NPC Issuance Wiki

NPC 20-026: JBA v. FNT and NNT

Issued Decision

Decision Text

JBA,

Complainant,

-versus-

FNT and NNT,

Respondents.

x----------------------------------------------------x

AGUIRRE, D.P.C.:

Before this Commission is a complaint filed by JBA against FNT and NNT for an alleged violation of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

In her Complaints-Assisted Form (CAF) dated 20 January 2020, JBA claimed that FNT and NNT committed identity theft “by using [her] name in different website[s] with their pictures and contact number[s].”1 Further, JBA stressed that FNT and NNT’s act affected her profession as a Real Estate Broker and that as of the date she filed the complaint, the websites using her name were still active.2 As evidence, JBA attached to her CAF various screenshots of website advertisements (ads) containing her name.3

According to JBA, she was a real estate sales person for FNT and NNT from 2014 to 2017.4 She only submitted her official resignation, on 30 October 2018.5 On the same date, FNT received and signed the resignation letter.6 The resignation letter stated:

I hereby tender my irrevocable resignation as a Sales Persons of Homeplus Realty effective today, October 30, 2018.

And hoping that my remaining commissions from my previous sales will be release [sic] as soon as it is available and all the dummy account [sic] you created in my name will be remove [sic] in [sic] Facebook, [LinkedIn] [and] any website and other online services.7

On 07 December 2020, an Order to Confer for Discovery was issued to the parties.8 On 02 September 2021, an Order was issued instructing FNT and NNT to file their respective verified comments within fifteen (15) days from receipt of the Order.9 Further, the parties were invited to virtually attend the preliminary conference scheduled on 11 November 2021 and 09 December 2021.10

Both parties failed to appear for the 11 November 2021 Preliminary Conference.11 As such, an Order was issued resetting the preliminary conference to the second schedule on 09 December 2021.12

On 09 December 2021, JBA and FNT were present, but NNT failed to appear for the second time.13 During the preliminary conference, FNT manifested that her sister, NNT, should be excluded from the complaint since she is not the head broker.14 Thereafter, the parties were instructed to virtually appear for the third setting of the preliminary conference on 28 January 2022.15 FNT and NNT were ordered to submit their verified comments within fifteen (15) days from receipt of the Order.16

In her email dated 13 December 2021, NNT explained that she has only received the forwarded email from her sister, FNT, on 13 December 2021.17 Further, she claimed the following:

I am not aware of this complaint until now from Ms[.] JBA, since as mentioned by my sister, I have no direct authority over Ms[.] JBA when she was an accredited agent with my sister. Yes, I am a [sic] also an Agent/Seller & Real Estate Broker at the same time by my sister but I have no authority over her direct recruits or agents. Ms[.] JBA is a direct recruit of Ms. FNT. My involvement with Ms[.] FNT’s direct agents/recruits before was merely to conduct classroom and onsite trainings/orientation and provide the best practices within the real estate industry. Any issues or problems encountered by my sister’s direct agents/recruits is under her full authority. I also have no personal involvement as to her complaint on identity theft or hacking into her social media or any online account. As far as I know she was an accredited agent and with mutual consent to be under the online marketing programs that was employed to agents/sellers to HELP THEM GENERATE SALES LEAD AND CONVERT THIS TO COMMISSIONABLE INCOME. As for the hacking complaint, I will not further comment on this since she has NO VALID EVIDENCE presented to point to us as the perpetrator. […] Lastly, to get me involved since I was on a posted picture is preposterous since I am not even aware of such online site or account being created.18

On 15 December 2021, an Order was issued noting the email manifestation of NNT and ordering that it be treated as her Comment to the complaint.19

On 23 December 2021, FNT submitted her Verified Comment.20 She reiterated that her sister NNT is not involved in the dispute:

My sister Miss NNT now may [sic] Co-Broker, has no direct participation of creating any Secondary Facebook Accounts; Multiple Posting of Ads and running Pay-Ads in any of our Facebook Page and other Websites. Ginagamit ang SECONDARY FACEBOOK ACCOUNT ng kapatid for AUTOPOSTING, PAY-ADS at ipapaliwanag ko ito. I will take the responsibility on this, on her behalf.21

FNT explained that the term “online marketing” is intentionally indicated in her recruitment ads for “online marketing real estate agent[s]” and similar positions so that the applicant would know that the selling of real estate and the finding of potential buyers will be through the internet and various social media platforms (e.g., Facebook, Lamudi, and Property24).22 Thus, online marketing ads are the medium used for her real estate ads placement.23 FNT claimed that her agents knew that real estate websites are used to post the ads.24

FNT gave an overview of her recruitment process:

Ang proseso ng Recruitment ko para sa gustong mag-Ahente, kapag nakapirma na ng Seller Accreditation at naka-ATTEND ng Basic Orientation on Real Estate Selling, ang kasunod ay ang pagtuturo ng ONLINE MARKETING gamit ang Facebook, at pagpost sa My Property, Property 24 at OLX na dating Sulit.com at iba pang kilalang Real Estate E-Commerce website. Ako ang nagka-conduct ng Orientation for newly recruits. At Staff ko naman po ang nagtuturo o Hands-On Tutorial sa pag create ng Facebook Page o tinawatawag na Business Page, Multiple Posting Ads sa mga iba’t ibang Group Page ng Facebook and creating Account and Posting Ads sa mga Real Estate Websites or E-Commerce.25

