NPC Issuance Wiki

NPC 18-109: ACN v. DT

Issued Decision

Decision Text

ACN,

Complainant,

-versus-

DT,

Respondent.

x---------------------------------------------x

AGUIRRE, D.P.C.:

Before this Commission is a Complaint filed by ACN (Complainant) against DT (Respondent) for an alleged violation of the Data Privacy Act of 2012 or Republic Act No. 10173 (DPA).

Facts

Complainant has been a licensed professional boxing judge since 22 September 2012 under the supervision and control of the Games and Amusement Board (GAB), Office of the President. He has officiated over three hundred ten (310) bouts, both local and international.1

Complainant alleged that he has been using the name “ACN-1” on the records of Boxrec.com, an online repository and record keeper of all boxing matches around the world, including data of boxers, referees, judges, among others.2 Complainant states that boxing organizations rely mainly on Boxrec.com, and this is where the experience, capacity, and competence of boxing officials are assessed.

He further states that the records in Boxrec.com serve as their service record.3

The Complaint-Affidavit further states:

  1. On 19 August 2018, Mr. DT, without my consent, modified and altered my personal details. My BOXREC name was changed to my birth name (from ACN-1 to ACN). I did searched (sic) for it myself last Monday 20 August 2018 and it yielded a negative result.

  2. I suffered sleepless nights, anxiety and panic as I thought my whole record in boxing has been lost.

  3. Then after this, I contacted another editor to “fix” this issue as I was surprised how this has happened.

  4. On Monday night, I was informed that my name has been restored back to its original state and that the responsible person of modifying and altering my name was Mr. DT, an editor of Boxrec… and his capacity to change data within that site.

On 05 December 2018, the parties were ordered to confer for discovery at the DICT Office, Morgan Street, Port Area, Cebu City. No settlement was reached during the discovery conference. On 17 December 2018, counsel for Respondent submitted through email its Entry of Appearance with Motion. In the same email, Respondent submitted his Position Paper dated 12 December 2018 as a responsive comment to the Complaint. A copy of the Entry was later filed through email and special courier. In the Position Paper, Respondent stated that he is one of the editors of www.boxrec.com, who is responsible for keeping the records of all boxers, referees, and judges updated and accurate.4

Respondent admitted that sometime in August 2018, in the performance of his functions, he updated several information contained in boxrec.com, including that of Complainant’s registered name, “ACN-1” to his birth name which is “ACN”.5

Respondent stated that, upon his discovery of the updating of his name to his birth name last 20 August 2018, Complainant contacted another editor of www.boxrec.com to address the issue. On the same day that Complainant discovered the update, the other editor of boxrec.com restored Complainant’s registered name back to “ACN-1”.6

Respondent refuted Complainant’s allegation that “to change ACN-1 into another name will render the search negative, and will result in fewer job opportunities, as it will show that I have no officiating record.” In his Position Paper, Respondent stated that:

Complainant’s job assignment as boxing judge emanates from the Games and Amusement Board and the boxing bodies such as the World Boxing Organization (WBO), International Boxing Federation (IBF), World Boxing Federation (WBF), World Boxing Foundation (WBF), among others. The GAB and the boxing bodies were the ones who issued licenses to the complainant as part of their pool of boxing judges. Before he was granted licenses by these offices or associations, his credentials and boxing officiating record was evaluated and scrutinized. GAB and these boxing bodies assign the complainant as judge because he was already licensed by them. If GAB (sic), these boxing bodies and any other future boxing organization which the complainant will apply (for) a license wants to check the officiating records of the complainant, they can easily search on the same website any name of the boxers or search the date of any boxing event that he has officiated previously and he could have easily discovered that his name is still listed as one of the judges in these fights. We also want to emphasize that GAB and all boxing bodies have a copy of the complainant’s passport issued by the Philippine Department of Foreign Affairs based on the foreign travels of the complainant which GAB and these boxing bodies have endorsed and processed, as the case may be. Hence, GAB and the boxing bodies know that the birth name of complainant is “ACN”.7

In his Reply to the Respondent’s Position Paper dated 27 December 2018, Complainant emphasized that the change of his name in Boxrec.com was without his consent. He alleged that:

  1. On 19 August 2018, Mr. DT without the Complainant’s consent, modified and altered his personal details – his BOXREC name – was changed (sic) to his birth name (ACN-1 to ACN).

