Decision Text
RLA,
Complainant,
-versus-
PLDT Enterprise,
Respondent.
x----------------------------------------------------x
LIBORO, P.C.:
Before this Commission is a Complaint filed by RLA (Complainant) against Respondent PLDT Enterprise (PLDT) for violation of the Data Privacy Act of 2012 (“DPA” or “Data Privacy Act”) when it published the Complainant’s personal information in its White Pages without the consent of the Complainant.
Facts
Complainant alleged that he was a regular employee of Knutsen Philippines, Inc. (Knutsen) and that he was provided a PLDT Digital Subscriber Line (DSL) subscription as part of his employment package. Further, that on 12 January 2016, he filled out a PLDT DSL subscription application form that was submitted to Respondent to activate the DSL facility installed at his then residence at Las Piñas City.1
On 12 April 2016, Complainant requested the same DSL facility to be transferred to his new residential address also at Las Piñas City.
Complainant narrated that on 21 March 2018, someone called and looked for him through his PLDT-issued landline number that was bundled together with the DSL subscription. The caller allegedly wanted to offer some products to Knutsen. The caller told him that she obtained his number and address from PLDT’s telephone directory – the White Pages.
Alarmed, Complainant called PLDT’s hotline number and sent an email to smecare@PLDT.com.ph to inquire why his number and address were published in their directory without his consent.
The PLDT customer service representative mentioned that Complainant’s telephone number was tagged as confidential in PLDT’s system.
Complainant sent another email to smecare@PLDT.com.ph for further clarification why his personal information was published in PLDT’s telephone directory. The customer service representative told Complainant that the involved number has been tagged as published in PLDT’s telephone directory listing since it was not requested as confidential via customer information form upon application. Complainant stated that there was no such option on the application form. Acting on Complainant’s concern, PLDT’s agent replied that his personal information would be tagged as confidential and will no longer be published in the 2018 telephone directory. Complainant avers that the agent’s response supports his allegation that his personal information was originally published and was not treated as confidential.
Complainant asserted that PLDT’s disclosure of his personal information was done without his consent and it poses great risk to his security and to his family. He further claims that his father’s life was in danger and as a proof he adduced DSWD Certificate.
According to the Complainant, he must protect his father’s welfare at all cost, including keeping his personal information confidential, even from their relatives and friends.
On 04 July 2018, this Commission, through the Complaints and Investigation Division (CID), conducted a Discovery Conference where both parties appeared. Both parties requested for continuance of their discussion of the case.
On 11 August 2018, another Discovery Conference was conducted. This time, the parties manifested that they are both willing to enter into an amicable settlement. Thus, they were given a period of fifteen (15) days from the date of the Discovery Conference or until 26 August 2018 to submit a notarized Compromise Agreement. However, the parties were unable to settle the case amicably within the given time.
On 05 October 2018, PLDT filed its responsive Comment.
PLDT argued that it is mandated by law to issue a listing directory of the names, addresses, and telephone numbers of all its subscribers. The publication of Complainant’s personal information was done in the performance of its mandate under existing Philippine laws.
In particular, PLDT stated that under Section 149 of Commonwealth Act No. 146, otherwise known as the Public Service Act, PLDT, as an entity operating a “telephone public service” is required, at least once a year, to issue a listing directory showing therein the names of all subscribers, together with their addresses, telephone numbers and such other information as may be of interest to subscriber’s everyday use of his telephone. In compliance with its obligations under the laws and regulations mentioned above, PLDT implemented its internal rules that was approved by the Public Service Commission in 1970.
PLDT also contended that it was merely acting upon the instructions of its customer, Knutsen, which was the personal information controller of the Complainant’s personal information.
It explained that PLDT is in the business of providing communication services to corporations. PLDT transacts with corporate/group clients/customers even if the ultimate recipients of the communication services it provides are individual persons connected to the corporate clientele. In PLDT’s process, the corporate clients/customers provide the required information of the end-user to facilitate the rendition of services, among others.
The relevant subscription agreements/contracts were unequivocally signed between PLDT and Knutsen. Knutsen, as a corporate client of PLDT, was the provider of DSL subscriptions for the benefit of its employees including the Complainant. In other words, it was Knutsen that applied for a corporate DSL account with PLDT on behalf of Complainant. Moreover, the required application form was made in the name of Knutsen and from PLDT’s perspective, it appeared that Complainant had no participation in accomplishing the forms. Considering that the application involved was a corporate account, PLDT published the details indicated in the application form in the White pages – Government and Business Book 2017.
