NPC Issuance Wiki

NPC 19-030 and NPC 19-132: CL v. DDZ and DM v. DDZ

Issued Decision

Decision Text

CL,

Complainant,

  • versus -

DDZ,

Respondent.

NPC No. 19-030 (formerly CID Case No. 19-A-030) For: Violation of the Data Privacy Act of 2012

x-----------------------------------------------x

DM,

Complainant,

  • versus -

DDZ,

Respondent.

NPC No. 19-132 (formerly CID Case No. 19-B-132) For: Violation of the Data Privacy Act of 2012

x-----------------------------------------------x

NAGA, D.P.C.:

Before this Commission are the complaints separately filed by Mr. CL and Mr. DM against Mr. DDZ for alleged violations of the Data Privacy Act (DPA) of 2012.

Facts

CL, DM, and DDZ were personnel of MVP, a company located at Clark Freeport Zone. On 22 November 2018, DDZ was terminated by MVP as Accounts Executive Officer.

On 28 November 2018, DDZ filed a case before the Office of the City Prosecutor of Mabalacat, Pampanga against DM, a member of the MVP Board of Directors, and IP, an Executive Assistant to the CEO, for theft.1

On 28 December 2018, DDZ moved to amend his original complaint to include CL and alleged grave coercion and light threats. Attached to DDZ’s complaint-affidavit to the Office of the City Prosecutor is a letter to the Department of Labor and Employment (DOLE) attaching copies of CL’s and DM’s passports as evidence. As indicated in his complaint-affidavit, DDZ also sent copies of the passports in his letters to the Clark Development Corporation (CDC) and the Bureau of Immigration (BI).

On 16 and 25 January 2019, CL and DM filed a complaint before the Commission, respectively. Both Complaints alleged that DDZ violated the DPA for revealing their passport without their consent, and that DDZ may have broken into MVP’s database where the scanned copies of the passports are stored. Complainants also stated that the attachment of their passports in the complaint filed before the Office of the Prosecutor, DOLE, CDC, and BI was for the purpose of harassing the Complainants.2

CL prayed that DDZ be held liable for the violations of Section 29 of the DPA. He also prayed for DDZ to be deported for the aforementioned violation. While DM prayed that DDZ be held liable for the violation of Sections 29 and 31 of the DPA.

DDZ filed an Answer to CL dated 07 June 2019 and to DM dated 16 August 2019. In his separate Answers, he argued that the Complaints before the NPC is a form of retaliation from Complainants since they are in danger of being deported for working in the Philippines without the necessary working VISA.

He also argued that the Commission should not have entertained the complaints for failing to exhaust all remedies as provided in Section 4 of the NPC Circular No. 16-04. Further he stated that, assuming that the complaint is valid, the passports are excluded from the coverage of Section 4(e) of the DPA and that the processing of such information is permitted under Section 12 (e) and (f) and 13 (f) of the DPA.3 In addition, he stated that he was able to obtain the passports upon legitimate request from SM (former Operations Manager) and DMV (former President and CEO), fully disclosing the purpose of where the passports are going to be used.4

On 01 July 2019 and 12 September 2019, CL and DM filed their Reply, respectively.5 Complainants maintain that DDZ failed to explain how he was able to obtain his sensitive personal information and that DDZ illegally obtained their passports and used it without their consent. They also argued that the use of their passports is not covered in the exceptions mentioned in Section 4(e) and Section 12(e) and (f) of the DPA. Further, CL reiterated his arguments in his previous complaint that DDZ has no authority/access to his sensitive personal information and therefore, has violated the DPA.

In his Rejoinder,6 DDZ reiterated his arguments in his Answer. He also stated that he was dismissed on November 27, 2018, and his letter to DOLE was received on December 18, 2018 which shows that he can no way enter the premises of MVP earlier than the date of his dismissal. He then prays for the Complaints to be dismissed for failure to exhaust remedies under Section 4 of the DPA and for the lack of merit.

Issue

  1. Whether the Complaints are exempted from Section 4 of the NPC Circular No. 16-04.

  2. Whether the Respondent violated the Data Privacy Act.

  3. Whether Respondent committed unauthorized access or intentional breach in processing Complainants’ passports.

Discussion

The Complaints for the violation of the DPA lack merit.

