NPC Issuance Wiki

NPC 18-038: FGP v. Maersk Global Service Centres, Philippines, Ltd.

Issued Decision

Decision Text

FGP,

Complainant,

-versus-

Maersk Global Service Centres, Philippines, Ltd.,

Respondent.

x----------------------------------------x

AGUIRRE, D.P.C.:

Facts

Before this Commission is a complaint for a violation of the data subject’s rights to access and rectification.

Complainant FGP was an employee of Respondent Maersk Global Service Centres, Philippines, Ltd. from 29 March 2010 to 30 April 2014. As a requirement of Complainant’s current employer, Reed Elseview Shared Services, Inc. (RESSPI), he consented to a background check to be done by Human Capital Asia, Inc. This background check involves, among others, verification of his records from his previous employments.

On 8 March 2018, Complainant was informed by the Human Resources representative of RESSPI that they received a report from Human Capital Asia, Inc. The report indicated that an e-mail was sent to Respondent to verify employment details, and Respondent claimed that they had no records with Complainant’s name in their HR database.1

On 13 March 2018, Complainant sent an e-mail to Respondent to confirm the fact that Human Capital Asia, Inc. contacted them as well as the contents of the report. Respondent replied on 19 March 2018 and confirmed the same.

On 20 March 2018, Complainant sent another e-mail to Respondent and attached proof of his past employment with them, such as his Employee IDs, certificate of employment, and Bureau of Internal Revenue (BIR) 2316 forms for his years of employment with them.2

Complainant stated that he demanded for the following from Respondent, via e-mail:

a. An explanation as to why they have no records with my name in their database despite the fact that I was indeed their former employee; b. That they inform the Background Investigator that I was their former employee; c. That they provide me two certificates of employment; d. That they provide me the name and designation of their Personal Information Controller.3

Complainant did not receive any feedback or reply from Respondent despite his follow-up e-mails on 22 and 27 March 2018,4 prompting him to file this complaint with the National Privacy Commission (NPC) for Respondent’s violation of his rights as a Data Subject, particularly his Right to Access, Right to Rectification, and, if appropriate, the Right to Damages.5

The parties were ordered to appear for Discovery Conference on 18 July 2018.6 Complainant and Respondent, through counsel, appeared. Both parties manifested that they were willing to enter into an amicable settlement. They were given fifteen (15) days from 18 July, or until 02 August 2018, to file their Compromise Agreement. Respondent was given ten (10) days from then or until 12 August 2018 to file their Responsive Comment in case the parties fail to reach a settlement. Complainant will then have ten (10) days from receipt to file his Reply.7

Complainant, however, sent an e-mail to the investigating officer on 06 August 2018, stating that he decided not to enter into an amicable settlement with Respondent. He also informed the investigating officer that he would like to proceed with the complaint.8

After two (2) motions for extension of time to file its Responsive Comment, Respondent submitted its Comment on 07 September 2018.

Arguments of the Parties

In their Comment, Respondent asserts that the Complaint should be dismissed on the ground of Complainant’s failure to file the same within the proper reglementary period, citing NPC Circular No. 16-04 or the NPC Rules of Procedure (“Rules”):

Section 4. Exhaustion of remedies. No complaint shall be entertained unless:

xxx

c. The complaint is filed within six (6) months from the occurrence of the claimed privacy violation or personal data breach, or thirty (30) days from the last communiqué with the personal information controller or concerned entity, whichever is earlier.9

Respondent points out that Complainant’s last communication with them was through an e-mail on 27 March 2018 and that records of this case readily show that Complainant only filed his complaint on 24 May 2018. They state:

  1. Thus, Complainant filed the instant Complaint 58 days - already more than 30 days – after his last communication with Respondent Maersk. Clearly, Complainant was in violation of Section 4(c) of Rule II of the NPC Rules and his Complaint should not be entertained by this Honorable Office.

xxx

  1. Notably, this Honorable Office may waive this requirement for the filing period of the Complaint, but ONLY IF:

(1) Good cause is shown by the complainant; or (2) The complaint involves a serious violation of the Data Privacy Act.

In either instance, this Honorable office must take into account “the risk of harm to the affected data subject.”

