Decision Text
B.Q.N.,
Complainant,
-versus-
NUQ INC., doing the business under the name and style of HQ, N.S., N.U., D.B.L. and S.K.D.,
Respondents.
x----------------------------------------------------x
LIBORO, P.C.:
Before this Commission is a case filed by B.Q.N. (Complainant) against NUQ INC., doing the business under the name and style of HQ, N.S., N.U., D.B.L. And S.K.D. (Respondents) for the violation of Data Privacy Act of 2012 (DPA).
Facts
On 06 July 2018, Complainant filed a complaint before the National Privacy Commission and alleged the following:
A court order1 has been issued to Respondents requiring the release of K.H.Q.’s (K.H.Q.) income as Complainant’s HQ driver. The income information was offered as evidence in a case against K.H.Q.. However, Respondents allegedly submitted a certification disclosing information pertaining to Complainant’s income and not that of K.H.Q.’s. The certification includes the name of the driver, vehicle type and plate number driven by K.H.Q., date of accreditation of K.H.Q. as HQ driver; name of complainant as operator; and breakdown of the number of rides, fares and incentives earned by K.H.Q. from January 2017 to January 2018.
On 11 September 2018, parties were ordered to confer for discovery. However, through email, Respondents asked for its postponement. Complainant manifested that she was not willing to enter into an amicable settlement. Thus, Respondents were ordered to submit their responsive Comment instead.
On 01 August 2018, Respondents filed their responsive Comment together with their supporting documents. In their Comment, Respondents explained that the disclosure of personal information indicated in the certification is legitimate. It was made in the performance of a legal obligation imposed upon Respondents through a validly issued court order.2 The compliance thereto will necessarily involve the processing and disclosure of personal information of K.H.Q. and Complainant to comply with a legally issued and served subpoena. Hence, the Respondents further stated that since the processing and disclosure of the personal information of Complainant and K.H.Q. are explicitly allowed under the law then the disclosure of the personal information included in the certification is not contrary to the DPA, its implementing rules and regulations, and other issuances of the Commission.
On 18 October 2018, Complainant submitted her Reply. She argued that Respondents made inconsistent statements in its Comment when it claimed that HQ is not privy to any arrangement between the peer/operator and the driver regarding how they split their earnings, while also stating in the same pleading that both the driver and the peer/operator share the same summary of earnings. Complainant questioned respondent HQ’s argument that the information which it processes regarding fare and incentive earnings solely belong to the driver when in fact the certification it issued in the name of Complainant also bears the same exact earnings as that issued to K.H.Q..
Issue
Whether Respondents committed a violation of the DPA in submitting the subject certification to the court in compliance to a subpoena.
Discussion
This complaint lacks merit and hence, the Commission adjudged its dismissal.
Upon careful consideration of the submissions of both parties, the Commission observed that Complainant is the car operator of Toyota Vios that is registered on a HQ platform while K.H.Q. is the registered driver. Due to a criminal case filed against K.H.Q., the court issued a subpoena against Respondents. The subpoena obliged Respondents to release a Certification as to the date of accreditation as HQ driver of K.H.Q., his number of trips, and monthly earnings from January 2017 up to January 2018. Hence, Respondents as the personal information controller (PIC) processed the information of K.H.Q. to comply with the subpoena. However, Complainant alleged that Respondents issuance of the Certificate containing her information instead of K.H.Q.’s information violated her data privacy rights against unlawful processing and unauthorized disclosure because the personal information was processed and disclosed without her consent.
Not all processing and disclosure of personal information, like Complainant’s information in this case, are violations of the DPA. It allows lawful circumstances where personal information can be validly processed and disclosed notwithstanding the absence of consent.
Section 12 of the DPA provides the criteria for lawful processing of personal information:
SEC. 12. The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:
(a) The data subject has given his or her consent;
(b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract;
(c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;
(d) The processing is necessary to protect vitally important interests of the data subject, including life and health;
(e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or
(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.
The processing of personal information shall be permitted only if not otherwise prohibited by law. Among the criteria for lawful processing of personal information provided above, it provided that processing of information is permissible if the processing is necessary for compliance with a legal obligation to which the personal information controller is subject.
In this case, the legal obligation of Respondents arose from the subpoena issued by the court. Rule 21, Rules of Court, provided the rules regarding subpoena and the effect of non-compliance therewith:
Section 1. Subpoena is a process directed to a person requiring him to attend and to testify at the hearing or the trial of an action, or at any investigation conducted by competent authority, or for the taking of his deposition. It may also require him to bring with him any books, documents, or other things under his control, in which case it is called a subpoena duces tecum.
xxxx
Section 9. Failure by any person without adequate cause to obey a subpoena served upon him shall be deemed a contempt of the court from which the subpoena is issued. If the subpoena was not issued by a court, the disobedience thereto shall be punished in accordance with the applicable law or Rule.
