NPC Issuance Wiki

NPC 19-1438: VMJR v. EBO

Issued Decision

Decision Text

VMJR,

Complainant,

-versus-

EBO,

Respondent.

x----------------------------------------------------x

BELARMINO, D.P.C.;

Before this Commission is a Complaint filed by VMJR (Complainant) against EBO (Respondent) for alleged violations of Sections 25 (Unauthorized Processing of Personal Information and Sensitive Personal Information), 31 (Malicious Disclosure), and 32 (Unauthorized Disclosure) of the Data Privacy Act of 2012 or Republic Act No. 10173 (“DPA”).

Facts

Complainant is a Human Resources Officer at x x x Corporation while Respondent is an employee and a member of the x x x Union, a union of workers within the said corporation.1

On 11 October 2019, the Complainant filed his Complaints-Assisted Form (CAF) with the Complaints and Investigation Division (CID) wherein he alleged that on 27 August 2019, Respondent posted on Facebook, Orders from the Office of the Ombudsman to file counter-affidavits that the Complainant and his officemates received.2

According to the Complainant, it is the Respondent’s act of posting the Orders which contained his personal data on Facebook which allegedly violated his right to privacy.3 He also stated in the CAF that he did not contact Respondent for clarification about the said post.4 He explained that evidence might be removed.5 Moreover, Complainant prayed for damages and all reliefs allowed by law and fines to be imposed on Respondent for violation of the DPA.6

On 12 November 2019, the National Privacy Commission (NPC), through its Complaints and Investigation Division (CID), issued an Order to the parties, requiring them to appear before the Commission for a discovery conference on 04 December 2019.7

On 04 December 2019, the parties appeared before the Commission for the discovery conference.8 After the termination of the conference, Respondent submitted his Counter-Affidavit wherein he asserted that, first, the Complainant stated that he did not contact him regarding his Facebook post.9 Hence, he argued that this act of the Complainant was, “just a malicious ploy to prejudice him and his union members, taking their valuable time and resources.”10

Second, Respondent claimed that Complainant did not indicate the section or provisions of the law violated by him.11 Thus, he asserted that there was no act by the Respondent which constituted a violation of the DPA on the face of the Complaint.12

Third, Respondent argued that his act of posting was not malicious as it was a private communication made in the performance of a moral and social duty to convey to the members of the Union that they have already filed the administrative and criminal charges before the Office of the Ombudsman, as the complainant therein representing all Union members.13 He maintained that this was done with reasonable expectation of privacy as he posted the Orders in their own private Facebook group, exclusively for members of their union.14

Fourth, Respondent contended that his act of posting is a fair and true report, made in good faith, without any comments or remarks, of any judicial, legislative, or other official proceeding which are not of confidential nature since it only informs the members of the private Facebook group of the status of the case filed by them against Complainant before the Office of the Ombudsman.15

Fifth, Respondent cited the case of People vs. Monton wherein the Supreme Court has held that, “a private communication made by any person to another in the performance of any legal, moral, or social duty is an exception to publicity”16.17

Lastly, Respondent averred that the Complaint collapses on its own as it stems from illegally obtained information, thereby violating the privacy of their union and its members.18 He reasoned that Complainant is not a member of the private Facebook group of the Union, so he should not have had access to the Facebook post therein.19

Given the foregoing, Respondent prayed for the dismissal of the Complaint and the grant of other pertinent reliefs.20

With this, the CID issued an Order dated 04 December 2019 for Complainant to file his reply within ten (10) days from receipt of the Order and for Respondent to file a rejoinder within ten (10) days from receipt of his reply.21

On 02 January 2020, the NPC received the Reply of Complainant wherein, first, Complainant cited the Supreme Court who has held that, “[i]t is not the caption of the pleading but the allegations therein that determine the nature of the action”22.23 Hence, he posited that his Complaint should be under Sections 25, 31, and 32 of the DPA.24

Second, Complainant argued that the case of People vs. Monton used by Respondent is grossly misplaced since the facts of the said case are different from those of the present case.25 According to him, the sending of a personal letter is different from the posting of an Order of the Ombudsman on Facebook.26

