NPC Issuance Wiki

NPC 19-142: MLF v. Grab Philippines

Issued Decision

Decision Text

MLF,

Complainant,

-versus-

MYTAXI.PH CORPORATION (GRAB PHILIPPINES),

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.:

Before this Commission is a complaint filed by MLF against MyTaxi.PH Corporation, doing business under the name of “Grab Philippines” (Grab Philippines), for an alleged violation of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

MLF, in his Complaints-Assisted Form, claimed that Grab Philippines committed violations of the DPA.1

On 6 February 2019, he booked a car ride from UP Town Center 2 and was assigned to Grab driver ADB with Booking ID No. IOS-141-99938-8-345.2 As stated by MLF:

Within the Grab System[,] my Name [and] Mobile Number is [sic] made available to the driver. There is also an in-app chat function. Both Mobile Number and Chat function are made available with my consent under their terms and condition for the purpose of transacting a ride. So that driver and rider can communicate to meet each other.3

MLF alleged that, after approximately three to ten (3-10) minutes from booking the ride,4 ADB told him that “it’s traffic and asked [him] to cancel the trip.”5 He further claimed in his Complaints-Assisted Form that “[t]his is not allowed. In fact[,] Grab Philippines penalizes riders who cancels [sic] trips. So[,] I responded to the driver that I will not cancel the trip but he can if he wants. After which the driver cursed me with the words ‘tang inamo’. Then cancelled the trip.”6

MLF escalated the matter to Grab Philippines as a privacy violation under Section 28 of the DPA.7 In turn, the Data Protection Officer (DPO) replied that “[r]egarding your concern with misuse of personal data, we would like to let you know that the conversation stayed within the app thus it does not breach you [sic] privacy.”8 As for Customer Support, it relayed that the driver had sent a handwritten apology letter explaining that the text message was not intended for MLF.9 MLF opined, however, that Grab Philippines’ responses are mere excuses and that it is not properly using his personal data.10

On 06 June 2019, the Commission ordered the parties to confer for a discovery conference.11 Only MLF appeared.12 The Commission, therefore, issued an Order requiring Grab Philippines to file its responsive comment within ten (10) days from receipt of the Order13 and an Order requiring MLF to file his reply to the responsive comment within ten (10) days from receipt of the responsive comment.14

On 24 June 2019, Grab Philippines, through counsel, filed its Entry of Appearance and Motion for Resetting of Discovery Conference.15 It alleged that it belatedly received the Order to Confer for Discovery, hence it respectfully prayed for resetting.16

On 05 July 2019, Grab Philippines filed a Manifestation and Motion to Defer Submission of Responsive Comment and asked that the filing of its responsive comment be deferred until its prior Motion for Resetting be resolved.17

On 15 July 2019, the Commission issued a Resolution granting Grab Philippines’ Motions.18 With MLF’s conformity, the discovery conference was reset to 13 August 2019.19

During the Discovery Conference on 13 August 2019, both parties appeared.20 Grab Philippines manifested that it was not willing to undergo mediation proceedings.21 MLF requested from Grab Philippines the discovery of the following information:

(1) his e-mail trail with the customer service and data protection officer of respondent from February to March 2019;

(2) his complaints with the customer service department of respondent;

(3) his chat blogs with respondent’s partner from January to May 2019; and

(4) a copy of respondent’s privacy impact assessment for 2018 and 2019.22

MLF also manifested that he would submit a supplemental complaint. The Commission ordered Grab Philippines to submit the required documents and MLF to submit his supplemental affidavit within fifteen (15) days from receipt of the Order.23

On 27 August 2019, MLF submitted his Affidavit Addendum.24 He attached the email thread between him and Grab Philippines’ DPO to show that “[the DPO] replied one time to the email.”25 Furthermore, he narrated another incident that occurred on 31 March 2019 wherein the Grab driver asked him to cancel the trip.26 The driver, however, did not cancel the trip and “held [MLF] hostage from using the service.”27 MLF had to call Customer Support to cancel the trip and book another one.28 He similarly escalated the incident to Grab Support.29 MLF claimed that “[i]n this incident the Driver has misused my Personal Data (Grab Account) to deny me of Grab Service. A driver is not allowed to ask a Rider to Cancel a ride […].”30 He argued that:

Grab being the Personal Information Controller of my Data (Name, Mobile Number, Grab Account) is responsible in [sic] ensuring [that] my Data is only used for authorized purposes. Based on their Terms and Condition, I am providing Grab Consent to process and share my Personal Data to their partners (Driver) for the purpose of transacting a trip/ride. Grab is not a social media/chat app. I do not choose the drivers who will process my data. Grab is the one who assigns them to me. I do not intend to have chat, call and sms with these assigned drivers outside of transacting a ride. In my case the Grab App was used by one of their driver [sic] for unjust vexation (original complaint). And in the complaint number 2 my Grab Account was held hostage by the driver who was forcing me to cancel the ride. In both cases, this is not the consent that I approved Grab to allow my Personal Data to be used for. […] Despite their claims of penalizing these erring partners (Drivers), misuse of my personal data still happened again. There is negligence in [sic] Grab’s part of handling my personal data based on Terms and Condition that I agreed on [sic].31

On 28 August 2019, Grab Philippines submitted the following documents requested during the Discovery Conference:

  1. Copy of email exchanges between MLF and Grab Philippines’ DPO containing a copy of the Complaint sent on 09 February 2019;32

  2. Copy of email thread of Grab Philippines’ customer service department with MLF;33 and

  3. Copy of MLF’s chat blogs with Grab Philippines’ partner, i.e., ADB.34

As for the 2018 and 2019 Privacy Impact Assessment (PIA) reports, Grab Philippines argued that it is too burdensome on its part to submit these documents because MLF has no legal right to request copies of its entire PIA results, which contain privileged, confidential, and other protected information.35

On 09 September 2019, Grab Philippines filed its Comment to MLF’s Complaint and Affidavit Addendum.36 Grab Philippines admitted the facts as alleged by MLF and added that he demanded its DPO to come up with a comprehensive and definitive report within forty-eight (48) hours; otherwise, he would report the case to this Commission.37 Grab Philippines alleged that it properly managed MLF’s complaint and escalated it to the proper team.38 It even caused the suspension of ADB.39 Grab Philippines, however, claimed that MLF’s demand to terminate ADB cannot be done because it will interfere with the contract between Grab Philippines and its “partners/drivers” (drivers).40

Grab Philippines argued that it should not be held liable for the subject acts committed by its drivers because there is no employee-employer relationship existing between them.41 Instead, the Land Transportation Franchising and Regulatory Board (LTFRB) Memorandum Circular No. 2015-15 ruled that drivers accredited by Transportation Network Companies, such as Grab Philippines, are independent contractors.42 Furthermore, Grab Philippines maintained that, as provided in its GrabPeer Service Agreement with its drivers, it “shall have no right to, and shall not, control the manner or prescribe the method the [drivers] use to perform accepted bookings.”43 In conjunction, its Terms and Conditions for GrabCar Philippines Drivers “expressly states that it shall not be responsible or liable for acts and/or omissions of any services offered by its [drivers] to its passengers, and for any illegal action committed by them.”44

Considering the foregoing, Grab Philippines averred that it is not the Personal Information Controller (PIC) in the complained incidents, therefore, it should not be held liable.45 It maintained that under its Terms and Conditions for Drivers and Terms of Use for Passengers, its service is limited to linking passengers with third party transportation providers.46 It does not provide transportation services or any act that can be construed in any way as an act of a transportation provider especially since it has “no right to, and shall not, control the manner or prescribe the method the [drivers] use to perform accepted bookings.”47 Thus, “the fact that the alleged unauthorized communications between the [drivers] and [MLF] happened using [its] mobile application, i.e., in-app chat feature, does not make [it] liable for the alleged violation of [MLF’s] privacy rights.”48

Alternatively, Grab Philippines posited that assuming it was the PIC, there was no unauthorized processing of personal data.49 MLF consented to its collection and use of his personal data.50 Additionally, Grab Philippines’ Privacy Policy states that these personal data may be used to “enable communications between users, i.e., [drivers].”51 Through Grab Philippines’ Terms of Use for Passengers, MLF also agreed that his personal data may be shared with third party providers who “may communicate with him for any reasons whatsoever.”52 Thus, though it does not tolerate unruly and unprofessional behavior of its drivers and frowns upon the cancellation of trips, it may not be held liable for the sharing of MLF’s personal data which enables communication between him and its drivers.53

Issue

I. Whether the case should be dismissed outright; and

II. Whether Grab Philippines violated Section 28 or Processing of Personal or Sensitive Personal Information for Unauthorized Purposes of the DPA.

Discussion

I. The case should be dismissed outright pursuant to Section 12 (b), Rule III, of NPC Circular No. 16-04 (2016 NPC Rules of Procedure).

Given that MLF filed his complaint on 02 March 2019, prior to the effectivity of NPC Circular No. 2021-01 (2021 NPC Rules of Procedure), the applicable rule is the 2016 NPC Rules of Procedure, which provides that:

Rule III. Procedure in Complaints

…

Section 12. Outright Dismissal. – The Commission may dismiss outright any complaint on the following grounds:

…

b. The complaint is not a violation of the Data Privacy Act or does not involve a privacy violation or personal data breach[.]54

There is no privacy violation in this case. The foul statement from the Grab driver in this situation, no matter how offensive, does not in itself constitute a violation of the DPA.

In this case, ADB asked MLF to cancel the trip.55 When MLF refused, the driver sent him a message through the in-app chat, stating “tang inamo”.56 MLF opined that these types of communication from drivers are “outside of transacting a ride”57 and are no longer for the purpose of coordinating a ride.58

The Commission finds MLF’s interpretation of Grab Philippines’ purpose of the processing of his personal information to be erroneous and narrow. The legitimate purpose principle requires that: (1) the purpose of the processing must be specified and declared to the data subject; and (2) the purpose must not be contrary to law, morals, or public policy.59 The first requisite should be understood in relation to the principle of transparency in that the data subject must be informed of the specific legitimate purpose behind the processing of his personal information. The second requisite requires the purpose to be within the limitations of the law, which should be understood to include the entire body of laws, rules, and regulations. Additionally, the purpose of the processing should not go against prevailing morals or run counter to public policy.

Both requisites of legitimate purpose are satisfied in this case. The processing of MLF’s information was done in pursuance of a legitimate purpose, which is to allow the communication between the driver and the passenger to facilitate the transaction of a Grab ride. This purpose was adequately communicated to MLF through Grab Philippines’ Privacy Policy and Terms of Use for Philippines GrabCar Passengers.60

Grab Philippines is a technology company that “enables and facilitates the matching and booking of transportation solutions […] between independent third-party service providers and independent customers through its online application software.”61

MLF claimed that he allowed Grab Philippines to share his personal data to its drivers since he “registered to [sic] [G]rab with the intent of transacting a ride.”62 He, however, opined that the driver contacted him “for purposes that [he] did not provide consent on [sic] based on [Grab Philippines’] terms and conditions.”63 He further stressed that:

Under the Data Privacy laws in the Philippines my rights as a data subject wherein my contact [i]nformation (mobile number and grab account) is collected for the purpose of transact[ing] a grab transaction. This rude and unacceptable behavior by your partner is clearly in violation of what constitutes as official business.64

Certainly the [c]ommunication of the partner does not cons[t]itute as official business [sic] or consent of me as a data subject. […] As per the data privacy act my personal [i]nformation and contact should only be used for the consent that [I] allowed grab[.]65

This is defenitely [sic] not authorize[d] use of my personal information and contact. I did not consent grab or your partners to harass me.66

MLF argued that:

The issue here is the driver was able to use [Grab Philippines’] platform to message me with messages that are obviously not for official use. I did not register or used [sic] grab to be harassed by your partner. […] Under the data privacy act this constitutes as unauthorized use of my personal data. This includes the facility and consent for your driver to be able to communicate to [sic] me.

