NPC Issuance Wiki

NPC 19-134: VVC v. CJB

Issued Decision

Decision Text

VVC,

Complainant,

  • versus -

CJB,

Respondent.

x-----------------------------------x

NPC 19-134

For: Violation of the

Data Privacy Act of 2012

AGUIRRE, D.P.C.;

Before this Commission is a Complaint filed by VVC (VVC) against CJB (CJB) for an alleged violation of Section 25 or Unauthorized Processing of Personal or Sensitive Personal Information and Section 32 or Unauthorized Disclosure of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

On 26 February 2019, VVC filed a Complaint against CJB. VVC stated that she holds the position of Land Management Officer I of the Department of Environment and Natural Resources (DENR).1 CJB is the Officer-in-Charge Provincial Environment and Natural Resources Officer (OIC-PENRO) in Compostela Valley.2

On 28 November 2018, CJB issued Special Order No. 11-067 reassigning VVC from the Land Management Sector to the Forest Protection Unit of the DENR.3 VVC requested CJB to reconsider since she was appointed by the Civil Service Commission (CSC) as a Land Management Officer.4 CJB denied VVC’s request.5

On 05 December 2018, CJB issued Special Order No. 12-069 creating a team to investigate VVC’s alleged irregular and improper conduct of desisting from reporting to the Forest Production Unit.6

On 17 January 2019, CJB issued a Memorandum to VVC with the subject “Show Cause Order to explain the inconsistency, improbability, and credibility of the official records of employment and school attendance of LMO I VVC.”7 The Memorandum required VVC to explain within 72 hours the “inconsistency, improbability, incredibility of [her] official records of employment and school attendance.”8 CJB stated the following allegations:

  1. CJB received an anonymous text message alleging that there were inconsistencies in VVC’s school records and employment in the DENR;
  2. VVC’s Personal Data Sheet (PDS) and school attendance based on his Official Transcript of Records show “incredible and improbable inconsistencies and spurious facts that may [be] tantamount to fraud, dishonesty, and misrepresentation”;
  3. The PDS states that VVC was employed by the DENR from July 2007 to April 2011 as Administrative Aide VI / Project Monitoring Officer assigned at CENRO Panabo, Davao del Norte, from April 2011 to August 2021 as Administrative Aide VI / National Greening Program Coordinator assigned at PENRO, Nabunturan, Compostela Valley, and from August 2012 to November 2014 as Administrative Aide XI / National Greening Program Coordinator assigned at CENRO Nabunturan, Compostela Valley;
  4. The Official Transcript of Records shows that VVC had perfect attendance in the regular semesters from 2009 to 2014, and that the school awarded her a Degree in Political Science;
  5. It would have been improbable for VVC to attend her classes and report to DENR at the same time throughout the 4-year period since the school is 200 kilometers away from Davao City. Assuming that the school is proximate to the office, VVC is administratively prohibited from attending both office and classes at the same time; and
  6. VVC openly declared that she is currently enrolled in a law school, which is contrary to the DENR policy that requires employees to secure prior clearance from the DENR Secretary in order to pursue further studies.9

The following documents were attached to the Show Cause Order as annexes: CS Form 212 PDS, Transcript of Records, Diploma, Eligibility for Graduation issued by Commission on Higher Education (CHED), CHED Special Order, and Google map of the distance from Davao City to the school.10

In her Complaint, VVC alleges that CJB “wantonly” processed her personal files, including sensitive personal information, and furnished a copy to third parties thus violating her rights under the DPA.11 VVC claims that CJB initiated an action to have her prosecuted for fraud and dishonesty based on her personal files. VVC maintains that her personal data was unlawfully processed and CJB committed Unauthorized Disclosure when the Show Cause Order was furnished to the following third parties, namely:12

  1. AMMD, DENR
  2. DAT, Civil Service Commission
  3. DRA, Commission on Higher Education
  4. DVL, Civil Service Commission.