Third, Complainant cited the case of Vivares vs. St. Theresa’s College27 and asserted that Respondent’s act of posting in a private group exclusively for union members cannot protect the said post from being shared to those who may or may not be allowed access to such.28

On 20 January 2020, the NPC received the Rejoinder-Affidavit of Respondent wherein he denied the allegations of Complainant and reiterated his arguments under his Counter-Affidavit.29

Issues

I. Whether the Complaint shall be given due course by the Commission.

II. Whether the processing of the personal and sensitive personal information of Complainant was lawful.

III. Whether Respondent is liable under Section 25 (Unauthorized Processing of Personal Information and Sensitive Personal Information) of the DPA.

IV. Whether Respondent is liable under Section 31 (Malicious Disclosure) of the DPA.

V. Whether Respondent is liable under Section 32 (Unauthorized Disclosure) of the DPA.

Discussion

I. The Commission exercises its authority to resolve the case on the merits.

Section 4, Rule II of NPC Circular No. 16-04 (NPC Rules of Procedure) provides:

Section 4. Exhaustion of remedies. – No complaint shall be entertained unless:

a. the complainant has informed, in writing, the personal information controller or concerned entity of the privacy violation or personal data breach to allow for appropriate action on the same;

b. the personal information controller or concerned entity did not take timely or appropriate action on the claimed privacy violation or personal data breach, or there is no response from the personal information controller within fifteen (15) days from receipt of information from the complainant; and

c. the complaint is filed within six (6) months from the occurrence of the claimed privacy violation or personal data breach, or thirty (30) days from the last communiqué with the personal information controller or concerned entity, whichever is earlier.

The failure to comply with the requirements of this Section shall cause the matter to be evaluated as a request to the National Privacy Commission for an advisory opinion, and for the National Privacy Commission to take such further action, as necessary.

The National Privacy Commission may waive any or all of the requirements of this Section, at its discretion, upon good cause shown, or if the complaint involves a serious violation or breach of the Data Privacy Act, taking into account the risk of harm to the affected data subject.30 (Emphasis supplied)

Section 4, Rule II of the NPC Rules of Procedure requires that the Complainant must have first informed, in writing, the concerned entity of the alleged privacy violation for a complaint to be given due course.31

A review of the records shows that Complainant did not inform, in writing, Respondent of the alleged privacy violation prior to the filing of the Complaint. On the CAF, the Complainant answered “no” when asked whether he had contacted Respondent and explained that:

Subject of complaint might remove evidence, other person whose privacy may have been violated stated in a meeting attended by the subject that “we’re preparing another complaint” regarding the possible privacy violation.32

Nevertheless, the last paragraph of Section 4, Rule II of the NPC Rules of Procedure allows the Commission to:

x x x waive any or all of the requirements of this Section, at its discretion, upon good cause shown, or if the complaint involves a serious violation or breach of the Data Privacy Act, taking into account the risk of harm to the affected data subject.33

Here, the Respondent has no longer any opportunity to provide any plain, speedy or adequate remedy to the alleged violation because the subject information was already posted on Facebook. Thus, the Commission exercises its authority to waive the requirement under Section 4, Rule II of the NPC Rules of Procedure and resolve the case on the merits.

II. The processing of the personal and sensitive personal information of Complainant was lawful.

A. Respondent processed personal and sensitive personal information of Complainant.

Section 3 (j), Chapter I of the DPA defines ‘processing’ as “any operation or any set of operations performed upon personal information”.34 This includes posting of photos containing personal data on social media.

Section 3, Chapter I of the DPA defines ‘personal information’ and ‘sensitive personal information’ as follows:

(g) Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.

x x x

(l) Sensitive personal information refers to personal information:

x x x

(2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;

x x x35 (Emphasis supplied)

In this case, Respondent posted on the Union’s private Facebook group Orders from the Office of the Ombudsman for Complainant and three (3) others to file their counter-affidavits containing personal information namely, their full names, designations, and work address from which the identity of Complainant is apparent.36 Further, the posted Orders also contain sensitive personal information, the criminal and administrative proceedings initiated by the Union and the offenses allegedly committed by Complainant.37

Thus, Respondent processed personal and sensitive personal information of Complainant.

