NPC Issuance Wiki

NPC 18-142: MSH v. RSF and TCC

Issued Decision

Decision Text

MSH,

Complainant,

-versus-

RSF and TCC,

Respondent.

x----------------------------------------------------x

NAGA, P.C.:

Before this Commission is a Complaint filed by MSH (MSH) against TCC (TCC), and its president, RSF (RSF) for the alleged violation of Republic Act No. 10173, or the Data Privacy Act of 2012 (DPA).

Facts

MSH filed a Complaint dated 25 September 2018 (Complaint) against respondents due to the discrepancies in her Transcript of Records (TOR), particularly the course and the Commission on Higher Education (CHED) Special Order Number (S.O. No.) indicated in the TOR.1

MSH is a graduate of TCC, with a degree of Bachelor of Elementary Education (BEE), based on CHED’s S.O. No. 50-140101-0126 s. 2008.2

From the records of the case, TCC issued two (2) TORs in the name of MSH. In the first TOR, dated 23 May 2008, the course stated was Bachelor of Secondary Education (BSE), instead of BEE. Meanwhile, the CHED S.O. No. found in the “remarks” portion was CHED S.O. No. 50-140102-0100 s. 2008.3 TCC issued a corrected TOR, dated 22 January 2018, which stated that MSH’s course was “Bachelor of Elementary Education”, however, there was still an error in the CHED S.O. number, by stating “CHED S.O. No. 50-140102-0126 s. 2008”.4

MSH alleged that due to these discrepancies, her employer, San Francisco Parish School (SFPS), conducted a background check and concluded that her credentials were fake, to her “grave shame and public humiliation”.5 Further, she is asking for “monetary settlement”.6

The parties failed to reach an amicable settlement during the course of the proceedings.7 Thus, the Commission, through the Complaints and Investigation Division (CID), issued an Order dated 02 September 2021, directing the respondents to file a verified comment within fifteen (15) days from receipt of the Order.8

The respondents subsequently filed a Verified Comment dated 22 September 2021 (Verified Comment).9 In the Verified Comment, the respondents prayed for the dismissal of the Complaint for lack of cause of action and utter lack of merit.10

The respondents reasoned that upon learning of the discrepancies from MSH, the Registrar undertook the following actions: 1) an Affidavit of Discrepancy dated 18 June 2018 stating the correct information, and explaining that the discrepancies were “obviously caused by typographical error or pure excusable inadvertence xxx”;11 2) a Certification dated 08 May 2018 stating the correct information, and further certifying that MSH was of “good moral character and has shown exemplary conduct during her stay in this institution”;12 and 3) another Certification dated 08 May 2018, explaining that the discrepancies were “misprinted”, and attaching the corrected TOR and certified true copy of the diploma.13

Further, the respondents explained that they did not issue the incorrect TORs to SFPS, even though the latter requested the TORs as part of the background check, since there was no written authorization from MSH.14 Thus, there was no improper disclosure.

Issue

Whether the respondents violated the Data Privacy Act of 2012.

Discussion

The Commission deems it necessary to summarize the undisputed facts for a proper discussion of the case.

From the records, it is clear that there were two (2) TORs containing discrepancies, namely: the stated course and the CHED S.O. number of MSH.15 These discrepancies were subsequently rectified through an Affidavit of Discrepancy and two Certifications, both dated 08 May 2018, and both signed by the Registrar, providing the correct details and explaining the reasons for the discrepancies.16 Nevertheless, due to the incorrect TORs, MSH’s employer, SFPS, conducted a background check and concluded that her credentials were fake.17

This Commission finds it undisputed that TCC is a personal information controller (PIC), since it “controls the collection, holding, processing or use of personal information”.18 MSH is the data subject for she is “an individual whose personal information is processed”.19

The personal information involved are the course and CHED S.O. number given that the data “when put together with other information would directly and certainly identify an individual”.20 Here, TCC processed the personal information of MSH (course and CHED S.O. No) for the issuance of her TOR.

While TCC endeavored to rectify the discrepancies of MSH’s personal information, the Commission finds that the respondent should indemnify MSH for the damages sustained due to the inaccurate and false information found in her previous TORs.

A PIC is obligated to ensure compliance, among others, with Section 11 of the DPA, providing for the General Data Privacy Principles. Particularly, Section 11(c) states:

SEC. 11. General Data Privacy Principles. – The processing of personal information shall be allowed, subject to compliance with the requirements of this Act and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.

Personal information must be:

xxx

(c) Accurate, relevant and, where necessary for purposes for which it is to be used the processing of personal information, kept up to date; inaccurate or incomplete data must be rectified, supplemented, destroyed or their further processing restricted;

xxx21

In this regard, Section 19(c) of the Implementing Rules and Regulations of the DPA (IRR) requires PICs to ensure data quality, to quote:

SECTION 19. General Principles in Collection, Processing and Retention. — The processing of personal data shall adhere to the following general principles in the collection, processing, and retention of personal data:

xxx

c. Processing should ensure data quality.

  1. Personal data should be accurate and where necessary for declared, specified and legitimate purpose, kept up to date.

  2. Inaccurate or incomplete data must be rectified, supplemented, destroyed or their further processing restricted.22

Meanwhile, a data subject has the right to rectification under Section 34 of the IRR:

SECTION 34. Rights of the Data Subject. — The data subject is entitled to the following rights:

xxx

d. Right to rectification. The data subject has the right to dispute the inaccuracy or error in the personal data and have the personal information controller correct it immediately and accordingly, unless the request is vexatious or otherwise unreasonable. If the personal data has been corrected, the personal information controller shall ensure the accessibility of both the new and the retracted information and the simultaneous receipt of the new and the retracted information by the intended recipients thereof: Provided, That recipients or third parties who have previously received such processed personal data shall be informed of its inaccuracy and its rectification, upon reasonable request of the data subject.23

Separate from the data subject’s right to rectification is the right of a data subject to damages anchored on Section 16(f) of the DPA, which provides:

SEC. 16. Rights of the Data Subject. – The data subject is entitled to:

xxx

(f) Be indemnified for any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information.24

Based on Section 11(c) of the DPA, and Section 19(d) of the IRR of the DPA, the respondent, being a PIC, had the obligation to ensure that MSH’s personal information was accurate and up to date. Yet, the fact that TCC separately issued two (2) inaccurate TORs reveals a clear lapse in ensuring diligent compliance with the DPA. MSH acted in the exercise of her right to rectification due to the inaccurate and false information stated in the two (2) TORs.

The Commission notes that TCC subsequently undertook to correct and update the TORs.25 Nevertheless, the issuance of inaccurate information, in itself, caused damage to MSH. Due to the discrepancies, SFPS found it necessary to conduct a background check to verify the authenticity of the credentials and integrity of MSH.26 This would have been avoided if TCC had more stringent measures in place to ensure data quality.

Section 16(f) of the DPA allows for indemnification in favor of the data subject when it is shown that there were damages sustained, and the cause of the injury was due to “inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information”.27

As discussed, the Commission finds that damages were sustained by MSH, despite TCC’s subsequent rectification of the inaccurate personal information. Thus, Section 16(f) of the DPA is applicable.

The Commission finds that Section 16(f) of the DPA is applicable since: 1) there was inaccurate and false information contained in two (2) TORs issued by TCC; and 2) there was damage because these discrepancies cast doubt on MSH’s credentials and employment.

TCC’s subsequent rectification of the TORs does not prohibit indemnification in favor of MSH.

As to the type and amount of damages to be awarded, it is appropriate to award MSH nominal damages. The award for nominal damages is proper when “a legal right is technically violated and must be vindicated against an invasion that has produced no actual present loss of any kind or where there has been a breach of contract and no substantial injury or actual damages whatsoever have been or can be shown”.28

It has been ruled that “[t]he assessment of nominal damages is left to the discretion of the court/tribunal, according to the circumstances of the case”.29

Taking into consideration the circumstances of the case, the Commission finds that damages in the amount of ten thousand pesos (Php 10,000.00) is proper.

While MSH impleaded RSF, TCC’s president, as a respondent in the case, only TCC is the proper party to indemnify her given that TCC is the PIC. Further, MSH has not proven that RSF had any intentional or direct involvement with the discrepancies.

The Commission notes that TCC subsequently rectified the discrepancies found in the two (2) separate TORs, thus honoring her right to rectification. Nevertheless, the issuance of the incorrect TORs affected MSH’s employment, and led to her employer conducting background checks on her credentials. Worse, it concluded that her credentials were fake. This would have all been avoided if TCC was zealous in ensuring data quality. It committed lapses in this obligation by issuing two incorrect TORs. Hence, the propriety of the award.

WHEREFORE, premises considered, this Commission ORDERS Respondent, TCC, to:

  1. INDEMNIFY the Complainant, MSH, in the amount of ten thousand pesos (Php 10,000.00) for the damages sustained due to Respondent’s issuance of inaccurate and false information, pursuant to Section 16(f) of the Data Privacy Act of 2012; and

  2. SUBMIT proof of compliance by Respondent with the abovementioned award within fifteen (15) days upon receipt of this Decision.

SO ORDERED.

City of Pasay, Philippines. 03 February 2022.

JOHN HENRY D. NAGA Privacy Commissioner

I CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

Copy furnished:

MSH Complainant

RSF and TCC Respondents

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Complaint Assisted Form dated 25 September 2018 filed by Complainant MSH. ↩

  2. See Id; Transcript of Records dated 19 June 2018. ↩

  3. Transcript of Records dated 23 May 2008. Discrepancy underlined. ↩

  4. Transcript of Records dated 22 January 2018. Discrepancy underlined. ↩

  5. Complaint Assisted Form dated 25 September 2018 filed by Complainant MSH, at page 2. ↩

  6. Id, at page 3. ↩

  7. Undated Letter of Complainant MSH, transmitted through e-mail, on 20 November 2018. ↩

  8. Order (To File Verified Comment) dated 02 September 2021. ↩

  9. Verified Comment dated 22 September 2021 filed by RSF and TCC. ↩

  10. Id, at page 3. ↩

  11. Id, at unmarked Annexes. ↩

  12. Id. ↩

  13. Id. ↩

  14. Id, at 2. ↩

  15. See Transcript of Record dated 23 May 2008, and Transcript of Record dated 22 January 2018. ↩

  16. Verified Comment dated 22 September 2021 filed by RSF and TCC. ↩

  17. Complaint Assisted Form dated 25 September 2018 filed by Complainant MSH. ↩

  18. Republic Act No. 10173, or the Data Privacy Act of 2012, Section 3(h). ↩

  19. Republic Act No. 10173, or the Data Privacy Act of 2012, Section 3(c). ↩

  20. Republic Act No. 10173, or the Data Privacy Act of 2012, Section 3(g). ↩

  21. Republic Act No. 10173, or the Data Privacy Act of 2012, Section 11(c). ↩

  22. Implementing Rules and Regulations of Republic Act No. 10173, Section 19(c). ↩

  23. Implementing Rules and Regulations of Republic Act No. 10173, Section 34(d). ↩

  24. Republic Act No. 10173, or the Data Privacy Act of 2012, Section 16(f). ↩

  25. See Verified Comment dated 22 September 2021 filed by RSF and TCC. ↩

  26. See Complaint Assisted Form dated 25 September 2018 filed by Complainant MSH, at page 2; and Verified Comment dated 22 September 2021 filed by RSF and TCC, at page 2. ↩

  27. Republic Act No. 10173, or the Data Privacy Act of 2021, Section 16(f). ↩

  28. MCC Industrial Sales Corp. v. Ssangyong Corp., G.R. No. 170633, 17 October 2007. ↩

  29. EA v. Q288, Inc., NPC 18-103, 23 July 2020, at page 7. ↩

Backlinks

  • No backlinks found