NPC Issuance Wiki

NPC 20-307: Spouses JGY and NTY v. BPI Family Savings Bank, Inc.

Issued Decision

Decision Text

SPOUSES JGY and NTY,

Complainant,

-versus-

BPI FAMILY SAVINGS BANK, INC.,

Respondent.

x----------------------------------------------------x

NPC 20-307

For: Violation of the Data Privacy Act of 2012

DE JESUS, D.P.C.;

Before this Commission is a complaint filed by Spouses JGY and NTY (Complainants) against BPI Family Savings Bank, Inc. (Respondent) for an alleged violation of Section 32 (Unauthorized Disclosure) of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

In their Complaint-Assisted Form received by the Commission, through its Complaints and Investigation Division (CID), on 26 November 2020, Complainants stated that they entered into an agreement with MBDC & Development Corporation (MBDC) for the construction of a two-story residential house located in Mxxxxxxx Cxxx (Construction Project) on 25 November 2016.1

For this Construction Project, Complainants applied for a loan with Respondent, which the latter approved through a Credit Advisory Letter2 issued on 09 February 2017.3

Thereafter, or on 03 March 2017, Complainants and Respondent executed a Mortgage Loan Agreement4 wherein the latter agreed to extend a housing loan to Complainants amounting to twelve million pesos (Php 12,000,000.00) with a mortgage constituted on the aforesaid property.5

As stated in the Credit Advisory Letter6 and Mortgage Loan Agreement,7 the loan proceeds shall be released to the Complainants after acceptance and confirmation of the accredited appraiser in accordance with the following schedule:

“Schedule of Releases: P 3,000,000.00 upon 0.00% completion P 3,000,000.00 upon 30.00% completion P 3,000,000.00 upon 60.00% completion P 3,000,000.00 upon 90.00% completion”8

According to the Complainants, as they submitted progress and construction appraisal reports to the Respondent, the housing loan proceeds were gradually released to them and were paid to MBDC according to the scheduled release of loan proceeds.9

On May 3, 2018, MBDC sent a demand letter10 to the Complainants because it had confirmed the release of the loan proceeds through the Complainant’s BPI account officer.11 Consequently, MBDC demanded payment in accordance with the terms of the construction agreement.12

Convinced that there was a violation of their right to privacy concerning their personal information related to the Mortgage Loan Agreement,13 Complainants, on 10 May 2018 communicated with Respondent regarding the alleged breach incident and asked for an investigation and explanation thereon.14

In an email-reply dated 16 May 2018,15 Respondent through its [] MP, denied that there was breach of confidentiality on their part, explaining therein:

Good day Mr. JGY,

Your complaint was forwarded by our account officer CL. We have checked on your complaint and have found no evidence of any BPI employee leaking information to a certain MBDC. At the time of your complaint, our employees were unaware of the contractor’s name and it was the first time they heard of it.

They said contractor called our landline last May 7, days after the first complain of Mr. JGY, and was asking for information and a meeting. They were informed that they would need to provide a written authorization or special power of attorney coming from Mr. JGY before they can talk to a BPI representative regarding the account of Mr. JGY. The same afternoon, they called insisting that they just wanted information, even via telephone call, regarding the loan of Mr. JGY, my assistant insisted that we cannot divulge any information without written consent of the client. The calls of the contractor seeking information, after your complaint is an evidence that the contractor does not have any information yet regarding your loan. The contractor must have bluffed that they know that the loan has been fully released considering that the application was almost three (3) years ago, while the first release was done last March 2017.

As you may recall, you have met with us last June regarding the appraisal or valuation of the ongoing construction where you brought along an engineer, possible a representative of your contractor. They may have heard in our meeting that releases are done at 0%, 30%, 60% and 90%. As your contractor, they may have assumed that since the house is already more than 90% completed, hence full release should be done.

As a contractor, they may have transacted with different banks and are also aware of bank policies that a construction loan must be finished in 1 year upon the first release. As your construction stated in March 2017, they may have assumed that the bank’s deadline is on the early part of 2018.

Thank you very much.16

In response thereto, Complainants sent to Respondent through its [] MP, a copy of MBDC’s demand letter17 and barangay report,18 wherein MBDC clearly stated that its basis for demanding payment was the information obtained from Respondent.19

As such, on 18 May 2018, Complainants had a meeting with [] and representatives from the Data Privacy and Consumer Protection Office – Compliance & Regulatory Affairs Division, who allegedly assured the Complainants that there was no breach at all and that they did not disclose any confidential information to MBDC.20

Following the said meeting, Respondent further confirmed through email21 sent by its Data Privacy and Consumer Protection – Compliance Officer DEM that they had conducted an investigation into the matter and found no evidence of any of its bank employee disclosing Complainants’ loan information to MBDC.”22

In the meantime, due to the alleged delays and unsatisfactory implementation of the Construction Project, the Complainants filed a criminal complaint against the directors, officers, and employees of MBDC for Rxxxxxx and/or Gxxxx Coercion under the Revised Penal Code.23

In MBDC’ Joint Counter-Affidavit,24 the events leading to the alleged unauthorized disclosure by the Respondent were allegedly narrated under oath by MBDC’ Senior Consultant, ET:

  1. (…) So, on May 2, 2018, I (ET) asked our Admin Officer of “BPI” handling the account of “SPS. JGY and NTY” and inquire about the pending release. And our suspicion was confirmed. The Loan Account Officer, ASH, disclosed that the LOAN AMOUNT EQUIVALENT TO 90% COMPLETION HAD ALREADY BEEN RELEASED BY “BPI” TO “SPS JGY AND NTY” IN THE EARLY PART OF THE YEAR (2018), which meant that the “PROJECT” had long been appraised at 90% by “BPI.” Attached herein is Annex “13” is an Affidavit from APA attesting to the said information.25

Attached as well in the Joint Counter-Affidavit26 is a screenshot of the text message27 between MBDC’ employee and ASH, Respondent’s loan account officer and marketing assistant handling Complainants’ account. In the said correspondence between MBDC and ASH, the latter confirmed the amount of the loan proceeds released by Respondent to the Complainants:28

APA: Gud morning Mam. Ask ko lng po latest appraisal report for client Mr. JGY. Tnk u ~ A of MBDC

ASH: Last appraisal report is at 70% completion. With this, we release partial loan proceeds dated 11/201/7 amounting to 1,055,912.68. Thanks.