  1. None of these exceptions are present in the case at bar.

  2. Complainant failed to allege, let alone show, any good cause why his Complaint should be considered by this Honorable Office, notwithstanding his belated filing thereof.

xxx

  1. In any event, it must be taken into account that the risk of harm to the Complainant is minimal, if none at all.

13.1 Complainant admits that he is presently employed by Reed Elsevier Shared Services (Philippines), Inc. (“Reed”), the company who requested for a background check of his past employment with Respondent Maersk.10

Respondent also disputes Complainant’s Right to Damages by stating:

13.2. Significantly, Complainant admits that there are no damages to him arising from Respondent Maersk’s alleged violation of the Data Privacy Act. While he states that he will claim damages if any are found after the filing of his Complaint, the fact that he has been unable to identify any damages to him strongly shows that there (sic) the risk of harm to him is minimal, if none at all.

13.3. Lastly, it is respectfully manifested that Respondent Maersk had already confirmed with Reed the Complainant’s past employment. Respondent Maersk had even verified as correct all the employment details declared by the Complainant. This may explain why he had been employed by Reed.

In Complainant’s Reply, he argues that the lapse of the thirty (30)-day reglementary period should not be a cause for the dismissal of his complaint:

  1. On 24 April, the Complainant attempted to send the complaint to this Honorable Office using the Complaints-assisted Online Form provided in the official website of the Commission;

xxx

  1. Due to this technical issue, the Complainant has resorted to producing and sending to this Honorable Office, via e-mail, a sworn and duly notarized Complaint-Affidavit, which took additional time and effort, as compared to simply sending the complaint in the Online Form.

xxx

  1. Based on the facts presented,

a. The online complaint form is a valid means to send a complaint to The Commission, and b. Had there been no technical issue, the complaint would have been filed the latest on 24 April 2018, which is 28 days after my last communication with the Respondent.11

Complainant also addresses the issue of damages that may be awarded to him, stating:

  1. While the Complainant continues to confirm that there are no known damages resulting from Respondent’s violation of the Complainant’s rights as a data subject at the date of the submission of his Reply, the same Act does not require damages or harm on a data subject for the rights of the data subject to be violated.

xxx

  1. Without even any damage or harm resulting from the Respondent’s violations of the rights of the Complainant, the evidences presented on (sic) the Complaint already established that the Complaint is valid under the following criteria as per Section 3 of the same act:

a. That the Complainant is a data subject of the Respondent, and b. The Respondent committed violations of the Complainant’s rights as the Respondent’s data subject.

xxx

  1. Had the Complainant fail (sic) to keep any documents as proof of his employment with the Respondent, the employment of the Complainant may have been terminated, as per company policy, resulting from his failure to prove his employment with Respondent.12

Issue

  1. Whether the Complaint may be dismissed for being filed beyond the thirty (30)-day period as provided under Section 4(c) of the NPC Rules of Procedure.

  2. Whether Respondent committed acts in violation of Complainant’s rights to access and rectification under the Data Privacy Act (DPA).

Discussion

The Complaint should not be dismissed.

The Rules provide that no complaint shall be entertained unless it is filed within six (6) months from the occurrence of the claimed privacy violation or personal data breach, or thirty (30) days from the last communication with the personal information controller or concerned entity, whichever is earlier.13

This rule was intended to prevent a deluge of vexatious complaints from those who waited for a long period of time to pass before deciding to lodge a complaint with the NPC, unduly clogging its dockets. Notably, however, the same Section provides that the Commission has the discretion to waive such period for filing upon good cause shown, or if the complaint involves a serious violation or breach of the DPA, taking into account the risk of harm to Complainant.

The Supreme Court also provides the following:

The Court has allowed some meritorious cases to proceed despite inherent procedural defects and lapses. This is in keeping with the principle that rules of procedure are mere tools designed to facilitate the attainment of justice and that strict and rigid application of rules which would result in technicalities that tend to frustrate rather than promote substantial justice must always be avoided. It is a far better and more prudent cause of action for the court to excuse a technical lapse and afford the parties a review of the case to attain the ends of justice, rather than dispose of the case on technicality and cause grave injustice to the parties, giving a false impression of speedy disposal of cases while actually resulting in more delay, if not a miscarriage of justice.14

In this case, the allegations and evidence presented by the Complainant sufficiently warrants the waiver of the thirty (30)-day requirement from the last communication with the personal information controller within which to file the complaint. The Commission is convinced that the case involves a possible serious violation of the data subject’s rights to access and rectification.