I. The Complaints are Exempted from Section 4 of the NPC Circular 16-04

In his Answer and Rejoinder, Respondent argues that the Commission should not have entertained the Complaints for failing to exhaust all remedies under Section 4 of NPC Circular No. 16-04. This Commission refers to the last paragraph of the aforementioned Circular, viz:

SECTION 4. Exhaustion of remedies. – No complaint shall be entertained unless:

a. the complainant has informed, in writing, the personal information controller or concerned entity of the privacy violation or personal data breach to allow for appropriate action on the same;

b. the personal information controller or concerned entity did not take timely or appropriate action on the claimed privacy violation or personal data breach, or there is no response from the personal information controller within fifteen (15) days from receipt of information from the complaint;

c. and the complaint is filed within six (6) months from the occurrence of the claimed privacy violation or personal data breach, or thirty (30) days from the last communiqué with the personal information controller or concerned entity, whichever is earlier.

The failure to comply with the requirements of this Section shall cause the matter to be evaluated as a request to the National Privacy Commission for an advisory opinion, and for the National Privacy Commission to take such further action, as necessary. The National Privacy Commission may waive any or all of the requirements of this Section, at its discretion, upon good cause shown, or if the complaint involves a serious violation or breach of the Data Privacy Act, taking into account the risk of harm to the affected data subject. (Emphasis supplied)

Further, Rule II, Section 2 of the NPC Circular No. 2021-01 provides:

The NPC may waive any or all of the requirements of this Section at its discretion upon (a) good cause shown, properly alleged and proved by the complainant; or (b) if the allegations in the complaint involve a serious violation or breach of the Data Privacy Act of 2012, taking into account the risk of harm to the affected data subject, including but not limited to:

i. when there is grave and irreparable damage which can only be prevented or mitigated by action of the NPC;

ii. when the respondent cannot provide any plain, speedy or adequate remedy to the alleged violation;

iii. or the action of the respondent is patently illegal. (Emphasis supplied)

This Commission recognizes that it is afforded with a broad range of powers to implement its mandate such as the power to waive the requirements of its Rules of Procedure. However, there are two alternate factors to be taken into account should it decide to waive the requirements of the aforementioned section: (a) good cause shown, properly alleged and proved by the complainant; or (b) if the complaint involves a serious violation or breach of the DPA, taking into account the risk of harm to affected data subjects.

Moreover, this Commission takes this opportunity to remind its previous ruling in NPC Case No. 19-528, which states that the purpose of Section 4 of NPC Circular No. 16-04 is to prevent the unduly clogging of the Commission’s docket and avoid instances wherein a case shall be dismissed despite the good cause shown by the Complainant or the case involves a serious violation of the DPA. This Commission also reminds that the Rule is meant to prohibit instances of deciding cases based on mere technicalities.7

Additionally, it shall be emphasized that the personal information of Complainants were already processed by the Respondent when he requested and accessed the passports and included it to his Complaint-Affidavit. In this case, the Rule can no longer apply given that the Respondent cannot take any appropriate action to remedy the situation since the passports were already included in the Complaint-Affidavit filed before the Office of the Prosecutor and cannot be withdrawn.

The Commission also finds that the Complaints involve a possible violation of the DPA given the alleged unauthorized processing of passports by the Respondent since the passports processed contain sensitive personal information, and the processing of such information is generally prohibited subject only to a few exceptions.

In addition, the processing of sensitive personal information involved may pose a risk of serious harm to the affected data subjects since the personal information involved may be used to enable identity fraud, theft, crimes, and other harm.

Further, as the Complainants allege the violation of Criteria for Lawful Processing of Personal Information, Sensitive Personal Information, and Unauthorized Access or Intentional Breach8 due to the processing of their passports without their consent and unauthorized access to their personal information, this Commission then finds that it is but proper to waive the requirement under Section 4 of NPC Circular No. 16-04. This is in consideration of the possible risk of harm to the affected data subjects and that the Complaints involve a serious violation or breach of the DPA.