…

After ng Basic Real Estate Orientation, gagawa ng Secondary Facebook Account ang mga Agent sa tulong ng Staff ko. Gumagawa din ng Real Estate Facebook Page, depende sa Ahente kung nais nito may sariling Real Estate Facebook Page. Ang pag-create ng Secondary Facebook Account at Facebook Page ay trabaho ng staff ko, kasama ang pagtuturo paano magLay-out or Edit na mga picture ng bahay at magposts sa mga Group Page o tinatawag na Multiple Posting.

Kailan meron Customized EMAIL Address for Real Estate ang Ahente, dahil gagamitin ito para sa pagsend ng UPDATED INVENTORIES, Pricelists, Project Details, PowerPoint Presentation ng House and Lot, Maps, Photos, Videos etc. Ina-announce ko sa group chat kapag hinihingi ng Lead Broker o Marketing Arm o Broker Coordinator ang mga email address ng mga ACCREDITED AGENT. Kung sino lang nagpasa ng email address sila lang ang makakatangap ng updates. Karamihan sa mga Lead Broker at Developer nakaMASSIVE SENT ng email.26

On an agent’s first day of accreditation, it is already explained to the agent that an effective way to find buyers is through Facebook and real estate websites since these are free and easy to use—all that is necessary is it to create an account and register.27

Particularly for Facebook, FNT explained the process for creating the agent’s Facebook account:

  1. Una, gagawa ng Secondary Facebook Account ang mga Ahente, gagamitin lamang ito sa Real Estate Selling. Nererequire ko na ang Secondary Facebook Account para hindi gamitin ang Primary Account dahil may possibilidad na maBLOCK or iSuspend ang Facebook ang Personal o Primary Account kapag gagamitin sa Multiple Posting ng Ads.

  2. Pangalawa, tutulungan ng staff ko ang Ahente sa pag-create ng Facebook Page or tinawag ngayon Business Page para din sa Real Estate. Ito ang Shop o Website ng Ahente sa Facebook. Maaaring gamiting ang Facebook Page sa pagpost ang mga Ads at ishare sa iba’t ibang Group Pages. Dito sa Facebook Page ina-upload ang mga pictures ng bahay na gustong ibenta ng Ahente. Gagawa ng ALBUM bawat House Model. Kapag Staff ko ang nagcreate ng Facebook Page may abiso sa Ahente na ipopost ang Contact Number nya dahil direct syang tatawagan if may prospect buyers. After po magawa ng Facebook Page, ay i-Turn-Over na ito sa Ahente, i-aadd ang Ahente as Admin sa Page para sya ay may access at full control. Ahente na ang nag-uupload ng mga photos at nag-eencode ng details.

  3. Pangatlo, tuturuan ang Ahente kung paano ang pag-join sa mga Group Pages, at paano magpost ng ADS gamit ang Multi-Posting. Tuturuan ng Multiple Posting upang mabilis ang pagposts ng Ads sa iba’t ibang grupo.

  4. Pang-apat, Editing o Layout ng mga Main Photos na may pangalan at phone number ng Ahente. May pahintulot sa Ahente, ini-inform namin na ilalagay ang contact number nya at direct syang tatawagan ng prospect buyers.

  5. Kapag may oras pa, tutulungan ng staff ko ang ahente gumawa ng account sa Sulit.com; Ayos Dito; My Property gamit ang kanyang pangalan at phone number. Siya lang ang nakakaalam ng password at username, wala kaming access dito. Kapag sa Lamudi Ads ay account ko ang ginagamit, at ang mga Selected Agents o Assigned Agents ang nagpopost ng Ads. Kapag ito ay Premium o may bayad, binibigay ko ang password sa Ahente para pwede sya magpost ng sarili nyang Ads na may Contact Number niya. Siya rin ang sasagot ng Inquiries base sa naipost nyang ADS. Kapag nagrequest ang Ahente na gawan sya ng Account halimbawa sa Ayos Dito, ginagawa ito ng Staff ko at iturn-over sa Ahente ang AyosDito account ibibigay ang username at password.28

Further, FNT stressed that:

Kapag created ng staff ko, gagawa sya ng ‘Customized Email Address[’] o BUSINESS email example [ ]. […] Ibinibigay ng staff ko ang USERNAME at Password sa Ahente. Pero kapag gawa ng Ahente ang Secondary Facebook Account, wala kaming access dito. Hindi hinihingi ng Staff ko o ako ang Password ng Ahente. Maliban nalang kung ibibigay ng Ahente sa staff ko ang username at password at magpapatulong sa posting ng Ads.29

She also mentioned in her Verified Comment that, for the Sheryna.ph listing, there was a “[m]onthly [a]uto [r]enew of post, upt o December 2018.”30