…

The issue here is [Grab Philippines’] system allowed an unfit partner to harass a rider. This includes providing the partner or driver access to the chat, call and sms facility which […] I provided consent to for official business.67

If [Grab Philippines is] not aware as per the data privacy law my [i]nformation as a data subject is to be used only for official business. In the case of your platform[,] my name, mobile number, facility to call/sms/message me is disclosed to you and your partners in good faith for the purpose of coordinating a ride. This has been violated when your partner began using that [i]nformation and that access outside of what would constitute as official business.68

It is clearly enumerated in his contract with Grab Philippines, however, that aside from providing services to MLF, Grab Philippines may share his personal data to other users to enable the communication between them, for any reason whatsoever. Grab Philippines specifically declared this legitimate purpose to MLF. It provides in its Terms of Use for Philippines GrabCar Passengers that:

The Company may use and process your Personal Data for business and activities of the Company which shall include, without limitation[,] the following (the “Purpose”):

• To perform the Company’s obligations in respect of any contract entered with you;

• To provide you with any services pursuant to the Terms of Use herein;

…

• To share your Personal Data […] with the Company’s and Group’s agents, third party providers, developers, advertisers, partners, even companies or sponsors who may communicate with you for any reasons whatsoever.69

Grab Philippines’ Privacy Policy similarly states that:

Use of Personal Data

Grab may use, combine and process your Personal Data for the following purposes (“Purposes”).

…

• provide you with Services across our various business verticals;

…

• enable communications between our users[.]70

In the absence of any law or regulation prohibiting the same and considering further that it does not go against prevailing morals or run counter to public policy, Grab Philippines’ purpose of enabling communication between drivers and passengers through the in-app chat module to facilitate the matching and booking of transportation solutions is considered legitimate.

While it is true that purpose is confined to official business use, MLF’s interpretation of what constitutes official business use is inaccurate. He correctly stated that official use should mean “for the purpose of coordinating a ride.”71 Coordinating a ride, however, is not strictly limited to messages that involve only transportation or booking a ride.

The Commission limits its disposition of the case to the issues raised against Grab Philippines and Grab Philippines’ obligations under the DPA. Therefore, it shall not discuss violations of laws that are beyond its jurisdiction. Thus, from a privacy perspective, despite the foul and improper language used by the Grab Philippines driver, the processing of MLF’s information by Grab Philippines in this case, adheres to the general privacy principle of legitimate purpose precisely because the communication between the driver and the passenger remains to be in relation to the desired transportation transaction. The incidents complained of by MLF all occurred within the in-app chat module of Grab Philippines72 and the exchange between the parties took place in the process of negotiating and eventually carrying out a Grab ride transaction.

Grab Philippines, as the platform that facilitates and enables the matching and booking of transportation solutions between independent third party service providers and independent customers, has no control over the manner in which the drivers communicate or correspond with their passengers for the purpose of booking or transacting a ride. Nevertheless, the exchange of messages between the passengers and the drivers, though related to cancellation or inappropriate statements, do not remove the situation from its legitimate purpose of transacting or booking a ride.

While the driver’s use of profanity may result in violations of other laws as against him, given its jurisdiction, the Commission limits its disposition of the case to the issues raised by MLF against Grab Philippines and its obligations under the DPA.