The subpoena being required by the court and issued within its powers, created an obligation arising from law3 on the part of Respondents in this case. The subpoena duces tecum is, in all respects, like the ordinary subpoena ad testificandum which mandates the witness to bring with him and produce at the examination the books, documents, or things described in the subpoena.4 Like in this case, Respondents were required to submit a Certification5 containing all the details required in the subpoena. Ergo, Respondents cannot be faulted in processing the information because of its compliance with the aforementioned.
Section 17 of the Implementing Rules and Regulations of the Data Privacy Act of 2012 (Rules) provides that:
The processing of personal data shall be allowed, subject to compliance with the requirements of the Act and other laws allowing disclosure of information to the public, and adherence to the principles of transparency, legitimate purpose, and proportionality.
The Rules6 then subjects the processing of data with DPA compliance and other laws allowing disclosure of information to the public. It further states that it should adhere to the principles of transparency, legitimate purpose, and proportionality. In the principle of proportionality,7 it provides that:
The processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.
The aforesaid principle then states that when assessing the processing of personal data, proportionality requires that only the personal data which is adequate and relevant for the purposes of the processing is collected and processed. In this case before the Commission, Respondents only processed and collected the information required in the subpoena.
More so, due to the nature of subpoena, Respondent’s cannot be faulted as failure to comply to the foregoing shall be deemed contempt of court with its corresponding liability.
Respondent HQ does not distinguish between the earnings of the driver and the operator, considering that its records only indicate the number of rides, fares, and incentives that are indicated in the mobile application. Considering that Respondent HQ is not a privy to the arrangement between the driver and the car owner, the grievance submitted by Complainant is not a matter that can be addressed before the Commission.
In a nutshell, the information contained in the certification under the name of K.H.Q., including the information on the number of rides, fares, and incentives, relates to K.H.Q. and not to Complainant. The processing of Complainant’s name as the operator was pursuant to a legal obligation by virtue of a subpoena issued to Respondents and in accordance with the principle of proportionality.
With the foregoing, it is prudent for the Commission to dismiss the case since the processing and disclosure of the personal information included in the Certification is not contrary to the DPA, its rules and regulations, and other issuances of the Commission.
Moving forward, the Commission takes this opportunity to remind the Respondents as a PIC to abide by the general privacy principles of transparency, legitimacy, and proportionality as it processes information even when responding to a legal obligation. Respondents should always be mindful of the rights and interests of the individual about whom personal information is processed.8
WHEREFORE, premises considered, the case NPC 18-066 “B.Q.N. vs. NUQ INC., doing the business under the name and style of HQ, N.S., N.U., D.B.L. and S.K.D.” is hereby DISMISSED for lack of merit.
SO ORDERED.
Pasay City, Philippines; 21 May 2020.
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
WE CONCUR:
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Copy furnished:
B.Q.N. Complainant
HQ, NUQ INC, N.S., N.U., D.B.L. AND S.K.D. Respondent
LEGAL DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission
Footnotes
-
Order of the Regional Trial Court, Branch 94 of Quezon City, dated 06 February 2018: As prayed for by Atty. S, let subpoena duces tecum ad testificandum be issued to Winston Beltran, Security and Safety Head, HQ, xxxxxxxx, for him to bring a Certification as to the date of accreditation as HQ driver of the accused and his number of trips and monthly earnings from January 2017 up to January 2018 and to testify thereon on the said date. ↩
-
Ibid. ↩
-
New Civil Code, Article 1157. ↩
-
G.R. No. L-13463, H. C. LIEBENOW vs. THE PHILIPPINE VEGETABLE OIL COMPANY, November 9, 1918. ↩
-
Respondent HQ’s certification, which was submitted to the court, enumerates the following: a. Name of the driver: K.H.Q.; b. Vehicle type and plate number driven by K.H.Q.; c. Date of accreditation of K.H.Q. as HQ driver; d. Name of complainant as operator; and e. Breakdown of the number of rides, fares and incentives earned by K.H.Q. from January 2017 to January 2018. ↩
-
Section 18 of the Implementing Rules and Regulations of the Data Privacy Act of 2012. ↩
-
Section 18(c) of the Implementing Rules and Regulations of the Data Privacy Act of 2012. ↩
-
NPC 17-047, Decision, National Privacy Commission. ↩