  2. [T]his unauthorized changing of name is already an admission that he processed complainant’s personal information WITHOUT HIS CONSENT.8

On the basis of this, Complainant alleged that Respondent violated Section 16 of the DPA, which pertains to the Rights of the Data Subject. In his Reply, Complainant prayed for the following:

WHEREFORE, complainant ACN pray (sic) that this Honorable Commission renders judgment finding respondent DT guilty of unauthorized access or intentional breach which carries a fine of Five Hundred Thousand Pesos (Php 500,000.00).

Moral damages in the amount of Five Hundred Thousand Pesos (Php 500,000.00).

Actual damages and cost of suit in the amount of One Hundred Thousand Pesos (Php 100,000.00).

Respondents (sic) further pray for such other relief that may be deemed just and equitable under the premises.9

In a Rejoinder dated 11 February 2019, Complainant reiterated the same allegations stated in his Reply, thus:

BAD FAITH OR MALICE IS NOT NEEDED TO VIOLATE REPUBLIC ACT 10173 OR DATA PRIVACY ACT OF 2012

  1. The Data Privacy Act of 2012 or Republic Act 10173, particularly Sections 29 and 31, punishes both intentional and unintentional breach of the Data Privacy Act.

  2. Clearly, there was malice in this case. The unauthorized change affected the livelihood of complainant. By changing the name ACN-1 to ACN, it will cause negative search results on boxrec.com resulting in lost job opportunities as boxing stakeholders will not be able to find the complainant’s name there.10

On 05 February 2020, Complainant filed a Motion to Render Judgment.

Issues

  1. Whether the complaint may be dismissed for non-exhaustion of remedies;
  2. Whether Respondent is liable for unauthorized access or intentional breach under Section 29 of the DPA; and
  3. Whether Respondent is liable for malicious disclosure under Section 31 of the DPA.

Discussion

The complaint may be dismissed for non-exhaustion of remedies.

Section 4 of NPC Circular No. 16-04 (Rules of Procedure) provides the rule for the exhaustion of remedies:

Section 4. Exhaustion of remedies – No complaint shall be entertained unless:

a. The complainant has informed, in writing, the personal information controller or concerned entity of the privacy violation or personal data breach appropriate action on the same;

b. The personal information controller or concerned entity did not take timely or appropriate action on the claimed privacy violation or personal data breach, or there is no response from the personal controller within fifteen (15) days from receipt of information from the complainant;…11

In this case, the Complainant stated in his Complaint-Affidavit that his concern was addressed by the representatives of Boxrec.com immediately after it was raised. Respondent, in his Position Paper, even alleged that the restoration of Complainant’s name from “ACN” was restored to “ACN-1” on the same day. This was not refuted by Complainant in either his Reply or Rejoinder. Based on these, Complainant’s main concern of allegedly being unsearchable on Boxrec.com was addressed soon after the concern was raised. The Commission reiterates that, where circumstances permit, it is a condition precedent to the filing of complaints that complainants give the respondents the opportunity to address the complaints against them. While the same Section in the Rules of Procedure provides for exceptions to the requirement of exhaustion of remedies,12 the Commission finds that there is neither a serious violation of the DPA nor a risk of harm to the affected data subject present in this case to warrant the waiving of the requirement.

Respondent is not liable for unauthorized access or intentional breach under Section 29 of the DPA.

In his Complaint-Affidavit, Complainant alleged that the Respondent amended his information in the Boxrec.com website without his consent in violation of Section 16 of the DPA:

  1. Having no idea about his motive/s behind this malicious act, I come to you to file this FORMAL COMPLAINT against this person. Under the Data Privacy Act of 2012 (Republic Act 10173), specifically Chapter IV Sec 16 which partly reads “… Any information supplied or declaration made to the data subject on these matters shall not be amended without prior notification of data subject…”

  2. And, having done this amendment to my private confidential BOXREC record without my prior consent is in fact violative of RA 10173 and, as a result, have put me in a disadvantaged position basically on the thought that he can just tinker with my personal data without me knowing it? What if I haven’t known it quickly enough? I would have been “inexistent” without my knowledge? Worst, what if he decides to put it onto another name altogether? That would be a disaster to me and my career as a boxing judge.13

In his Reply to Respondent’s Position Paper, the Complainant alleged that the unauthorized changing of his name constitutes processing of his personal information without his consent:

  1. On 19 August 2018, Mr. DT, without the Complainant’s consent, modified and altered his personal details. His BOXREC name was changed to his birth name (from ACN-1 to ACN).