PLDT elaborated that the terms and conditions of the application form stated that it shall provide its telephone services in accordance with the rules and regulations issued by other appropriate government agencies. It is Knutsen, as a corporate subscriber of PLDT’s services, which has the option to decide whether to publish the names, addresses and telephone numbers provided in the DSL subscription application form.
PLDT further argued that Knutsen as the personal information controller of Complainant, has the duty to ensure that the rights of Complainant as a data subject are upheld. Knutsen was responsible for ensuring that Complainant gave his informed consent to the processing of his personal information. Knutsen should have informed Complainant of its option not to be listed in the directory for publication and relay the chosen option to PLDT as the personal information processor. However, Knutsen never requested from PLDT not to publish Complainant’s personal information. Had Knutsen clarified with PLDT that Complainant intended to keep his personal information confidential, PLDT would have complied.
For PLDT, no breach was concealed because the publication of Complainant’s information was made under legal compliance and was known to Knutsen. PLDT explained that intentional breach is committed when a person knowingly and unlawfully violates data confidentiality and security data systems or breaks into system where personal and sensitive personal information are stored.
Complainant also failed to show how PLDT unlawfully obtained his personal data, as it obtained his personal information under its agreement with Knutsen.
PLDT raised that Complainant has no proof of actual threat of abduction on his father and that the publication of his whereabouts caused security risks to the safety of his family. He failed to show how the publication of directory risked the safety of his family because his whereabouts can be easily known on his and his family’s posts on Facebook, all set to public mode. Such act is contrary to his claim that he and his family were in hiding from the abductors of his father.
As remedial action, PLDT updated the DSL application forms for corporate accounts and the relevant internal rules in processing such accounts.
PLDT took immediate action to reinforce its procedure for handling customer cases and concerns on data privacy and protection.
On 05 October 2018, Complainant in his Reply argued that PLDT’s statutory obligation to automatically publish their subscribers’ personal information even without prior consent of the data subject is a clear violation of National Telecommunication Commission (NTC) Memorandum Circular No. 05-06-2007, known as Consumer Protection Guidelines, and the Data Privacy Act.
Complainant gave his consent to his employer, Knutsen, only for purpose of availing the DSL facility at his residence as part of the employment privilege. Had he known that his information will be published, he would have stopped the processing of his application.
Complainant also stated that Knutsen was not aware that PLDT can automatically decide to publish the subscriber’s personal information since its request to PLDT was only to install the DSL facility. The option not to publish its subscribers’ personal information is nowhere to be found on the application form. He also alleged that the terms and conditions at the back of the application form is not readable and it is not indicated that the personal information will be processed for public disclosure.
In a meeting with PLDT’s Data Privacy Team on 13 July 2018, Complainant presented the police report, DSWD certifications and court cases indicating that his father’s life was threatened due to the exposure of their address. During the said meeting, PLDT, through its Chief Data Privacy Officer, offered an immediate option to change his telephone number or a CCTV be installed at Complainant’s existing residence. Complainant perceived these offers as a recognition on the part of PLDT of the severity of Complainant’s situation.
Complainant justified that his posting of pictures on social media was for their friends and relatives, who were unable to visit or talk to them personally for security reasons. Furthermore, Complainant also alleged that he used aliases on his social media account to protect his identity and the pictures were taken outside Complainant’s present residence. Complainant believes that his father should neither be deprived of his liberty to enjoy life with his family nor be locked in a certain place.
Complainant alleged that he and his father relocated several times after the abduction of the latter. After some time, Complainant needed to relocate his father to a different place to secure his safety. However, when PLDT published his address in its White Pages, Complainant knew that his safety and that of his father were jeopardized after somebody called his landline telephone to verify his name and residential address as seen on the PLDT’s White Pages. Complainant believed that the publication of his personal information can never be corrected because it can no longer be recalled from the public. The only remedy he had in mind was to relocate again to another place.
Due to such publication, Complainant accused PLDT of violating the following provisions of the DPA:
a. Section 28 for Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes, when Complainant was not informed of the purpose for processing his personal information and to whom said information will be disclosed;
b. Section 29 for Unauthorized Access or Intentional Breach, when Complainant’s personal information was published intentionally and knowingly published even with the presence of the prevailing law under National Telecommunication Commission and Data Privacy Act;
c. Section 30 for Concealment of Security Breaches Involving Sensitive Personal Information, when PLDT’s customer service representative told Complainant that his personal information was already tagged as confidential during his initial inquiry in March 2018 when it only started to be confidential for their June 2018 publication; and
d. Section 32 for Unauthorized Disclosure, when Complainant’s personal information was published in PLDT’s White Pages without his consent.