As for the cellphone numbers used in some of the posted ads, FNT admitted that the [ ] and [ ] numbers were previous office contact numbers and were assigned to accounts of agents.31 If there were inquiries made through these contact numbers, then the inquiries were passed on to the agent.32

As to the usage of FNT’s photograph, she argued that this is due to human error:

Ang pag-create ng account sa iba’t ibang website ay nakaassign ang task na ito sa Staff ko, ganun din ang manual Posting of Ads assigned sa kanya. Masasabi kong HUMAN ERROR o hindi sinasadyang pagkakamali ng staff ko na nag-create ng mga account at ADS, at ginagamit ang picture ko. Apat ang nakita ko sa Google, not a LARGE NUMBER. More than 100 Real Estate Website na pwedeng maAds ang mga Ahente dito sa Pilipinas.33

…

Human Error from my Staff o pagkakamali na walang intention, bakit picture ko ang inilagay. Ang instruction ko sa Staff, create ng account sa iba’t ibang website na gamit pangalan ko profile picture at email address ko at contact number dito office kapag nagregister. Sa post ilalagay ang contact number agent at pangalan para sila na direct na kakausapin ng prospect buyer.34

…

Last December 2021 nalaman na may mga account ginawa para sa agent na picture ko ang nakalagay. Wala akong full knowledge, created ito ng Staff ko at wala po akong alam na nilagay picture ko sa Profile at pangalan sa Ahente.35

Regarding the deletion or deactivation of accounts, FNT reasoned that she is not aware of all the website accounts created by her staff, stating that, “[a]ng dami ng deleted posts, at deactivated account at website na deactivated na rin. Exhausted na kame dahil dati pa dini-delete ang mga posts. Hindi ko kabisado ang mga website kung saan nag-register at nagcreate ang staff ko.”36 She further stressed that she cannot verify these information since her staff has passed away.37 She also reasoned that she has no back-up files of the broken computer hard-drive her staff previously used.38 She claimed: “[w]ala akong alam sa mga Username at Password na ginagamit ng Staff ko para makalog-in[.]”39

In her Verified Comment, FNT mentioned that the Facebook account created for JBA has been deactivated40 and that some websites were already inactive.41 She demonstrated that some websites, however, do not have a deactivation or delete account option.42

FNT emphasized that the accounts were created with JBA’s consent, stating that “[g]inawa po ang mga account during the time accredited po kayo sa amin. At aware po kayo sa PAY-ADS PROGRAM or POSTING ADS sa iba’t ibang website. Nakita nyo noon ang mga OJT kung paano sila magposts ng Ads sa Sulit.com at Ayos Dito.”43

In any case, FNT attempted to delete and deactivate the posts and ads.44 She explained that there are some websites, like Sheryna.ph, however, that cannot be accessed and deleted because it was created by her staff and she claimed that she does not know the corresponding username.45 Further, these details cannot be verified with her staff who has passed away: “[h]indi ko na rin makausap ang staff ko na nakikipag-Coordinate sa mga Ahente dahil namayapa na ito after 2 years na nakalipas nag-Resign sya sa akin bilang staff. She resigned End Quarter of 2016 and passed-away 2018.”46

Ultimately, FNT argued that she obtained JBA’s consent for the ads support scheme:

Ang Tatlong (3) na taon na pag-Ahente accredited to me, is a way saying ‘approved’ o ‘with consent’ na nagjoin ka ng Online Marketing o Pay-Ads Program. Wala po kayong pagtututol sa Three (3) years na Online Marketing o Pay-Ads Program na aavail nyo.47

On 24 December 2021, an Order was issued noting the Verified Comment of FNT and instructing that it be furnished to JBA.48

On 28 January 2022, both JBA and FNT attended the Preliminary Conference.49 For the discovery proceedings, JBA required a death certificate of FNT’s staff who posted the ads.50 It was pointed out, however, that only certain individuals can request for death certificates pursuant to the Philippine Statistics Authority rules.51

Instead, FNT and NNT were ordered to submit an affidavit from their agent that their staff in fact, died two (2) years ago.52

FNT and JBA submitted their Application for Mediation dated 31 January 2022 and 01 February 2022, respectively.53

On 09 February 2022, JBA filed her Response to FNT’s Verified Comment.54 She attached more screenshots demonstrating that, on January to February 2022, posted ads still existed containing her name.55 Further, she stressed that she was never informed that the cellphone numbers posted on the ads were assigned to her as an agent.56 Rather, she alleged that FNT and NNT have full control of the numbers.57 Regarding FNT’s argument that she cannot delete or deactivate some accounts due to her staff’s passing, JBA pointed out that there must have been some sort of turn-over policy before the staff left.58 Lastly, she stressed that she was not informed of the posted ads for some of the websites:

Hindi nyo rin po ako ininform na meron kayong ginawang websites ng Property findersph.com, Chitku, Sheryna.ph, Cebu classified.com, Terraconnector.com, Pinoy Professionals, VigattinTrade.com, Piliko.com, BigBenta, Piyesta.com, Hanapbahay.com at adpost.com para sa pangalan ko gamit ang inyong larawan, Contact Nos. at gmail na [ ] na kayo ang may gawa. Wala din po kayong binigay na password sa mga Websites na nabanggit ko.59