II. Respondent’s Processing of Passports is Permissible Under the Data Privacy Act of 2012

Respondent stated that he was able to obtain a copy of CL and DM’s passports through a legitimate request from the Human Resources (HR) of MVP, SM (former Operations Manager), and DMV (former President and CEO) wherein he fully disclosed the purpose of his request of attaching the information in his complaint-affidavit. In his Rejoinder to CL’s Reply, Respondent stated:

  1. Respondent upon his legitimate request with the HR of MVP, with full complete statements of the purpose for which such Information was needed, was provided with the copy of complainant’s passport. There is no way can the respondent enter the premises of MVP since he was dismissed, albeit illegally, from his employment and prevented to enter the MVP;9

In his Answer to DM’s Complaint, which he then also reiterated in his Rejoinder for this case, Respondent stated:

  1. Respondent, upon his legitimate request with the employees of MVP, particularly SM, the former Operations Manager, and DMV, the former President and CEO, with full complete statements of purpose for which such Information was needed, was provided with the copy of complainant’s passport. There is no way the respondent can enter the premises of MVP since he was dismissed, albeit illegally, from his employment and prevented to enter MVP;10

At the outset, it shall be emphasized that in this case, there are two forms of processing involved. Section 3(j) of the DPA defined processing as:

(j) Processing refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.11

The first processing conducted by DDZ was when he requested for CL and DM’s passports from MVP’s officer and successfully collected such information. The second processing was when DDZ used the copy of Complainants’ passports as attachment to his complaint-affidavit before the Office of the Prosecutor of Mabalacat, Pampanga, Letter to DOLE, CDC, and BI.

As previously discussed, passports contain sensitive personal information wherein its processing is generally prohibited subject only to a few exceptions. Such exceptions are provided in Section 13(f) of the DPA, thus:

SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.12 (Emphasis Supplied)

This Commission then finds that Respondent’s request and access to the copies of CL and DM’s passports fall under the exception as stated in Section 13(f) of the DPA, specifically, the processing is necessary for the establishment, exercise or defense of legal claims. As previously ruled by the Commission in NPC Case No. 17-018, “the relationship of the parties during the processing and judicial ties between them are being considered in determining valid reliance to Section 13(f) of the DPA.”13 In this case, Respondent’s attachment of CL and DM’s passports to his DOLE letter attached in his complaint-affidavit to the Office of the Prosecutor is to show factual antecedent for his allegations of theft and grave coercion against Complainants. It also alleges that both CL and DM are Australian citizens without valid working visas in the Philippines.

Likewise, the second processing by Respondent wherein he submitted the copies of passports as attachment to his letter to DOLE, CDC and BI which were attached to his complaint-affidavit to the Office of the Prosecutor, also falls under the same exception stated in the aforementioned section.

It must be noted that DDZ’s allegations of CL and DM’s grave threats and illegal stay in the Philippines are under the investigative powers of these government agencies. The Office of the Prosecutor has the investigative powers on all charge of crimes, misdemeanors, and violations of penal laws and ordinances within their respective jurisdictions.14 While, the Secretary of Labor has the visitorial power to inspect the premises, books of accounts and records of any person or entity covered by the Labor Code, require it to submit reports regularly on prescribed forms, and act on violation of any provisions of the Labor Code.15

CDC as the operating and implementing arm of the Bases Conversion and Development Authority (BCDA), is authorized to manage the Clark Special Economic Zone (CSEZ).16 And finally, the functions of the Bureau of Investigation primarily include the administration and enforcement of immigration, citizenship and alien admission and registration laws in accordance with the provisions of the Philippine Immigration Act of 1940, as amended (C.A. No. 613, as amended).17

Moreover, this Commission takes this opportunity to reiterate its ruling in a previous case,18 that the processing of personal and sensitive personal information relying in Section 13(f) must still adhere and be consistent with Section 11 of the DPA or the General Data Privacy Principles of transparency, legitimate purpose, and proportionality. Further, Section 13(f) requires that the processing activities shall be done within the limits of the law, such entails the obligations of the controller to comply with the requirements of the DPA.

