NPC Issuance Wiki

NPC 17-047: JV v. JR

Issued Decision

Decision Text

JV,

Complainant,

-versus-

JR, as the Customer Service Manager of SM Store at SM Bicutan,

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.

For consideration before this Commission is a complaint filed by JV against JR, in her capacity as the Customer Service Manager of the SM Store, for an indeterminate violation of the Data Privacy Act (DPA).1

These Proceedings

On 15 March 2018, this Commission, through the Complaints and Investigation Division, conducted a Discovery Conference. At the Conference, this Commission directed the respondent and other representatives of SM Bicutan to submit a responsive pleading within ten (10) days from receipt of the Order dated 16 March 2018.2

On 26 March 2018, the respondent filed her Comment containing a narration of incidents and arguments refuting the complainant’s allegations.3

On 13 April 2018, the complainant filed his Letter-Reply.

Facts

From these filings, we ascertain these facts.

The complainant filed and paid for a copy of his birth certificate from the Philippine Statistics Authority (PSA) through the Customer Service Center of the SM Store at SM Bicutan.

Upon payment, the cashier collected the complainant’s name, address, and phone number. JV claims he does not know why this information is necessary, and that no one let him know who can process that information further.4

When the complainant returned for his birth certificate, he noted the SM personnel pull his birth certificate from a folder on her desk. He also noted that his birth certificate was kept together with the birth certificates of other people and that another person’s Certificate of No Marriage was lying on another table, accessible to any of the other personnel of SM Store.

The SM personnel, JH, then handed the complainant his birth certificate uncovered and in plain sight. JH was the only person at the counter.

The complainant then asked for an envelope for his birth certificate. JH told JV that no envelopes were to be given, as the PSA did not provide envelopes for the purpose.

When the complainant brought this to the respondent’s attention, the respondent informed the complainant that all customer service counters in all SM Stores throughout the country do not provide individual envelopes for their clients’ birth certificates.

Nevertheless, the respondent placed the complainant’s birth certificate in an envelope and handed over the birth certificate to the complainant. At this point, the complainant was taking photos and videos of JH and the respondent, over their objections.

Arguments of the Parties

The complainant now comes to us claiming there is a violation of his privacy rights. He claims that his data was not treated with the confidentiality it deserves. He finds it unfair that the persons handling the PSA-issued documents, who are also under the supervision of the respondent, may not be authorized to handle them.5

The complainant also feels that any complaint filed with SM Store will not be treated fairly; he acknowledges that he has filed a prior complaint against the same respondent for being arrogant and unprofessional in a previous transaction.6

The respondent claims that as a mere conduit of the PSA, she had no obligation to place the birth certificate in an envelope when the PSA provided no such envelope for the purpose; the PSA hands over all documents to be released in just one envelope for every request made in one certain day.

The respondent argues that there is no violation of informational privacy rights or any other violation of the Data Privacy Act.7 She notes that the Data Privacy Act and its Implementing Rules and Regulations do not define what a “privacy violation” is. Therefore, the respondent concludes, the actions must be measured against the test of what may constitute a reasonable expectation of privacy.

The respondent points to jurisprudence laying down a two-part test: (1) whether by conduct, an individual has exhibited an expectation of privacy; and (2) whether this expectation is one that society recognizes as reasonable.8 She then contends that as authorized representatives of the PSA, the complainant should have reasonably expected that JH and the respondent can process and facilitate the release of the copy of JV’s birth certificate.9 She argues, further, that this reasonable expectation extends to SM Store and its authorized personnel.10

The respondent maintains that there was no data breach, and as such, no criminal liability for unauthorized disclosure under Section 32 of the Data Privacy Act, because only authorized employees of SM Store were at the counter, at all material times in this complaint; JH released the complainant’s birth certificate to the complainant only.11

For the respondent, Philippine data privacy laws do not require that every document containing personal data be separated individually from other documents. Neither do these laws prohibit putting different documents in just one envelope. She believes that all that the DPA requires is “appropriate and reasonable” security measures to ensure the confidentiality, integrity and availability of personal data.