The Rules speak of “risk of harm” and do not require an actual harm or damage to Complainant. As pointed out by Complainant, his lack of employment record could have resulted in his inability to provide previous work experience, which could have jeopardized his current employment. The fact that Complainant was able to keep and provide other proof of employment, such as his company IDs, BIR forms, and past certificates of employment, is extraneous to this case and speaks more to the diligence of Complainant rather than the absence of any risk of harm caused by the actions of Respondent. Respondent’s continuing inaccurate record may cause further repercussions in the future, should Complainant seek employment elsewhere.

Hence, contrary to what Respondent alleges, the violation of Complainant’s rights was not “minimal” such that the Commission’s discretion to waive the period requirement should be curtailed.

Respondent committed acts in violation of Complainant’s right to access under the DPA.

The DPA provides that every data subject has the right to reasonable access, upon demand, of his or her personal data and certain information about the processing, which the controllers must provide.15 This includes the following information:

(1) Contents of his or her personal information that were processed; (2) Sources from which personal information were obtained; (3) Names and addresses of recipients of the personal information; (4) Manner by which such data were processed; (5) Reasons for the disclosure of the personal information to recipients; (6) Information on automated processes where the data will or likely to be made as the sole basis for any decision significantly affecting or will affect the data subject; (7) Date when his or her personal information concerning the data subject were last accessed and modified; and (8) The designation, or name or identity and address of the personal information controller;16

In his e-mail dated 20 March 2018,17 Complainant requested information regarding the fact of his employment with Respondent, specifically the following:

  1. An explanation as to why they have no records of his employment, whereas in fact [he] was indeed a former employee of Maersk Global Service Centres, Philippines Ltd.
  2. Two (2) Certificates of Employment; and
  3. The name and designation of their Personal Information Controller.

Despite follow-up e-mails by Complainant, Respondent failed to provide the requested information. While Respondent sent correspondence to Human Capital Asia, Inc. belatedly on 18 April 2018 to clarify Complainant’s employment information, Respondent has not responded to the request of Complainant as of the time the instant Complaint was filed on 27 March 2018.

Respondent did not violate Complainant’s right to rectification.

The DPA likewise provides that every data subject has the right to rectification, defined as their right to:

Dispute the inaccuracy or error in the personal information and have the personal information controller correct it immediately and accordingly, unless the request is vexatious or otherwise unreasonable. If the personal information have been corrected, the personal information controller shall ensure the accessibility of both the new and the retracted information and the simultaneous receipt of the new and the retracted information by recipients thereof: Provided, That the third parties who have previously received such processed personal information shall be informed of its inaccuracy and its rectification upon reasonable request of the data subject.18

While the provision states that the information must be corrected “immediately and accordingly,” the Commission looks at the circumstances surrounding the request. This may include, among others, the volume of information involved and the time that has lapsed since the time the information was processed. Hence, there is no uniform timeframe for all the personal information controllers to comply with the obligation to correct inaccurate information,19 as long as there is no undue or excessive delay.20

The records of this case show that Complainant was informed on 08 March 2018 that Respondent did not have his employment information in their HR database. Respondent confirmed this to Complainant on 19 March 2018. After Complainant’s request on 20 March 2018 for Respondent to inform Human Capital Asia, Inc. of the correct information regarding his previous employment, Respondent rectified the matter with Human Capital Asia, Inc. through an e-mail sent on 18 April 2018.

The Commission finds that the e-mail to Human Capital Asia, Inc. twenty nine (29) days after receiving Complainant’s request is considered reasonable under the circumstances and complies with the requirement that “the third parties who have previously received such processed personal information shall be informed of its inaccuracy and its rectification upon reasonable request of the data subject.”

Complainant is entitled to damages.