JBA similarly filed a Response to NNT’s Comment. She attached various check vouchers containing NNT’s signature and checks issued from joint accounts of which NNT was a joint holder to demonstrate that her commissions were received from NNT.60 She emphasized that FNT instructed that sales be entered in NNT’s name, and that at around November 2016, FNT told them to report to NNT.61 In addition, she alleged that NNT also assisted in answering queries in the group chat.62

On 24 February 2022, FNT submitted the Affidavit of Ms. LGM dated 23 February 2022 attesting that she informed FNT of the demise of her staff, Ms. MSA, in 2021:

That in year 2021, I informed MISS FNT, that her former staff MISS MSA passed away due to Cardiac Arrest.

That, I personally know MISS MSA, and also known to me that she worked as Accredited Agent and Staff of MISS FNT.63

FNT also submitted a letter dated 24 February 2022 explaining the status of some of the posted ads:

Ang iba posts hindi na naming ma-retrieve. Hundreds ang mga posts sa facebooks at iba’t ibang WEBSITE sa lahat ng Agents. MASSIVE POSTING NG ADS lahat na sumang-ayon sa ONLINE MARKETING PROGRAM. Dahil sa dami, hindi ko binubuksan yan iniisa isa iopen para icheck kung may inquiries. Madalas wala sa opisina, ang dami ng Screenshot na sinasabi ng staff wala dito si Mam FNT. Any important transaction, details o request, minimessage sa akin staff sinusulat sa papel para balikan ko ang Ahente o Buyer kung may katanungan kung hindi nila masugatan. Ganun din kapag may ginagawa tasks, nagmemessage ang Staff, sinasabi mam tapos na po, mam ito hindi pa po nagawa tatapos bukas. After ng training, kahit mga dinadala dito na mga Recruit ng complainant, ang naka-assign training ng mga postings ay staff ko at yun din ng nagtuturo paano ang Multiple posting ng Ads.64

Sa mga posts ng Ads, ganun din Staff, hindi binubuksan araw araw, dahil hindi araw araw yan lang ang gagawin na Staff magpost ng mga Ads. Isang beses lang magposts, at hindi na binabalikan dahil ang ibang posting naka AUTO RENEW, ibig sabihin, after 30days kapag na-expire may auto renewal posts either 3 months, 6 months or 1 year. Ang maidelete na mga Ads, kapag meron access at tama ang mga password. Kapag hindi approved change ng Title ng Page, Username hindi napalitan, inactivate na ito. Kaya walang bagong postings.65

…

And also, in my COMMENTS I already presented, regarding Posting Ads, Website with my Photos still exists with the Ads, these websites are no longer Accessible and other ADS was deleted but posting still exists.

Kung naiintihan ang kabuan ng internet at website, sinabi ‘Google Search shows information gathered from websites across the web. Even if we remove content from Google Search, it may still exist on the web. This means someone might still find the content on the page that hosts it, through social media, on other search engines’.

As explained, there are other posts are paid or with subscription for AUTO RENEWAL for a year.66

On 20 April 2022, the Mediation Officer issued a Notice of Non-settlement of Dispute stating that the parties were unable to reach a settlement.67 On 25 April 2022, an Order was issued instructing the parties to submit their respective memoranda within fifteen (15) days from receipt of the Order, including a list of all the evidence presented by the parties and its respective purpose.68

On 08 May 2022, FNT submitted her (1) Memorandum containing a summary of her causes of action and defense and website recovery, deactivation, and deletion; (2) tabulation of the pieces of evidence; and (3) evidence demonstrating that the ads posted are for marketing only.69 On 31 May, she submitted a revised Tabulation of Additional Evidence.70

JBA, on the other hand, requested an extension of time to submit her Memorandum.71 In an Order dated 24 May 2022, the CID granted JBA’s request and gave her fifteen (15) calendar days from receipt of the Order to submit her Memorandum.72 JBA submitted her Memorandum dated 07 June 2022 where she reiterated that her personal information was used even after her contract with FNT expired.73 As a result, she prayed that damages be awarded in her favor.74

After received JBA’s Memorandum, FNT, through an email dated 14 June 2022, requested an additional fifteen (15) days “to verify other links” found in the Memorandum and “to submit another tabulation”.75 On 15 June 2022, the CID issued an Order granting FNT’s request and giving her fifteen (15) calendar days from receipt of the Order to file her pleading.76

Issues

I. Whether NNT is liable for violating the DPA; and

II. Whether FNT is liable for Section 25 (Unauthorized Processing of Personal or Sensitive Personal Information) of the DPA.

Discussion

I. NNT is not liable for violating the DPA.

The case against NNT should be dismissed for lack of merit. The CAF filed by JBA was dated 20 January 2020.77 Seeing as it was filed before 12 February 2021, which is the effectivity of NPC Circular 2021-01 or the 2021 NPC Rules of Procedure, NPC Circular 16-04 or the 2016 NPC Rules of Procedure is the applicable rule in this case.