The respondent insists that the complainant’s birth certificate was never compromised, as SM Bicutan established and implemented appropriate and reasonable security measures, especially following the issuance of PSA Office Memorandum 2017-09, which specified the authorized persons who can be issued the certificates. She points to SM Store policies on the release of requested certificates to its customers:

  1. Only authorized personnel, such as Customer Service Assistants, are allowed inside the counters of customer service areas, including those where the customers can request for and receive birth certificates;
  2. During the release of certificates, the authorized employee shall search only the requested certificate in the envelope corresponding to the date of request.
  3. The requested certificates shall only be released to the owners, or their duly authorized representatives, as enumerated in the guidelines of PSA.
  4. If the one claiming the certificate is not the owner, the representative shall be required to submit an authorization letter from the owner, a copy of a valid identification (ID) card of the owner and a valid ID of the representative.
  5. The authorized personnel must always maintain all the certificates inside the labeled envelopes.

The respondent claims that the design, including the physical arrangement of furniture and equipment, of the counters in the customer service counters in SM Bicutan provides privacy to the personnel handling the personal data.

The respondent also claims that the Non-Disclosure Agreement (NDA) that she and JH were made to sign obliged them to hold personal data under strict confidentiality during and even after their employment.12 Their NDAs, as presented to this Commission, require them to comply with the provisions of the Data Privacy Act,13 and prohibit the retention of any copies of any documents that may come into their possession that contain confidential and personal information.

In rebuttal, the complainant argues that as an authorized partner of the government in providing services, it is not just a mere conduit; SM Store is bound to follow the rules of PSA and the Data Privacy Act as a personal information controller.

He maintains that the locations of the folders and envelopes are material: having been placed in a location accessible by all personnel in the customer area, JR had ready access to his birth certificate. The complainant stresses that since respondent was someone whom he had complained about for unprofessional behavior and for discourtesy, he was bothered by the respondent’s access to his birth certificate.

The complainant claims that any photo and video taken was for evidentiary purposes;14 the public nature of the incident removes any reasonable expectation of privacy for JH and the respondent.

Finally, the complainant points toward a peculiarity in JH and the respondent’s Non-Disclosure Agreements, having been executed only 6 October 2017, two days prior to the incident. The complainant notes that these documents did not exist at the time he filed and paid for his birth certificate.

Issues

The issues to be resolved in this case are:

  1. Whether the Respondent committed any violation of the Data Privacy Act; and
  2. Whether the security measures implemented by SM Bicutan are considered reasonable and appropriate.

Discussion

On the procedural aspect of the case, NPC Circular 16-04 provides for the form and content of Complaints, thus:

Form and Contents of Complaints

The complaint shall include a brief narration of the material facts and supporting documentary and testimonial evidence, all of which show: (a) the violation of the Data Privacy Act or related issuances; or (b) the acts or omissions allegedly committed by the respondent amounting to a privacy violation or personal data breach. The complaint must include any and all reliefs sought by the complainant.15

From the narration of events, this Complaint stems from the admitted fact that the birth and other certificates being released at the customer service counter in SM Bicutan were not sealed or covered individually.

Procedural Deficiency

On the basis of this, complainant alleges that his privacy was violated without specifying either the provisions of the Data Privacy Act that were violated or the acts constituting a violation of those provisions despite what NPC Circular 16-04 requires.

Notwithstanding this deficiency in form, however, the Commission resolves to give due course to the Complaint to clarify important legal concepts on privacy.

Considering that the complainant cites no specific violation of the Data Privacy Act, we must determine whether the processing was done in accordance with some lawful criteria as provided in the law.

It is undisputed that the birth certificate of the complainant contains personal information and sensitive personal information as defined under the Data Privacy Act.

One of the criteria provided under Sections 12 and 13 of the Act for the lawful processing of both personal and sensitive personal information is consent of the data subject. This consent must be specific to the purpose declared prior to the processing.

A person requesting his birth certificate from the PSA is asked to fill out an application form for the issuance of his birth certificate.

In the application form, the requester signifies his consent for the processing of his birth certificate for the purpose of releasing it to him.

The requester also has the option to avail the services of PSA through their accredited partners, in this case, SM Store.16

Here, the complainant chose to apply for his birth certificate in SM Store, an accredited partner of the PSA.17 In doing so, the complainant is considered to have given his consent to SM Store to process his request to get a birth certificate from PSA. He was aware that the processing shall be for purposes of issuing and releasing his birth certificate to him or to his duly authorized representative. Thus, SM Store, as an accredited partner of PSA, processed Complainant’s birth certificate according to one of the lawful criteria set out in the Data Privacy Act.

Respondent Did Not Commit Any Violation of the Data Privacy Act to Warrant a Recommendation for Prosecution

The respondent argues that since complainant only claimed in general that there was a privacy violation and neither the Data Privacy Act nor its IRR defines what a privacy violation is, the circumstances of the case must be measured against what reasonable expectations of privacy exist. Using the reasonable expectation of privacy test as a measure, she claims that she did not commit any violation of the Data Privacy Act.