APA: Ma’am tnk u for d info. Have a good day!29

Moreover, in an Affidavit dated 24 September 2018,30 attached to the Joint Counter-Affidavit,31 APA, MBDC’ Administrative Officer, stated the following:

  1. That I am presently employed by MBDC & DEVELOPMENT CORPORATION and holding the position of Administrative Officer;

  2. That on May 2, 2018, our Senior Consultant, ET, asked me to call the Account Officer of BPI Family Bank to inquire about the status of the loan release equivalent to 90% of our client, Spouses JGY and NTY;

  3. I, then, immediately contacted ASH, the Account Officer of BPI Family Bank handling Spouses JGY and NTY’s loan account;

  4. ASH, who was then assigned to another BPI branch, confirmed and told me that the amount equivalent to 90% of the approved loan of Spouse JGY and NTY was already released by the bank since early of 2018. Since she was no longer in the Head Office, she cannot give me the specific date of release but confirmed that the amount was already released. (Emphasis supplied)32

Thereafter, Complainants claimed that in an email dated 24 October 2018,33 Respondent, through its Compliance Officer DEM, started providing justification for the alleged unauthorized disclosure:

Dear Sps. JGY and NTY,

Thank you for the information that you have provided.

Based on the emails between you and our marketing assistant, ASH, copy furnished several Account Officers, you were the one who introduced and involved your contractor in your dealings with the Bank with regard to your housing loan. This is not surprising however because your loan is a home construction loan and the ultimate recipient of your proceeds is the contractor.

(…) you provided ASH’s mobile number to your contractor, by this overt act, you gave your contractor access to information related to your loan.

(…) we note that you have authorized your contractor to be involved in your housing loan with the Bank, and that your contractor is an interested party to this transaction. xxx34

Complainants sought relief from the Bangko Sentral ng Pilipinas, forwarding to its Consumer Affairs Division their security concerns regarding their accounts with Respondent.35

Unsatisfied, Complainants filed this instant Complaint for violation of Section 32 of the DPA alleging, among others, that Respondent “blatantly conceded that there was indeed unauthorized disclosure to MBDC.”36

Complainants averred that the Respondent and its employees, who handle the loan account, are Personal Information Controllers (PICs) as they hold, and process personal information related to the Complainants’ Mortgage Loan Agreement with them.37

Moreover, Complainants posited that the identities of the parties, conditions and terms of the Mortgage Loan Agreement, the Schedule of Release of the proceeds of the loan, status of the loan, the amount of loan proceeds disclosed by the Respondent to MBDC are considered personal information.38

According to the Complainants, the disclosure of these information, along with the identification and confirmation of the Complainants’ identities as recipients of the loan by a Respondent’s employee, enabled the parties, conditions, and terms of the procured loan to be readily ascertained.39

Lastly, Complainants alleged that the unauthorized disclosure by Respondent strained their good business relationship with their contractor, MBDC, and primarily caused the latter to unreasonably pressure the Complainants to pay for the works which they believe were unsatisfactorily performed.40

Thus, Complainants seek the following reliefs:

  • A. Settlement;
  • B. Six Million Four Hundred Thousand Fifty Four Thousand Five Hundred Twenty Two Pesos and Twenty Six Cents (Php 6,454,522.26) as actual damages;
  • C. Six Million Five Hundred Thousand Pesos (Php 6,500,000) as moral damages;
  • D. One Million Pesos as exemplary damages;
  • E. Imposition of fine; and
  • F. Cease and Desist Order.41

Giving due course to the Complaint, the Commission, through its Complaints and Investigations Division (CID), issued an Order dated 26 May 2021, requiring the Respondent to file a verified comment within fifteen (15) days from receipt thereof.42

On 06 July 2021, the assigned investigating officer issued another Order directing the parties to appear virtually for preliminary conferences on 27 July 2021 and 10 August 2021.43

On 12 July 2021, Respondent filed before this Commission its Verified Comment44 through email.45

In its Verified Comment,46 Respondent argued that the subject information does not fall within the definition of “personal information” as defined under the DPA47 by stating:

  1. At the outset, it is pertinent to state that unauthorized disclosure provided under Section 32 should pertain solely to personal information.

  2. Relatedly, personal information is expressly defined in R.A. 10173, thus:

“(g) Personal Information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.”

  1. As can be gleaned from the foregoing definition, personal information is confined solely to information which reveals the identity of the individual and not all information falls within the ambit of the term “personal information”.

