NPC Issuance Wiki

CID 18-D-012: JBD v. JI and VVV

Issued Decision

Decision Text

JBD,

Complainant,

-versus-

JI and VVV,

Respondent.

x----------------------------------------------------x

DECISION

AGUIRRE, D.P.C.:

Before this Commission is a Complaint filed by Complainant JBD against the respondents JI and VVV for an alleged violation of Republic Act No. 10173 (“Data Privacy Act of 2012” or “DPA”).

Facts

The Commission has previously summarized the factual antecedents in this case through an Order dated 21 May 2020, thus:

Complainant here alleges that his Social Security System (“SSS”) Employment and Payment history were illegally obtained by Respondent JI, his common law spouse, and her lawyers. He learned about this when he received a Position Paper against him with attached print-outs from the SSS. These contained his birthdate and SSS number, as well as his employment history and actual premiums.1 This Position Paper was filed with the Professional Regulation Commission (“PRC”) in connection with an ongoing case involving him and Respondent JI.

Complainant initially filed a complaint before the SSS. Upon inquiring with SSS, he was told by its Fraud and Legal Department that this data was not processed within the vicinity of the agency, and that an unauthorized individual accessed the SSS data portal where his work history and premiums were collected.2

Upon the filing of this Complaint with the National Privacy Commission, the parties were called for a Discovery Conference. Complainant and Respondent VVV were present, but Respondent JI failed to appear.

During the Discovery Conference, the parties manifested that they were not willing to enter into an amicable settlement. They further manifested that there is no need to secure evidence from each other to further their case.

Hence, an Order was issued by the Commission on 12 July 2018 directing Respondents to file their responsive Comment until 22 July 2018. Complainant was in turn given ten (10) days from the receipt of the Comment to file his Reply.

In the same Order, the Commission directed the Complainant to submit additional evidence pursuant to Section 21 of NPC Circular 16-04 (“NPC Rules of Procedure” or “Rules”),3 thus:

In the interest of giving due course to Complainant’s claims, the Commission resolves to order Complainant to provide the following:

1.) A Certified True Copy of the Position Paper containing the subject SSS documents filed with the PRC; and 2.) Documents to substantiate the allegations made in Paragraph 10 of the Verified Reply which refers to the findings of the SSS Fraud and Legal Department.

The foregoing is pursuant to NPC Circular 16-04 which provides that the Commission may, on the basis of its review of the evidence, order the conduct of a clarificatory hearing if in its discretion, additional information is needed to make a Decision.

WHEREFORE, all the above premises considered, the Commission hereby ORDERS Complainant JBD to submit the documents enumerated above within fifteen (15) days from receipt of this Order. The failure of Complainant to submit such documents shall cause this case to be submitted for resolution.

In a Manifestation and Motion dated 29 July 2020, Respondent VVV requested the Commission to order the Complainant to furnish him a copy of the Verified Reply and allow him to file a Rejoinder. Respondent VVV also moved that his other prayers be granted, namely, to (a) note their manifestation; (b) hold in abeyance any clarificatory hearing pending the consideration of his Manifestation and Motion; and (c) note his counsel’s Entry of Appearance.4

On 04 August 2020, Complainant filed a Motion for Extension to Comply with the Commission’s Order dated 21 May 2020, citing the lockdown of the Legal Division of Professional Regulation Commission (PRC) from 20 July 2020 to 27 July 2020. Complainant specifically requested that he be given until 02 September 2020 to comply with the said Order.5

The Commission issued a Resolution dated 06 August 2020 stating thus:

WHEREFORE, premises considered, Complainant’s Motion for Extension to Comply with the Commission’s Order until 02 September 2020 is hereby GRANTED. Complainant is ORDERED to furnish the Respondents a copy his Verified Reply within ten (10) days from receipt of this Resolution.

