NPC Issuance Wiki

NPC 18-141: MHH v. VCF and SPFS

Issued Decision

Decision Text

MHH,

Complainant,

-versus-

VCF and SPFS,

Respondents.

x----------------------------------------------------x

AGUIRRE, D.P.C.:

For this Commission’s Resolution is the Complaint1 filed by Complainant MHH against Respondents VCF and SPFS, involving an alleged violation of R.A. No. 10173 (Data Privacy Act).

Facts

The Complainant alleges that she has been a private school teacher in SPFS for ten (10) years. She states that on 18 October 2017, the School Director of SPFS, Respondent VCF, sent a letter2 to the Registrar of Tomas Claudio Colleges (TCC) requesting a copy of Complainant’s Official Transcript of Records and Diploma without her consent. The letter was premised on his intention to ensure that the teachers working in the institution were well-equipped with the necessary units and seminars needed to effectively teach the students.

On 28 April 2018, while Complainant was processing her master’s degree enrolment in TCC, she was informed about Respondent VCF’s letter-request and that TCC did not respond to the same.3 Complainant then called JPS, the SPFS Secretary, to clarify the matter. He answered, “Ma’am, tapos na po iyon. Dala lang po ng galit, magpapaliwanag po kami ni A.”4

The Complainant replied and said, “Ok na iyon, sige tapos na. Sana tama na.”5

After the call was disconnected, Complainant received a text message6 stating that:

Madam, lipas na yun, sorry kung nawalan talaga kami ng tiwala noon, alam mo naman ang tension dati kaya siguro dala ng galit ay nakasama kami sa ganun sitwasyon, papaliwanag kami ni A sayo as soon as possible, is a ka sa advisers ko pero nagawa ko yun kaya sorry ulit, my second mom!7

After that, Complainant thought that the issue was already settled.8 However, the SPFS Management Committee sent a letter to the Registrar of TCC dated 02 May 2018 informing them that they were in the process of reviewing the documents of their old and new teacher applicants and following up on their 18 October 2017 letter:

In connection to this, please provide us a written explanation on the letter submitted to your office last October 18, 2017 of the documents of MHH for verification veracity (sic) of the papers submitted.9

On 09 May 2018, Complainant wrote a letter to Respondent VCF informing him that she will file criminal and administrative cases against SPFS and all the persons whose signatures appeared on the letter dated 02 May 2018, which included Respondent VCF. Complainant enumerated the violations they have allegedly committed against her, namely, Section 2, Bill of Rights of the Philippines Constitution; Sections 25 and 26 of R.A. No. 10173 (Data Privacy Act of 2012); Section 1 of Article V, Section 2 of Article VI, and Sections 1, 2 and 3 of Article XI of Code of Ethics for Professional Teachers.

On 25 September 2018, the Complaints and Investigation Division (CID) of this Commission received a Complaint10 from Complainant via its online complaints-assisted portal alleging that Respondent VCF requested from TCC her Official Transcript of Records and Diploma without her consent and knowledge.

On 14 November 2018, the CID ordered the parties to appear before this Commission to Confer for Discovery to discuss whether discovery of information and of electronically-stored information will be sought; the issues relating to preservation of information, the period to produce the information, the method of asserting and preserving claims of privilege information, confidentiality and proprietary status of information, the appropriateness of allocating expenses of production of information, and any other issues relating thereto.11 Both parties were present.12

On 03 December 2018, Respondents filed their Answer.13

Respondent VCF alleged that on 01 May 2017, he became the School Director of SPFS and he discovered that the school was laden with debts due to qualified theft, unpaid tuition fees, low number of enrolees, and unqualified personnel. In the course of the investigation and evaluation of the problem, SPFS was able to get hold of two (2) transcripts of records of Complainant, namely, (1) Transcript of Records dated 23 May 2008 with the course of Bachelor of Secondary Education with Special Order No. [Redacted] S. 2008; and (2) Transcript of Records dated 22 January 2018 with the course of Bachelor of Elementary Education with Special Order No. [Redacted] S. 2008.