  2. It is clear from the foregoing definition that the supposed disclosure regarding the fact that the project has already been Ninety (90%) Percent appraised by BFSB, and that the loan proceed corresponding to the 90% of the project has been released, does not fall within the definition of “personal information” as the term is defined under R.A. 10173.”48 (Emphasis supplied)

Consequently, Respondent claimed that even assuming that such disclosure was made, the same would not constitute a violation of Section 32 of the DPA, which reads:

  1. Consequently, even assuming arguendo that a disclosure regarding the fact that the project has already been 90% appraised and that the corresponding loan proceeds has already been released, was actually made, the same would not constitute a violation of Section 32 of R.A. 10173.49

The Respondent further asserted that the burden to prove the fact of alleged disclosure and alleged violation of Section 42 of R.A. 10173, rests solely upon the Complainant.50 Additionally, Respondent claimed that the pieces of evidence submitted by the Complainants in support of their Complaint, such as MBDC’s Joint Counter-Affidavit51 and ASH’s Affidavit52 are merely hearsay, considering that they are not within the personal knowledge of the Complainants.53 Further, these statements were made in another proceeding wherein the Respondent was not given the opportunity to challenge their veracity.54

At any rate, according to Respondent, even if the affidavits are to be accepted, Respondent opined that the contents thereof would reveal, among others, that it was the Complainants who disclosed to MBDC the existence of the construction loan agreement with the bank, the schedule of progress appraisal and corresponding loan release, and even the fact that the property under construction has already been appraised by the Respondent as ninety percent (90%) completed with the loan proceeds corresponding thereto having been released.55

Furthermore, Respondent claimed that assuming without conceding that any disclosure may have been made, such disclosure was with the express instruction of the Complainants.56 According to the Respondent, it was the Complainants who insisted that the representative of MBDC attend various meetings with the Respondent’s officers and be present during scheduled appraisal visits, and even coordinate with the MBDC regarding the dates of progress appraisals.57

Respondent also elucidated that as a banking institution, it has both the right and the duty to determine that the loan proceeds are actually utilized for the purpose agreed upon in the loan agreement pursuant to Article III, Section 39 of R.A. 8791 or the General Banking Act of 2000.58 Accordingly, Respondent has an economic interest in the completion of the Construction project, which was constituted as collateral security under the Credit Advisory Letter59 and the Mortgage Loan Agreement60 for the amount loaned by the Complainants.61

Respondent went on further arguing that (1) the Complainants themselves informed MBDC regarding the loan, (2) they impliedly admitted that the project was appraised to be 90% completed, and that (3) the representatives of the Respondents were instructed to directly coordinate with MBDC, to wit:

  1. Furthermore, it is important to emphasize the fact that it was the complainants themselves who informed their contractor MBDC of the existence of the loan agreement with respondent BFSB, and more importantly, of the work completion schedule provided under the loan agreement.

  2. A perusal of the Joint Counter-Affidavit (Annex”D”), which was submitted by the complainants as part of their evidence, would readily confirm this fact as it is plainly stated therein that it was the complainants who informed the contractor MBDC of the existence of the loan agreement.

  3. In fact, as stated by the representative of MBDC (Annex “D”), complainants even gave the contractor a copy of the work completion schedule imposed by respondent BFSB, and even forced them to adhere to said schedule in order to be entitled to payment.

  4. Pertinently, when contractor MBDC was informed of the work completion schedule, necessarily they likewise became aware of when the loan proceeds will be released, as per agreement, it releases as a matter of course based on the appraiser’s determination of the percentage of completion, thus:

“The loan proceeds will be released to you on a staggered basis based on our appraiser’s progress report, as follows: Schedule of Releases: P 3,000,000.00 0.00 completion P 3,000,000.00 30% completion P 3,000,000.00 60% completion P 3,000,000.00 90% completion

  1. Further, complainants even informed the contractor MBDC of the various work completion appraisals conducted by respondent BFSB.62 (Emphasis supplied)

Finally, Respondent prays that the complaint for violation of the DPA be dismissed for lack of merit.63

On 27 July 2021, during the first scheduled Preliminary Conference in this case, the Commission received an email from the Respondent requesting for a resetting of the conference due to another hearing scheduled on the same day.64 Finding merit on the Respondent’s request and with the conformity of the Complainants, who were present in said preliminary conference, the conference was reset to 04 August 2021.65

On 04 August 2021, the respective representatives of both parties were present.66 Respondent sought the discovery of the following documents from the Complainants:

  1. The status or resolution of the case where the Joint Counter-Affidavit of directors, officers, and employees of MBDC was filed; and
  2. The list of other cases and/or status thereof between complainants and MBDC.67

Thereafter, and considering that both parties manifested their willingness to undergo mediation under NPC Circular 2021-01,68 the scheduled second preliminary conference was canceled, and the proceedings were suspended.69

On 27 August 2021, the assigned investigating officer issued an Order approving the Application for Mediation filed by the parties, and ordering them to appear at the preliminary mediation conference set on 10 September 2021.70

Unable to reach a settlement, the mediation proceedings were ordered terminated on 06 December 2021.71

In an Order dated 08 December 2021, the CID resumed the proceedings and ordered the parties to appear for the second setting of the preliminary conference on 26 January 2022.72

The Complainant was likewise directed to submit within fifteen (15) calendar days from receipt thereof the documents subject of the discovery proceedings as referred to during the first preliminary conference.73

On 28 December 2021, the Complainants submitted a Manifestation, wherein Complainants requested for the admissibility of the affidavits it has previously submitted to the Commission, arguing that it cannot yet be regarded as hearsay evidence because the affiants therein have yet to be presented for examination.74

Further, as to the discovery sought by Respondent on the 04 August 2021 preliminary conference, Complainants manifested that the civil case is still ongoing (as to the discovery request on the status of the case where the joint counter affidavit of MBDC was filed);75 and that there is one criminal case that is still ongoing between Complainants’ and MBDC.76

On 24 January 2022, Respondent, through email requested for the resetting of the second preliminary conference to 03 February 2022.77 On the same day, the CID granted the request of the Respondent.78