Respondent VVV’s Motion to Order the Complainant to furnish him a copy of the Verified Reply and his prayers for the Commission to (a) Note his Manifestation; (b) Hold in abeyance any clarificatory hearing pending the consideration of his Manifestation, and (c) Note his counsel’s entry of appearance, are hereby GRANTED. Respondent is also ORDERED to submit his Rejoinder within ten (10) days from receipt of the Verified Reply.

On 25 November 2020, Complainant submitted a Certified True Copy from the PRC of the subject Position Paper which included the printouts of his SSS Employment History and actual premiums.

On 28 November 2020, Complainant forwarded his Reply to Respondent VVV via email. Complainant manifested that Respondent JI has not submitted a Responsive Comment, hence no Reply was prepared for her.

On 11 January 2021, the Commission received the Rejoinder from Respondent VVV.

On 12 January 2021, Complainant submitted to the Commission a letter from the Special Investigation Department, Investigation and Research Section.

The case is now submitted for the Commission’s Resolution.

Issue

The issues in this case are follows:

i. Whether procedural due process was observed in relation to Respondent JI; and

ii. Whether Respondents committed unauthorized processing of Complainant’s SSS employment history and actual premiums.

Discussion

Procedural Due Process Was Observed in relation to Respondent JI.

The Commission notes that Respondent JI has not submitted any Responsive Comment to the Complaint, nor did she appear at the Discovery Conference. In that Conference, Respondent VVV manifested that he was not representing Respondent JI in this case.

According to a Certification by the courier utilized by the Commission, the Order to Submit a Responsive Comment was mailed to Respondent JI via LBC Express with a tracking number 126767817685 and consigned to JI. The address, based on the Complaint-Affidavit and the Order to Confer for Discovery, was at Laguna. The same Certification provides that on 24 July 2018, said shipment was “delivered but refused by the consignee.”6 On 11 August 2018, the shipment was returned to the origin branch and released to the representative of the shipper on 29 August 2018.7

Respondent JI’s refusal to accept the Order mailed by the Commission and subsequent failure to submit a Responsive Comment cannot deprive the Commission of jurisdiction over her person. The NPC Rules of Procedure8 provides thus:

Section 17. Failure to Submit Comment. – If the respondent does not file a Comment, the investigating officer may consider the complaint as submitted for resolution. The respondent shall, in any event, have access to the evidence on record.

The Commission is likewise bound to dispose of cases according to its Rules of Procedure. Section 22 of its Rules provides thus:

Section 22. Rendition of decision. – The Decision of the Commission shall adjudicate the issues raised in the complaint on the basis of all the evidence presented and its own consideration of the law…

Respondent JI was given multiple opportunities to present her position against the Complaint. The Commission emphasizes that any party to a Complaint lodged in the Commission cannot refuse to accept any of its lawful Orders that were properly served to the correct address.

Respondent JI Committed Unauthorized Processing Under Section 25 of the DPA.

In his Complaint, Complainant argues that his SSS personal information was disclosed by Respondent VVV to PRC without his consent and for unauthorized purposes. He asserts that the contents of his SSS personal data were not authorized and authenticated by the organization since the annexes are pictures only from a personal computer of a certain individual who has access to the SSS data portal. He also alleges that he gave no consent for Respondents to acquire the sensitive personal information they presented as evidence in the PRC case.9 He prays for moral damages for the anxiety, sleepless nights, and extreme emotional pain that this caused.10

The Complainant’s allegations pertain to the act of Unauthorized Processing under Section 25 of the Data Privacy Act. This Section provides thus:

SEC. 25. Unauthorized Processing of Personal Information and Sensitive Personal Information. – (a) The unauthorized processing of personal information shall be penalized by imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00) shall be imposed on persons who process personal information without the consent of the data subject, or without being authorized under this Act or any existing law.

(b) The unauthorized processing of personal sensitive information shall be penalized by imprisonment ranging from three (3) years to six (6) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Four million pesos (Php4,000,000.00) shall be imposed on persons who process personal information without the consent of the data subject, or without being authorized under this Act or any existing law.