  2. This fact is readily admitted by respondent in paragraph 4 of his position paper where he said it was in the performance of his function as an editor of www.boxrec.com that he updated several information and updated complainant’s registered name “ACN-1” to his birth name, “ACN”. This unauthorized changing of name is already an admission that he processed complainant’s personal information WITHOUT HIS CONSENT.14

Further, in Complainant’s Rejoinder, he stated thus:

  1. There was never any consent from the data subject, ACN to change his personal information his name (sic) from ACN-1 to ACN.

xxx

  1. It is clear that respondent modified and tampered the “Personal Information” of complainant. Personal information refers to any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.

THERE WAS AN INTENTION TO MAKE ACN’S PROFILE INVISIBLE TO PROSPECTIVE EMPLOYERS NO MATTER HOW SHORT OF SPAN OF TIME

  1. The complainant was not informed or consented to the change in his personal information or nickname in boxrec.com. The actions of Respondent in changing the name and start date of complainant’s career as a judge is unlawful and a violation of his rights as a data subject.15

The pertinent provision on unauthorized access or intentional breach in the DPA provides:

SEC. 29. Unauthorized Access or Intentional Breach. – The penalty of imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00) shall be imposed on persons who knowingly and unlawfully, or violating data confidentiality and security data systems, breaks in any way into any system where personal and sensitive personal information is stored.

For a person to be held liable under this provision, the following elements must be met:16

  1. The data system stores personal or sensitive personal information;
  2. The accused breaks into the system; and
  3. The accused knowingly and unlawfully broke into the system in a manner which violates data confidentiality and security of the same.

The allegations of both parties reveal that the second and third elements are not present in this case. Respondent did not break into the system of Boxrec.com much less did it in a manner that violates the data confidentiality and security of the same.

In his Complaint-Affidavit, Complainant admits that Respondent is an editor of Boxrec.com, thus:

On Monday night, I was informed that my name has been restored back to its original state and that the responsible person of modifying (sic) and altering my name was Mr. DT, an editor of Boxrec… and has the capacity to change data within that site.17

Respondent likewise stated in his Position Paper that:

Respondent DT is an editor of www.boxrec.com, a free-of-charge and public website which keeps records of all boxing bouts worldwide including records of boxers, referees and judges. One of his functions is to keep the records of said boxers, referees, and judges, including that of complainant, updated and accurate.18

It is therefore undisputed that, as an editor of Boxrec.com, Respondent’s access to the database of the website is lawful. Respondent, therefore, cannot be held liable for unauthorized access or intentional breach under Section 29 of the DPA.

On the Complainant’s assertions that he did not give his consent to his name being updated on the website, it must be clarified that the lack of consent did not change the nature of Respondent’s access and make it unlawful all of a sudden. The information involved in this case is the name of the Complainant which is classified as personal information.

The Commission takes this opportunity to stress that consent is not the only lawful basis to process personal or sensitive personal information under the DPA. Even a cursory look at Sections 12 and 13 of the DPA will show that there are other lawful criteria to process personal information and sensitive personal information aside from consent.19

In describing the nature of Boxrec.com, Complainant explains that it is “an online repository, record keeper of all boxing matches around the world, including data of boxers, referees, judges, among others…”20

As the “online record keeper of the sport of boxing,” Complainant should have known that Boxrec.com updates the information on its website as a matter of course even without the consent of boxers, referees, and judges.21 This is part of its legitimate interest and is an integral part of maintaining its credibility as the official record keeper for the sport of professional boxing.

This is consistent with Respondent’s allegations in his Position Paper, which state:

The information must at all times be accurate, relevant and updated for purposes for which it was processed and stored in the first place. The respondent, in processing complainant’s personal information in the website of boxrec.com, merely updated the same to reflect the accurate and true name of the latter which is the aim of the website. There is no showing that respondent tried to tamper or to attribute the credentials of the complainant to another person or to completely delete the latter’s personal information in (sic) the website.22

Respondent is not liable for malicious disclosure under Section 31 of the DPA.

The Complainant also alleged that Respondent should be liable for Malicious Disclosure. Section 31 of the DPA provides:

SEC. 31. Malicious Disclosure. – Any personal information controller or personal information processor or any of its officials, employees or agents, who, with malice or in bad faith, discloses unwarranted or false information relative to any personal information or personal sensitive information obtained by him or her, shall be subject to imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).