On 03 February 2022, at the second preliminary conference, both parties were represented by their respective counsels.79 To address all issues and clarifications of Respondent, the investigating officer ordered the latter to file a comment on the Complainant’s Manifestation (In Response to the Order dated 08 December 2021) dated 28 December 2021, and for the Complainants to file an opposition to the comment to be filed by Respondent.80

On 21 February 2022, Respondent filed its Comment81 to Complainant’s Manifestation (In Response to the Order dated 08 December 2021), stating that Complainant has manifestly failed to comply with the Order of the Commission to submit the documents required by Respondent as part of the discovery proceedings.82

Moreover, Respondent insisted that “the presentation and disclosure of [these records of pending] case/s and [its] corresponding documents are necessary and relevant to the issues in this case, especially since the sole evidence presented by Complainant to justify its claim emanated from the said case.”83

It likewise reiterated that the presentation of the entirety of the related documents to justify Complainants’ claim emanated from a separate criminal action in which the Respondent is not a party.84

Lastly, Respondent claims that the other statements made in the submitted affidavits allegedly contradict the Complainants’ claim and thus, “for a fair and full appreciation and admissibility and reliability of the said statement, the presentation of the entirety of the related documents [of cases pending with other tribunals] are not only relevant but essential.”85

On 5 March 2022, Complainants filed their Opposition86 to Respondent’s Comment,87 arguing that the entire record of the case between them and MBDC is irrelevant, as the sole issue is whether Respondent committed an unauthorized disclosure to a third party and that the affidavits are public documents, therefore, admissible, relevant and allowed by law under residual exception.88

In compliance with the Order dated 03 February 2022,89 the Complainants, through email,90 submitted their Proposed Stipulations for the Commission’s consideration and approval.91 Likewise, Respondent submitted its own proposed stipulation of facts by way of Manifestation and Compliance on 21 March 2022.92

On 04 April 2022, Complainants submitted its Comment93 on Respondent’s Proposed Stipulations. In its comment, Complainant rejected the stipulation of Respondent as to the Construction Checklist Form.94 Complainant claims that the said form is misleading as it does not contain the schedule of loan releases corresponding to any percentage completion, thus, it cannot be treated as a source of confidential information which was unjustifiably disclosed by Respondent to a party outside of the loan agreement.95

Complainant also rejected the proposed stipulation made by the Respondent as to the inclusion of representatives of MBDC in meetings with Respondent and its instruction to the latter to directly coordinate with MBDC.96

Further, Complainant also claimed in its Comment that the presence of the Contractor will never be required in meetings wherein the disbursement of loan proceeds is the main topic as it is beyond the contractors expertise.97

Finally, Complainant prayed that the rejected proposed stipulations made by Respondent be excluded from the written stipulations of this case.98

On 20 April 2022, Respondent filed its Memorandum,99 reiterating its defenses and arguments set forth in its Verified Comment dated 08 July 2021,100 among others:

  1. The information allegedly disclosed are not within the ambit of the term “personal information” as defined under the DPA, and that would constitute a violation of Section 32 thereof;101
  2. The sole evidence presented by the Complainants, which pertain to the Joint Counter-Affidavit102 and Affidavit103 submitted by Complainants’ opposing party in a separate criminal action, and in which Respondent is not a party, is clearly hearsay in nature;104
  3. Even assuming without conceding that the said affidavits may be admitted, a perusal thereof would reveal that the same directly controvert the claims of the Complainants as it was in fact the latter who made the supposed disclosure to their contractor;105
  4. The Complainants, on numerous occasions, included the representatives of their contractor in meetings with Respondent and have even instructed bank employees to directly coordinate with the contractor regarding the appraisal of the project and the schedule of release of payment. As such, any disclosure by Respondent was only made with Complainant’s express consent and instructions;106 and
  5. The Respondent has the right and the duty to determine whether the proceeds of a loan or other credit accommodation was actually used for the purpose agreed upon in the loan agreement pursuant to the mandate of Section 39 of the General Banking Law of 2000, thus, even assuming arguendo that the release of the loan proceeds to the Complainants was actually communicated to the contractor, the same would be legally justified in consonance with the aforementioned provision.107

Based on the foregoing, the Respondent prays that the instant Complaint be dismissed for utter lack of merit.108

On the same day, the Complainants, by email,109 filed their Memorandum,110 arguing that the evidence is clear that Respondent violated Section 32 of the DPA, inasmuch as:

  1. Respondent is a personal information controller, which holds and processes personal information concerning the loan and mortgage account of the Complainants while MBDC is a stranger to the Mortgage Loan Agreement111 between Complainants and Respondent;112
  2. The information disclosed – identities of the parties, conditions and terms of the Mortgage Loan Agreement,113 the schedule of release and the dates of actual release of loan proceeds, and other matters concerning the status of the loan, fall within the definition of “personal information” under the DPA;114
  3. Since the disclosure was unauthorized, Complainants discovered such disclosure through the supposed affidavits thus, disregarding the same for being hearsay would defeat the purpose of the DPA as Complainants had no way of knowing or being present in the event of disclosure by Respondent to MBDC;115 and
  4. The Complainants never allowed MBDC, on its own, to coordinate or transact with Respondent on their behalf, and absent any clear and written authorization, Respondent wrongly assumed and concluded that the indirect acts of the Complainants constitute authority for such third persons to transact on their behalf.116

In view thereof, the Complainants pray that Respondent be found guilty for unauthorized disclosure of personal information under the DPA, be ordered to pay the Complainants actual, moral and exemplary damages, and to impose a fine against Respondent according to Section 32 of the DPA.117

Issue

Whether Respondent violated Section 32 (Unauthorized Disclosure) of the Data Privacy Act of 2012.