On 27 March 2019, the Commission issued an Order to confer for discovery on 30 April 2019.13

On 30 April 2019, the parties conferred for discovery but failed to reach a settlement.14 The Commission issued an Order for the resumption of complaint proceedings.15

On 03 May 2019, an Order was issued to CJB to file a responsive comment ten (10) days from receipt of the Order.16

On 05 July 2019, CJB, through counsel, filed his Entry of Appearance with an Urgent Motion for Extension of Time to File his Responsive Comment.17

On 15 July 2019, CJB filed his Responsive Comment.18 CJB alleged that the Complaint should be dismissed for lack of merit because his acts were in the performance of his official functions as VVC’s direct supervisor.19 CJB stated that the act of furnishing copies to the third parties is part of the verification of contents of VVC’s documents.20 He emphasized that the PDS submitted by VVC contains a waiver and authority for the agency head to verify and validate the contents therein.21

On 07 August 2019, VVC filed her Answer to the Responsive Comment in response to the Comment.22 VVC asserted that the release of her PDS to offices outside the DENR violated her rights as a data subject because it contains sensitive personal information and made her vulnerable to identity theft.23

On 16 August 2019, CJB submitted his Motion to Admit Rejoinder.24 CJB reiterated his argument that as VVC’s direct supervisor, it is his legal obligation to verify the legitimacy of the qualifications of his subordinate.25

On 4 September 2019, VVC filed her Answer to the Responsive Rejoinder.26 VVC stated that CJB acted with ill motive when he released her PDS without her consent.27

Issues

  1. Whether the case should be dismissed on procedural grounds for VVC’s alleged failure to give CJB an opportunity to address the complaint pursuant to Section 4 (a) of NPC Circular No. 16-04 (NPC Rules of Procedure);

  2. Whether a PDS contains personal and sensitive personal information;

  3. Whether VVC consented to the processing of her personal and sensitive personal information;

  4. Whether CJB is liable under Section 25 (Unauthorized Processing of Personal and Sensitive Personal Information) and Section 32 (Unauthorized Disclosure) when he released VVC’s PDS to third parties

Discussion

The case should not be dismissed on procedural grounds. VVC expressly consented to the processing of her personal and sensitive personal information. As such, CJB is not liable under Section 25 (Unauthorized Processing of Personal and Sensitive Personal Information) and Section 32 (Unauthorized Disclosure) of the DPA.

I. The case should not be dismissed for VVC’s alleged failure to give CJB an opportunity to address the complaint against him.

CJB alleges that the Commission should dismiss the case against him since VVC failed to provide him with an opportunity to address the complaint against him as required in Section 4 (a) of NPC Circular No. 16-04.28 Section 4 (a) of NPC Circular No. 16-04 provides:

Section 4. Exhaustion of remedies – No complaint shall be entertained unless:

a. The complainant has informed, in writing, the personal information controller or concerned entity of the privacy violation or personal data breach appropriate action on the same;

…

The National Privacy Commission may waive any or all of the requirements of this Section, at its discretion, upon good cause shown, or if the complaint involves a serious violation or breach of the Data Privacy Act, taking into account the risk of harm to the affected data subject.29

Where circumstances permit, it is a condition precedent to the filing of complaints that the complainant gives the respondent an opportunity to address the complaint against him.30 The Commission, however, has the discretion to waive any of the conditions precedent enumerated in Section 4 of NPC Circular No. 16-04 “upon good cause shown, or if the complaint involves a serious violation or breach of the DPA, taking into account the risk of harm to the affected data subject.”31 The Commission emphasizes that Section 4 of NPC Circular No. 16-04 speaks of “risk of harm” and does not require actual harm or damage to the complainant.32

In this case, the complaint contains an allegation on CJB’s alleged wanton processing of VVC’s personal files, which contains sensitive personal information.33 The nature of sensitive personal information and the risks involved in the processing of such information increases the risk of harm to the data subject. This serves as sufficient basis to give the complaint due course.34

In any case, NPC Circular No. 21-01 (2021 Rules of Procedure) provides that the Commission may waive the conditions precedent when the respondent cannot provide any plain, speedy, or adequate remedy to the alleged violation:

Section 2. Exhaustion of remedies

…

The NPC may waive any or all of the requirements of this Section at its discretion upon (a) good cause shown, properly alleged and proved by the complainant; or (b) if the allegations in the complaint involve a serious violation or breach of the Data Privacy Act of 2012, taking into account the risk of harm to the affected data subject, including but not limited to:

i. when there is grave and irreparable damage which can only be prevented or mitigated by action of the NPC; ii. when the respondent cannot provide any plain, speedy or adequate remedy to the alleged violation; iii.or the action of the respondent is patently illegal.35

The alleged privacy violation supposedly resulted from the disclosure of VVC’s sensitive personal information to third parties without her consent. To require VVC to first exhaust her remedies with CJB would be unreasonable. CJB is not in a position to provide any plain, speedy, or adequate remedy to the alleged violation against VVC since the PDS has already been released to third parties. The Commission reiterates that the requirement to exhaust available remedies does not contemplate exercises in futility that only delay justice for data subjects whose rights are supposedly violated.36

Given all these, the Commission waives the procedural technicalities cited by CJB and proceeds to determine if CJB violated Section 25 (Unauthorized Processing of Personal and Sensitive Personal Information) and Section 32 (Unauthorized Disclosure) of the DPA.

II. A PDS contains personal and sensitive personal information of a government official or employee.

A PDS is an official document that contains personal and sensitive personal information of a government employee or official.37 A PDS contains a government official of employee’s personal background, qualifications, and eligibility38, which necessarily includes personal and sensitive personal information as defined by the DPA:

Section 3. Definition of Terms. – Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

(g) Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.

…

(l) Sensitive personal information refers to personal information:

(1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; (2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and (4) Specifically established by an executive order or an act of Congress to be kept classified.39

Further, the PDS contains an explicit authorization to allow the agency head or authorized representative to verify or validate its contents:

I declare under oath that I have personally accomplished this Personal Data Sheet which is a true, correct and complete statement pursuant to the provisions of pertinent laws, rules and regulations of the Republic of the Philippines. I authorize the agency head/authorized representative to verify/validate the contents stated herein. I agree that any misrepresentation made in this document and its attachments shall cause the filing of administrative case/s against me.40

III. VVC consented to the processing of her personal and sensitive personal information in the PDS.

Personal information of a data subject may be processed when the data subject has given his or her consent to such processing. Section 12 (a) of the DPA provides:

Section 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

(a) The data subject has given his or her consent;41

Sensitive personal information of a data subject, as a general rule, shall not be processed. It is only permitted when the data subject consents to such processing or any of the other lawful criteria of processing under Section 13 of the DPA is present. Section 13 (a) of the DPA allows the processing of sensitive personal information when the data subject has given his or her consent to the processing:

Section 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

(a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing;42

The DPA defines consent as follows:

Section 3. Definition of Terms. – Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

(b) Consent of the data subject refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so.43

Consent of the data subject shall be: (1) freely given; (2) specific; (3) an informed indication of will; and (4) evidenced by written, electronic or recorded means.44

Consent is freely given if the data subject was given a real choice on the processing of his or her personal or sensitive personal information.45 The data subject should not have been deceived, intimidated, or coerced into consenting to the act of processing.46

VVC consented to the processing of her personal and sensitive personal information when she signed the PDS. VVC freely gave her consent despite the fact that the PDS is a condition for employment in the government. Such consent is not invalidated by the mere fact that the PDS is a contract of adhesion. As held by the Supreme Court, contracts of adhesion are as binding as ordinary contracts since the party who adheres to the contract remains free to reject it:

A contract of adhesion, wherein one party imposes a ready-made form of contract on the other, is not strictly against the law. A contract of adhesion is as binding as ordinary contracts, the reason being that the party who adheres to the contract is free to reject it entirely. Contrary to petitioner’s contention, not every contract of adhesion is an invalid agreement. As we had the occasion to state in Development Bank of the Philippines v. Perez:

… In discussing the consequences of a contract of adhesion, we held in Rizal Commercial Banking v. Court of Appeals:

It bears stressing that a contract of adhesion is just as binding as ordinary contracts. It is true that we have, on occasion, struck down such contracts as void when the weaker party is imposed upon in dealing with the dominant bargaining party and is reduced to the alternative of taking it or leaving it, completely deprived of the opportunity to bargain on equal footing, Nevertheless, contracts of adhesion are not invalid per se; they are not entirely prohibited. The one who adheres to the contract is in reality free to reject it entirely; if he adheres, he gives his consent.47

Indeed, VVC always had the option to not sign the PDS and consequently, to not accept employment with the DENR. Thus, VVC freely gave her consent to the processing of her personal and sensitive personal information stated in the PDS.

