NPC Issuance Wiki

NPC 19-0048: GJ v. VMJ and MTP

Issued Decision

Decision Text

GJ,

Complainant,

-versus-

VMJ and MTP,

Respondents.

x--------------------------------------------x

NAGA, D.P.C.:

Before this Commission is a Complaint filed by GJ (Complainant) against VMJ and MTP (Respondents) for a violation of the Data Privacy Act of 2012 (DPA).

Facts

The parties are employees of DFXX. Complainant is an Insurance Section Supervisor of the International Department under the Finance Division, while Respondent VMJ is the Officer-in-Charge (OIC) of the Management Information Services Division (MSD) and concurrent Manager of the Manpower Development Department (MDD), and Respondent MTP is the OIC of the Human Resource Division (HRD).

On 24 April 2018, Complainant was allegedly requested by Respondent VMJ for an immediate meeting to inquire details regarding her notice of disallowance that she, along with her co-employee refused to submit a reply to considering their previous submission.1

On the same week, Complainant came to know from an unnamed concerned employee that copies of her training certificates were allegedly collected by Respondent VMJ from the training section without proper endorsement and request filed with the Human Resource Information Section (HRIS).

On 07 May 2018, Complainant sent a letter to Respondents stating that the DPA requires that all personal information must be collected for reasons that are specified, legitimate, and reasonable.2

On 15 May 2018, Complainant received Respondent VMJ’s reply wherein the latter explained that her function includes the evaluation and ascertainment of the completeness of documents to accomplish the docketing process. Further, Respondent VMJ alleged that no breach of data privacy was committed as the information or document collected was specific, the circumstances for requesting it were legitimate and reasonable and for internal use only.3

Complainant responded to both Respondents by sending her own reply.4 The reply mainly refuted Respondents’ claim and maintained that there was a violation of data privacy. Further, she allegedly requested for a certified true copy of the memorandum (HRMD-MDD-20XX-XX) from HRD on 06 July 2018. The request was denied.5

On 31 January 2019, Complainant filed the instant Complaint before the Commission. She alleged that Respondent VMJ’s collection of the copies of her training certificates from Training Section-MDD without properly endorsing his request to the HRIS is a violation of her data privacy rights. Complainant manifests that her training certificates and 201 file are the personal information affected by the act of Respondents. Thus, she prayed for all the reliefs allowed by law and that the Commission impose the corresponding penalty for violation of the DPA. Likewise, a prayer to order Respondents to cease and desist from performing any act prohibited under the said law.6

The parties were ordered to appear before the Commission to confer for discovery on 17 April 2019.7 Acting on a request from Respondents to reschedule the discovery conference, an Order dated 10 April 2019 was issued rescheduling the discovery conference to 30 April 2019.8

During the discovery conference, both parties were present9 and signified their willingness to enter into amicable settlement through an application for mediation. Correspondingly, an Order10 to mediate was issued for the parties to appear at the preliminary mediation conference which was scheduled on 07 June 2019.11

On 07 June 2019, there being no settlement reached by the parties,12 they were ordered to appear before the Commission for the resumption of complaint proceedings on 02 July 2019.13

During the second discovery conference, both parties were present.14 Considering the manifestation of the parties, Respondents were given ten (10) days to file their Responsive Comment while Complainant was also given ten (10) days from receipt of the Responsive Comment to file her Reply. In addition, Respondents were given an option to file their Rejoinder within ten (10) days from receipt of the Reply.15

On 15 July 2019, a Responsive Comment was jointly filed by Respondents and prayed that the instant Complaint be dismissed for lack of cause of action.16

As alleged by Respondents, during an examination of documents forwarded to the office for the liquidation of a training attended to by Complainant, it was discovered that the training directive was not part of the documentation. Respondents clarified that what was retrieved from the Training Section-MDD was a training directive and not a training certificate. Respondents manifest that the retrieval of the said training directive was necessary as it is part of the documentation requirement needed to be attached for liquidation purposes and the intention in retrieving the training directive is to attest to the fact that the said training passed through proper procedure.17