Discussion

The instant Complaint for the alleged violation of the DPA must be dismissed for lack of merit.

The Commission previously held in [[decisions/2016/npc-18-010-rla-v-pldt-enterprise|RLA vs. PLDT Enterprise]]118 that Section 32 of the DPA penalizes disclosure of personal information not falling within Section 31 of the DPA or due to malicious disclosure.119 According to the Commission:

A PIC or a PIP may be held liable for malicious disclosure if it discloses unwarranted or false personal or sensitive personal information with malice of bad faith. A finding of Malicious Disclosure requires that first, the disclosed personal information is unwarranted or false, and second, the disclosure is malicious or in bad faith. If either of these two requisite is absent, then the offense falls under Section 32 or Unauthorized Disclosure.120

Moreover, in EG v. JI, RO and RR,121 the Commission held that “for a violation of Section 32 of the DPA to be committed, the personal or sensitive information should neither be unwarranted nor false”122 and the “The disclosure was not malicious nor done in bad faith.”123

The Supreme Court has defined “malice” as that which “connotes ill will or spite and speaks not in response to duty but merely to injure the reputation of the person defamed and implies an intention to do ulterior and unjustifiable harm.”124 As to bad faith, it “implies a conscious and intentional design to do a wrongful act for a dishonest purpose or some moral obliquity.”125

Here, the Complainants alleged that Respondent committed a violation of Section 32 of the DPA (Unauthorized Disclosure) when it disclosed to MBDC the status of the appraisal of the Construction Project, and the fact of disbursement of their loan proceeds.126

Thus, in determining whether a violation of Section 32 of the DPA occurred, the following elements must concur:

  1. The perpetrator is a personal information controller or personal information processor;
  2. The information relates to personal data;
  3. The perpetrator disclosed information to a third party;
  4. The disclosure was without any of the lawful basis for processing, consent or otherwise, under Sections 12 and 13 of the DPA; and
  5. The disclosure neither relates to unwarranted or false information nor malicious or in bad faith.127

As to the first element, the DPA defines a personal information controller (PIC) as “a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.”128

Having said this, Respondent is considered a PIC. As a party to the Mortgage Loan Agreement, Respondent obtained knowledge pertaining to and used the personal data of the Complainants.129

As to the second element, it is required that the information involved must relate to personal information or sensitive personal information (collectively, “personal data”).130 Personal information refers to “any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information or when put together with other information would directly and certainly identify an individual.”131

Respondent submits that the information involved relating to the fact that the project had already been ninety percent (90%) appraised by Respondent and the loan proceeds corresponding to ninety percent (90%) of the project had already been released to the Complainants does not fall within the definition of personal information, as it does not reveal the identity of the Complainants.132

Meanwhile, the Complainants argue that the identities of the parties, conditions and terms of the loan agreement, the schedule of release and dates of the actual release of loan proceeds, and other matters concerning the status of the loan are all considered personal information.133

Personal information, as defined above, is “any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information or when put together with other information would directly and certainly identify an individual.”134

In the instant complaint, the last name of the Complainants is the personal information involved.135 This information, together with the status of appraisal, the fact that the loan proceeds were already released, the date it was released, and the amount thereof, fall within the definition of such information which can be linked to an individual’s identity.

To recall, attached in the Joint Counter-Affidavit136 is a screenshot of the text message137 between APA the MBDC’ Administrative Officer, and ASH, Respondent’s loan account officer and marketing assistant handling Complainants’ account. The text messages reads:138

APA: Gud morning Mam. Ask ko lng po latest appraisal report for client Mr. JGY. Tnk u ~ A of MBDC

ASH: Last appraisal report is at 70% completion. With this, we release partial loan proceeds dated 11/201/7 amounting to 1,055,912.68. Thanks.

APA: Ma’am tnk u for d info. Have a good day!139 (Emphasis supplied)

Moreover, APA, attested in an affidavit140 that on 02 May 2020, ASH disclosed to her the fact of the release of the loan proceeds to Complainants, to wit:

“4. ASH, who was then assigned to another BPI branch, confirmed and told me that the amount equivalent to 90% of the approved loan of Spouse JGY and NTY was already released by the bank since early of 2018. Since she was no longer in the Head Office, she cannot give me the specific date of release but confirmed that the amount was already released.” (Emphasis supplied)141

Notably, the email made by Respondent’s [], MP, on 07 May 2020, confirms that MBDC sought information regarding the loan covered by the Mortgage Loan Agreement. This email confirms that the disclosure made by ASH was enough to clearly identify the Complainants as the individuals pertained to in the text exchanges between Respondent’s account officer and MBDC, thus satisfying the second element in this case.

Anent the third element, the parties hold conflicting views as to whether MBDC should be considered a third party within the ambit of the DPA.

Respondent alleges that it was the Complainants who involved the representatives of their contractor in meetings with Respondent and even instructed bank employees to directly coordinate with the contractor regarding the appraisal of the project and schedule of release of payment, and as such, any disclosure by Respondent was only made with Complainant’s express consent and instructions.142

The Complainants, on the other hand, denied giving any authority to MBDC to coordinate or transact, on its own, with the Respondent on their behalf.143 Thus, the Complainants posited that absent any clear and written authorization, the Respondent wrongly assumed and concluded that the indirect acts of the Complainants constitute authority for MBDC, a third party, to transact on their behalf.144

The Mortgage Loan Agreement145 states that Respondent agreed to extend a housing loan to Complainants amounting to twelve million pesos (Php 12,000,000.00) with a mortgage constituted on the aforesaid property, without any mention of a named contactor.146 It was executed by and between the Complainants and Respondent only; MBDC is considered a third party to such agreement. Thus, the latter is not entitled to gain access to the contents and other information in relation thereto. Thus, the third element is present.