The PDS specifically provides that the data subject permits the agency head or authorized representative to verify or validate the contents of the PDS.48 This shows that VVC was informed of the purpose behind the processing of her personal and sensitive personal information. By signing and agreeing to the conditions stated in the PDS, VVC indicated her consent to the processing of her personal and sensitive personal information.

IV. CJB is neither liable under Section 25 nor Section 32 of the DPA when he released the PDS to third parties.

CJB is neither liable for Section 25 of the DPA on Unauthorized Processing of Personal and Sensitive Personal Information nor Section 32 of the DPA on Unauthorized Disclosure.

CJB is not liable under Section 25 of the DPA on Unauthorized Processing of Personal and Sensitive Personal Information.

Section 25 of the DPA on Unauthorized Processing of Personal and Sensitive Personal Information provides:

Section 25. Unauthorized Processing of Personal Information and Sensitive Personal Information. – (a) The unauthorized processing of personal information shall be penalized by imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00) shall be imposed on persons who process personal information without the consent of the data subject, or without being authorized under this Act or any existing law.

(b) The unauthorized processing of personal sensitive information shall be penalized by imprisonment ranging from three (3) years to six (6) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Four million pesos (Php4,000,000.00) shall be imposed on persons who process personal information without the consent of the data subject, or without being authorized under this Act or any existing law.49

Unauthorized Processing of Personal or Sensitive Personal Information is committed when the following requisites concur:

  1. The perpetrator processed the information of the data subject;
  2. The information processed was personal information or sensitive personal information;
  3. The processing was done without the consent of the data subject, or without being authorized under the DPA or any existing law.50

In this case, CJB processed VVC’s personal and sensitive personal information when he, as her direct supervisor, released the PDS to persons authorized to receive VVC’s personal information by virtue of their functions as officials of the DENR, CSC, and CHED. Nevertheless, the processing was done with the consent of VVC since she signed and agreed to the conditions stated in the PDS. Absent the third requisite, CJB is not liable under Section 25 of the DPA on Unauthorized Processing of Personal or Sensitive Personal Information.

CJB is not liable under Section 32 of the DPA on Unauthorized Disclosure.

Section 32 of the DPA on Unauthorized Disclosure states:

Section. 32. Unauthorized Disclosure. – (a) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).51

A strict and literal reading of Section 32 of the DPA on Unauthorized Disclosure shows that a personal information controller (PIC) or personal information processor (PIP) is liable if it discloses to a third party personal information without the consent of the data subject.52 Such reading, however, will result in absurdity since it penalizes a PIC or a PIP if the disclosure is without the consent of the data subject even if such disclosure is justified under some other criteria for lawful processing in Sections 12 and 13 of the DPA. Following the rules of statutory construction:

Where a literal meaning would lead to absurdity, contradiction, or injustice, or otherwise defeat the clear purpose of the lawmakers, the spirit and reason of the statute may be examined to determine the true intention of the provision.53

To require the consent of the data subject when some other lawful criteria such as law or regulation requires or justifies the processing of the personal information, including its disclosure, will result in absurdity.

Section 32 of the DPA on Unauthorized Disclosure should also not be read in isolation from the other provisions of the DPA:

A law must not be read in truncated parts; its provisions must be read in relation to the whole law. It is the cardinal rule in statutory construction that a statute’s clauses and phrases must not be taken as detached and isolated expressions, but the whole and every part thereof must be considered in fixing the meaning of any of its parts in order to produce a harmonious whole. Every part of the statute must be interpreted with reference to the context, i.e., that every part of the statute must be considered together with other parts of the statute and kept subservient to the general intent of the whole enactment.54

It should be read together with Sections 12 and 13 on the criteria for lawful processing of personal and sensitive personal information.