B. The processing of personal and sensitive personal information had lawful basis.

For the processing of personal and sensitive personal information to be lawful, it must have a lawful basis under the DPA.38 Section 13 (f), Chapter III of the DPA allows for the processing of sensitive personal information when it is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, to wit:

Section 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

x x x

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.39 (Emphasis supplied)

The Commission has held that the term “necessary” serves to limit the potentially broad concept of “protection of lawful rights and interests of natural or legal persons in court proceedings”.40 In one case, the submission of documents which contained a complainant’s personal data was held necessary for the filing of a criminal complaint and a petition for the issuance of a permanent protection order by therein respondents against the complainant in the case.41 The Commission explained that the DPA is not a means to hinder legitimate proceedings.42

In another case, the Commission found the use of the personal information in the Daily Time Record (DTR) to support a claim of gross ignorance of labor management as valid since it was necessary for the protection of therein respondents’ lawful rights and interests as contemplated by Section 13(f) of the DPA.43

Further, while Section 13 (f) applies to sensitive personal information, the protection of lawful rights and interests of natural or legal persons in court proceedings under Section 13 (f) is considered as legitimate interest pursuant to Section 12 (f) of the DPA.44

Applying the foregoing, Respondent posted the Orders of the Office of the Ombudsman on the Union’s private Facebook group as it was necessary for the protection of the lawful rights and interests of the Union members in the proceedings before the Office of the Ombudsman.45 His act of posting the Orders was necessary to the performance of his duty to convey to the members of the Union that they have already filed the administrative and criminal charges before the Office of the Ombudsman and to inform the members on its status.46 This is essential for the Union members to timely and properly prepare their action in the Office of the Ombudsman.

Therefore, the processing of personal and sensitive personal information had lawful basis under the DPA.

C. The processing of personal and sensitive personal information did not adhere to the general data privacy principle of proportionality.

While the processing of personal and sensitive personal information may be lawful, as it is with a lawful basis under the DPA, such processing must still adhere to the general data privacy principles, such as the principle of proportionality.47 The qualifier “necessary” under Section 13 (f), Chapter III of the DPA cited previously pertains to this principle.48 Section 11 (c) and (d), Chapter III of the DPA provides:

Section 11. General Data Privacy Principles. The processing of personal information shall be allowed, subject to compliance with the requirements of this Act and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.

Personal information must, be:

x x x

(c) Accurate, relevant and, where necessary for purposes for which it is to be used the processing of personal information, kept up to date; inaccurate or incomplete data must be rectified, supplemented, destroyed or their further processing restricted;

(d) Adequate and not excessive in relation to the purposes for which they are collected and processed;

x x x49 (Emphasis supplied)

Section 18 (c), Rule IV of the Implementing Rules and Regulations of the Data Privacy Act of 2012 (Rules) elaborates on this, to wit:

Section 18. Principles of Transparency, Legitimate Purpose and Proportionality. The processing of personal data shall be allowed subject to adherence to the principles of transparency, legitimate purpose, and proportionality.

x x x

c. Proportionality. The processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.50 (Emphasis supplied)

In this case, Respondent posted images of the Orders of the Office of the Ombudsman containing personal and sensitive personal information of Complainant on the private Facebook group of the Union.51 This cannot be considered proportional to his purpose of informing the members of the Union of the fact of filing of the administrative and criminal charges against Complainant before the Office of the Ombudsman and its status.52 It must be emphasized that the posting of the Orders on the Facebook group is not the least intrusive means to achieve the said purpose. Respondent could have informed the members of the Union through a meeting called for such purpose and/or through electronic mail so as to ensure that the Orders will only be disclosed to the persons concerned. Thus, the posting, which is considered as processing under the DPA, is excessive.

Given the foregoing, the processing of personal and sensitive personal information did not adhere to the general data privacy principle of proportionality.