Since Respondent VCF was unable to solicit a convincing explanation from the Complainant, he sent the letter dated 18 October 2017 to TCC requesting for a copy of the Official Transcript of Records and Diploma of Complainant, which was ignored. After seven (7) months, the SPFS Management Committee sent the 02 May 2018 letter to TCC asking for a written explanation on status of their first letter, which was also ignored.14

Respondents denied Complainant’s allegations that SPFS was making a background check on her and claimed that the inquiry was for the legitimate interest of the school to protect it from unqualified personnel.15

Respondents also stated that prior to the filing of the instant complaint, Complainant also filed a complaint against LOC, a public school principal.16 On the other hand, Complainant’s son filed complaints against IR, MD, PO, TS, LL, and BD,17 for allegedly taking part in the background checking of the authenticity and validity of Complainant’s credentials.

Respondents also refuted Complainant’s claim that she had submitted her Transcript of Records when she applied at SPFS, asserting that Complainant was suspended in 2012 for her failure to submit the same.

It was only during the discovery conference on 14 November 2018 that Complainant submitted the following documents:

  1. Official Transcript of Records dated 19 June 2008;
  2. Diploma for Bachelor of Elementary Education; and
  3. Affidavit of Discrepancy of MSD.18

Respondents maintained that the Affidavit of Discrepancy by TCC’s School Registrar is not reliable since it did not explain the discrepancies in the two (2) different official transcript of records.

Furthermore, the submissions made by the Complainant only prove that there were indeed different courses and different special order numbers in complainant’s transcripts of records.19

In Complainant’s Reply,20 she argued that the signatories of the letter dated 02 May 2018 were not legitimate members of the SPFS Management Team since most of them were just volunteer parishioners. Thus, she asserted that they have no right to meddle with school issues in the absence of an employer-employee relationship with SPFS or any board resolution, constitution or other document granting them authority.

Complainant also stressed that her credentials were allegedly disclosed by ECP, Respondents’ counsel, during a non-related case conference before the Department of Labor and Employment Mediation Board in Cainta, Rizal.21

Complainant maintained that the discrepancy in her transcripts of records is not her fault and any accountability should be shouldered by TCC.22

In Respondents’ Rejoinder,23 they reiterated the failure of Complainant to submit her transcript of records in 2012. Despite being given a three (3)-day suspension in the Memorandum dated 2 April 2012 and promising to submit her Transcript of Records in a letter dated 03 August 2012, Complainant was again given a warning in a subsequent Memorandum dated 21 September 2012 but she still failed to submit her Transcript of Records.

Respondents maintained that it has the right to protect SPFS and to be clarified as to the truth or falsity of the two sets of Transcripts of Records, which was the reason why the letter-requests were sent to TCC.

Issue

The sole issue in this case is whether Complainant was able to prove that Respondent committed a violation of the Data Privacy Act.

Discussion

This Commission hereby finds no substantial evidence to support the Complaint for a violation under the Data Privacy Act.

Complainant’s allegation of a data privacy violation is centered on Respondents’ letter-requests to TCC for a copy of her official Transcript of Records and Diploma after it found that her personnel file contains discrepancies.

The documentary evidence submitted by the parties show that TCC did not release any of Complainant’s records despite the repeated requests of Respondents. It was only during the discovery conference that the Complainant submitted her records when required by the investigating officer.24

Respondents cannot be held liable for a data privacy violation for merely requesting from TCC the Transcript of Records and Diploma of Complainant. The unheeded request for documents containing personal information cannot be considered as processing of personal information. The processing of personal information is an essential element of any data privacy violation.

Section 3(j) of the Data Privacy Act defines Processing as follows:

Processing refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.25

While there were requests from Respondents for a copy of Complainant’s Transcript of Records and Diploma, TCC did not grant such requests. Intent to process is not a violation under the Data Privacy Act, as it defines processing as a “set of operations performed upon personal information.”26 Without any of these acts performed upon Complainants’ Transcript of Records and Diploma coming from TCC, there was no processing of the personal information contained in those documents.

Moreover, as to the two (2) sets of Transcripts of Records of Complainant that were already in the possession of Respondents during their alleged investigation regarding unqualified personnel, there is nothing on record to show that they were obtained by Respondents through unlawful or unauthorized means.

Transcripts of Records are part of the usual pre-employment documents that need to be submitted during the recruitment process. The record also shows that SPFS followed up several times with Complainant for her to submit her Transcript of Records back in 2012. Complainant even stated in her Reply that she would not be in service with SPFS for 10 years if the matter were not resolved.27 In fact it was Complainant who stated that the Transcript of Records dated 23 May 2008, the Transcript of Records dated 22 January 2018, and her Diploma were already in the possession of Respondents as part of her 201 files.28

Complainant also alleged in her Reply that her credentials were disclosed to unauthorized persons, such as the SPFS management committee, the PTA president of SPFS, the president of TCC, and the volunteer parishioners of SPFS.29 While the 02 May 2018 letter Complainant referred to states that it was attaching the “papers submitted by the said person,” there is no evidence on record, however, showing the exact nature of those papers or that they contained personal information.