Sections 12 and 13 show that consent is but one of the lawful criteria for processing. The presence of any of the criteria listed in either section is sufficient to justify the processing of personal or sensitive personal information as the case may be. Such literal interpretation based on an isolated reading of Section 32 of the DPA will render Sections 12 and 13 of the DPA inoperative.

The rule is that a construction that would render a provision inoperative should be avoided; instead, apparently inconsistent provisions should be reconciled whenever possible as parts of a coordinated and harmonious whole.55

Thus, Section 32 of the DPA on Unauthorized Disclosure should be read and understood as follows: Unauthorized Disclosure is committed when the perpetrator processes personal information without any of the lawful basis for processing under Sections 12 and 13. This reading is more in line with the principle that “when two or more interpretations are possible, that interpretation which is favorable or beneficial to the accused must be adopted.”56 This interpretation benefits the accused since it narrows the extent to which disclosure of personal information may be considered as Unauthorized Disclosure.

The requisites of Unauthorized Disclosure are:

  1. The perpetrator is a personal information controller or personal information processor;
  2. The perpetrator disclosed information;
  3. The information relates to personal or sensitive personal information;
  4. The perpetrator disclosed the personal or sensitive personal information to a third party;
  5. The disclosure was without any of the lawful basis for processing, consent or otherwise, under Sections 12 and 13 of the DPA; and
  6. The disclosure neither relates to unwarranted or false information nor malicious or in bad faith.

Here, CJB disclosed VVC’s personal and sensitive personal information to third parties when he released VVC’s PDS to persons authorized to receive VVC’s personal information by virtue of their official functions. The disclosure does not relate to unwarranted or false information since true, correct, and complete information should be indicated in the PDS.57 This disclosure was neither malicious nor in bad faith since it was done in the performance of his official functions as VVC’s direct supervisor in order to verify or validate the contents of the PDS.58 Finally, VVC consented to the disclosure of the information to third parties when she granted her direct supervisor and persons authorized to receive VVC’s personal information by virtue of their official functions the authority to validate the legitimacy of the information in the PDS. Thus, CJB is not liable under Section 32 of the DPA on Unauthorized Disclosure.

Consent is a common requisite of Section 25 and Section 32 of the DPA.

Processing personal or sensitive personal information without the consent of the data subject or any other lawful criteria under Sections 12 or 13 of the DPA is a common requisite of Sections 25 and 32 of the DPA. If the data subject consents to or any other lawful criteria under Sections 12 and 13 of the DPA allows the processing of personal and sensitive personal information, then the perpetrator cannot be held liable for the offenses of Unauthorized Processing of Personal and Sensitive Personal Information or Unauthorized Disclosure.

As previously discussed, VVC consented to the processing of her personal and sensitive personal information by agreeing to the conditions stated in the PDS. In doing so, VVC granted CJB, her direct supervisor, and persons authorized to receive VVC’s personal information by virtue of their official functions the authority to validate the legitimacy of the information she indicated in the PDS. Since the PDS was processed and disclosed to third parties with VVC’s consent, then the necessary requisite of processing without the consent of the data subject or any other lawful criteria under Sections 12 and 13 of the DPA is absent. Hence, there is no violation of Sections 25 and 32 of the DPA and the Complaint against CJB must be dismissed.

WHEREFORE, premises considered, the Commission resolves that the case filed by VVC against CJB is hereby DISMISSED.

SO ORDERED.

Pasay City, Philippines.

10 December 2021.

Sgd.

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

WE CONCUR:

Sgd.

RAYMUND ENRIQUEZ LIBORO

Privacy Commissioner

Sgd.

JOHN HENRY D. NAGA

Deputy Privacy Commissioner

Copy furnished:

VVC

Complainant

CJB

Respondent

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

National Privacy Commission

Footnotes

  1. Affidavit Complaint, at 1, in VVC v. CJB, NPC 19-134 (NPC 2019). ↩

  2. Id. ↩

  3. Id. Annex A. ↩

  4. Id. at 1. ↩

  5. Id. ↩

  6. Id. ↩

  7. Affidavit Complaint, supra note 1, Annex C. ↩

  8. Id. at 1. ↩

  9. Id. Annex C. ↩

  10. Id. ↩

  11. Id. at 1. ↩

  12. Id. Annex B. ↩

  13. Order to Confer for Discovery, 27 March 2019, at 1, in VVC v. CJB, NPC 19-134 (NPC 2019). ↩

  14. Order, 03 May 2019, at 1, in VVC v. CJB, NPC 19-134 (NPC 2019). ↩

  15. Id. ↩

  16. Id. ↩

  17. Entry of Appearance with An Urgent Motion for Extension of Time, 05 July 2019, at 1, in VVC v. CJB, NPC 19-134 (NPC 2019). ↩

