Decision Text
SCM,
Complainant,
-versus-
XXXX,
Respondent.
x----------------------------------------------------x
DECISION
NAGA, D.P.C.:
This Decision refers to the Complaint and Application for Temporary Ban on the processing of personal information filed by SCM (Complainant) against XXXX (Respondent) for an alleged violation of the Data Privacy Act of 2012 (DPA).
Facts
On 30 May 2019, Complainant filed a complaint with an application for temporary ban on the processing of her personal information with the Commission stating, among others, that the Respondent had been compelling her to pay her loan despite the prolongation agreement between them, viz:
“Sinisingil parin (sic) ako kahit naka-5 prolongation na ako sa kanila which is dapat bayad na ako. Diko (sic) din alam na may 700 fee if mag avail ng prolongation”1
Complainant further alleged that the Respondent repeatedly called and texted her to collect the loan even during office hours. This caused her depression because the Respondent forced her to pay despite telling them that she does not have enough money.
On 26 October 2019, Respondent filed its consolidated responsive comment/opposition praying for the dismissal of the Complaint because of the following grounds:
-
Complainant does not have the legal standing to file the complaint because the transaction between them did not push through as the application of the Complainant was denied by the Respondent; and
-
There were several procedural infirmities in the Complaint filed by the Complainant, which are contrary to NPC Circular No. 16-04 otherwise known as the Rules of Procedures of the National Privacy Commission, such as: Complaint was not notarized, Complainant failed to exhaust available remedies prior to filing the Complaint, Complaint does not pertain to any violation of Complainant’s data privacy rights, and Complaint was not substantiated by proof.
Issue
Whether there was a violation of the Complainant’s data privacy rights.
Discussion
The instant Complaint lacks merit.
As ruled by this Commission in several decided cases and following established jurisprudence on the matter, it is the Complainant that has the burden of proving his or her allegations in an administrative case. As stated by the Supreme Court, “The basic rule is that mere allegation is not evidence and is not equivalent to proof.”2
The Complainant failed to present any evidence to establish the contractual relationship between the parties herein. On the other hand, the Respondent alleged and presented proof in their system that the Complainant’s loan application was rejected by them.3
Further, assuming the establishment of the contractual relationship between the parties, the Complaint would still be defeated due to its failure to state a cause of action that is anchored on any of the provisions of the DPA. A liberal reading of the Complaint would reveal that such allegations would only constitute unfair debt collection, which is outside of this Commission’s jurisdiction.4
The allegation of repeated calls and texts committed by the Respondent must be clearly established by the Complainant as violations of Sections 11, 12, or 13 of the DPA in order to be considered unlawful processing. Evidence of the repeated calls and text should also be presented to substantiate the allegations in the Complaint.
In sum, the Complaint and the Application for Temporary Ban on the processing of personal information should be dismissed for lack of merit.
On another matter, this Commission noticed the phrasing of the Respondent’s Privacy Policy as stated in its consolidated comment/opposition and as part of its attachments, viz:
- User Data Processing
a. Without limitation to the foregoing, User data may be processed by OLP among others for the following purposes:
xxx5
Respondent herein is sternly reminded by this Commission to abide by the General Data Privacy Principles, specifically the principle of proportionality. As provided in Section 11 (c) of the DPA:
SEC. 11. General Data Privacy Principles. — The processing of personal information shall be allowed, subject to compliance with the requirements of this Act and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.
Personal information must, be:
(d) Adequate and not excessive in relation to the purposes for which they are collected and processed;
In other words, processing of personal data cannot be declared in any privacy policy or in a contract to be without limitation because the DPA itself provides the processing should only be adequate and not excessive to the Personal Information Controller’s purpose.
WHEREFORE, all premises considered, this Commission resolves to DISMISS the instant Complaint filed by SCM against Respondent XXXX for lack of merit.
Respondent, XXXX is STERNLY REMINDED to comply with the general data privacy principle of proportionality as provided by the Data Privacy Act of 2012.
SO ORDERED.
Pasay City, Philippines. 19 November 2020.
JOHN HENRY D. NAGA Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
Copy furnished:
SCM Complainant
CLO Counsel for Respondent
COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission