NPC Issuance Wiki

NPC 19-450: JRG v. Creditable Lending Corporation (Easy Peso)

Issued Decision

Decision Text

JRG,

Complainant,

-versus-

Creditable Lending Corporation (Easy Peso),

Respondent.

x----x

AGUIRRE, D.P.C.

Before this Commission is a Complaint by JRG (Complainant) against Creditable Lending Corporation (Respondent) for a violation of the Data Privacy Act of 2012.

Facts

Complainant, using the Complaints-Assisted Form, described her complaint as follows “harassment & invasion of privacy; text blasting to all my contacts.”1 She stated that she has suffered depression and trauma from Respondent’s acts.2 She alleged that she found out about this incident when her contacts forwarded to her the text message.3 Complainant indicates that she is seeking a temporary ban on Respondent’s processing.4

The parties were initially scheduled for Discovery Conference on 12 August 2019, but this was rescheduled after a Presidential Proclamation declared this as a regular holiday in observance of the Muslim feast of Eid’l Adha.5 The Discovery Conference was reset to 19 August 2019.

At the Discovery Conference, Respondent was present but Complainant failed to appear. The Investigating Officer issued an Order resetting the Discovery Conference to 18 September 20196 but Complainant again failed to appear on the said date.7 Thereafter, the Investigating Officer issued an Order requiring Respondent to file a Responsive Comment within ten (10) days from receipt of that Order.8

In their Comment, Respondent confirmed that Complainant was a borrower whose account was overdue for one hundred thirty two (132) days. As to the allegations of “text blasting” to all the Complainant’s contacts, Respondent stated thus:

We are not tolerating any indecent moves of our employee/agent… The original term is only 14 days and the purpose of which is being explained by our review team “as it is for emergency use only.” It is also disclosed that we are asking for at least two to five (2-5) character references in the event that we cannot contact her.9

Respondent alleges that Complainant has given her consent for the access of her contact lists. Their Comment stated thus:

Based on Republic Act No. 3765, otherwise known as Truth in Lending Act, the company observes the disclosure requirements as it is being read by the clients/customers by clicking “agree” prior to claiming the loan proceeds at our accredited merchant partners branch of her choice. As it is operated online, systems generated loan Agreement is provided herein…[a]pplication procedures are also attached herein… the said procedures will best answer her queries. Therefore, she allows us to access her contact lists. She may review the said procedures to help her clarify her complaint, as we cannot access her contacts without her permission.10

Issue

  1. Whether Respondent committed a violation of the Data Privacy Act that warrants a recommendation for prosecution; and

  2. Whether a temporary ban should be issued against Respondent’s processing of personal data.

Discussion

The Complaint Does Not Warrant a Recommendation for Prosecution of a Violation Under the Data Privacy Act

The Complaint alluded to certain messages sent by Respondent to her contacts. The Complaint, however, did not specify the content of these forwarded text messages. Aside from allegations that she learned about the incident from messages forwarded by her contacts, Complainant has not offered any proof of the existence of these messages supposedly sent by Respondent to third parties. She has also not identified the contacts she was referring to.

Despite several opportunities given to Complainant to substantiate her allegations at the two (2) Discovery Conferences scheduled on 19 August 2019 and 18 September 2019, Complainant failed to appear without notice or justification.

Given all these, the Commission is left without any basis to recommend Respondent for prosecution under the Data Privacy Act, considering it is bound to adjudicate following the NPC Rules of Procedure, which provides:

Section 22. Rendition of decision. – The Decision of the Commission shall adjudicate the issues raised in the complaint on the basis of all the evidence presented and its own consideration of the law.11

As the Supreme Court held in Government Service Insurance System v. Prudential Guarantee, “it is basic in the rule of evidence that bare allegations, unsubstantiated by evidence, are not equivalent to proof. In short, mere allegations are not evidence.”12

As such, in the absence of sufficient evidence to support Complainant’s allegations that Respondent disclosed her personal information to her contacts, it cannot be said that Respondent committed an act that would constitute the prohibited acts of unauthorized processing13 or processing for an unauthorized purpose.14

The Complaint Does Not Warrant the Issuance of a Temporary Ban

Complainant stated in the Complaints-Assisted form that she is applying for a temporary ban on Respondent’s processing of her personal data based on the ground of “legal & hearing.”15 The issuance of this is governed by the NPC Rules of Procedure which provide:

Section 19. Temporary Ban on Processing Personal Data. – At the commencement of the complaint or at any time before the decision of the National Privacy Commission becomes final, a complainant or any proper party may have the National Privacy Commission, acting through the investigating officer, impose a temporary ban on the processing of personal data, if on the basis of the evidence on record, such a ban is necessary in order to preserve the rights of the complainant or to protect national security or public interest.

a. A temporary ban on processing personal data may be granted only when: (1) the application in the complaint is verified and shows facts entitling the complainant to the relief demanded, or the respondent or respondents fail to appear or submit a responsive pleading within the time specified for within these Rules; xxx16

Considering the findings above on the Complaint’s lack of substantial evidence, Complainant’s application for the issuance of a temporary ban is denied.