III. Respondent is not liable under Section 25 of the DPA.

With respect to the alleged violations under the DPA, Section 25, Chapter VIII of the DPA provides:

Section 25. Unauthorized Processing of Personal Information and Sensitive Personal Information. – (a) The unauthorized processing of personal information shall be penalized by imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00) shall be imposed on persons who process personal information without the consent of the data subject, or without being authorized under this Act or any existing law.

(b) The unauthorized processing of personal sensitive information shall be penalized by imprisonment ranging from three (3) years to six (6) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Four million pesos (Php4,000,000.00) shall be imposed on persons who process personal information without the consent of the data subject, or without being authorized under this Act or any existing law.53

In determining whether a person is liable under Section 25 for Unauthorized Processing, three (3) elements must be established with substantial evidence:

  1. The perpetrator processed the information of the data subject;
  2. The information processed was personal information or sensitive personal information; and
  3. The processing was done without the consent of the data subject, or without being authorized under the DPA or any existing law.54

The first two (2) elements have been established under the previous paragraphs. Respondent posted on the Union’s private Facebook group Orders from the Office of the Ombudsman for Complainant and three (3) others to file their counter-affidavits containing their full names, designations, work address, and criminal and administrative proceedings initiated by the Union for offenses allegedly committed by Complainant.55

However, the third element was not established in this case. As discussed previously, the processing was authorized under Sections 12 (f) and 13 (f) of the DPA since the posting of the Orders was for the protection of the lawful rights and interests of the Union members in the proceedings before the Office of the Ombudsman.

Thus, Respondent is not liable under Section 25 of the DPA.

IV. Respondent is not liable under Section 31 of the DPA.

As to the alleged Malicious Disclosure, Section 31, Chapter VIII of the DPA states:

Section 31. Malicious Disclosure. – Any personal information controller or personal information processor or any of its officials, employees or agents, who, with malice or in bad faith, discloses unwarranted or false information relative to any personal information or personal sensitive information obtained by him or her, shall be subject to imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).56

For a person to be liable under Section 31 for Malicious Disclosure, the following requisites must be present:

  1. The perpetrator is a personal information controller or personal information processor or any of its officials, employees, or agents;
  2. The perpetrator disclosed personal or sensitive personal information;
  3. The disclosure was with malice or in bad faith; and
  4. The disclosed information relates to unwarranted or false information.57

Section 3(h) of the DPA defines a personal information controller as:

a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.58

In this case, the first two (2) requisites are present as Respondent who possessed the Orders from the Office of the Ombudsman had control over the personal data in the said Orders and, having such control, disclosed the personal data therein by posting the Orders on the Union’s private Facebook group.59

However, the third and fourth requisites are absent in this case. As to the third requisite, malice or bad faith cannot be presumed.60 It is fundamental that those who allege have the burden to prove the allegation with the quantum of evidence prescribed,61 and in administrative proceedings such as this case, through substantial evidence or such evidence that a reasonable mind might accept as adequate to justify a conclusion.62

Complainant failed to allege and prove through substantial evidence that Respondent acted with malice or bad faith in posting the Orders of the Ombudsman on the Union’s private Facebook group. The mere act of posting does not substantially show bad faith or malice. Further, Respondent had a lawful basis for disclosing the information pertaining to Complainant, that is, to protect the lawful rights and interests of the Union members in the administrative and criminal proceedings before the Office of the Ombudsman.63

As to the fourth requisite, the disclosed information does not relate to unwarranted or false information, as the Orders of the Office of the Ombudsman pertain to actual orders for the Complainant in relation to administrative and criminal cases filed against him.

Hence, absent the third and fourth requisites, Respondent cannot be deemed to have violated Section 31 of the DPA on Malicious Disclosure.

V. Respondent is not liable under Section 32 of the DPA.

With regard to the alleged Unauthorized Disclosure, Section 32, Chapter VIII of the DPA provides:

Section 32. Unauthorized Disclosure. – (a) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).