Rule II, Section 10 of the 2016 NPC Rules of Procedure states the following:

Section 10. Form and Contents of the Complaint.

…

The complaint shall include a brief narration of the material facts and supporting documentary and testimonial evidence, all of which show: (a) the violation of the Data Privacy Act or related issuances; or (b) the acts or omissions allegedly committed by the respondent amounting to a privacy violation or personal data breach.78

In administrative cases, it is the complainant that must prove her allegations with substantial evidence:

In administrative proceedings, such as this case, it is the complainant who carries the burden of proving her allegations in the complaint with substantial evidence or such ‘relevant evidence that a reasonable mind might accept as adequate to support a conclusion.’

…

Thus, it is the party who alleges a fact that has the burden of proving it. Allegations alone do not constitute evidence since ‘self-serving assertion[s] cannot be given credence.’

…

Ultimately, it is [the complainant] that bears the burden of proving the allegations in her Complaint with substantial evidence. Jurisprudence is settled that if she ‘fail[s] to show in a satisfactory manner the facts upon which [her] claims are based, the [respondent is] not obliged to prove [its] exception or defense.’79

In this case, JBA was not able to sufficiently demonstrate with any substantial evidence that NNT committed acts or omissions that amounted to a violation of the DPA.

In her CAF, JBA impleaded NNT as a respondent, along with FNT, and claimed that they committed identity theft “by using [her] name in different website[s] with their pictures and contact number[s].”80 To demonstrate NNT’s involvement in the alleged identity theft, JBA also submitted to the Commission various check vouchers containing NNT’s signature and checks issued from joint accounts of which NNT was a joint holder.81 She argued that these showed that her commissions were received from NNT.82 Further, she alleged that FNT instructed that the sales be entered in NNT’s name.83

Upon further scrutiny of the various checks and check vouchers submitted, the Commission finds that these are not enough to substantially demonstrate NNT’s involvement in any privacy violation, particularly, the posting of ads containing JBA’s personal information even after her withdrawal of consent.

The check vouchers contained NNT’s signature under the portion indicating “Approved By:“.84 As for the checks addressed to JBA, they were issued from the following joint accounts: (1) NNT or CMN; or (2) NNT and/or FNT.85 Contrary to JBA’s claims, these various checks and check vouchers merely demonstrate that NNT is an account holder of the checks issued and that she is involved in the organization’s finances. These checks and check vouchers, however, do not show that NNT committed any act or omission in violation of the DPA. Thus, NNT cannot be said to have violated the DPA solely on the basis that she is a signatory and account holder of “commission” checks received by JBA.

Further, NNT maintained that she had no direct authority over JBA since JBA is a direct recruit or agent of her sister FNT.86 With this, FNT herself manifested in her Verified Comment that NNT “has no direct participation of creating any Secondary Facebook Accounts; Multiple Posting of Ads and running Pay-Ads in any of our Facebook Page and other Websites.”87

Given that JBA was not able to discharge the necessary burden of proof, the case against NNT should be dismissed for lack of merit.

II. FNT is liable for Section 25 (Unauthorized Processing of Personal or Sensitive Personal Information) of the DPA.

FNT violated Section 25 of the DPA, or Unauthorized Processing of Personal or Sensitive Personal Information, when she continued to post ads containing JBA’s personal information even after JBA’s withdrawal of consent.

Unauthorized Processing of Personal or Sensitive Personal Information is committed when:

  1. The perpetrator processed the information of the data subject;

  2. The information processed was personal information or sensitive personal information; and

  3. The processing was done without the consent of the data subject, or without being authorized under the DPA or any existing law.88

All three (3) requisites are present.

On the first requisite, FNT processed the information of her data subject, JBA. Section 3 of the DPA defines processing as follows:

Section 3. Definition of Terms.

…

(j) Processing refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.89

As mentioned by FNT in her Verified Comment, her staff assisted her agents in posting ads on multiple platforms such as “My Property, Property 24 at OLX na dating Sulit.com at iba pang kilalang Real Estate E-Commerce website.”90 Thus, FNT processed JBA’s personal information through her staff, who used JBA’s name in the posted online marketing ads.91

As for the second requisite, the information that FNT processed is personal information. Section 3 of the DPA defines personal information:

Section 3. Definition of Terms.

…

(g) Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.92

As previously held by the Commission, a name is personal information:

The names stated in the affidavit can reasonably and directly ascertain the identities of the individuals involved in the incidents. The names, therefore, are considered personal information, the processing of which must be in accordance with the DPA.93

The various screenshots JBA submitted to the Commission show that her name, “JBA” is displayed on the posted ad listings.94 Thus, FNT processed JBA’s personal information.

The third requisite is similarly present. FNT’s posting of ads were done without JBA’s consent nor were they authorized under the DPA or any existing laws.

To recall, JBA submitted her official resignation letter on 30 October 2018.95 She withdrew her consent and explicitly exercised her right to erasure when she stated that she hoped “all the dummy account [sic] you created in my name will be remove [sic] in [sic] Facebook, [LinkedIn] [and] any website and other online services.”96

JBA submitted multiple screenshots of ads posted prior to her official resignation.97 These were posted with JBA’s consent, seeing as she was still a sales agent at the time.

