NPC Issuance Wiki

NPC 19-621: AMP v. Hupan Lending Technology, Inc. (Cash Me)

Issued Decision

Decision Text

AMP,

Complainant,

-versus-

HUPAN LENDING TECHNOLOGY, INC. (CASH ME),

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.:

Before this Commission is a Complaint filed by AMP (Complainant) against Hupan Lending Technology, Inc. (Cash Me) (Respondent) for a violation of the Data Privacy Act of 2012 (DPA).

Facts

Complainant, using the Complaints-Assisted Form, described his complaint as “threatening or all contacts will receive message (sic) regarding unsettled amount.”1 He stated that his credibility was affected and that all his co-workers and family members complained about the calls and text messages they have received.2 He alleges that he was humiliated and embarrassed.3 Complainant indicated that he is seeking a temporary ban on Respondent’s processing.4

The parties were ordered to appear for discovery conference on 13 September 2019.5 Both parties failed to appear on the said date, causing the discovery conference to be reset on 12 December 2019.6

On the second discovery conference, Complainant failed to appear while Respondent was present. The Respondent was then ordered to submit its Responsive Comment.7

In its Responsive Comment, Respondent contended that Complainant willingly and knowingly gave his consent to them, thus:

  1. It is worthy to note that Complainant AMP willingly and knowingly gave his consent to Respondent Hupan Lending Technology Inc. (Cash Me) through its Mobile App to make and manage phone calls, to access photos, media and files on his device as can be shown in Annex “C” and “C-1”. Consent is acquired before any customer-borrower may start processing the loan application. It was also clear in the Privacy Policy of what kind of information needs to be collected, one of which is the communication information containing call history, sms (sic), CONTACTS and more.

xxx

  1. Moreover, the Authorization Letter of Information found at the end of the process of the loan application expressly stated that borrower-customer is granting Respondent Hupan Lending Technology Inc. (Cash Me) to use the contacts and addresses provided for collection purposes when the applicant’s loan becomes overdue.

  2. Assuming arguendo that messages were sent by Respondent Hupan Lending Technology Inc. (Cash Me) pending presentation of those messages, there was no violation committed as there was a proper consent obtained from Complainant AMP to use other ways, such as contacts and addresses, for collection purposes when Complainant AMP defaulted in his loan as provided in the Authorization Letter of Information which Complainant AMP agreed upon during his loan application. xxx8

Issues

  1. Whether Respondent committed a violation of the Data Privacy Act that warrants a recommendation for prosecution; and

  2. Whether a temporary ban should be issued against Respondent’s processing of personal data.

Discussion

The Complaint does not warrant a recommendation for prosecution of a violation under the Data Privacy Act

The Complaint alleged that certain messages were sent by Respondent to his contacts. The Complaint, however, did not specify the content of these forwarded text messages. Aside from allegations that his co-workers and family members complained about the calls and text messages they received from Respondent, Complainant has not offered any proof of the existence of the messages supposedly sent by Respondent to these third parties.

Despite the opportunities given to Complainant to substantiate his allegations during the two (2) discovery conferences scheduled on 13 September 2019 and 12 December 2019, Complainant failed to appear without notice or justification.

Given all these, the Commission is left without any basis to recommend Respondent for prosecution under the Data Privacy Act, considering it is bound to adjudicate following the NPC Rules of Procedure, which provides:

Section 22. Rendition of decision. – The Decision of the Commission shall adjudicate the issues raised in the complaint on the basis of all the evidence presented and its own consideration of the law.9

As the Supreme Court held in Government Service Insurance System v. Prudential Guarantee, “it is basic in the rule of evidence that bare allegations, unsubstantiated by evidence, are not equivalent to proof. In short, mere allegations are not evidence.”10

As such, in the absence of sufficient evidence to support Complainant’s allegations that Respondent disclosed his personal information to his contacts, it cannot be said that Respondent committed an act that would constitute the prohibited acts of unauthorized processing11 or processing for an unauthorized purpose.12

The Complaint does not warrant the issuance of a temporary ban

In his Complaints-Assisted form, Complainant applied for a temporary ban on Respondent’s processing of his personal data based on the ground of “privacy invasion.”13 This is governed by NPC Circular 16-04 (NPC Rules of Procedure) which provides:

Section 19. Temporary Ban on Processing Personal Data. – At the commencement of the complaint or at any time before the decision of the National Privacy Commission becomes final, a complainant or any proper party may have the National Privacy Commission, acting through the investigating officer, impose a temporary ban on the processing of personal data, if on the basis of the evidence on record, such a ban is necessary in order to preserve the rights of the complainant or to protect national security or public interest.

a. A temporary ban on processing personal data may be granted only when: (1) the application in the complaint is verified and shows facts entitling the complainant to the relief demanded, or the respondent or respondents fail to appear or submit a responsive pleading within the time specified for within these Rules; xxx14

Not having presented any evidence, much less substantial evidence, Complainant’s application for the issuance of a temporary ban is denied.