In the memorandum-reply dated 15 May 2018 of Complainant, Respondent VMJ alleged that he replied to the same on 07 May 2018. He explained that as part of the functions of his office, he has the authority to retrieve the training directive from the Training Section-MDD department. Respondent VMJ further explained that the retrieval of the training certificate was intended to establish a fact that Complainant attended the required training and that any issues on the said training will be settled.18

Respondents claimed that no breach of data privacy was committed as the information collected was specific, circumstances were legitimate, reasonable and for internal use only, which is intended to settle the liquidation of funds used for a particular training. Further, Complainant did not indicate in the Complaint when and how the Complainant’s 201 file was retrieved.19

In addition, Respondents argued that the Complaint should not have been entertained. They claim that the Complaint was filed in 31 January 2019, seven (7) months and twenty-four (24) days after Complainant’s last communication was transmitted to Respondents. Such act failed to conform to exhaustion of remedies under Section 4 (c) of NPC Circular No. 16-04.20

Respondents stressed that the training directive is evidence that the training to be attended has been authorized by the office and obligates the employee to attend. It contains the name and position of the personnel, details of the training and the required submission. Respondents claims that it does not contain sensitive personal information as defined by Section 3 (l) of the DPA.21

On 23 July 2019, Complainant filed her Reply dated 18 July 2019 wherein she prayed that such Reply be given due credence and consideration and the reliefs prayed for in the Complaint be granted.

Complainant contended that she strongly disagree with the position of the Respondents as there are conflicting statements in Respondents’ Responsive Comment.22

First, Complainant alleged that it is highly impossible that there is a liquidation of training attended by her because the training was from 25-27 April 2017 and the liquidation was done allegedly on the latter part of 2018 for which a clearance was issued to her indicating that liquidation was already completed.23

Second, Complainant claims that Respondents’ clarification for retrieving a training directive and not a training certificate is against what was clearly indicated in the Memorandum 15 May 2018. In the Memorandum, Respondents stated that a training certificate was retrieved. Such admission was made to justify that the retrieval of the certificate was intended to establish a fact where an issue on a training was being settled.24

Third, Complainant refutes that the validation and verification if a training passed through the proper procedure is Respondents’ function. Their duty only includes receiving the documents submitted to them and not the one who complete it. Complainant further allege that Respondents are incorrect in saying that there was no breach of data privacy as the information was specific, the circumstances for obtaining the copy was legitimate, reasonable and for internal use only. However, the purpose for which the information was taken, without her consent, is malicious.25

Fourth, Complainant stressed that the Commission may accept complaints even after the lapse of six (6) months period from the occurrence of the claimed privacy violation or personal data breach, at its discretion and expounded that the violation of DPA applies to all types of personal information.26

Fifth, Complainant argued that violation of the DPA does not only involve sensitive personal information. The law applies to all types of personal information as provided by Section 4 of the DPA.27

On 05 August 2019, the Commission received Respondents’ Rejoinder to the Reply of the Complainant wherein Respondents’ reiterated its prayer for dismissal for lack of cause of action.28

In the said Rejoinder, Respondents denied Complainant’s claim that their statements are conflicting in relation to the supposed liquidation that was done during the latter part of 2018 which, according to them, Complainant’s claim has no basis, as no such statement was made and said date of liquidation is immaterial.29

Respondents reiterated their allegations that what was retrieved is a training directive and not a training certificate. Nonetheless, whether it was a directive or certificate, MDD has a file of all company-funded trainings by reason of its function. Should a document relative to a training is lacking, furnishing a copy of the required document for the purpose of completing it is acted upon. The submissions are intended to fully account for expenses disbursed in relation to company-funded trainings and the retrieval and use of a training document can neither be malicious since it is for a legitimate purpose, which is to account for a disbursement of government funds.30

Respondents countered Complainant’s fourth point by admitting that the Commission may waive the timeliness of the filing of the complaint but contended that the seriousness of the damage or risk of harm was not shown and likewise does not correspond with Complainant’s procrastinated move.31

Finally, Respondents states that there was no processing of personal information made in the instant case. Retrieval of an official training document of a government employee using government funds for an officially sanctioned activity neither constitute processing nor a disclosure of personal information protected by the DPA.32

Issue

  1. Whether the Complaint should be dismissed for being filed out of time as provided under Section 4 (c) of the NPC Circular No. 16-04; and

  2. Whether Complainant was able to prove that Respondents committed a violation of the DPA.

Discussion

The instant Complaint lacks merit.