  18. Respondent’s Responsive Comment, 15 July 2019, at 1, in VVC vs. CJB, NPC 19-134 (NPC 2019). ↩

  19. Id. at 2–3. ↩

  20. Id. ↩

  21. Id. ↩

  22. Complainant’s Answer to Responsive Comment, 07 August 2019, at 1, in VVC vs. CJB, NPC 19-134 (NPC 2019). ↩

  23. Id. at 2. ↩

  24. Motion to Admit Rejoinder, 16 August 2019, at 1, in VVC vs. CJB, NPC 19-134 (NPC 2019). ↩

  25. Respondent’s Rejoinder, 16 August 2019, at 2, in VVC vs. CJB, NPC 19-134 (NPC 2019). ↩

  26. Answer to Responsive Rejoinder, 04 September 2019, at 1, in VVC vs. CJB, NPC 19-134 (NPC 2019). ↩

  27. Id. ↩

  28. Respondent’s Responsive Comment, supra 18, at 1. ↩

  29. National Privacy Commission, Rules on Procedure of the National Privacy Commission, Circular No. 04, Series of 2016 NPC Circular No. 16-04, §4 (a) (15 December 2016). ↩

  30. AC N v. DT, NPC Case No. 18-109 (2021). ↩

  31. NPC Circular No. 16-04, §4. ↩

  32. FGP v. Maersk, NPC Case No. 18-038 (2020). ↩

  33. Answer to Responsive Rejoinder, supra note 26, at 1. ↩

  34. MNLC v. PXXX, et al., NPC Case No. 19-528 (2020). ↩

  35. National Privacy Commission, 2021 Rules on Procedure of the National Privacy Commission, Circular No. 01, Series of 2021 NPC Circular No. 21-01, Rule II, §2 (28 January 2021). Emphasis supplied. ↩

  36. Declaro v. Declaro, et al., CID Case No. 18-D-012 (2020). ↩

  37. National Privacy Commission, Advisory on Access to Personal Data Sheets of Government Personnel, Advisory No. 02, Series of 2017 (03 April 2017). ↩

  38. Affidavit Complaint, supra note 1, Annex D. ↩

  39. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, § 3 (g), (l). ↩

  40. Affidavit Complaint, supra note 1, Annex D. ↩

  41. Data Privacy Act of 2012, § 12 (a). Emphasis supplied. ↩

  42. Id. § 13 (a). Emphasis supplied. ↩

  43. Id. § 3. Emphasis supplied. ↩

  44. Id. Emphasis supplied. ↩

  45. MNLC, NPC Case No. 19-528 (2020). ↩

  46. Id. ↩

  47. Cabanting v. BPI Family Savings Bank, Inc., G.R. No. 201927 (2016). ↩

  48. Affidavit Complaint, supra note 1, Annex D. ↩

  49. Data Privacy Act of 2012, § 25. ↩

  50. MNLC, NPC Case No. 19-528. ↩

  51. Data Privacy Act of 2012, § 32. ↩

  52. Id. ↩

  53. Metropolitan Bank and Trust Co. v. Liberty Corrugated Boxes Manufacturing Corp., G.R. No.184317 (2017). ↩

  54. Fort Bonifacio Development Corp. v. Commissioner of Internal Revenue, G.R. Nos. 158885 & 170680 (Resolution) (2009). ↩

  55. JMM Promotions & Management, Inc. v. National Labor Relations Commission, G.R. No. 109835 (1993). Emphasis supplied. ↩

  56. People v. Liban, G.R. Nos. 136247 & 138330 (2000). ↩

  57. Affidavit Complaint, supra note 1, Annex D. ↩

  58. Id. ↩

Backlinks