The Commission finds that, in relation to the obligations of Grab Philippines under the DPA, Grab Philippines did not commit any privacy violation because these exchanges remain within the legitimate purpose consented to by MLF. As such, the driver’s profanity continues to be within the context of the whole general purpose of the communication to fulfill a Grab ride transaction, especially since the exchanges were made only within Grab Philippines’ app and in the process of discussing the details of the booking. The utterance of a foul statement does not, by itself, place it outside of the original legitimate purpose from which it stemmed. In effect, contrary to MLF’s claim, the in-app chat and the messages exchanged therein never ceased to be for the purpose of coordinating a ride. Therefore, the exchanges continue to be for the legitimate purpose of transacting official business.

Given that the exchanges in the in-app chat module relating to foul language and cancellations are still within Grab Philippines’ legitimate purpose, there is no privacy violation in this case. As such, it should be dismissed pursuant to Section 12 (b), Rule III of NPC Circular No. 16-04.

II. There is no violation of Section 28 or the Processing of Personal or Sensitive Personal Information for Unauthorized Purposes.

MLF roots his complaint in Section 28 of the DPA.73 Section 28 or the Processing of Personal or Sensitive Personal Information for Unauthorized Purposes requires the concurrence of the following elements:

  1. a person processed information of the data subject;

  2. the information processed is classified as personal or sensitive personal information;

  3. the person processing the information obtained consent of the data subject or is granted authority under the DPA or existing laws; and

  4. the processing of personal or sensitive personal information is for a purpose that is neither covered by the authority given by the data subject and could not have been reasonably foreseen by the data subject nor otherwise authorized by the DPA or existing laws.74

The first three (3) requisites are present in this case.

Section 3 of the DPA defines personal information and processing as follows:

Section 3. Definition of Terms. – Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

(g) Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.

…

(j) Processing refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.75

Given the foregoing, the first and second requisites are met.

The DPA defines a Personal Information Controller (PIC) as a “person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.”76

The Terms of Use for Philippines GrabCar Passengers specifically provides the following:

  1. Personal Data Protection

You agree and consent to the Company using and processing your Personal Data for the Purpose and in the manner as identified hereunder.

…

The Company may use and process your Personal Data for business and activities of the Company which shall include, without limitation[,] the following (the “Purpose”):

• To perform the Company’s obligations in respect of any contract entered with you;

• To provide you with any services pursuant to the Terms of Use herein;

…

• Process, manage or verify your application for the Service pursuant to the Terms of Use herein;

• To validate and/or process payments pursuant to the Terms of Use herein;

…

• To communicate with you for any of the purposes listed herein;

…

• To share your Personal Data amongst the companies within the Company’s group of companies comprising the subsidiaries, associate companies and or jointly controlled entities of the holding company of the group (the “Group”) and with the Company’s and Group’s agents, third party providers, developers, advertisers, partners, event companies or sponsors who may communicate with you for any reasons whatsoever.77

Based on the foregoing, Grab Philippines is a PIC because it collects, processes, and retains personal data of the passenger before and after booking a ride. Prior to booking a ride transaction, the passenger uses a “mobile application supplied to [him] by the [Grab Philippines] Company[.]”78 In the course of booking a ride, it processes personal information in order to “perform the Company’s obligation” and provide the passenger “with any services.”79 It also determines what information will be shared to its drivers and provides the means to allow the passenger to coordinate with the driver through its in-app chat module.80

Thus, Grab Philippines, as the PIC, processed the personal information of MLF, particularly his mobile number and name, in order to connect him to its drivers.

As for the third requisite, it is fulfilled pursuant to the following admissions of MLF stating that he consented to Grab Philippines’ Terms and Conditions for the purpose of transacting a ride so that he and the driver can communicate with each other:

Both Mobile Number and Chat function are made available with my consent under their terms and condition for the purpose of transacting a ride. So that driver and rider can communicate to meet each other.81

Based on their Terms and Condition, I am providing Grab [c]onsent to process and share my Personal Data to their partners (Driver) for the purpose of transacting a trip/ride. […] There is negligence in [sic] Grab’s part of handling my personal data based on Terms and Condition that I agreed on [sic].82

This includes providing the partner or driver access to the chat, call and sms facility which […] I provided consent to for official business.83

The fourth requisite, however, is lacking.