As provided above, three (3) elements must be established with substantial evidence in determining whether a violation of Section 25 of the Data Privacy Act occurred:

  1. The accused processed the information of the data subject;

  2. The information processed was personal information and sensitive personal information;

  3. That the processing was done without the consent of the data subject, or without being authorized under this act or any existing law.11

A. The accused processed the personal information and sensitive personal information of the data subject.

In the Certified True Copy of the subject Position Paper submitted by Complainant JBD, printouts of his SSS Employment History and Actual Premiums are attached as Annex 2-A and Annex 2-B.12 In the print-out of the SSS Employment History, Complainant’s full name, date of birth, and social security number are visible. There is also a list of all his previous employers, reporting dates, and employment dates.

The DPA defines personal information as, “any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.”13

Clearly, the Complainant’s full name coupled with his employment history can reasonably and directly ascertain his identity. The Complainant’s age, deduced from his displayed date of birth, and his social security number are considered sensitive personal information under the enumeration provided in the DPA.14

In the Complaints-Assisted Form duly filled out by Complainant, he stated that he found out about the incident when he received the Position Paper last 02 March 2018. He proceeds to state that:

I have given no consent and authorization to the respondents in order for them to processed (sic) acquire these sensitive personal information presented to the Medical Technology Board as evidence. It clearly shows that they violated the Data Privacy Act of 2012- my right to secure sensitive personal information.

The DPA enumerates a series of processing activities to emphasize that it covers the different stages of the data lifecycle. Processing is defined by the DPA as, “any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.”15

The usage of Complainant’s SSS Employment History and Actual Premiums as an attachment to a Position Paper falls within the definition of processing under the DPA.

The processing was committed by Respondent JI, but not by Respondent VVV.

In the last page of the subject Verified Position Paper is a Verification that states:

VERIFICATION

I, JI, of legal age and Filipino, after having been duly sworn to in accordance with law, depose and state THAT:

I am the respondent in the above entitled case; I have caused the preparation of the foregoing document and I have read the same and the contents of which are true and correct of my own knowledge and / or on the basis of authentic documents.

AFFIANT SAYETH NAUGHT.

In witness whereof, I hereunto affix my signature this 2nd day of March 2018.16

(sgd) JI Affiant

It is clear from the foregoing that it is Respondent JI who caused the preparation of the Position Paper and determined what attachments to include to substantiate her allegations. She is the person who is considered to have processed the personal information of Complainant in this case.

The Commission likewise notes Respondent VVV’s assertion in the Rejoinder, which states:

  1. Respondent Atty. VVV vehemently deny (sic) any participation with regard to the subject matter being raised in the case at bar. Respondent has no means do not personally know the complainant.

xxx

  1. We likewise humbly beseech this Honorable Commission that respondent Atty. VVV is not the one who caused the preparation of the pleading wherein the subject matter of this case was stemmed. Attached herewith as Annex “1” is the Verification signed by respondent JBD.

  2. It should be noted that a pleading is verified by an affidavit that the affiant has read the pleading that he/she caused the preparation of the said pleading and that the allegations therein are true and correct of his/her personal knowledge or based on authentic records. Hence, it was respondent JBD who caused the preparation of the pleading which is the subject matter of the present complaint.

  3. From the said discussion, the only part of respondent Atty. VVV is to be the substitute lawyer of respondent JBD and merely assist her as a normal lawyer would do. Nothing therein involves or constitutes any violation of the Data Privacy Act on the part of respondent Atty. VVV.

The Commission finds merit in this argument by Respondent VVV. Respondent VVV merely acted under the instructions of Respondent JI as her lawyer for the PRC case. Given that it was Respondent JI who declared under oath that she is the author of the Position Paper, she was the one who committed the act of processing in this case and not Respondent VVV.

Considering that the first two (2) elements do not apply to Respondent VVV, the Complaint against him fails for a lack of cause of action.