The two-part test she cited to determine whether an individual’s reasonable expectation of privacy was violated, however, must now be considered within the context of existing laws, specifically the Data Privacy Act.

Quoting the concurring opinion of Justice Harlan in the United States Supreme Court case of Katz v. US,18 the Philippine Supreme Court incorporated the reasonable expectation of privacy test in Ople v. Torres,19 thus:

The reasonableness of a person’s expectation of privacy depends on a two-part test: (1) whether by his conduct, the individual has exhibited an expectation of privacy; and (2) whether this expectation is one that society recognizes as reasonable.20

Expounding on the Katz test, Ople further explained:

The factual circumstances of the case determines the reasonableness of the expectation. However, other factors, such as customs, physical surroundings and practices of a particular activity, may serve to create or diminish this expectation.21

In Ople v. Torres,22 the Supreme Court expressly recognized the right to privacy as a fundamental right guaranteed by the Constitution, identifying in the process several constitutional provisions that protect different facets of such right. Apart from this, the Court explicitly recognized that different zones of privacy are protected under different laws, thus:

Zones of privacy are likewise recognized and protected in our laws. The Civil Code provides that ‘[e]very person shall respect the dignity, personality, privacy and peace of mind of his neighbors and other persons’ and punishes as actionable torts several acts by a person of meddling and prying into the privacy of another. It also holds a public officer or employee or any private individual liable for damages for any violation of the rights and liberties of another person, and recognizes the privacy of letters and other private communications. The Revised Penal Code makes a crime the violation of secrets by an officer, the revelation of trade and industrial secrets, and trespass to dwelling. Invasion of privacy is an offense in special laws like the Anti-Wiretapping Law, the Secrecy of Bank Deposits Act and the Intellectual Property Code. The Rules of Court on privileged communication likewise recognize the privacy of certain information.23

Application of the Reasonable Expectation Test to Informational Privacy

It is in this context that the Data Privacy Act of 2012 was enacted — “to protect the fundamental human right of privacy of communication while ensuring free flow of information to promote innovation and growth.”24

Considering that Ople itself recognized the idea of statutory zones of privacy, it follows that with respect to the zone of privacy specifically covered and protected by the Data Privacy Act, the strand of privacy known as informational privacy,25 the determination of the metes and bounds of the right to privacy should necessarily be grounded in the Act itself. Given the specific standards the Data Privacy Act provides with regard to the obligations it imposes on those who process personal data and the rights it gives to data subjects, it follows that reference should first be made to these clear and objective standards26 before going into an abstract and general examination that is the “reasonable expectation of privacy” test in Katz — a test that was traditionally applied for locational or situational privacy cases to determine when a search can be considered as an intrusion into the right to privacy of individuals.27

The Data Privacy Act now grants certain, specific rights to individuals whose personal information and sensitive personal information (collectively, “personal data”) is processed. As an overview, these include their right to be informed about the nature and scope of its processing; to access the personal data collected from them; to correct any inaccuracy in the personal data used by other entities; to remove their personal data from another entity’s system; and to be indemnified of any damages sustained due to such inaccurate, incomplete, outdated, or unauthorized use of their personal data.28

The personal data of individuals can no longer be collected and used by any person or organization without finding basis in the different lawful criteria provided for in the Act. Aside from consent, the processing of personal information is now only permitted if it is necessary for the fulfillment of a legal obligation; to protect the life and health of the data subject; to respond to a national emergency, public order and safety; or for a public authority to fulfill its mandate. The Act also considers legitimate interests pursued by an entity, subject to certain provided exceptions. Furthermore, the Act provides a special category of personal information29 that is prohibited from being processed, except on certain grounds. Subject to qualifications provided for in the law itself, these include: consent of the data subject, existing laws and regulation, the protection of life and health, the achievement of lawful and non-commercial objectives of public organizations, treatment by a medical practitioner or a medical treatment institution, and the protection of lawful interests in court or the defense of legal claims.

These rights and parameters correlate to obligations on the part of other persons and entities who process personal data. These persons and entities must be able to justify their processing of personal data under any of the lawful criteria mentioned. They now have an obligation to provide mechanisms for the access, correction, and removal of personal data upon request, as well as the filing of a complaint. They are further required by the Act to secure the processing of any personal data by documenting and implementing organizational, technical, and physical measures to respect the abovementioned rights.30 At the core of these obligations are the general data privacy principles31 of transparency, legitimate purpose, and proportionality. Following this, any person or entity that processes information should collect information only for legitimate purposes that have been made known to the data subject. They should only collect as much information as is needed to achieve business interests or to comply with the law.