Nevertheless, the Commission notes that Respondent misunderstands the DPA in asserting that they obtained Complainant’s consent to access his contacts.15

Notably, the “consent” form that appears on the screen of the customer-borrowers upon download of the application merely asks:

Allow cm to make and manage phone calls? (Deny, Allow)16

xxx

Allow cm to access photos, media and files on your device? (Deny / Allow)17

The Privacy Policy attached by Respondent only states “anti-fraud services” as the purpose for obtaining the customer-borrower’s communication information, thus:

  1. What kind of information needs to be collected? xxx

  • Communication information. Call history, sms, contacts and more.

xxx

  1. How to use customer information? xxx

  • Communication information. Based on the consent of the customer, the data reported to the server, the information will be used for anti-fraud services. xxx18

Respondent likewise asserts in its Responsive Comment that the Authorization Letter of Information should also serve as a justification of consent from Complainant.

A look at the Authorization Letter of Information, however, would show that it only refers to emergency contacts and not the entirety of the contacts in Complainant’s phone book:

Important Note:

xxx

The applicant has already clearly understand and accept the Cash Lending service from Hupan Lending Technology Inc. (Cash Me) Lending Technology Inc the person will provide the emergency contact to objectively evaluate the credit level and lending amount and supply the good service for the applicant.

The applicant will agree and grant that Hupan Lending Technology Inc. (Cash Me) Lending Technology Inc can use the other contact ways and address provided for collection when the applicant is overdue for repayment.19

Personal information controllers who rely on consent as basis to process their information must ensure that such consent is “freely given, specific, and an informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her.”20

The data subject must be informed of all the personal information intended to be collected. In this case, the Commission notes that the Privacy Policy and Authorization Letter of Information did not adequately inform the customer borrowers of the full extent of the intended processing. It only stated that it will process the customer-borrower’s emergency contacts, which the Complainant may easily accept as an industry practice. This notice to the customer-borrower, however, is inconsistent with the allegations in the Complaint that all of Complainant’s co-workers and family members received messages of his unsettled loan.21

Uninformed consent cannot be considered as valid consent.

The Commission likewise notes that the Authorization Letter of Information contains ambiguous statements such as how “Hupan Lending Technology Inc. (Cash Me) can use the other contact ways and address provided for collection when the applicant is overdue for repayment.”22 The broad statement of purpose for processing cannot be considered as compliant with the general privacy principle of transparency.

The DPA’s Implementing Rules and Regulations explain the principle of transparency, thus:

The data subject must be aware of the nature, purpose, and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of personal information controller, his or her rights as a data subject, and how these can be exercised. Any information and communication relating to the processing of personal data should be easy to access and understand, using clear and plain language.

While the Commission finds that the allegations of Complainant are not sufficiently substantiated to warrant a recommendation for prosecution, it finds it necessary to emphasize the need for personal information controllers, such as Respondent, to inform their data subjects of the nature and purpose of the processing of their personal information in “clear and plain language.” The requirement to use clear and plain language does not mean using layman’s terms to substitute technical words at the risk of not capturing the complex concepts they represent. Rather, this requirement means that information should be provided in as simple a manner as possible, avoiding sentence or language structures that are complex.23 The information provided should be concrete and definitive; it should not be phrased in abstract or ambivalent terms or leave room for different interpretations24 such as in the above-cited provision which states that “Hupan Lending Technology Inc. (Cash Me) can use the other contact ways and address provided for collection when the applicant is overdue for repayment.”

WHEREFORE, all the above premises considered, the Complaint by AMP against Hupan Lending Technology Inc. (Cash Me) is hereby DISMISSED.

This is without prejudice to the filing of appropriate civil, criminal or administrative cases against the Respondent before any other forum or tribunal, if any.

SO ORDERED.

Pasay City, Philippines; 19 November 2020.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

JOHN HENRY D. NAGA Deputy Privacy Commissioner

Copy furnished:

AMP Complainant

ACA Counsel for Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Complaints-Assisted Form received on 26 July 2019. ↩

  2. Ibid. ↩

  3. Ibid. ↩

  4. Ibid. ↩

  5. Order dated 26 July 2019. ↩

  6. Order dated 17 December 2019. ↩

  7. Order dated 12 December 2019. ↩

  8. Responsive Comments dated 20 December 2019. ↩

  9. NPC Circular No. 16-04 dated 15 December 2016 (“NPC Rules of Procedure”), Section 22. Emphasis supplied. ↩

  10. G.R. No. 165585, 20 November 2013, citing Real v. Belo, 542 Phil. 109 (2007). ↩

  11. Republic Act No. 10173, Section 25. ↩

  12. Id., at Section 28. ↩

  13. Supra, Note 1. ↩

  14. NPC Circular No. 16-04 dated 15 December 2016 (“NPC Rules of Procedure”), Section 19. ↩

  15. Supra, Note 9. ↩

  16. Supra, Note 8 at Annex C. ↩

  17. Ibid, at Annex C-1. ↩

  18. Ibid, at Annex D. ↩

  19. Ibid, at Annex F. Emphasis supplied. ↩

  20. Republic Act No. 10173, Section 3(b). Emphasis supplied. ↩

  21. Supra, Note 1. ↩

  22. Supra, Note 8 at Annex F. ↩

  23. See, Guidelines on transparency under Regulation 2016/679 of the Article 29 Working Party (2017). ↩

  24. Ibid. ↩

Backlinks