Complainant prayed for actual damages representing the cost of their several relocations to safeguard their welfare and for moral damages representing the mental anguish, fright, anxiety, sleepless nights, and emotional stress caused to the Complainant for jeopardizing the safety of his family due to the disclosure of their exact address.
Issue
Whether PLDT violated Sections 28, 29, 30, and 32 of the Data Privacy Act of 2012 in publishing Complainant’s personal information in its White Pages without the consent of the Complainant.
Discussion
Complainant was not provided with adequate information regarding the processing of his personal information.
The Data Privacy Act of 2012 defines “personal information” as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.2
The law also defines “processing” as any operation performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.3
Additionally, “disclosure” or “disclosing” means the release, transmission, transfer, or provision of access to personal information outside the organization holding or controlling such information, by whatever means.4
When processing personal information for a particular purpose, organizations must ensure that the data subject is informed, prior to or at the time of collection of personal information, of the purposes of the collection and processing. This is the essence of transparency and informed consent. The Data Privacy Act mandates that data subjects have the right to be informed of the existence, use, and disclosure of his personal information.
In the instant case, Complainant submitted his personal information (his name and address) to Knutsen when he applied for a PLDT DSL subscription service as part of his employment benefit. He did not authorize the disclosure of his personal information to third parties. More importantly, Complainant was never informed that his personal information would be processed for the purpose of being published in PLDT’s White Pages and made accessible to the general public.
When Complainant inquired with PLDT regarding the publication of his personal information, PLDT simply responded that the publication was done as required by law. However, PLDT failed to explain or disclose to Complainant that at the time of processing, there was an option for him not to have his information published in the directory. The absence of a clear and readable disclosure regarding the option not to be published, either in the application form or in the terms and conditions, is a violation of Complainant’s right to information.
PLDT’s defense that Knutsen as the personal information controller should have informed Complainant of the option not to be published does not excuse PLDT from its obligation to obtain Complainant’s consent. Under the Data Privacy Act, PLDT, as the personal information processor, still has the duty to adhere to the data protection principles and to ensure the implementation of the requirements of the law. The mere fact that PLDT delegated the task of informing the data subject to its corporate client does not relieve PLDT of its responsibility to process personal information in compliance with the law.
Processing of personal information without informed consent.
The Data Privacy Act provides that personal information shall not be processed unless there is a lawful basis for such processing. The law explicitly requires that the processing of personal information be based on the consent of the data subject, except in cases where processing is authorized by law or when the processing is necessary for the performance of a contract or service.5
In the present case, Complainant’s personal information was processed for the purpose of being published in a directory without his knowledge or informed consent. Although PLDT claims that the publication of subscriber information is mandated by the Public Service Act, the law does not provide an automatic exemption from the requirements of the Data Privacy Act. The Data Privacy Act, being a later and more specific law on data protection, would prevail over the general provisions of the Public Service Act.
More significantly, Complainant explicitly did not consent to the processing of his personal information for the purpose of publication in the White Pages. While he consented to the processing of his information for the limited purpose of receiving DSL services, no such consent was extended to the disclosure of his personal information to the general public.
The processing of personal information without the informed consent of the data subject, absent any valid legal authorization, constitutes a violation of the Data Privacy Act.
Violation of Section 28: Processing for Unauthorized Purposes.
Section 28 of the Data Privacy Act states:
SEC. 28. Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes.—The processing of personal information for unauthorized purposes shall be penalized by imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00) shall be imposed on persons processing personal information for purposes not authorized by the data subject, or otherwise authorized under this Act or under existing laws. (Emphasis and underlining supplied)
At the time of the collection of Complainant’s personal information, the processing was authorized only for the limited purpose of providing DSL services to Complainant. However, PLDT processed such information for a different and unauthorized purpose—to publish it in a public directory. The publishing of the personal information in the White Pages falls outside the scope of the original authorization given by Complainant when he subscribed to the DSL service.
The fact that PLDT relied on its corporate client, Knutsen, to inform Complainant of the option not to be published does not negate this violation. PLDT, as the entity that actually processed and disclosed the information, bears responsibility for ensuring that the processing was done only for authorized purposes. The failure to secure Complainant’s consent for the broader purpose of publication constitutes processing for an unauthorized purpose under Section 28.