In processing of personal information for unauthorized purposes, the person processing the information either obtained the data subject’s consent or is authorized for a declared and specific purpose under the DPA or any existing laws. The processing becomes unlawful, however, when the information is processed for a different purpose that is neither covered by the authority obtained from the data subject or could not have been reasonably foreseen by the data subject or otherwise authorized under the DPA or any existing law.

As mentioned in MLF’s Affidavit Addendum, he himself admitted that he is “providing Grab [c]onsent to process and share [his] Personal Data to their partners (Driver) for the purpose of transacting a trip/ride.”84 To reiterate the above discussion, the conversation between MLF and the driver continues to be within the context of transacting for a Grab ride. Therefore, the exchanges, in relation to Grab Philippines’ obligations under the DPA, are still within official business and legitimate purpose consented to by MLF.

Grab Philippines did not process MLF’s personal information for a different purpose that is neither covered by the authority given by him nor otherwise authorized by the DPA or existing laws. The processing of MLF’s information remains in accordance with Grab Philippines’ legitimate purpose of enabling communications between the driver and the passenger to facilitate the transaction of a Grab ride.

Given that the processing of MLF’s personal information did not go beyond what he consented, it being within the ambit of the declared and specified purpose, the Commission finds that Grab Philippines did not violate Section 28 of the DPA.

WHEREFORE, premises considered, this Commission resolves that the case filed by MLF against MyTaxi.Ph Corporation is hereby DISMISSED.

This is without prejudice to the filing of appropriate civil, criminal or administrative cases before any other forum or tribunal, if any.

SO ORDERED.

City of Pasay, Philippines. 31 March 2022.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

DUG CHRISTOPER B. MAH Deputy Privacy Commissioner

Copy furnished:

MLF Complainant

MYTAXI.PH CORPORATION Respondent

QUISUMBING TORRES Counsel for Respondent

Footnotes

  1. Complaints-Assisted Form, 2 March 2019, at 1, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  2. Id. at 2. ↩

  3. Id. at 2-3. Emphasis supplied. ↩

  4. Id. at 4. ↩

  5. Id. at 3. ↩

  6. Complaints-Assisted Form, 02 March 2019, at 3, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). Emphasis supplied. ↩

  7. Id. ↩

  8. Id. ↩

  9. Id. ↩

  10. Id. ↩

  11. Order to Confer for Discovery, 13 April 2019, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  12. Attendance Sheet for Discovery Conference, 06 June 2019, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  13. Order, 14 June 2019, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  14. Id. ↩

  15. Entry of Appearance and Motion for Resetting of Discovery Conference, 24 June 2019, at 1, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  16. Id. at 2. ↩

  17. Manifestation and Motion to Defer Submission of Responsive Comment, 05 July 2019, at 2, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  18. Resolution, 15 July 2019, at 2, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  19. Id. ↩

  20. Order, 13 August 2019, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  21. Id. ↩

  22. Id. ↩

  23. Id. ↩

  24. Affidavit Addendum to CID Case No. 19-C-142, 27 August 2019, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  25. Id. Annex A. ↩

  26. Affidavit Addendum to CID Case No. 19-C-142, 27 August 2019, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  27. Id. ↩

  28. Id. ↩

  29. Id. ↩

  30. Id. ↩

  31. Id. Emphasis supplied. ↩

  32. Compliance to Order dated 13 August 2019, 28 August 2019, Annex A, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  33. Id. Annex B. ↩

  34. Id. Annex C. ↩

  35. Id. at 2. ↩

  36. Comment to Complaint dated 02 March 2019 and Affidavit Addendum dated 27 August 2019, 09 September 2019, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  37. Id. at 2. ↩