Malicious disclosure is committed when:

  1. The accused is a personal information controller or a personal information processor or any of its officials, employees or agents;
  2. The accused made a disclosure of information;
  3. The information disclosed was unwarranted or false information;
  4. The information relates to any personal information or sensitive personal information;
  5. The information was obtained by the accused; and
  6. The disclosure was made with malice or in bad faith.23

It is important to note that the Respondent altered Complainant’s personal information by changing his registered nickname “ACN-1” to his birth name “ACN.”

In relation to the third element, the Commission finds that the change made by Respondent involved neither unwarranted nor false information on the records of Complainant. On the contrary, it was Complainant’s actual name that was made to appear on the website.

Furthermore, for Section 31 of the DPA to apply, the sixth element of malice or bad faith must be present.

The Supreme Court defines malice as one which “connotes ill will or spite and speaks not in response to duty but merely to injure the reputation of the person defamed, and implies an intention to do ulterior and unjustifiable harm.”24

In this case, Complainant did not present any evidence to support his allegations that Respondent acted with ill will, spite, or any intention to do unjustifiable harm. The Supreme Court has ruled in several occasions that mere allegations do not constitute proof:

In administrative proceedings, the quantum of proof necessary for a finding of guilt is substantial evidence, which is that amount of relevant evidence that a reasonable mind might accept as adequate to support a conclusion. Further, the complainant has the burden of proving by substantial evidence the allegations in his complaint. The basic rule is that mere allegation is not evidence and is not equivalent to proof. Likewise, charges based on mere suspicion and speculation cannot be given credence.25

On the other hand, Respondent sufficiently explained in his Position Paper that there was no “intention to do ulterior and unjustifiable harm,” thus:

We would also want to emphasize that GAB and all boxing bodies have a copy of the complainant’s passport issued by the Philippine Department of Foreign Affairs based on the foreign travels of the complainant which GAB and these boxing bodies have endorsed and processed, as the case may be. Hence, GAB and the boxing bodies know that the birth name of complainant is “ACN”.

In short, the change or update neither harmed nor caused any damage to the complainant. His record with the website is intact after all. The seeming anxiety, worry and fear of the complainant were not caused by the action of the respondent, by any stretch of the imagination.

Without the presence of the essential elements of Sections 29 and 31 of the DPA, the Complaint against Respondent must be dismissed.

WHEREFORE, premises considered, this Commission resolves that the instant Complaint filed by ACN against DT is hereby DISMISSED. The prayer for actual and moral damages is likewise DENIED.

SO ORDERED.

City of Pasay, Philippines. 01 June 2021.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

JOHN HENRY D. NAGA Deputy Privacy Commissioner

Copy furnished:

ACN Complainant

EPE ENRIQUEZ & QUIAMBAO Counsel for Respondent

DT Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Records, p. 1. ↩

  2. Ibid. ↩

  3. Ibid. ↩

  4. Records at 6. ↩

  5. Ibid. ↩

  6. Ibid. ↩

  7. Position Paper dated 12 December 2018. ↩

  8. Records at 7. ↩

  9. Id., at 21-22. ↩

  10. Id., at 25-26. ↩

  11. NPC Circular 16-04 dated 15 December 2016, Section 12. Emphasis supplied. ↩

  12. See, NPC Circular 16-04 dated 15 December 2016, Section 12. ↩

  13. Complaint-Affidavit dated 24 August 2018. ↩

  14. Reply to Respondent’s Position Paper dated 27 December 2018. ↩

  15. Records at 26-29. ↩

  16. Element requirements from SEC. 29 of the DPA. ↩

  17. Id., at 2, Emphasis supplied. ↩

  18. Id., at 5. ↩

  19. The DPA permits processing on other lawful bases including necessity for fulfilling contracts, legal obligations, protecting vital interests, responding to emergencies, or pursuing legitimate interests of the controller or third parties. ↩

  20. Records, p.1. ↩

  21. “BoxRec About Us” page available at: Boxrec.com/en/about, last accessed on: 24 June 2021. ↩

  22. Id., at 9. ↩

  23. NPC 19-605, 05 November 2020. ↩

  24. Delgado v. HRET, G.R. No. 219603, 26 January 2016. ↩

  25. BSA Tower Condominium Corp. v. Reyes, II, A.C. NO. 11944, 20 June 2018. ↩

Backlinks