Decision Text
FAT,
Complainant,
-versus-
XXX,
Respondent.
x--------------------------------------------x
NAGA, D.P.C.:
Before this Commission is a Complaint by FAT (Complainant) against XXX (Respondent) for unauthorized disclosure of Complainant’s mobile number just a day after the scheduled turnover of the Complainant’s condominium unit.
Facts
On 27 January 2019 at 4:07 p.m., Complainant filed a complaint to the Commission, viz:
“Right after the day of my scheduled turnover of my unit with XXXX, a certain ‘X’ of GLC, contacted me asking if I was interested to rent out my condominium unit. X mentioned that he got my number form a broker named ‘X’. I knew this was a breach because XXX have their own leasing services and I would expect a formal email from their official channels to offer their leasing services. No one from my family members would give out my number to an agent without my consent (only one of my sisters and my immediate manager at work knew that I was already scheduled for turnover last Saturday. Both of them wouldn’t give out my number to others without my consent). My agent would not also disclose my number since she also gets commission from referring lessees to her clients’ units to be rented out. From the Facebook group of ASS resident, numerous members also complained that a certain Richie contacted them right after their unit was turned over. It could only be someone from the turnover team because that ‘X’ or ‘X’ immediately contacts whoever has their unit been turned over.”
At the Discovery Conference set on 20 April 2019,1 both the Complainant and Respondent failed to appear. Hence, the Discovery Conference was reset on 02 July 2019.2
During the second Discovery Conference on 02 July 2019, only the Complainant appeared. He manifested that he was willing to undergo the mediation process to settle the case amicably. However, considering that it was the second time that Respondent failed to appear, the latter was ordered to file its Responsive Comment, and Complainant to file his Reply within the period provided after receipt of the Responsive Comment.3
On 24 July 2019, Respondent, through its counsel, the Law Firm of HNSO, filed its Entry of Appearance with a request for a copy of the Complaint. Respondent claimed that it did not receive any order or notice prior to the Order dated 02 July 2019.
On 25 July 2019, Respondent, through counsel, filed a Motion For Additional Time To Rile A Responsive Comment in view of the insufficient time to draft a Comment and citing other equally important and crucial professional work of Respondent’s counsel.
On 1 August 2019, Respondent filed its Responsive Comment. The Respondent contended that the Complaint should be dismissed outright for being filed prematurely and for lack of sufficient information to substantiate the allegations in the Complaint pursuant to Section 12 of the NPC Circular 16-04.4 It further stated that Complainant notified them of the Complaint at 6:15 p.m. of 27 January 2019, which fell on a Sunday, a day before he filed the same with the Commission on 28 January 2019. Respondent argued that there was no reasonable time and opportunity for them to take the appropriate action in response to Complainant’s allegation of unauthorized disclosure of his personal mobile number.5
Respondent further asserted that Complainant did not give any material information which can substantiate his allegation that someone from Respondent disclosed his mobile number to a third party.6 Respondent stressed that it is not connected and has not transacted with a company named GLC. Respondent is also not knowledgeable of the person named X who contacted the Complainant. Despite the very limited information provided by Complainant regarding the suspected unauthorized disclosure of his personal mobile number, Respondent conducted its internal investigation and interviewed its employees who are part of the sales and turnover team. It was further alleged by Respondent that the members of the sales and turnover team stated they did not know an X from GLC and that they did not disclose any personal data of clients to third parties. Respondent also claimed that the investigation shows no sign of unauthorized access or disclosure of client’s personal data.7
It was manifested by Respondent that it has been observing the General Data Privacy Principles under the Data Privacy Act of 2012.8 It instils to its employees this obligation of confidentiality and respect for data privacy rights of clients when handling personal data as provided in Respondent’s Employee Privacy Policy Handbook and the Data Privacy Policy. Respondent conducts data privacy awareness seminars for its employees and regularly sends them informative emails about their obligations under the DPA.9
No Reply was filed by the Complainant. Hence, with no other pleadings to be submitted, the investigation of the Complaint is terminated.
Issue
-
Whether or not Respondent was given an opportunity to address Complainant’s complaint, pursuant to Section 4 of NPC Circular No. 16-04 on Exhaustion of Remedies.
-
Whether or not Respondent committed unauthorized disclosure of Complainant’s mobile number.
Discussion
The Complaint lacks merit.
Respondent was not given an opportunity to address the complaint
As shown in the records, the incident occurred on 27 January 2019 at 4:07 p.m. The following day, the complaint was filed at 4:55 p.m. Respondent acknowledges the receipt of Complainant’s concern on the day of the incident. However, the Complaint was filed with this Commission the very next day.