Unauthorized Disclosure in violation of Section 32.
Section 32 of the Data Privacy Act defines unauthorized disclosure as:
The unlawful or inappropriate access to, destruction, use, modification or disclosure of personal information in the organization’s possession or under its control.
Complainant’s personal information was disclosed to the general public through PLDT’s White Pages without Complainant’s consent. Although PLDT argues that the disclosure was required by law, the absence of a clear mechanism to opt out of such disclosure, coupled with the lack of informed consent, renders the disclosure unauthorized under the Data Privacy Act.
The law protects the privacy rights of data subjects above and beyond statutory obligations. If PLDT was required by law to maintain a directory of subscribers, the law did not mandate that subscriber information be disclosed without an option for confidentiality. The failure to provide Complainant with a clear and adequate opportunity to opt out of the public listing of his personal information in the directory constitutes unauthorized disclosure.
Determination of Responsible Officers.
As PLDT is a corporation, the individual officers, directors, and employees responsible for the violation must be identified. Under Section 34 of the Data Privacy Act:
SEC. 34. Extent of Liability.—If the offender is a corporation, partnership or any juridical person, the penalty shall be imposed upon the responsible officers, as the case may be, who participated in, or by their gross negligence, allowed the commission of the crime. (Emphasis supplied)
A corporation acts only through its officers and employees. Since PLDT, as a corporation, committed the violation of Sections 28 and 32 of the Data Privacy Act, those officers and employees responsible for the decision to process and disclose Complainant’s personal information without his consent must be identified and held accountable.
A thorough and meticulous investigation must be conducted to determine those liable officers who willfully or knowingly participated in, or by their gross negligence, allowed the commission of the violation of the Data Privacy Act. However, upon careful perusal of the evidence submitted and the Complaint itself, the information necessary to identify these liable officers or employees are not readily available. Thus, a further investigation is necessary.
In view of this, this Commission REMANDS this case to the Complaints and Investigation Division for further investigation and for the determination of the responsible officers of PLDT Enterprise, who by participation, negligence, or omission, allowed the violations of Sections 28 and 32 of the DPA.
Complainant is entitled to the award of nominal damages.
As established above, the Respondent processed Complainant’s personal information for unauthorized purposes which resulted to unauthorized disclosure of Complainant’s personal information in the White Pages without or against the consent of the Complainant.
However, this Commission notes that Complainant was not able to satisfactorily establish his loss, including the perceived threat of another abduction incident of his father. While evidence submitted by Complainant indicates that there was a previous abduction attempt against Complainant’s father, it does not immediately follow that the publication in the White Pages would inevitably result in another abduction attempt. Hence, the threat may be more apparent than real.
As provided by the Supreme Court, in the case of Areola v. Court of Appeals:6
Nominal damage is recoverable where a legal right is technically violated and must be vindicated against an invasion that has produced no actual present loss of any kind, or where there has been a breach of contract and no substantial injury or actual damages whatsoever have been or can be shown.
Since no present loss of any kind, substantial injury, or actual damages have been proved by Complainant, this Commission awards the nominal damages of Fifty Thousand Pesos (P50,000.00) to the Complainant.
WHEREFORE, all these premises considered, this Commission resolves to AWARD Complainant, RLA, nominal damages in the amount of Fifty Thousand Pesos (P50,000.00) for Respondent PLDT Enterprise’s violation of Complainant’s rights under the Data Privacy Act.
Moreover, this Commission resolves to REMAND this case to the Complaints and Investigation Division for the limited purpose of determining and identifying the responsible persons, officers, or individuals of PLDT Enterprise who caused the violations of Sections 28 and 32 of the DPA prior to recommending the matter to the Secretary of Justice for criminal prosecution.
SO ORDERED.
Pasay City, Philippines. 17 December 2020
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
WE CONCUR:
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Copy furnished:
RLA Complainant
PLDT Inc. Respondent Chief Data Privacy Officer
COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT NATIONAL PRIVACY COMMISSION
Footnotes
-
Fact-Finding Report dated 13 October 2020. ↩
-
Republic Act No. 10173, Section 3 (g). ↩
-
Republic Act No. 10173, Section 3(h). ↩
-
Id., at Section 3(i). ↩
-
Section 3 (b), Data Privacy Act of 2012. ↩
-
Areola v. Court of Appeals, G.R. No. 95641, [September 22, 1994], 306 PHIL 656-667. ↩