Complainant is Exempted from Section 4 of the NPC Circular No. 16-04

As provided by Section 4 of NPC Circular No. 16-04 or the NPC Rules of Procedure, the Commission has the sole discretion to waive the rule on period of filing upon good cause shown, or if the complaint involves a serious violation or breach of the DPA, taking into account the risk of harm to complainant, to wit:

SECTION 4. Exhaustion of remedies. – No complaint shall be entertained unless:

a. the complainant has informed, in writing, the personal information controller or concerned entity of the privacy violation or personal data breach to allow for appropriate action on the same;

b. the personal information controller or concerned entity did not take timely or appropriate action on the claimed privacy violation or personal data breach, or there is no response from the personal information controller within fifteen (15) days from receipt of information from the complaint; and

c. the complaint is filed within six (6) months from the occurrence of the claimed privacy violation or personal data breach, or thirty (30) days from the last communiqué with the personal information controller or concerned entity, whichever is earlier.

The failure to comply with the requirements of this Section shall cause the matter to be evaluated as a request to the National Privacy Commission for an advisory opinion, and for the National Privacy Commission to take such further action, as necessary. The National Privacy Commission may waive any or all of the requirements of this Section, at its discretion, upon good cause shown, or if the complaint involves a serious violation or breach of the Data Privacy Act, taking into account the risk of harm to the affected data subject. (Emphasis Supplied)

Likewise, Section 2, Rule II of the NPC Circular No. 2021-01 or the NPC 2021 Rules of Procedure, has further provided circumstances wherein the Commission should take into consideration if it wishes to exercise such waiver, viz:

SECTION 2. Exhaustion of remedies. – No complaint shall be given due course unless it has been sufficiently established and proven that:

xxx

The NPC may waive any or all of the requirements of this Section at its discretion upon (a) good cause shown, properly alleged and proved by the complainant; or (b) if the allegations in the complaint involve a serious violation or breach of the Data Privacy Act of 2012, taking into account the risk of harm to the affected data subject, including but not limited to:

i. when there is grave and irreparable damage which can only be prevented or mitigated by action of the NPC;

ii. when the respondent cannot provide any plain, speedy or adequate remedy to the alleged violation; or

iii. the action of the respondent is patently illegal.

In addition, as held by the Commission in the case of NPC 19-030 and NPC 19-132,33 it has been emphasized that despite the failure to exhaust all remedies under Section 4 of NPC Circular No. 16-04, the Commission has its discretionary power to waive the requirements under the said Section grounded on good cause shown, or if the complaint involves a serious violation or breach of the DPA, taking into account the risk of harm to complainant.

Moreover, in NPC Case No. 19-528, the Commission states the purpose of Section 4 of NPC Circular No. 16-04 which is to prevent the unduly clogging of the Commission’s docket and avoid instances of dismissing a case based on mere technicalities.34

In consideration of the Rules and preceding decisions, the Commission weighed and found that herein Complainant was able to file a complaint which demonstrated good cause to justify the waiver of the procedural requirement.

In contrary with Respondents’ contention that the seriousness of the damage or the risk of harm towards Complainant was not shown and does not correspond with Complainant’s belated filing, the allegations in the instant Complaint posed a serious risk or harm committed by Respondents that if proven and not acted upon, may lead to grave injustice to Complainant since it involves the processing of Complainant’s training certificates without proper endorsement and request from the HRIS. In addition, Complainant likewise manifests that her 201 files were affected by the act of Respondents. Hence, the Commission deems it proper to waive the requirement under Section 4 of NPC Circular No. 16-04.