All of these constitute objective standards provided by the Data Privacy Act with respect to informational privacy.

In fact, even applying the reasonable expectation of privacy test within the context of informational privacy, the result still points to the Data Privacy Act.

The first part asks “whether by his conduct, the individual has exhibited an expectation of privacy.”32 This expectation of privacy has to be examined taking into consideration what the Act itself provides. An individual’s expectation of privacy does not depend on a particular action on their part before they are granted the rights provided under the law; these rights are not waived, and the obligations of controllers and processors cannot be ignored simply because there is no overt exhibition of this expectation of privacy. As to the second part, which asks “whether this expectation is one that society recognizes as reasonable,”33 this determination should be considered as having been made when Congress and the President, as representatives of the people, codified what data subjects should expect with regard to their privacy.

Given these, insofar as informational privacy cases are concerned, the application of the reasonable expectation of privacy test under Katz and Ople should necessarily result in a determination in accordance with the provisions of the Data Privacy Act. An individual’s expectation of privacy should therefore be determined taking into consideration the rights the Act gives to data subjects34 and the obligations it imposes on those who process personal information by, among others, ensuring they follow not only the general data privacy principles35 but also that they have lawful basis for that specific processing activity.36

This is not to say, however, that the concept of reasonable expectation of privacy no longer applies. While the two-part test under Katz and Ople should now be construed taking into consideration the provisions of the Data Privacy Act, this concept of “reasonable expectation” may still be useful in addressing issues concerning informational privacy in relation to what controllers and processors may legitimately do.

In this regard, this concept of “reasonable expectation” is considered to determine the legitimacy of the additional processing by examining whether such further processing is compatible with the original business purpose communicated to the data subject and not beyond what the data subject may reasonably expect as to the purpose, scope, manner, and extent of the processing of their personal data.37

On the proper usage of publicly available data, for example, this Commission has stated that “the reasonable expectation of the data subject on the purpose for processing of his or her personal information at the time of its collection becomes a crucial consideration… In the absence of a pre-existing relationship, the PIC must demonstrate that the processing can be reasonably expected, particularly if the personal information was collected and obtained from a third party.”38

In this case, while it is correct to say that the complainant cannot expect that only the PSA will handle his request for his birth certificate, it is incorrect to say that “there is no longer a reasonable expectation that the privacy of his birth certificate extends only to the PSA”39 and therefore there is no privacy violation under the DPA. Following the discussion above on the application of the reasonable expectation of privacy test to informational privacy cases, determining whether the privacy rights of the complainant were violated or not should be rooted in the provisions of the Data Privacy Act.

From the facts of this case, the complainant clearly consented to the Customer Service Center of the SM Store at SM Bicutan processing his request for a birth certificate as an accredited partner of PSA when he filed and paid for his request through them. Consent under Sections 12(a) and 13(a) of the Data Privacy Act served as the lawful basis for the respondent as well as the authorized personnel of SM Bicutan and PSA to process complainant’s request.

Having established that there was lawful basis for respondent to process complainant’s personal and sensitive personal information, do the circumstances alleged by complainant rise to the level of a violation of the Data Privacy Act to warrant a recommendation for criminal prosecution? We answer in the negative. As will be shown hereunder, this does not mean, however, that there was no lapse on the part of respondent or SM Bicutan.

SM Bicutan, as an accredited partner of PSA, has put in place security measures. However, these measures should be strictly implemented.

While the Commission takes note of the security measures set out in the respondent’s Comment, it follows that these measures should be strictly implemented by the Company and its personnel and that measures should be taken to ensure this. Also, while not rising to the level of a crime under the DPA, it cannot be said that SM Store’s security measures already satisfy the “reasonable and appropriate” standard given the circumstances.

The fact that additional measures are being implemented, as admitted in the counter-affidavit of JH,40 is itself a recognition of a deficiency that could have been previously identified and addressed by SM Store. This also shows that the complainant’s concern relating to certificates being placed in common envelopes is not entirely unwarranted.

This is all the more true given the pictures taken by the complainant showing a pile of certificates on the counter.41 This not only goes against the policies of SM Bicutan outlined in the respondent’s Comment but, more importantly, potentially endangers the data subjects whose certificates were left where they may be seen by persons transacting near the counter.