Section 4 of the NPC Circular 16-04 requires that Personal Information Controller (PIC) be afforded the opportunity and reasonable time to address the privacy concern in order to avoid indiscriminate filing of complaints; viz:
SECTION 4. Exhaustion of remedies. – No complaint shall be entertained unless:
a. the complainant has informed, in writing, the personal information controller or concerned entity of the privacy violation or personal data breach to allow for appropriate action on the same;
b. the personal information controller or concerned entity did not take timely or appropriate action on the claimed privacy violation or personal data breach, or there is no response from the personal information controller within fifteen (15) days from receipt of information from the complaint; and
c. the complaint is filed within six (6) months from the occurrence of the claimed privacy violation or personal data breach, or thirty (30) days from the last communiqué with the personal information controller or concerned entity, whichever is earlier.
In the present case, Respondent was clearly deprived of the opportunity to address the concern as the Complaint was filed immediately a day after it was brought to the attention of Respondent. Complainant did not give Respondent reasonable time to address and act on the alleged privacy concern. Complainant immediately brought his concern to this Commission without first ventilating all his concerns with the PIC.
The Commission may waive any or all of the requirements of abovementioned provision in NPC Circular 16-04, at its discretion, upon good cause shown, or if the complaint involves a serious violation or breach of the Data Privacy Act, taking into account the risk of harm to the affected data subject.10 However, no justifiable reason or substantial proof was presented by Complainant to persuade this Commission to warrant its waiver.
Nevertheless, in the interest of justice, this Commission deems it wise to still rule on the substantial issue raised by the Complainant herein, specifically whether the Respondent committed a data privacy violation.
Respondent did not commit unauthorized disclosure
Complainant claims that his personal mobile number was disclosed without his consent based on the speculation that considering the timing of the incident, it was from the Respondent’s turnover team who disclosed his personal information. It could not be one of his sisters, his immediate manager, nor his agent as he was certain that they will not disclose his personal information without his consent.
However, no proof was submitted to substantiate this claim. Complainant failed to show a reasonable connection between X, the supposed agent from GLC, and the Respondent. Likewise, no evidence was presented that shows a connection between GLC and Respondent. Absent any evidence to support the Complainant’s claim, allegations, conjectures and suppositions in the complaint, Respondent cannot be found to have committed unauthorized disclosure.
As provided by Section 22 of NPC Circular No. 16-04, “the Decision of the Commission shall adjudicate the issues raised in the complaint on the basis of all the evidence presented and its own consideration of the law.”
As the Supreme Court held in Government Service Insurance System v. Prudential Guarantee, “it is basic in the rule of evidence that bare allegations, unsubstantiated by evidence, are not equivalent to proof. In short, mere allegations are not evidence.”11
Further, as held by the Supreme Court in the case of Wong v. Wong, “The rule is well-settled that he who alleges a fact has the burden of proving it and a mere allegation is not evidence. Thus, his self-serving assertion cannot be given credence.”12
Hence, bearing only allegations without any corresponding pieces of evidence to support Complainant’s claim that Respondent disclosed his personal information which gave X the ability to contact him cannot merit a favorable decision from this Commission.
In fine, this Commission sustains Respondent’s contention that the instant Complaint should be dismissed outright for being filed prematurely and for lack of sufficient information to substantiate the allegations in the complaint as provided by Section 12 of NPC Circular No. 16-04,13 viz:
SECTION 12. Outright Dismissal. – The Commission may dismiss outright any complaint on the following grounds:
a. The complainant did not give the respondent an opportunity to address the complaint, unless failure to do so is justified;
b. The complaint is not a violation of the Data Privacy Act or does not involve a privacy violation or personal data breach;
c. The complaint is filed beyond the period for filing; or
d. There is insufficient information to substantiate the allegations in the complaint or the parties cannot be identified or traced.
WHEREFORE, all premises considered, the Complaint is hereby DISMISSED for lack of merit.
This is without prejudice to the filing of appropriate civil, criminal or administrative cases against Respondent before any other forum or tribunal, if any.
SO ORDERED.
Pasay City, Philippines; 17 December 2020.
JOHN HENRY D. NAGA
Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO
Privacy Commissioner
LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner
Copy furnished:
FAT
Complainant
HNSO
Counsel for Respondent
COMPLAINTS AND INVESTIGATION DIVISION
ENFORCEMENT DIVISION
GENERAL RECORDS UNIT
National Privacy Commission
Footnotes
-
Order dated 26 March 2019. ↩
-
Order dated 30 April 2019. ↩
-
Order dated 02 July 2019. ↩
-
Responsive Comment, page 1 (1). ↩
-
Id., page 2 (3). ↩
-
Id., page 3 (7). ↩
-
Id., page 4 (8). ↩
-
Id., page 4 (10). ↩
-
Id., page 4 (11). ↩
-
Section 4, paragraph 2 of NPC Circular No. 16-04. ↩
-
G.R. No. 165585, 20 November 2013, citing Real v. Belo, 542 Phil. 109 (2007). ↩
-
G.R. No. 180364, 03 December 2014. ↩
-
Responsive Comment, page 1 (1). ↩