JBA, however, also presented screenshots of websites demonstrating that ads were posted on Sheryna.ph containing her personal information even after her resignation on 30 October 2018:

  1. Imus Gen Trias Cavite 3BR 2T&B Catherine (Ad ID: 408339) – posted on 23 November 2018;98

  2. Gabrielle Imus Gen Trias Cavite 3BR 2T&B (Ad ID: 408330) – posted on 27 December 2018;99

  3. Imus Gen Trias Cavite 3BR 2T&B Catherine (Ad ID: 408339) – posted on 29 November 2021;100 and

  4. Imus Gen Trias Cavite 4BR 3T&B Alexandra (Ad ID: 408326) – posted on 08 February 2021.101

The dates of these particular ad listings show that they were posted after JBA’s resignation dated 30 October 2018. To recall, JBA’s resignation letter explicitly contained her withdrawal of consent and request for the exercise of her right to erasure.102 Thus, since these ads were posted after JBA’s resignation, FNT’s processing of JBA’s personal information on these particular ads was done without her consent or authority under the DPA or any existing law.

Section 16 of the DPA specifically provides for a data subject’s right to erasure:

Section 16. Rights of the Data Subject. The data subject is entitled to:

…

(e) Suspend, withdraw or order the blocking, removal or destruction of his or her personal information from the personal information controller’s filing system upon discovery and substantial proof that the personal information are incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes or are no longer necessary for the purposes for which they were collected. In this case, the personal information controller may notify third parties who have previously received such processed personal information.103

Section 34 of the Implementing Rules and Regulations (IRR) further explains when this right may be exercised:

Section 34. Rights of the Data Subject. The data subject is entitled to the following rights:

…

e. Right to Erasure or Blocking. The data subject shall have the right to suspend, withdraw or order the blocking, removal or destruction of his or her personal data from the personal information controller’s filing system.

  1. This right may be exercised upon discovery and substantial proof of any of the following:

(a) The personal data is incomplete, outdated, false, or unlawfully obtained;

(b) The personal data is being used for purpose not authorized by the data subject;

(c) The personal data is no longer necessary for the purposes for which they were collected;

(d) The data subject withdraws consent or objects to the processing, and there is no other legal ground or overriding legitimate interest for the processing;

(e) The personal data concerns private information that is prejudicial to data subject, unless justified by freedom of speech, of expression, or of the press or otherwise authorized;

(f) The processing is unlawful;

(g) The personal information controller or personal information processor violated the rights of the data subject.

  1. The personal information controller may notify third parties who have previously received such processed personal information.104

Certain obligations are imposed upon the Personal Information Controller (PIC) in relation to the right to erasure or blocking:

Section 10. Right to Erasure or Blocking.

…

C. PICs shall inform the recipients or third parties who have previously received such personal data of the fact of erasure. PICs shall likewise inform the data subject about such recipients of his or her personal data.

D. Where personal data that is the subject of a request for erasure is publicly available, i.e. online, reasonable and appropriate measures shall be taken by the PIC to communicate with other PICs, including third party indexes, and request them to erase copies or remove or de-list search results or links to the pertinent personal data. In determining what is reasonable and appropriate, the available technology and the cost of implementation shall be considered.

E. Data subjects must be adequately informed of the consequences of the erasure of their personal data.105

The PIC, however, may deny the request for erasure or blocking, wholly or partly, when the personal data is still necessary for any of the following:

Section 10. Right to Erasure or Blocking.

…

B. PICs should judiciously evaluate requests for the exercise of the right to erasure or blocking.

…

  1. Denial of Request. A request for erasure or blocking may be denied, wholly or partly, when personal data is still necessary in any of the following instances:

a) Fulfillment of the purpose/s for which the data was obtained;

b) Compliance with a legal obligation which requires personal data processing;

c) Establishment, exercise, or defense of any legal claim;

d) Legitimate business purposes of the PIC, consistent with the applicable industry standard for personal data retention;

e) To apprise the public on matters that have an overriding public interest or concern, taking into consideration the following factors: i. constitutionally guaranteed rights and freedoms of speech, of expression, or of the press; ii. whether or not the personal data pertains to a data subject who is a public figure; and iii. other analogous considerations where personal data are processed in circumstances where data subjects can reasonably expect further processing.

f) As may be provided by any existing law, rules, and regulations.106

In this case, none of the circumstances that would warrant a denial of a request for erasure under Section 10 (B) (2) of NPC Advisory 21-01 (Data Subject Rights) are present. Thus, there is no reason for FNT to deny the request for erasure. As the PIC, she should have complied with the request.

FNT received and acknowledged the resignation of JBA on 30 October 2018.107 After acknowledging JBA’s withdrawal of consent to process her personal information and exercise of her right to erasure in her resignation letter, FNT, as the PIC, should not have processed JBA’s personal information from that point onwards. Rather, she should have initiated the removal of JBA’s personal information in the currently posted ads.

Further, there is no longer any reason to post ads with JBA’s name after the resignation since, at that point, JBA was no longer affiliated with FNT.