Nevertheless, the Commission notes that Respondent misunderstands the Data Privacy Act (DPA) in asserting that they obtained Complainant’s consent to access her contacts.17

The Loan Agreement, attached to their Responsive Comment, contains this provision:

VIII. Waivers

xxx

The Borrower hereby willingly, voluntarily, and with full knowledge of his right under the law, waives the right to confidentiality of information and authorize the Lender to disclose, divulge, and reveal any such information relating to Borrower’s loan availment, including events of default, for the purpose of, among others, client evaluation, credit reporting or verification and recovery of the obligation due and payable to the Lender under this Loan Agreement.

In view of the foregoing, the Lender may disclose, divulge and reveal the aforementioned information to third parties, including but not limited to the Borrower’s employer, credit bureaus, the Lender’s affiliate, subsidiaries, agents, service providers, as well as any prospective assignee or transferee, rating agency, insurer, and any such person, entity or regulatory body that may be required by law or competent authority.18

Personal information controllers who rely on consent as basis to process their information must ensure that such consent is “freely given, specific, and an informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her.”19

In its waiver provision, Respondent combines various purposes for disclosure and various parties to be given access of Complainant’s information. This does not meet the requirement for consent to be specific. Having an enumeration of each and every purpose of the processing in a single paragraph still fails to provide the data subject with a genuine choice as he or she will be bound to sign off on the entire provision in toto.20

Provisions that use vague and overbroad language, as in this case, cannot be said to comply with the general privacy principle of transparency. As the DPA’s Implementing Rules and Regulations explain:

The data subject must be aware of the nature, purpose, and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of personal information controller, his or her rights as a data subject, and how these can be exercised. Any information and communication relating to the processing of personal data should be easy to access and understand, using clear and plain language.

While the Commission finds that the allegations of Complainant are not sufficiently substantiated to warrant a recommendation for prosecution, it finds it necessary to emphasize the need for personal information controllers, such as Respondent, to inform their data subjects of the purpose of the processing of their personal information in “clear and plain language.” The requirement to use clear and plain language does not mean using layman’s terms to substitute technical words at the risk of not capturing the complex concepts they represent. Rather, this requirement means that information should be provided in as simple a manner as possible, avoiding sentence or language structures that are complex.21 The information provided should be concrete and definitive; it should not be phrased in abstract or ambivalent terms or leave room for different interpretations22 such as in the above-cited provision which uses the word “any” several times, as well as wordings like “including but not limited to”.

WHEREFORE, all the above premises considered, the Complaint by JRG against Creditable Lending Corporation is hereby DISMISSED.

This is without prejudice to the filing of appropriate civil, criminal or administrative cases against the Respondent before any other forum or tribunal, if any.

SO ORDERED.

Pasay City, Philippines; 09 June 2020.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

JOHN HENRY D. NAGA Deputy Privacy Commissioner

Copy furnished:

JRG Complainant

CREDITABLE LENDING CORPORATION (EASY PESO) Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Complaints-Assisted Form received on 28 June 2019. ↩

  2. Id., at 3. ↩

  3. Id., at 5. ↩

  4. Id., at 7. ↩

  5. Presidential Proclamation No. 555. ↩

  6. Order dated 19 August 2019. ↩

  7. Attendance Sheet for Discovery Conference dated 18 September 2019. ↩

  8. Order dated 18 September 2019. ↩

  9. Comment dated 08 October 2019. Emphasis supplied. ↩

  10. Ibid. ↩

  11. NPC Circular No. 16-04 dated 15 December 2016 (“NPC Rules of Procedure”), Section 22. Emphasis supplied. ↩

  12. G.R. No. 165585, 20 November 2013, citing Real v. Belo, 542 Phil. 109 (2007). ↩

  13. Republic Act No. 10173, Section 25. ↩

  14. Id., at Section 28. ↩

  15. Complaints-Assisted Form, p. 7. ↩

  16. Supra Note 11, at Section 19. ↩

  17. Supra Note 9. ↩

  18. Id., at Annex A. ↩

  19. Republic Act No. 10173, Section 3(b). ↩

  20. NPC Advisory Opinion 2018-063. 23 October 2018. ↩

  21. See, Guidelines on transparency under Regulation 2016/679 of the Article 29 Working Party (2017). ↩

  22. Ibid. ↩

Backlinks