(b) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party sensitive personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from three (3) years to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00).64

For the determination of liability under Section 32 for Unauthorized Disclosure, the following requisites must concur:

  1. The perpetrator is a personal information controller or personal information processor;
  2. The perpetrator disclosed information;
  3. The information relates to personal or sensitive personal information;
  4. The perpetrator disclosed the personal or sensitive personal information to a third party;
  5. The disclosure was without any of the lawful basis for processing, consent or otherwise, under Sections 12 and 13 of the DPA; and
  6. The disclosure is neither malicious nor done in bad faith and the information disclosed is not unwarranted or false information.65

Unauthorized Disclosure under Section 32 requires that personal information or sensitive personal information is disclosed to a third party without any of the lawful criteria under Sections 12 and 13 of the DPA.66

In this case, the fourth and fifth requisites are absent. As to the fourth requisite, Respondent did not disclose personal data to third parties. He only disclosed the Orders of the Office of the Ombudsman to members of the Union who were parties in the cases subject of the Orders as complainants.67

The fifth requisite is also absent since as discussed previously, the Respondent’s disclosure of the Orders of the Office of the Ombudsman pertaining to Complainant to members of the Union was with lawful basis under Sections 12 (f) and 13 (f) of the DPA. The post was intended to protect the lawful rights and interests of the Union members in the proceedings before the Office of the Ombudsman.68

Thus, absent the fourth and fifth requisites, Respondent cannot be liable for Unauthorized Disclosure under Section 32 of the DPA.

Notwithstanding the foregoing, Respondent’s non-adherence to the general data privacy principle of proportionality in the processing of Complainant’s personal and sensitive personal information warrants the award of nominal damages to Complainant.

Section 37, Chapter VIII of the DPA provides for restitution for any aggrieved party under the Civil Code.69 Article 2221 of the New Civil Code is clear that nominal damages are adjudicated in order that a right of the plaintiff, which has been violated or invaded by the defendant, may be vindicated or recognized.70 Further, the Commission has ruled that the award of nominal damages to a complainant was warranted following a finding that the respondent therein failed to observe the general data privacy principle of proportionality.71

The DPA requires that the processing of personal information adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality.72 In this case, Respondent failed to adhere to the principle of proportionality, as his act of posting the Orders on the Union’s private Facebook group cannot be considered proportional to his purpose of informing the members of the status of the administrative and criminal cases against Complainant before the Office of the Ombudsman.

Thus, since Respondent failed to adhere to the general data privacy principle of proportionality under the DPA, this Commission awards nominal damages in the amount of fifteen thousand pesos (P15,000.00) to Complainant.

WHEREFORE, premises considered, this Commission:

  1. DISMISSES the instant Complaint filed by VMJR against EBO for lack of merit;

  2. AWARDS nominal damages in the amount of fifteen thousand pesos (P15,000.00) to the Complainant for Respondent’s non-adherence to the general data privacy principle of proportionality under Section 11 of the DPA; and

  3. ORDERS the submission of proof of compliance with the abovementioned award within thirty (30) days from receipt of this Decision.

This is without prejudice to the filing of appropriate civil, criminal or administrative cases against the Respondent EBO before any other forum or tribunal, if any.

SO ORDERED.

Quezon City, Philippines. 08 May 2025.

JOSE AMELITO S. BELARMINO II Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

VMJR Complainant

EBO Respondent

CID, END, GRU National Privacy Commission

Footnotes

  1. Complaints-Assisted Form, 11 October 2019, at 2-3, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  2. Id. at 3. ↩

  3. Id. at 4. ↩

  4. Id. at 2-3. ↩

  5. Id. ↩

  6. Id. at 6. ↩

  7. Order to Confer for Discovery, 12 November 2019, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  8. Attendance Sheet for Discovery Conference, 04 December 2019, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  9. Counter-Affidavit, 04 December 2019, at 1, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  10. Id. ↩