Complainant Failed to Prove that Respondents Violated the DPA

It has been numerously held by the Commission that unsubstantiated allegations by either the complainant, respondent or both, cannot merit a favorable decision from the Commission and would warrant a dismissal of the case.

As previously held by the Commission in NPC Case No. 19-569, a complaint bearing only allegations without any corresponding pieces of evidence to support complainant’s claim cannot merit a favorable decision from this Commission, to wit:

As the Supreme Court held in Government Service Insurance System v. Prudential Guarantee, “it is basic in the rule of evidence that bare allegations, unsubstantiated by evidence, are not equivalent to proof. In short, mere allegations are not evidence.”35

Further, as held by the Supreme Court in the case of Wong v. Wong, “The rule is well-settled that he who alleges a fact has the burden of proving it and a mere allegation is not evidence. Thus, his self-serving assertion cannot be given credence.”36

Hence, bearing only allegations without any corresponding pieces of evidence to support Complainant’s claim that Respondent disclosed her personal information which includes the details about her unsettled obligation to her contact list, from which caused her sleepless night and embarrassment, cannot merit a favorable decision from this Commission.37

Moreover, in NPC Case No. 19-612, the Commission likewise dismissed the case for lack of merit as the complainant in the case did not attached any evidence to support her claim, viz:

In this case, Complainant alleged that Respondent contacted Complainant’s manager, superior and other people in her contact list which allegedly were not registered as contact reference in her loan application and informed them about her unpaid loan. Records show that Complainant have not attached any evidence to support her claim. In addition, Complainant was given a chance to substantiate her allegations during the discovery conference. However, Complainant was absent on both dates scheduled for the said discovery conference. More so, she failed to justify her absence. Accordingly, Complainant failed to substantiate the allegations she leveled against Respondent with proof required by law despite being given the opportunity to do so. Other than her bare allegations there is nothing in the records that would indicate that Respondent indeed violated the DPA.

With the foregoing, Complainant’s unsubstantiated allegations remain as mere allegations which cannot be accepted as proof. Hence, the Commission so hold that if a complaint against a corporation holds no basis whatsoever in fact or in law, the Commission will not hesitate to dismiss the case due to a groundless allegation.38

In addition, NPC Case No. 18-135 was dismissed as the Commission cannot rely on mere allegations that is not supported by substantial evidence, to wit:

In this case, the Complainant was not able to provide substantial evidence to prove the alleged recording of his phone calls without his consent. He did not adduce any evidence that could substantiate the existence thereof. Bare allegations, unsubstantiated by evidence, are not equivalent to proof.39

The Commission is bound to adjudicate complaints following Section 22 of NPC Circular 16-04, which provides:

Section 22. Rendition of decision. – The Decision of the Commission shall adjudicate the issues raised in the complaint on the basis of all the evidence presented and its own consideration of the law. (Emphasis supplied)

In view of the foregoing, this Commission finds that there is insufficient information to substantiate the allegations of Complainant in the instant complaint against Respondents. Therefore, the Complaint must be dismissed for lack of merit. The Commission cannot rely on mere allegations that is not supported by substantial evidence.40

In the present case, Complainant neither specified the particularity of the certificates nor presented pieces of evidence that would substantiate her claim of unauthorized collection. Despite having discovered the alleged violation through a concerned employee, Complainant did not include such material testimony or documentary evidence to support and justify her claim. In addition, Complainant failed to provide an evidence that her training certificate were actually retrieved. She merely anchored her allegations on Respondents’ reply which was the memorandum (HRMD-MDD)-20XX-XX dated 15 May 2018 which mentions the retrieval of a training certificate. This memorandum was the reply to Complainant’s 07 May 2018 Memorandum.

Moreover, Complainant alleged in her Complaint that her 201 files were affected. However, no discussion were made in her Complaint on how such files were affected and violated the DPA.

In consideration of the foregoing, the Commission cannot merely rely on the allegations of Complainant in order to decide in her favor. Hence, the Commission finds to dismiss this case.