The Commission also refutes FNT’s argument regarding the automatic renewal of ads for the Sheryna.ph listing.108 To recall, FNT explained as follows:

Isang beses lang magposts, at hindi na binabalikan dahil ang ibang posting naka AUTO RENEW, ibig sabihin, after 30days kapag na-expire may auto renewal posts either 3 months, 6 months or 1 year.109

…

As explained, there are other posts are paid or with subscription for AUTO RENEWAL for a year.110

Availing of automatic renewal methods, however, does not remove a PIC’s obligation to ensure that personal information is properly processed and that a data subject’s rights are observed. FNT, as the PIC, cannot deny accountability by stating that the posts were subject to automatic renewal. As a PIC, she should have had measures in place or taken the necessary steps after receiving JBA’s resignation to ensure that she can control when the posted ads would be posted or removed.

The mere act of uploading and posting ads on internet websites does not remove a PIC’s liability since the PIC is expected to have control over the posted ads.

FNT similarly cannot deflect responsibility by pointing to her deceased staff member, stating that “[h]indi ko kabisado ang mga website kung saan nag-register at nagcreate ang staff ko,”111 and “[w]ala na akong mapagtanungan dahil namayapa na siya.”112 Therefore, “[w]ala akong alam sa mga Username at Password na ginagamit ng Staff ko para makalog-in[.]”113

According to the Affidavit of Ms. LGM, FNT was informed of the demise of her staff in 2021.114 JBA, however, resigned in October 2018.115 Thus, FNT could have and should have removed the posted ads starting from the date of resignation. Further, even assuming that she could no longer delete the accounts created under the name of JBA, she should have taken steps to ensure that there will be no further processing of personal information in relation to these accounts.

Instead, the records show that listings were still being posted under the name of JBA as late as February and November 2021.116

Given these, any processing made by FNT after she acknowledged JBA’s resignation and exercise of her right to erasure is without consent or authority under the DPA or any existing law. Therefore, the processing of those particular ads were unauthorized and done in violation of Section 25 of the DPA.

WHEREFORE, premises considered, this Commission hereby:

  1. DISMISSES the case against NNT for lack of merit; and

  2. FINDS that FNT violated Section 25 of the Data Privacy Act of 2012 (DPA) and FORWARDS this Decision and a copy of the pertinent case records to the Secretary of Justice. This Commission RECOMMENDS the prosecution of FNT for Unauthorized Processing of Personal or Sensitive Personal Information under Section 25 of the DPA.

SO ORDERED.

City of Pasay, Philippines

22 September 2022

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

I CONCUR:

JOHN HENRY D. NAGA

Privacy Commissioner

Copy furnished:

JBA

Complainant

FNT and NNT

Respondents

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Complaints-Assisted Form, 20 January 2020, at 3, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  2. Id. at 5. ↩

  3. Id. at 13-120. ↩

  4. Id. at 5. ↩

  5. Id. ↩

  6. Id. at 11. ↩

  7. Complaints-Assisted Form, 20 January 2020, at 11, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). Emphasis supplied. ↩

  8. Order to Confer for Discovery, 07 December 2020, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  9. Order (To File Verified Comment and Appear Virtually for Preliminary Conference), 02 September 2021, at 1, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  10. Id. ↩

  11. Order (After the 1st Preliminary Conference held on 11 November 2021), 11 November 2021, at 1, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  12. Id. ↩

  13. Order (After the 2nd Preliminary Conference held on 09 December 2021, to Submit Email Address and Verified Comment, and to Appear for the 3rd Setting of the Preliminary Conference), 09 December 2021, at 1, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  14. Id. ↩

  15. Id. at 2. ↩

  16. Id. ↩

  17. Email from NNT, to NPC CID Hearings (13 December 2021). ↩

  18. Id. ↩

  19. Order (Noting the Manifestation of the Respondent NNT and Treating such Manifestation as Respondent NNT’s Comment), 15 December 2021, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  20. Email from FNT, to NPC CID Hearings (23 December 2021). ↩

  21. Verified Comment of FNT, 23 December 2021, at 1, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  22. Id. at 2. ↩

  23. Id. ↩

  24. Id. at 5. ↩

  25. Id. at 2. ↩

  26. Id. at 5. Emphasis supplied. ↩

  27. Verified Comment of FNT, 23 December 2021, at 12, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  28. Id. at 12-16. ↩

  29. Id. at 18. ↩

  30. Id. at 82. ↩

  31. Id. at 65. ↩

  32. Id. ↩

  33. Verified Comment of FNT, 23 December 2021, at 83, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  34. Id. at 142. ↩

  35. Id. ↩

  36. Id. at 85. ↩

  37. Id. ↩

  38. Id. at 97. ↩

  39. Verified Comment of FNT, 23 December 2021, at 97, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  40. Id. at 86. ↩

  41. Id. at 88-90. ↩

  42. Id. at 87, 91, 93. ↩

  43. Id. at 112. ↩

  44. Id. at 137-139. ↩

  45. Verified Comment of FNT, 23 December 2021, at 139, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  46. Id. at 142. ↩