As to the fourth element, it must be noted that, by Complainant’s own admission in their Memorandum,147 they were the ones who informed MBDC about their existing loan agreement with Respondent even prior to the latter’s disclosure, to wit:

  1. Since the schedule of the release of loan proceeds is dependent on the construction phases in the Construction Checklist Form (CCF), Spouses JGY and NTY requested MBDC to construct the house in stages provided in BFSB’s CCF. It is worthy to note, however, that the CCF does not contain any information pertaining to the details of the Loan Agreement, such as the total loan amount and the Schedule of Releases of the loan proceeds. Neither did Spouses JGY and NTY provide MBDC with a copy of the Schedule of Releases.148 (Emphasis supplied)

Clearly, MBDC was completely aware of Complainant’s existing loan with Respondent and the requirements that comprise each percentage completion. These information, including their identities as borrowers in a specific loan agreement with Respondent, were supplied to MBDC by Complainants themselves and not by Respondent.

Nonetheless, obtaining the consent of the data subject is not the only lawful basis for even if the disclosure was made without the consent of Complainants, the disclosure by Respondent falls within the lawful processing of personal information pursuant to Section 12 (f) of the DPA, which provides:

SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

x x x

(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.149

Based on the foregoing, personal information may be processed when it is for a legitimate interest.

Instructive on this, the Commission has previously enumerated the conditions which must be established by a PIC in using legitimate interest as lawful basis in the processing of personal information, under Section 12 (f) of the DPA:

Processing based on legitimate interest requires the fulfillment of the following conditions: (1) the legitimate interest is established; (2) the processing is necessary to fulfill the legitimate interest that is established; and (3) the interest is legitimate or lawful and it does not override fundamental rights and freedoms of data subjects.150

As to the first condition, Respondent established its legitimate interest because, as previously discussed, it is a party to the loan agreement with Complainant.

As to the second and third condition, Respondent correctly pointed out that it has the right and the duty to determine whether the proceeds of the loan granted to the Complainants was actually utilized for the purpose agreed upon, which, in this case, was supposedly for the Construction Project.151

Particularly, Section 39 of R.A. 8791 or the General Banking Law of 2000 provides:

Section 39. Grant and Purpose of Loans and Other Credit Accommodations. - A bank shall grant loans and other credit accommodations only in amounts and for the periods of time essential for the effective completion of the operations to be financed. Such grant of loans and other credit accommodations shall be consistent with safe and sound banking practices. The purpose of all loans and other credit accommodations shall be stated in the application and in the contract between the bank and the borrower. If the bank finds that the proceeds of the loan or other credit accommodation have been employed, without its approval, for purposes other than those agreed upon with the bank, it shall have the right to terminate the loan or other credit accommodation and demand immediate repayment of the obligation. (Emphasis supplied)152

As stated above, the purpose of the loan is required to be indicated in the application and the contract between the borrower and the bank for the reason that should the proceeds thereof be used for purposes other than what was agreed upon, the latter has the right to terminate the loan and demand immediate repayment thereof.

Clearly, Respondent is well within its duty to determine whether the loan proceeds were used by the Complainants for the very purpose it was obtained, approved and released – for the Construction Project. Otherwise, the Respondent shall have the right to terminate its loan agreement with the Complainants and demand the latter to immediately repay the same.

In the case of GBA v SBG and LPLP v SBG, the Commission held:

As to the second and third requisites of legitimate interest, not only must the interest established be legitimate but the manner in which that legitimate interest is sought to be achieved is equally important. It must be done in a way that does not override the fundamental rights and freedoms of the data subjects taking into consideration the principles of proportionality and fairness.153

In NPC Privacy Policy Office Advisory Opinion No. 2020-050 the Commission reiterated:

In determining the balancing of rights and interests, it is important to identify whether the data subject had reasonable expectation at the time and in the context of collection of personal information that processing for fraud investigation may occur. Transparency during the collection of personal information and the relationship between the PIC and the data subject are just some of the factors which may be taken into consideration in evaluating reasonableness.154

Again, the processing of Complainants’ information was made in pursuit of its legitimate interest. In other words, in order for Respondent to determine whether the loan was indeed used for the purpose it was secured in compliance with the above-cited provision,155 it was necessary for the Respondent to disclose to Complainants’ contractor, MBDC, the status of the project and the release of the loan proceeds corresponding thereto.

As stated in the Credit Advisory Letter,156 the loan proceeds shall be released to the Complainants on staggered basis based on appraiser’s progress report, as follows:

Schedule of Releases: P 3,000,000.00 upon 0.00% completion P 3,000,000.00 upon 30.00% completion P 3,000,000.00 upon 60.00% completion P 3,000,000.00 upon 90.00% completion157

Thus, the release of the proceeds of such a loan is primarily dependent on the completion of the Construction Project. The purpose of this is to ensure that the loan proceeds will be utilized for which it was obtained and granted, to the end that the accomplished or completed phase of the Construction Project shall be paid accordingly.

Therefore, based on the above discussions, Respondent had established a legitimate interest to process Complainants’ information in view of its responsibility as a banking institution and as a party to the loan agreement.

As such, considering that the purpose of the Respondent in processing the Complainant’s personal information was based on lawful criteria as provided in Section 12 (f), it can be said, therefore, that the fourth element is absent.

Finally, as to the last element, nothing in the records points to the information disclosed as being unwarranted or false. Complainants did not even dispute the information disclosed by Respondent to MBDC.

