Decision Text
RBB,
Complainant,
-versus-
U-PESO.PH LENDING CORPORATION (UPESO),
Respondent.
x--------------------------------------------x
AGUIRRE, D.P.C.:
Before this Commission is a Complaint filed by Complainant RBB against Respondent U-PESO.PH Lending Corporation (UPESO) for an alleged violation of R.A. 10173 (“Data Privacy Act”).
DECISION
The Facts
In her Complaint, the Complainant alleges that she has an outstanding loan with Respondent. Upon her default of payment, Respondent allegedly threatened to file a case of estafa against her. Complainant claims that she tried to communicate with Respondent regarding her situation, but the threats from Respondent continued.1
The parties were ordered to appear on 28 August 2019 for a Discovery Conference.2 On the scheduled conference, however, only Respondent appeared. The Conference was reset to 17 October 2019 where only Respondent appeared and Complainant again failed to appear. Respondent was thus ordered to submit their responsive comment.3
Arguments of the Parties
In her Complaint, Complainant alleges that these threats caused her sleepless nights, loss of appetite, and anxiety to the point of considering taking her own life.
In their Comment,4 Respondent confirmed that Complainant is a borrower through their UPESO lending application. Complainant had previously settled four (4) loan obligations, and obtained her fifth loan with Respondent for P12,000.00 due on 18 June 2019. This due date was not met by Complainant. Respondent claims that, after several follow-ups, they could no longer contact Complainant.
In their Comment, Respondent argues:
As for the allegations that the Complainant was being harassed or threatened by UPESO or its collecting agents when she failed to pay her obligations, [s]uch matters are civil in nature and are outside the jurisdiction of this Honorable Commission and must be conducted in proper courts.
The complainant only made allegations of harassment and threats because of her continued failure to settle her obligation and no proof as to the alleged harassment or threats made by the others were presented.
Issue
The sole issue here is whether Respondent committed a violation of the Data Privacy Act that warrants a recommendation for prosecution.
Discussion
It is important to note that Complainant states in her Complaints-Assisted Form that she learned about this incident by “receiving it in her own number.”5 As her Complaint excludes the issue of disclosure of her personal information to third parties, and there are no other allegations on other uses of Complainant’s information, we focus our discussion on Respondent’s use of Complainant’s information for purposes of collecting the amount she loaned.
The processing of personal information by Respondent, which resulted in communicating with Complainant through her mobile number, may be considered as “necessary for compliance with a legal obligation to which the personal information controller is subject” under Section 12 of the Data Privacy Act. In this case, Complainant admitted that she entered into a Contract of Loan with Respondent. This Contract created a legal obligation on the part of Complainant to pay her loan upon due date. Consequently, Respondent is permitted under Section 12 of the DPA to process Complainant’s data to ensure the latter’s compliance with her legal obligations.
It is thus valid for Respondent to communicate with Complainant through her mobile number which she provided.
As to Complainant’s allegations of threats by Respondent to file a case of estafa, it must be emphasized that the Commission is not the competent authority to determine the allowable practices in debt collection.
Hence, there is nothing in the Complaint that would reasonably connect Respondent to any of the possible violations enumerated under the Data Privacy Act. Neither did Complainant provide supporting documents to her allegations. Notably, she failed to appear at the two (2) Discovery Conferences, where the second one was rescheduled because of her absence at the first.
Nevertheless, the Commission notes several problematic provisions in the Loan Agreement cited by Respondent in their Comment, such as:
- Data Privacy. The Borrow hereby acknowledges, agrees, and consents that the Lender or its authorized officer’s may collect, store, process and dispose data about the Borrower. Any information and data received from the Borrower by the Lender may be used and utilized by the Lender, either directly or indirectly in the performance of the terms of this Agreement.6
Respondent later states in their Comment that:
This means that the Complainant has consented for UPESO to contact her contact references and her contacts in case she continues to fail to pay her obligations with UPESO and to answer the calls and messages of UPESO.7
The Commission does not agree. Such vague and overbroad language in their loan agreement in no way complies with transparency, a general privacy principle. This is explained in the Implementing Rules and Regulations as such:
The data subject must be aware of the nature, purpose, and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of personal information controller, his or her rights as a data subject, and how these can be exercised. Any information and communication relating to the processing of personal data should be easy to access and understand, using clear and plain language.
While the Commission finds that the allegations of Complainant do not fall under the purview of the Data Privacy Act, it finds it necessary to emphasize the need for personal information controllers such as Respondent to inform their data subjects of the purpose of the processing of their personal information in “clear and plain language.”
The requirement to use clear and plain language does not mean using layman’s terms to substitute technical words at the risk of not capturing the complex concepts they represent. Rather, this requirement means that information should be provided in as simple a manner as possible, avoiding sentence or language structures that are complex.8 The information provided should be concrete and definitive; it should not be phrased in “abstract or ambivalent terms or leave room for different interpretations”9 such as in this case.
WHEREFORE, on the basis of this Complaint, the Commission hereby resolves to DISMISS the Complaint of RBB against Respondent UPESO.PH Lending.
This is without prejudice to the filing of appropriate civil, criminal or administrative cases against the Respondent before any other forum or tribunal, if any.
SO ORDERED.
Pasay City, 21 May 2020.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Copy furnished:
RBB Complainant
MANZANAL & ANG LAW OFFICES Counsel for Respondent
ENFORCEMENT DIVISION GENERAL RECORDS UNIT
Footnotes
-
Complaints-Assisted Form dated 25 July 2019, p. 19. ↩
-
Order to Confer for Discovery dated 25 July 2019. ↩
-
Order dated 17 October 2019. ↩
-
Comment dated 25 October 2019. ↩
-
Complaints-Assisted Form dated 25 July 2019, p. 5. ↩
-
Comment dated 25 October 2019, p. 8. Emphasis supplied. ↩
-
Ibid. ↩
-
See, Guidelines on transparency under Regulation 2016/679 of the Article 29 Working Party (2017). ↩
-
Ibid. ↩