  47. Id. at 144. ↩

  48. Order (Noting the Submission of Comment of Respondent FNT), 24 December 2021, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  49. Order (After the 3rd Preliminary Conference held on 28 January 2022, Submission of Documents from the Parties, and to Submit a Filled-Out Application for Mediation Form), 28 January 2022, at 1, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  50. Id. ↩

  51. Order (After the 3rd Preliminary Conference held on 28 January 2022, Submission of Documents from the Parties, and to Submit a Filled-Out Application for Mediation Form), 28 January 2022, at 1, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  52. Id. ↩

  53. Application for Mediation, 31 January 2022, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022); Application for Mediation, 01 February 2022, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  54. Response to FNT’s Verified Comment, 09 February 2022, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  55. Id. at 1-19. ↩

  56. Id. at 22. ↩

  57. Id. ↩

  58. Id. ↩

  59. Id. at 27. ↩

  60. Response to NNT’s Comments, 09 February 2022, at 1, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  61. Id. ↩

  62. Id. ↩

  63. Affidavit, 23 February 2022, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  64. FNT’s Letter to NPC, 24 February 2022, at 3-4, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  65. Id. at 4. Emphasis supplied. ↩

  66. Id. at 5-6. Emphasis removed. Emphasis supplied. ↩

  67. Notice of Non-Settlement of Dispute, 20 April 2022, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  68. Order (for Resumption of Complaints Proceedings, Noting the Submissions of the Respondents, and Requiring the Parties to Submit their Simultaneous Memoranda), 25 April 2022, at 2-3, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  69. Email from FNT, to NPC CID Hearings (08 May 2022). ↩

  70. Tabulation of Additional Evidence, 31 May 2022, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  71. Email from JBA, to NPC CID Hearings (23 May 2022). ↩

  72. Order (Granting the Complainant’s Request for Extension of Time to File Memorandum), 24 May 2022, at 1, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  73. Memorandum, 07 June 2022, at 2, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  74. Id. at 6-7. ↩

  75. Email from FNT, to NPC CID Hearings (14 June 2022). ↩

  76. Order (Granting the Respondent’s Email Manifestation), 15 June 2022, at 3, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  77. Complaints-Assisted Form, 20 January 2020, at 5, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  78. National Privacy Commission, 2016 Rules of Procedure of the National Privacy Commission [NPC 2016 Rules of Procedure], rule II, 10 (15 December 2016). Emphasis supplied. ↩

  79. NPC 19-465, 03 March 2022, at 7, 10 (NPC 2022) (unreported). ↩

  80. Complaints-Assisted Form, 20 January 2020, at 3, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  81. Response to NNT’s Comments, 09 February 2022, at 1-3, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  82. Id. at 1. ↩

  83. Id. ↩

  84. Id. at 1, 3. ↩

  85. Id. ↩

  86. Email from NNT, to NPC CID Hearings (13 December 2021). ↩

  87. Verified Comment of FNT, 23 December 2021, at 1, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  88. NPC 19-134, 10 December 2021, at 12 (NPC 2021) (unreported). ↩

  89. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, a nd For Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, 3 (j) (2012). Emphasis supplied. ↩

  90. Verified Comment of FNT, 23 December 2021, at 2, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  91. See Complaints-Assisted Form, 20 January 2020, at 25-120, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  92. Data Privacy Act of 2012, 3 (g). ↩

  93. NPC 21-031, 03 March 2022, at 9 (NPC 2022) (unreported). ↩

  94. Complaints-Assisted Form, 20 January 2020, at 25-120, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  95. Id. at 11. ↩

  96. Id. ↩

  97. See Complaints-Assisted Form, 20 January 2020, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  98. Complaints-Assisted Form, 20 January 2020, at 109, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  99. Id. at 111. ↩

  100. Response to FNT’s Verified Comment, 09 February 2022, at 15-16, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  101. Id. at 17. ↩

  102. Complaints-Assisted Form, 20 January 2020, at 11, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  103. Data Privacy Act of 2012, 16 (e). ↩

  104. National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, 34 (e) (2016). Emphasis supplied. ↩

  105. National Privacy Commission, Data Subject Rights, Advisory No. 01, Series of 2021 [NPC Advisory No. 21-01], 10 (C)-(E) (29 January 2021). Emphasis supplied. ↩

  106. Id. 10 (B) (2). ↩

  107. Complaints-Assisted Form, 20 January 2020, at 11, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  108. See Verified Comment of FNT, 23 December 2021, at 82, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022); FNT’s Letter to NPC, 24 February 2022, at 4, 6, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  109. FNT’s Letter to NPC, 24 February 2022, at 4, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  110. Id. at 6. ↩

  111. Verified Comment of FNT, 23 December 2021, at 85, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  112. Id. ↩

  113. Id. at 97. ↩

  114. Affidavit, 23 February 2022, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  115. Complaints-Assisted Form, 20 January 2020, at 11, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

  116. Response to FNT’s Verified Comment, 09 February 2022, at 15-17, in JBA v. FNT and NNT, NPC Case No. 20-026 (NPC 2022). ↩

Backlinks