The allegations of the complainant do not meet the quantum of evidence required for administrative cases.

The complainant filed this case out of his apprehension that the persons handling his request for birth certificate might misuse the personal data contained in said certificate. He feels threatened because he previously complained to the management of SM Bicutan about the person supervising the release of his birth certificate.

In Morales vs. Ombudsman, et al.,42 the Supreme Court held:

The basic rule is that mere allegation is not evidence and is not equivalent to proof. Charges based on mere suspicion and speculation likewise cannot be given credence. When the Complainant relies on mere conjectures and suppositions, and fails to substantiate his allegations, the complaint must be dismissed for lack of merit.43

The complaint shall only be recommended for prosecution if it is supported with relevant evidence which a reasonable mind might accept as adequate to justify a conclusion.44 The allegations in the complaint must be based on substantial evidence that there is a clear and real violation of the law.

The complainant’s allegations are grounded on his fear that the respondent may prejudice his personal data considering her position in SM Store. As the Customer Service Manager of SM Store in SM Bicutan, the respondent exercises supervision over the operations of SM Store in its capacity as an accredited partner of PSA. However, there is nothing in the allegations that the respondent took advantage of her position to the prejudice of the complainant’s personal data.

SM Store or PSA’s act of not putting each requested certificate in a separate envelope or cover does not prove that a violation of the Act has been committed. The complainant’s previous altercation against the persons handling his document also does not add weight to the alleged violation of the Act. The complaint failed to show that the acts of the Respondent amounted to a violation of the DPA.

The prosecution of violations committed under the DPA should not be based on mere suspicion or speculation of the Complainant that harm may be done to his personal data. Without any evidence or proof to support his allegations, the Complaint should be dismissed for lack of merit.

In PSA’s Application Form for Birth Certificate, PSA has accredited partners extending their services such as delivery of the requested documents through their authorized couriers. It is the option of PSA clients, such as the herein complainant, to secure certifications and copies of civil registry documents from any of PSA’s accredited partners.45

SM Store is a partner of PSA in accepting and releasing the requested certificates. PSA, a personal information controller, outsources the services of SM Store in SM Bicutan and other SM locations to process the personal data of the requesting data subjects.46 The processing covers the filing of requests and releasing of the certificates, containing personal data, of the data subjects. SM Store is considered as a personal information processor.

As a personal information processor, SM Store insists that it has adopted reasonable and appropriate security measures including:

  1. Company policies with respect to the release of the NSO Birth Certificate;
  2. Disciplinary actions to be imposed on the employees who commit a violation of the company policies affecting its obligation as an authorized agent of the PSA;
  3. Design of the counters of the customer service areas where the request and release of certificates are made; and
  4. Execution of NDAs of the employees handling personal data of the customers.47

The mere existence of security measures is not by itself enough to protect the personal data of the subjects.

In this case, the complainant observed that the requested certificates, contained in one folder, were just placed on top of the table at the counter. While only authorized personnel are allowed at the customer service counter, any person transacting at the counter may view some of the details of the certificate appearing first on the folder.48 Given this, this incident may result in the accidental disclosure of the personal data of any requester whose certificate may appear first on the folder.

While SM Store already has existing reasonable and appropriate measures, this Commission finds that said establishment is not strictly implementing these measures.

Compliance with Data Privacy Act Requirements

It is also worth noting that the NDAs of Respondent and JH were only executed two days before the incident.49 SM Store should require their employees to execute that document or some similar agreement at the beginning of their employment, or at least before they are assigned to handle documents containing personal data of their customers.

Section 26(d) of the Implementing Rules and Regulations of the Data Privacy Act provides:

d. Management of Human Resources. Any natural or juridical person or other entity involved in the processing of personal data shall be responsible for selecting and supervising its employees, agents, or representatives, particularly those who will have access to personal data. The said employees, agents, or representatives shall operate and hold personal data under strict confidentiality if the personal data are not intended for public disclosure. This obligation shall continue even after leaving the public service, transferring to another position, or upon terminating their employment or contractual relations. There shall be capacity building, orientation or training programs for such employees, agents or representatives, regarding privacy or security policies.

SM Store is duty-bound to strengthen the implementation of their privacy and security measures by ensuring that their employees, agents or representatives assigned in the customer service counter of SM Store are contractually bound to protect the privacy right of their customers.

The management should make their personnel aware of the nature of the data they are handling before they are assigned at the customer service counter. These personnel should also be oriented on the existing measures adopted and implemented by SM Bicutan.