The DPA provides that every data subject has the right to be indemnified for “any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information.”21 Indeed, it is part of the Commission’s mandate to award indemnity on matters affecting any personal information.22

Despite Respondent’s verification of Complainant’s records with Human Capital Asia, Inc., the fact remains that Respondent stored and disclosed inaccurate information about Complainant. This is contrary to Respondent’s obligations to observe the general data privacy principles under the DPA, which require that personal information must be, among others:

(c) Accurate, relevant and, where necessary for purposes for which it is to be used the processing of personal information, kept up to date xxx23

Respondent’s failure to provide the requested information to Complainant24 also indicates a lack of mechanism for data subjects to exercise their right to access under the DPA.25

Contrary to Respondent’s assertion that the risk of harm is “minimal, if none at all,” Complainant faced a real risk of negative consequences from an inconsistency between his declared information and the background check. It is worth noting that the DPA does not require actual or monetary damages for data subjects to exercise the right to damages. As provided in the law, the consequences of processing inaccurate information is enough for the right to arise.26

The DPA provides that restitution for any aggrieved party shall be governed by the provisions of the New Civil Code.27 The relevant provision in this Code states:

Art. 2221. Nominal damages are adjudicated in order that a right of the plaintiff, which has been violated or invaded by the defendant, may be vindicated or recognized, and not for the purpose of indemnifying the plaintiff for any loss suffered by him.

The DPA gives individuals the right to receive indemnification from personal information controllers and personal information processors for both material and non-material damages.28 The Supreme Court has also clarified that no actual present loss is required to warrant the award of nominal damages, thus:

Nominal damages are recoverable where a legal right is technically violated and must be vindicated against an invasion that has produced no actual present loss of any kind or where there has been a breach of contract and no substantial injury or actual damages whatsoever have been or can be shown.29

Pursuant to the New Civil Code and the aforementioned findings of a failure to process personal information that is accurate, relevant and up to date,30 as well as a failure to provide a mechanism for data subjects to access their personal information upon reasonable request,31 the Commission finds that the award of nominal damages to Complainant is warranted.

WHEREFORE, all these premises considered, this Commission resolves to AWARD Complainant FGP damages in the amount of P5,000.00 for Respondent Maersk Global Service Centres, Philippines, Ltd.’s violation of his right to access. Respondent is hereby ORDERED to submit its compliance within fifteen (15) days from receipt of this Decision.

SO ORDERED.

Pasay City, 21 May 2020.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

JOHN HENRY DU NAGA Deputy Privacy Commissioner

Copy furnished:

FGP Complainant

ROMULO MABANTA BUENAVENTURA SAYOC & DELOS ANGELES Counsel for Respondent Maersk

COMPLAINTS AND INVESTIGATION DIVISION GENERAL RECORDS UNIT ENFORCEMENT DIVISION

Footnotes

  1. Records, pp. 50-69. ↩

  2. Ibid. ↩

  3. Ibid. ↩

  4. Id., at 67-69. ↩

  5. Supra at Note 1. ↩

  6. Records at pp. 94-95. ↩

  7. Id., at 49. ↩

  8. Id., at 44. ↩

  9. Section 4, Rule II, NPC Circular 16-04. Dated 15 December 2016. ↩

  10. Id., 30-34. ↩

  11. Id., 14-26. ↩

  12. Ibid. ↩

  13. Section 4, NPC Circular 16-04. Dated 15 December 2016. ↩

  14. PNB v. Court of Appeals, G.R. No. 218901, 15 February 2017. ↩

  15. See R.A. 10173, Section 16(c). ↩

  16. Ibid. ↩

  17. Records, p. 67. ↩

  18. R.A. 10173, Section 16(d). ↩

  19. NPC Advisory Opinion 2018-018. Dated 21 April 2017. ↩

  20. See, EU General Data Protection Regulation, Article 16. ↩

  21. R.A. 10173, Section 16(f). ↩

  22. R.A. 10173, Sec. 7(b). ↩

  23. Id, at Sec. 11(c). ↩

  24. Supra at Note 17. ↩

  25. Supra at Note 16. ↩

  26. Supra at Note 21. ↩

  27. R.A. 10173, Sec. 37. ↩

  28. See, Handbook on European Data Protection Law, p. 246. ↩

  29. Seven Brothers Shipping Corporation v. DMC-Construction Resources, Inc. G.R. No. 193914. November 26 2014. ↩

  30. Supra at Note 23. ↩

  31. Supra at Note 25. ↩

Backlinks