  11. Id. ↩

  12. Counter-Affidavit, 04 December 2019, at 2, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  13. Id. ↩

  14. Id. ↩

  15. Id. ↩

  16. People v. Monton, G.R. No. L-16772, (November 30, 1962). ↩

  17. Counter-Affidavit, 04 December 2019, at 2, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  18. Id. at 4. ↩

  19. Id. ↩

  20. Counter-Affidavit, 04 December 2019, at 5, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  21. Order, 04 December 2019, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  22. Almuete v. Andres, G.R. No. 122276, (November 20, 2001). ↩

  23. Reply, 02 January 2020, at 1, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  24. Id. ↩

  25. Id. at 2. ↩

  26. Id. ↩

  27. Vivares v. St. Theresa’s College, G.R. No. 202666, (September 29, 2014). ↩

  28. Reply, 02 January 2020, at 2, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  29. Rejoinder-Affidavit, 20 January 2020, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  30. National Privacy Commission, Rules of Procedure of the National Privacy Commission [NPC Rules of Procedure], Section 4, Rule II (Dec. 15, 2016). ↩

  31. Id. ↩

  32. Complaints-Assisted Form, 11 October 2019, at 2-3, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  33. NPC Rules of Procedure, Section 4, Rule II. ↩

  34. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, Section 3 (j), Chapter I (2012). ↩

  35. Id. Section 3, Chapter I. ↩

  36. Complaints-Assisted Form, 11 October 2019, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  37. Id. ↩

  38. ARG v. AMP, NPC 22-257 (NPC 2024). ↩

  39. Data Privacy Act of 2012, Section 13 (f), Chapter III. ↩

  40. AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2024). ↩

  41. Id. ↩

  42. Id. ↩

  43. KRL v. Trinity University of Asia, AA, MC, NCB, RG GV, GCT, RR, MR, PB, CID Case No. 17-K-003 (NPC 2019). ↩

  44. AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2024). ↩

  45. Counter-Affidavit, 04 December 2019, at 2, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  46. Id. ↩

  47. Data Privacy Act of 2012, Section 11, Chapter III. ↩

  48. JPV v. Souley MD Services, Inc., NPC 22-201 (NPC 2024). ↩

  49. Data Privacy Act of 2012, Section 11 (c) (d), Chapter III. ↩

  50. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, Section 18 (c), Rule IV (2012). ↩

  51. Complaints-Assisted Form, 11 October 2019, at 3, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  52. Counter-Affidavit, 04 December 2019, at 2, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  53. Data Privacy Act of 2012, Section 25, Chapter VIII. ↩

  54. ARG v. AMP, NPC 22-257 (NPC 2024). ↩

  55. Complaints-Assisted Form, 11 October 2019, at 3, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  56. Data Privacy Act of 2012, Section 31, Chapter VIII. ↩

  57. JCB v. FRL, NPC 21-031 (NPC 2022). ↩

  58. Data Privacy Act of 2012, Section 3, Chapter I. ↩

  59. Complaints-Assisted Form, 11 October 2019, at 3, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  60. JCB v. FRL, NPC 21-031 (NPC 2022). ↩

  61. Id. ↩

  62. 2019 AMENDMENTS TO THE 1989 REVISED RULES ON EVIDENCE, Section 6, Rule 133. ↩

  63. Counter-Affidavit, 04 December 2019, at 2, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  64. Data Privacy Act of 2012, Section 32, Chapter VIII. ↩

  65. JCB v. FRL, NPC 21-031 (NPC 2022). ↩

  66. MAF v. Shopee Philippines, Inc., NPC 21-167 (NPC 2022). ↩

  67. Complaints-Assisted Form, 11 October 2019, at 3, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  68. Counter-Affidavit, 04 December 2019, at 2, in VMJR v. EBO, NPC 19-1438 (NPC 2025). ↩

  69. Data Privacy Act of 2012, Section 37, Chapter VIII. ↩

  70. An Act To Ordain And Institute The Civil Code Of The Philippines [CIVIL CODE OF THE PHILIPPINES], Republic Act No. 386, Article 2221 (1949). ↩

  71. MNLCI v. PXXX Corporation, et al., NPC 19-528 (NPC 2020). ↩

  72. Data Privacy Act of 2012, Section 11, Chapter III. ↩

Backlinks

  • No backlinks found