SM Store, as an accredited partner of PSA, should always be mindful that the Data Privacy Act specifically provides that any doubt in the interpretation of any provision of the law shall be liberally interpreted in a manner mindful of the rights and interests of the individual about whom personal information is processed.50 As such, SM Store should strictly implement its existing security measures to prevent these incidents in the future.

WHEREFORE, premises considered, the Commission FINDS no violation of the Data Privacy Act on the part of Respondent JR as the Customer Service Manager of SM STORE at SM Bicutan to warrant a recommendation for prosecution.

This Commission FINDS, further, that considering that while SM STORE is not a party to this case, there is substantial evidence on record to support a finding that SM Store did not adequately implement their privacy policies with respect to the protection of personal data.

Let the records of this case be forwarded to the Compliance and Monitoring Division for the conduct of a compliance check pursuant to NPC Circular No. 18-02.

This is without prejudice to the filing of appropriate civil, criminal or administrative cases against the Respondent before any other forum or tribunal, if any.

SO ORDERED.

Pasay City, 13 August 2019.

Sgd. LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

Concurring:

Sgd. IVY D. PATDU Deputy Privacy Commissioner

Sgd. RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

Copy furnished:

JV Complainant

JR Customer Service Manager

COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [DATA PRIVACY ACT]. ↩

  2. Records, p. 18; NPC Circular No. 16-04, Rule III, Section 15. ↩

  3. Id., at pp. 22-34. ↩

  4. Id., at p. 3. ↩

  5. Id., at p. 1. ↩

  6. Ibid. ↩

  7. Id., at p. 30. ↩

  8. Id., at p. 29. ↩

  9. Ibid. ↩

  10. Ibid. ↩

  11. Id., at p. 30. ↩

  12. Id., pp. 48-49, 59-60. ↩

  13. Ibid. ↩

  14. Id., at p. 102. ↩

  15. NPC Circular 16-04, Section 10. ↩

  16. Application Form – Birth Certificate, https://www.psaserbilis.com.ph/Secure/Files/Birth%20Application%20Form.pdf (last accessed on 08 August 2019). ↩

  17. Ibid. ↩

  18. Katz v. United States, 389 U.S. 347 (1967). ↩

  19. G.R. No. 127685, 292 SCRA 141, 23 July 1998. ↩

  20. Ibid. ↩

  21. Ibid. ↩

  22. G.R. No. 127685, 292 SCRA 141, 23 July 1998. ↩

  23. Ibid. ↩

  24. Data Privacy Act, § 2. ↩

  25. See the discussion on the three strands of privacy in Vivares v. St. Theresa’s College, G.R. No. 202666, 29 September 2014, citing Chief Justice Reynato Puno’s speech, The Common Right to Privacy. ↩

  26. Canon of statutory construction that a specific law prevails over a general law. See Lopez v. Civil Service Commission, G.R. No. 87119, 16 April 1991, citing Butuan Sawmill, Inc. v. City of Butuan, No. L-21516, April 29, 1966, 16 SCRA 755. ↩

  27. See generally, Articulating the Complete Philippine Right to Privacy in Constitutional and Civil Law, 82(4) PHIL. L.J. 78 (2008), cited in Pollo v. David, G.R. No. 181881, Oct. 18, 2011 (Bersamin, J., separate opinion). ↩

  28. Data Privacy Act, § 16. ↩

  29. Id., at § 4(l). ↩

  30. Id., at § 20. ↩

  31. Id., at § 11. ↩

  32. Ople v. Torres, G.R. No. 127685, 292 SCRA 141, 23 July 1998. ↩

  33. Ibid. ↩

  34. Data Privacy Act, § 16. ↩

  35. Id., at § 11. ↩

  36. Id., at §§ 12 and 13. ↩

  37. See EU General Data Protection Regulation, Recital 47. ↩

  38. NPC Advisory Opinion 2018-050. ↩

  39. Records, p. 29. ↩

  40. Id., at p. 55. ↩

  41. Id., at p. 5. ↩

  42. 798 SCRA 609, 17 July 2016. ↩

  43. Id., at p. 627. ↩

  44. Rules of Court, Rule 133, § 5. ↩

  45. Supra note 16. ↩

  46. Data Privacy Act, § 3(i). ↩

  47. Records, pages 22-33. ↩

  48. Id., Pages 3 and 5. ↩

  49. Id., Pages 48-49, 59-60. ↩

  50. Data Privacy Act, § 38. ↩

Backlinks