B. The processing was done without the consent of the data subject, or without being authorized under the DPA or any existing law.

The Complainant asserts that he has “given no consent and authorization to the respondents in order for them to processed (sic) acquire these sensitive personal information presented to the Medical Technology Board as evidence.”17 Consent is defined under the DPA as, “any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so.”18

The fact that Complainant did not give his consent is not disputed by Respondent VVV, and Respondent JI did not participate nor did she submit anything to the contrary. The DPA also provides for lawful criteria other than consent to process personal information. For the subject personal and sensitive personal information in this case, the lawful criteria are found under Section 1219 and 1320 of the law.

Respondent VVV particularly asserts that the attachment of Complainant’s SSS Employment History and Actual Claims is justified under the lawful criteria of Section 13 (f) of the DPA which allows the processing if such “concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.”

In the Rejoinder, Respondent VVV asserts thus:

  1. We humbly beseech this Honorable Commission to consider that there is a case filed against respondent JBD before the Professional Regulation Commission by the complainant for Cross Dishonorable and/or Unethical Conduct. The filing of this complaint is necessary for the protection of rights and interests of respondent JBD as she was being indicted in an administrative case. Note that the complainant claimed in his complainant (sic) before the Professional Regulation Commission that he was employed to certain companies, this is part of the complaint and being raised against respondent JBD in the said case. And this was provided by respondent JBD before the Professional Regulation Commission which is a government office. Hence, the following circumstances fall under the exception provided in Section 13(f) of RA 10173.

The Commission cannot agree with this reasoning for the benefit of either Respondent VVV or Respondent JI. While it will not go into the merits of the case in the PRC, the Commission looks into the manner the personal information was processed for its inclusion in the Position Paper.

In this case, Complainant was able to submit to the Commission a letter from the SSS Special Investigation Department – Investigation and Research Section with the following findings:

Initial verification from the SSS Web Inquiry (WINS) of your Actual Premiums and Employment History shows the same information provided in the questioned documents, allegedly presented by JI and VVV before the PRC.

However, the questioned documents are not certified by the PRC as the same copies as those submitted by JI and VVV. Per your assertions, these are the documents provided by JI and VVV.

Although observed to be different from SSS generated and issued printouts on its face and seems irregular, we are precluded from concluding on the matter, considering that there was no investigation conducted by this Office, as you were previously advised to file your complaint and present the questioned documents instead before the NPC, which has the proper jurisdiction on the matter.

Meantime, a careful examination of the questioned documents reveals the following, showing difference with the SSS officially issued printouts:

  1. Side details are not shown as they are not fit inside the grid of the device used;
  2. The font size is bigger;
  3. It has shady color; and
  4. Presence of the mouse cursor in one of the documents.21

The SSS itself recognized the irregularity of the subject printouts, which puts into question the manner by which these were obtained. Underhanded or irregular processing of personal information is not what the DPA contemplates in Section 13(f).

The NPC has already ruled in a previous case that the processing of personal and sensitive personal information for the establishment or defense of legal claims under Section 13(f) must still be within the limits of the law, thus:

The DPA should not be seen as curtailing the practice of law in litigation. Considering that it is almost impossible for Congress to determine beforehand what specific data is “necessary” or may or may not be collected by lawyers for purposes of building a case, applying the qualifier “necessary” to the second instance in Section 13(f) therefore, serves to limit the potentially broad concept of “establishment of legal claims” consistent with the general principles of legitimate purpose and proportionality.

As regards legitimate purpose, the Implementing Rules and Regulations (IRR) of the Data Privacy Act provides that the processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy.22 This means that the processing done for the establishment of a legal claim should not in any manner be outside the limitations provided by law.23

It has been clearly established that Respondent JI processed the personal data of Complainant when she caused the inclusion of Complainant’s SSS Employment History and Actual Premiums in her Verified Position Paper for an ongoing PRC case. It is undisputed that this was done without the consent of Complainant, and Respondent JI cannot rely on Section 13(f) of the DPA as her lawful criterion to process the information from the SSS because such provision contemplates processing activities that are still within the limits of the law. Such is not the case here, considering the findings of the SSS Special Investigation Department – Investigation and Research Section.