  38. Id. at 2-3. ↩

  39. Id. at 3. ↩

  40. Id. at 12. ↩

  41. Id. at 5. ↩

  42. Comment to Complaint dated 02 March 2019 and Affidavit Addendum dated 27 August 2019, 09 September 2019, at 5, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  43. Id. at 5-6. ↩

  44. Id. at 6. ↩

  45. Id. at 7. ↩

  46. Id. ↩

  47. Id. ↩

  48. Comment to Complaint dated 02 March 2019 and Affidavit Addendum dated 27 August 2019, 09 September 2019, at 8, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  49. Id. at 8. ↩

  50. Id. ↩

  51. Id. ↩

  52. Id. at 9. Emphasis omitted. ↩

  53. Id. ↩

  54. National Privacy Commission, Rules on Procedure of the National Privacy Commission, Circular No. 04, Series of 2016 [NPC Circular No. 16-04], § 12 (b) (15 December 2016). ↩

  55. Complaints-Assisted Form, 02 March 2019, at 3, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  56. Id. Emphasis supplied. ↩

  57. Affidavit Addendum to CID Case No. 19-C-142, 27 August 2019, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). Emphasis supplied. ↩

  58. Compliance to Order dated 13 August 2019, 28 August 2019, Annex B, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). Emphasis supplied. ↩

  59. National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (2016). ↩

  60. Comment to Complaint dated 2 March 2019 and Affidavit Addendum dated 27 August 2019, 09 September 2019, Annex J, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019); Id. Annex K. ↩

  61. Id. at 1. Emphasis omitted. ↩

  62. Complaints-Assisted Form, 02 March 2019, at 4, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  63. Id. Emphasis supplied. ↩

  64. Affidavit Addendum to CID Case No. 19-C-142, 27 August 2019, Annex A, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  65. Id. at Annex A. ↩

  66. Id. at Annex A. ↩

  67. Compliance to Order dated 13 August 2019, 28 August 2019, Annex B, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). Emphasis supplied. ↩

  68. Id. Annex B. Emphasis supplied. ↩

  69. Comment to Complaint dated 02 March 2019 and Affidavit Addendum dated 27 August 2019, 09 September 2019, Annex J, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). Emphasis supplied. ↩

  70. Id. at Annex K. Emphasis supplied. ↩

  71. Compliance to Order dated 13 August 2019, 28 August 2019, at Annex B, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  72. Complaints-Assisted Form, 02 March 2019, at 2-4, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019); Affidavit Addendum to CID Case No. 19-C-142, 27 August 2019, Annex A, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019); Affidavit Addendum to CID Case No. 19-C-142, 27 August 2019, Annex B, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  73. Complaints-Assisted Form, 02 March 2019, at 3, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  74. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, § 28 (2012). Emphasis supplied. ↩

  75. Id. § 3 (g) & (j). ↩

  76. Id. § 3 (h). Emphasis supplied. ↩

  77. Comment to Complaint dated 02 March 2019 and Affidavit Addendum dated 27 August 2019, 09 September 2019, Annex J, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). Emphasis supplied. ↩

  78. Id. Annex J. ↩

  79. Id. Annex J. ↩

  80. Complaints-Assisted Form, 02 March 2019, at 2-3, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). ↩

  81. Id. Emphasis supplied. ↩

  82. Affidavit Addendum to CID Case No. 19-C-142, 27 August 2019, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). Emphasis supplied. ↩

  83. Compliance to Order dated 13 August 2019, 28 August 2019, Annex B, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). Emphasis supplied. ↩

  84. Affidavit Addendum to CID Case No. 19-C-142, 27 August 2019, in MLF v. MyTaxi.Ph Corporation, NPC Case No. 19-142 (NPC 2019). Emphasis supplied. ↩

Backlinks