III. Respondent Cannot be Held Liable for the Violation of Section 29 of the DPA or Unauthorized Access or Intentional Breach

CL and DM alleged that DDZ may have broken into the MVP’s database where the scanned copies of their passports are stored. However, Complainants failed to provide substantial proof to support their allegations and prove that a violation of Section 29 or Unauthorized Access or Intentional Breach were committed by the Respondent. Section 29 of the DPA states:

SEC. 29. Unauthorized Access or Intentional Breach. – The penalty of imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00) shall be imposed on persons who knowingly and unlawfully, or violating data confidentiality and security data systems, breaks in any way into any system where personal and sensitive personal information is stored.19 (Emphasis Supplied)

Complainants were not able to demonstrate by substantial evidence the very corpus delicti of the crime which is the instance that the Respondent breaks into the data system where personal or sensitive personal information of the MVP is stored. Section 22 of NPC Circular No. 16-04 provides, “the Decision of the Commission shall adjudicate the issues raised in the complaint on the basis of all the evidence presented and its own consideration of the law.” (Emphasis Supplied)

Further, as the Supreme Court held in Florencio Morales, Jr. v. Ombudsman Conchita Carpio-Morales, et. al., “The basic rule is that mere allegation is not evidence and is not equivalent to proof. Charges based on mere suspicion and speculation likewise cannot be given credence. When the complainant relies on mere conjectures and suppositions, and fails to substantiate his allegations, the complaint must be dismissed for lack of merit.”20

With only mere allegations and absent the supporting evidence to prove that Respondent indeed broke into the database of MVP to obtain the copies of their passports, such allegations cannot be given credence by the Commission. Thus, this Commission finds that Respondent cannot be found to have committed a violation of Section 29 of the DPA or Unauthorized Access or Intentional Breach.

WHEREFORE, all premises considered, this Commission resolves that the instant Complaints filed by CL and DM are hereby DISMISSED for lack of merit.

SO ORDERED.

City of Pasay, Philippines.

10 June 2021.

JOHN HENRY D. NAGA Deputy Privacy Commissioner

WE CONCUR:

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

Copy furnished:

CL Complainant

DM Complainant

MJRVLO Counsel for Complainants

DDZ Respondent

PMB Counsel for Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Records (NPC Case No. 19-030) at 1 to 31, and Records (NPC Case No. 19-132) at 1-19. ↩

  2. Records (NPC Case No. 19-030) at 1 to 9, and Records (NPC Case No. 19-132) at 1 to 6. ↩

  3. Records (NPC Case no. 19-030) at p. 89 to 90, and Records (NPC Case no. 19-132) at p. 45 to 46 and 78. ↩

  4. Id. at p. 51 to 58, and p. 41 to 49. ↩

  5. Id. at p. 71 to 78, and p. 62 to 70. ↩

  6. Records (NPC Case no. 19-030) at 88 to 93, and Records (NPC Case no. 19-132) at 72 to 79. ↩

  7. Resolution, NPC Case No. 19-528. Dated 23 February 2021. ↩

  8. Sections 12, 13 and 29, DPA. ↩

  9. Records (NPC Case No. 19-030) at p. 91. ↩

  10. Records (NPC Case No. 19-132) at p. 46. ↩

  11. Section 3(j) of the Data Privacy Act of 2012. ↩

  12. Section 13(f) of the DPA. ↩

  13. Resolution, NPC Case No. 17-018. Dated 05 November 2020. ↩

  14. Section 9(b) of the Republic Act No. 10071. ↩

  15. Article 37 of the Labor Code of the Philippines. ↩

  16. Section 1 of Executive Order No. 80, Series of 1993. ↩

  17. Section 31 of the Administrative Code of 1987. ↩

  18. Resolution, NPC Case No. 17-018. Dated 5 November 2020. ↩

  19. Section 29 of the Data Privacy Act of 2012. ↩

  20. G.R. No. 208086, 27 July 2016, citing Agdeppa v. Office of the Ombudsman citing De Jesus v. Guerrero III, 614 Phil. 520, 529. ↩

Backlinks