As previously stated, Section 32 of the DPA penalizes disclosure of personal information not falling within Section 31 of the DPA or due to malicious disclosure.158 In this case, neither was there any indication, more so, proof that Respondent’s account officer acted with malice or bad faith when the latter disclosed Complainant’s loan information to MBDC.

Despite this, the Commission has the power to make an independent determination on whether such information is unwarranted or false information, or the disclosure was made maliciously, or in bad faith.

Malice is defined as one which “connotes ill will or spite and speaks not in response to duty but merely to injure the reputation of the person defamed, and implies an intention to do ulterior and unjustifiable harm.”159

While bad faith is explained by the Supreme Court in Spouses Espinoza, et. al. vs. Spouses Mayandoc, et. al. as:

Bad faith does not simply connote bad judgment or negligence. It imports a dishonest purpose or some moral obliquity and conscious doing of a wrong. It means breach of a known duty through some motive, interest or ill will that partakes of the nature of fraud.160

Both of which, the Complainants failed to prove by substantial evidence. Thus, the last element is present in this case.

Having failed to satisfy the fourth element as discussed above, Respondent could not be held liable for violation under Section 32 of the DPA for Unauthorized Disclosure.

WHEREFORE, premises considered, this Commission resolves that the instant Complaint filed by Spouses JGY and NTY against BPI Family Savings Bank, Inc. be hereby DISMISSED for lack of merit.

This is without prejudice to the filing of appropriate, civil, criminal, or administrative cases, if any, against BPI Family Savings Bank, Inc. before any other forum or tribunal.

SO ORDERED.

City of Pasay, Philippines. 17 August 2023.

NERISSA N. DE JESUS Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

Copy furnished:

SPOUSES JGY and NTY Complainants

KAGL Counsel for Complainants HMG

BANK OF THE PHILIPPINE ISLANDS BPI LEGAL Counsel for Respondent CDP And GNB

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307. ↩

  2. Id., Annex “B.” ↩

  3. Id. ↩

  4. Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307, Annex “C.” ↩

  5. Id. ↩

  6. Id., Annex “B.” ↩

  7. Id., Annex “C.” ↩

  8. Id., at page 5. ↩

  9. Id. ↩

  10. Id., Annex “F.” ↩

  11. Id. ↩

  12. Id. ↩

  13. Id., Annex “C.” ↩

  14. Id. ↩

  15. Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307, Annex “A-2.” ↩

  16. Id. ↩

  17. Id., Annex “F.” ↩

  18. Id., Annex “G.” ↩

  19. Id. ↩

  20. Id. ↩

  21. Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307, Annex “A-5.” ↩

  22. Id., at page 10. ↩

  23. Id. ↩

  24. Id., Annex “D.” ↩

  25. Id., at page 6. ↩

  26. Id., Annex “D.” ↩

  27. Id., Annex “7” of Annex “D.” ↩

  28. Id. ↩

  29. Id., Annex “7” of Annex “D.” ↩

  30. Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307, Annex “E.” ↩

  31. Id., Annex “D.” ↩

  32. Id., at page 7. ↩

  33. Id., Annex “A-8.” ↩

  34. Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307, at page 11. ↩

  35. Id. ↩

  36. Id., at page 12. ↩

  37. Id., at page 8. ↩

  38. Id. ↩

  39. Id. ↩

  40. Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307. ↩

  41. Id., at pp 14-17. ↩

  42. Order to Comment, 26 May 2021. ↩

  43. Order to Appear for Preliminary Conference, 06 July 2021. ↩

  44. Verified Comment (To Complaint dated October 13, 2020), 08 July 2021. ↩

  45. Respondent’s email, 12 July 2021. ↩

  46. Verified Comment (To Complaint dated October 13, 2020), 08 July 2021. ↩

  47. Id., par. 10. ↩

  48. Id., par. 7 to 10. ↩

  49. Id., par. 12. ↩

  50. Id., par. 13. ↩

  51. Id., par. 15, see also Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307, Annex “D.” ↩

  52. Id., par. 15, see also Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307, Annex “E.” ↩

  53. Verified Comment (To Complaint dated October 13, 2020), 08 July 2021. ↩

  54. Verified Comment (To Complaint dated October 13, 2020), 08 July 2021, par. 15. ↩

  55. Id., par. 17. ↩

  56. Id., par. 18. ↩

  57. Id. ↩

  58. Id., par. 19. ↩

  59. Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307, Annex “B.” ↩

  60. Id., Annex “C.” ↩

  61. Verified Comment (To Complaint dated October 13, 2020), 08 July 2021, par. 19. ↩

  62. Id., par. 19. ↩

  63. Id. ↩

  64. Respondent’s Email, 27 July 2021. ↩

  65. Order Resetting the First Preliminary Conference, 27 July 2021. ↩

  66. Order dated 04 August 2021. ↩

  67. Id. ↩

  68. 2021 Rules of Procedure of the National Privacy Commission, NPC Circular No. 2021-01. ↩

  69. Order dated 04 August 2021. ↩

  70. Order to Mediate, 27 August 2021. ↩

  71. Notice of Non-Settlement of Dispute, 06 December 2021. ↩

  72. Order for Resumption of Complaints Proceedings and to Appear Virtually for Preliminary Conference, 08 December 2021. ↩

  73. Id. ↩

  74. Complainant’s Manifestation (In Response to the Order dated 08 December 2021), 28 December 2021. ↩

  75. Id. ↩

  76. Id. ↩

  77. Respondent’s email, 28 December 2021. ↩

  78. Order (Granting the Email Manifestation of Respondent to reset the Preliminary Conference from 26 January 2022 to 03 February 2022), 24 January 2022. ↩