It is a basic rule of evidence that mere allegations are not equivalent to proof.30 As this Commission held in [[decisions/2019/npc-17-047-jv-vs-jr|JV v. JR]]:31

The complaint shall only be recommended for prosecution if it is supported with relevant evidence which a reasonable mind might accept as adequate to justify a conclusion. The allegations in the complaint must be based on substantial evidence that there is a clear and real violation of the law.

As to Complainant’s claim that her credentials were disclosed by Respondents’ counsel, ECP, during a non-related case conference before the Department of Labor and Employment Mediation Board in Cainta, Rizal, suffice it to say that aside from the fact that no proof of said disclosure has been proffered, Respondents’ counsel is not a respondent in this case.

This Commission takes this opportunity to clarify that educational records are considered sensitive personal information, the lawful processing of which should conform to Section 13 of the Data Privacy Act. Given this, Respondents’ justification for requesting the educational records of Complainant from TCC without her consent on the basis of its legitimate interest as an employer holds no merit.

This Commission’s Advisory Opinion No. 2018-006 provides that:

First and foremost, LPU, as an educational institution, is considered as a personal information controller (PIC), processing personal information of its students, employees, and alumni, thus, is covered by the law and under the jurisdiction of the NPC.

x x x

As a PIC, LPU is bound to implement reasonable and appropriate organizational, physical, and technical measures to protect the personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing. It is accountable for any personal information under its control and custody, including those transferred to a third party. Given the responsibility of LPU to secure personal information, its denial of your request for information may be justified due to the lack of consent of the data subject. Although consent is not the only condition for lawful disclosure or processing, in general, of personal information, it may be the most appropriate criterion in this scenario. Likewise, LPU as the PIC is mandated to recognize and enforce the rights of the data subject, including the right to be informed regarding the recipients to whom data will be disclosed.32

Be that as it may, since the allegations for unauthorized processing, accessing personal information due to negligence, and unauthorized disclosure have not been proven by Complainant, her Complaint must be dismissed.

WHEREFORE, premises considered, the instant complaint is hereby DISMISSED for lack of merit.

SO ORDERED.

Pasay City, Philippines. 09 June 2020

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

I CONCUR:

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

JOHN HENRY D. NAGA Deputy Privacy Commissioner

Copy furnished:

MHH Complainant

VCF Respondent

SPFS Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Complaint via online complaints-assisted portal dated 25 September 2018. ↩

  2. Letter-Request dated 18 October 2017. ↩

  3. Supra note 1. ↩

  4. Ibid. ↩

  5. Ibid. ↩

  6. Ibid. ↩

  7. Screenshot of a text message dated April 28. ↩

  8. Supra note 1. ↩

  9. Ibid. ↩

  10. Supra note 1. ↩

  11. Order to Confer for Discovery scheduled on 14 November 2018. ↩

  12. Fact-Finding Report dated 28 April 2020. ↩

  13. Answer dated 28 November 2018. ↩

  14. Supra note 12. ↩

  15. Ibid. ↩

  16. Letter-Complaint dated 15 May 2018. ↩

  17. Letter-Complaint received on 14 June 2018. ↩

  18. Supra note 12. ↩

  19. Supra note 13. ↩

  20. Reply dated 02 December 2018. ↩

  21. Ibid. ↩

  22. Ibid. ↩

  23. Rejoinder received by General Records Unit on 22 January 2019. ↩

  24. Supra note 12. ↩

  25. Emphasis supplied. ↩

  26. Data Privacy Act, Section 3(j). ↩

  27. Supra note 20, at par. 4(o). ↩

  28. Ibid., at par. 4(q). ↩

  29. Ibid., at par. 4(f), (g), and (i). ↩

  30. See, Morales v. Ombudsman, 798 SCRA 609, 17 July 2016. ↩

  31. NPC Case No. 17-047, 13 August 2019, available at https://www.privacy.gov.ph/wp-content/uploads/2020/10/CID-17-047-JV-v.-JR-Decision-PSD-10Aug2020.pdf. ↩

  32. Emphasis supplied. ↩

Backlinks