Respondents Were Acting Within the Bounds of Their Official Function

Consent is not the only lawful basis for processing of personal information.41 As provided by Section 12 (f) of the DPA, one of the criteria to lawful processing of personal information is if the processing is necessary for the purposes of the legitimate interests pursued by the personal information controller, viz:

SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

xxx

(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.42

Based on records43, one of the functional statements of MDD is managing training programs and maintaining employees’ records of trainings and seminars attended, among others. Hence, the retrieval of the training certificates or training directive, by reason of Respondents’ function, is within their authority.

Further, as government employees performing an official act, Respondents have in their favor the presumption of regularity in the performance of official duties.44 However, Complainant failed to refute this presumption by clear and convincing evidence. Hence, such presumption stands.

WHEREFORE, all the above premises considered, this Commission resolves that the instant complaint filed by GJ against VMJ and MTP is hereby DISMISSED for lack of merit.

SO ORDERED.

Pasay City, Philippines. 17 September 2021.

JOHN HENRY D. NAGA Deputy Privacy Commissioner

WE CONCUR:

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

Copy furnished:

GJ Complainant

VMJ Respondent

MTP Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Complaint-Assisted Form (CAF), received on 01 February 2019. ↩

  2. Memorandum re: Training Certificates dated 07 May 2018. ↩

  3. Memorandum (HRMD-MDD)-29XX-XX dated 15 May 2018. ↩

  4. Memorandum re: Training Certificates dated 04 June 2018. ↩

  5. Complaint-Assisted Form (CAF), received on 01 February 2019. ↩

  6. Id. ↩

  7. Order to Confer for Discovery dated 23 March 2019. ↩

  8. Order 10 April 2019. ↩

  9. Attendance Sheet for Discovery Conference dated 30 April 2019. ↩

  10. Order to Mediate dated 30 April 2019. ↩

  11. Order dated 30 April 2019. ↩

  12. Notice of Non-Settlement of Dispute dated 07 June 2019. ↩

  13. Order for Resumption of Complaint Proceedings dated 07 June 2019. ↩

  14. Attendance Sheet for Discovery Conference dated 02 July 2019. ↩

  15. Order dated 02 July 2019. ↩

  16. Responsive Comment received on 15 July 2019. ↩

  17. Id. ↩

  18. Memorandum re: Training Certificates dated 07 May 2018. ↩

  19. Responsive Comment received on 15 July 2019. ↩

  20. Id. ↩

  21. Id. ↩

  22. Reply dated 18 July 2019, received 23 July 2019. ↩

  23. Id. ↩

  24. Id. ↩

  25. Id. ↩

  26. Id. ↩

  27. Id. ↩

  28. Rejoinder of Respondents (to the Reply of Complainant) received on 05 August 2019. ↩

  29. Id. ↩

  30. Paragraphs 3-4, Id. ↩

  31. Paragraph 5, Id. ↩

  32. Id. ↩

  33. Resolution, NPC CN 19-030 and NPC 19-132 dated 10 June 2021. ↩

  34. Resolution, NPC Case No. 19-528 dated 23 February 2021. ↩

  35. G.R. No. 165585, 20 November 2013, citing Real v. Belo, 542 Phil. 109 (2007). ↩

  36. G.R No. 180364, 03 December 2014. ↩

  37. Decision, NPC Case No. 19-569 dated 19 November 2020. ↩

  38. Decision, NPC Case No. 19-612 dated 13 November 2020. ↩

  39. Florencio Morales, Jr., v Ombudsman, G.R. No. 208086. July 27, 2016. ↩

  40. Decision, NPC Case No 18-135 dated 06 August 2020. ↩

  41. Section 12 and 13 of the DPA. ↩

  42. Section 12 (f) of R.A. No. 10173. ↩

  43. DFXX Functional Statement Manpower Development Department, page 35. ↩

  44. Yap v. Lagtapon, GR No. 196347, 23 January 2017 citing Gatmaitan v. Gonzales, 525 Phil. 658, 671 (2006). ↩

Backlinks

  • No backlinks found