  79. Order on the Submission of Comment on the Manifestation Opposition to the Comment, Simultaneous Written Stipulations, Comment on the Stipulations, and Memoranda, 03 February 2022. ↩

  80. Id. ↩

  81. Comment to Complainants’ Manifestation (In Response to the Order dated 08 December 2021), 17 February 2022. ↩

  82. Id., par. 5 and 6. ↩

  83. Id., par. 29. ↩

  84. Id. ↩

  85. Id., par. 29. ↩

  86. Complainant’s Opposition (To Comment dated 17 February 2022), 5 March 2022. ↩

  87. Respondent’s Comment to Manifestation (In Response to the Order dated 08 December 2021), 17 February 2022. ↩

  88. Complainant’s Opposition (To Comment dated 17 February 2022), 5 March 2022. ↩

  89. Order (After the 2nd Preliminary Conference held on 03 February 2022, Submission of Comment on the Manifestation Opposition to the Comment, Simultaneous Written Stipulations, Comment on the Stipulations, and Memoranda, 03 February 2022. ↩

  90. Complainant’s email, 20 March 2022. ↩

  91. Complainants’ Proposed Stipulations, 20 March 2022. ↩

  92. Respondent’s Manifestation and Compliance, sent through email on 21 March 2022. Verified Comment (To Complaint dated October 13, 2020), 08 July 2021. ↩

  93. Complainant’s Comment of Respondent’s Proposed Stipulations, 04 April 2022. ↩

  94. Id. ↩

  95. Id., par. 2. ↩

  96. Id., par. 3. ↩

  97. Id., par. 4. ↩

  98. Id. ↩

  99. Respondent’s Memorandum, 17 April 2022. ↩

  100. Verified Comment (To Complaint dated October 13, 2020), 08 July 2021. ↩

  101. Respondent’s Memorandum, 17 April 2022, at page 3. ↩

  102. Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307, Annex “D.” ↩

  103. Id., Annex “E.” ↩

  104. Respondent’s Memorandum, 17 April 2022, at pp 4-5. ↩

  105. Id., at pp 4-5. ↩

  106. Id., at pp 12-14. ↩

  107. Id., at pp 12-14. ↩

  108. Id. ↩

  109. Complainant’s email, 20 April 2022. ↩

  110. Complainant’s Memorandum, 20 April 2022. ↩

  111. Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307, Annex “C.” ↩

  112. Complainant’s Memorandum, 20 April 2022, at par. 19. ↩

  113. Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307, Annex “C.” ↩

  114. Complainant’s Memorandum, 20 April 2022, at par. 20-21. ↩

  115. Id., at par. 22. ↩

  116. Id., at par. 23. ↩

  117. Id. ↩

  118. NPC 18-010. ↩

  119. Id., at p. 18. ↩

  120. Id. ↩

  121. NPC 21-111. ↩

  122. Id., at p. 16. ↩

  123. Id., at p. 17, see also p. 11. ↩

  124. Delgado v. HRET, G.R. No. 219603, 26 January 2016. ↩

  125. Montinola vs. Philippine Airlines, G.R. No. 198656, 08 September 2014. ↩

  126. Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307. ↩

  127. Data Privacy Act of 2012, § 32, see also NPC 18-010. ↩

  128. Data Privacy Act of 2012, § 3(h). ↩

  129. Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307, Annex “C.” ↩

  130. Data Privacy Act of 2012, § 32. ↩

  131. Data Privacy Act of 2012, § 3(g). ↩

  132. Verified Comment (To Complaint dated October 13, 2020), 08 July 2021, par. 10. ↩

  133. Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307. ↩

  134. Data Privacy Act of 2012, § 3(g). ↩

  135. Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307, Annex “7” of Annex “D.” ↩

  136. Id., Annex “D.” ↩

  137. Id., Annex “7” of Annex “D.” ↩

  138. Id. ↩

  139. Id., Annex “7” of Annex “D.” ↩

  140. Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307, Annex “E.” ↩

  141. Id. ↩

  142. Respondent’s Memorandum, 17 April 2022, at pp 12-14. ↩

  143. Complainant’s Memorandum, 20 April 2022, at par. 23. ↩

  144. Id. ↩

  145. Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307, Annex “C.” ↩

  146. Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307, Annex “C.” ↩

  147. Complainant’s Memorandum, 20 April 2022. ↩

  148. Id. ↩

  149. Data Privacy Act of 2012, § 12. ↩

  150. NPC 19-758, citing NPC 21-167, MAF v. Shopee Philippines, Inc., 22 September 2022. ↩

  151. Verified Comment (To Complaint dated October 13, 2020), 08 July 2021, par. 19. ↩

  152. The General Banking Law of 2000, § 39. ↩

  153. NPC 20-317 and 20-318 GBA v SBG & LPL v SBG available at https://www.privacy.gov.ph/wp-content/uploads/2023/03/NPC-20-317-and-20-318.pdf ↩

  154. NPC Privacy Policy Office Advisory Opinion No. 2020-050, 26 November 2020. ↩

  155. The General Banking Law of 2000, § 39. ↩

  156. Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307, Annex “B.” ↩

  157. Complaints-Assisted Form, 26 November 2020, in Spouses JGY and NTY v. BPI Family Savings Bank, Inc. NPC 20-307, page 5. ↩

  158. Id., at p. 18. ↩

  159. MED v. House of Representatives Electoral Tribunal and PAP, G.R. No. 219603, 26 January 2016. ↩

  160. Spouses ME and WV v. Spouses AM and ECM, G.R. No. 211170, 03 July 2017. ↩

Backlinks

  • No backlinks found