Absent any lawful criteria for the processing of Complainant’s personal information in this case, Respondent JI’s act of using Complainant’s SSS Employment History and Actual Premiums for her Verified Position Paper in a pending PRC case constitutes Unauthorized Processing of Sensitive Personal Information under Section 25 of the DPA.

WHEREFORE, all these premises considered, this Commission hereby:

  1. FINDS that Respondent JI has violated Section 25 of the Data Privacy Act; and

  2. FORWARDS this Decision and a copy of the pertinent case records to the Secretary of Justice, recommending the prosecution of the Respondent for the crime of Unauthorized Processing under Section 25 of the Data Privacy Act, for its further actions.

SO ORDERED.

Pasay City, Philippines; 21 January 2021.

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

WE CONCUR:

RAYMOND ENRIQUEZ LIBORO

Privacy Commissioner

JOHN HENRY DU NAGA

Deputy Privacy Commissioner

Copy furnished:

JBD

Complainant

Valenzuela City

JI

Respondent

Laguna

THE LAW FIRM BACCAY HUSSIN AND VIZCONDE

Counsel for Respondent VVV

Room 302 Cabrera Building I

130 Timog Avenue, Brgy. Sacred Heart

1103 Quezon City

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

National Privacy Commission

Footnotes

  1. Records, p. 9-10. ↩

  2. Id., p. 59. ↩

  3. NPC Circular 16-04. Rules of Procedure of the National Privacy Commission. Dated 15 December 2016. ↩

  4. Manifestation and Motion dated 29 July 2020, p. 2. ↩

  5. Motion for Extension to Comply with NPC Order filed on 4 August 2020, pp. 1-2. ↩

  6. LBC Certification dated 02 February 2021. ↩

  7. Ibid. ↩

  8. NPC Circular 16-04, Rules of Procedure of the National Privacy Commission. Dated 15 December 2016. ↩

  9. Id., p. 5. ↩

  10. Records p. 8. ↩

  11. NPC Case No. 17-018, Decision dated 15 July 2019. ↩

  12. PRC Admin Case No. 48 JBD v. JI Verified Position Paper, pp.44-45. ↩

  13. RA 10173, Section 3 (g) ↩

  14. R.A. 10173, Section 3(i) Sensitive personal information refers to personal information: (1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; (2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or cm-rent health records, licenses or its denials, suspension or revocation, and tax returns; and (4) Specifically established by an executive order or an act of Congress to be kept classified. ↩

  15. R.A. 10173, Section 3(j). ↩

  16. PRC Admin Case No. 48 JBD v. JI Verified Position Paper ↩

  17. Complaints-Assisted Form. ↩

  18. R.A. 10173, Section 3 (b). ↩

  19. SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists: (a) The data subject has given his or her consent; (b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract; (c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject; (d) The processing is necessary to protect vitally important interests of the data subject, including life and health; (e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or (f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution. ↩

  20. SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases: (a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing; (b) The processing of the same is provided for by existing laws and regulations: Provided, that such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information; (c) The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing; (d) The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, that such processing is only confined and related to the bona fide members of these organizations or their associations: Provided, further, That the sensitive personal information are not transferred to third parties: Provided, finally, That consent of the data subject obtained prior to processing; (e) The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured; or (f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority. ↩

  21. Letter dated 07 January 2021. Page 1-2. ↩

  22. Implementing Rules and Regulations of the Data Privacy Act of 2012 (hereinafter, “IRR”), § 18(b). ↩

  23. Resolution, NPC Case No. 17-018. Dated 5 November 2020. Emphasis supplied. ↩

Backlinks