mere allegation is not evidence.1 Hence, the burden lies on Complainant to prove whether or not Respondent committed a violation of the DPA.
Section 3 (f), Rule 1 of NPC Circular 16-03 (Personal Data Breach Management) provides that:
Personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed. A personal data breach may be in the nature of: An availability breach resulting from loss, accidental or unlawful destruction of personal data; Integrity breach resulting from alteration of personal data; and/or A confidentiality breach resulting from the unauthorized disclosure of or access to personal data.
Upon careful examination of the case, Respondent sent several demand letters containing the personal data of ID L.S. (“Data Subject”) to Complainant. Accordingly, the personal data of the Data Subject was breached or compromised due to the unauthorized disclosure by Respondent. However, Complainant as a mere recipient of the demand letter was not personally affected by the unauthorized disclosure committed by Respondent to the Data Subject.
Settling the existence of breach in this case, the Commission now tackles the crux of the complaint. Section 3 of NPC Circular 16-04 (NPC Rules of Procedure) provides for who may file a complaint:
SECTION 3. Who may file complaints. – The National Privacy Commission, sua sponte, or persons who are the subject of a privacy violation or personal data breach, or who are otherwise personally affected by a violation of the Data Privacy Act, may file complaints for violations of the Act. The person who is the subject of the privacy violation or personal data breach, or his or her duly authorized representative may file the complaint, Provided, that the circumstances of the authority must be established. Any person who is not personally affected by the privacy violation or personal data breach may: (a) request for an advisory opinion on matters affecting protection of personal data; or (b) inform the National Privacy Commission of the data protection concern, which may in its discretion, conduct monitoring activities on the organization or take such further action as may be necessary.
In this case, the Commission observed that there was no allegation that Complainant’s personal information was breached and resulted to loss, accidental, or unlawful destruction of her personal data. Further, there was no allegation that Complainant’s personal information was disclosed to the Data Subject or to any other person. What was alleged in the Complaint is that Complainant was personally affected when she became the recipient of the demand letters belonging to the Data Subject.
The clear provision of the law then clearly implies that being a recipient alone of someone else’s personal information does not entitle the recipient, which is the Complainant in this case, the right to file a complaint or claim for damages. Hence, Complainant’s allegation that she was personally affected cannot be admitted by the Commission for her failure to show that her personal information was breached or compromised. Complainant’s stand-alone allegation is not sufficient to file a complaint before the Commission because she is neither the subject of a privacy violation or personal data breach, or who is otherwise personally affected by a violation of the DPA. Put simply, Complainant does not have a legal standing to sue Respondent since she is not the affected data subject or was personally affected by a violation of the DPA.
The pronouncement however of the Commission in this case does not bar the people who are not personally affected to call the attention of the Commission on matters affecting protection of personal data. The law also extends help to any person who is not personally affected by the privacy violation or personal data breach. Whereas, the person not personally affected, like Complainant in this case, can request for an advisory opinion on matters affecting protection of personal data. As to data protection concern, they can inform the National Privacy Commission, which may in its discretion, conduct monitoring activities on the organization or take such further action as may be necessary.
In view of the foregoing, the Commission finds that the case must be dismissed for the reason that Complainant does not have a legal standing to sue Respondent for a violation of the DPA.
WHEREFORE, premises considered, the case NPC 17-015— ID Y.S. vs. DS Bank is hereby DISMISSED for lack of merit.
This is without prejudice to the filing of appropriate civil, criminal or administrative cases against the Respondent before any other forum or tribunal, if any.
SO ORDERED.
Pasay City, Philippines; 31 January 2020.
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
WE CONCUR:
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Copy furnished:
ID Y.S. Complainant
DS Bank Respondent
LEGAL DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission
Footnotes
-
Luxuria Homes Inc. vs. CA, GR No. 125986, Jan 28, 1999 ↩