NPC Issuance Wiki

NPC 20-317 and 20-318: GBA v. SBG and LPL v. SBG

Issued Decision

Decision Text

NPC 20-317 and NPC 20-318

GBA, Complainant (NPC 20-317), and LPL, Complainant (NPC 20-318),

-versus-

SBG,

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.:

Before this Commission are the consolidated cases filed by GBA and by LPL (Complainants) against SBG for an alleged violation of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

The Complainants are members of the Benguet State University and Community Multipurpose Cooperative (Cooperative).1 They alleged that on two separate occasions, SBG accessed the IT Accounting System of the Cooperative, printed the accounts of some of the members, including those of the Complainants, and showed the printed documents to some officers of the Cooperative.2 The Complainants claimed that SBG accessed their personal data, particularly their names, addresses, marital status, and details of their savings and loans accounts.3

According to the Complainants, SBG had no authority to access the accounts because she was no longer an employee of the Cooperative when she accessed their accounts.4 Further, the Complainants asserted that they did not give their consent to the processing of their accounts.5 The Complainants claimed that they are entitled to damages for the alleged unauthorized access of their accounts.6

On 18 August 2021, the Commission, through its Complaints and Investigation Division (CID), issued an Order directing the Complainants to submit their evidence to support the allegations in their complaints.7

On 23 August and 24 August 2021, LPL and GBA, respectively, submitted the same set of documentary evidence, which includes:

  1. Joint Affidavit of JTA and Rhodora LPL, who personally witnessed SBG’s alleged processing of the Complainants’ accounts;8 and

  2. Copies of the accounts and ledgers, which SBG allegedly processed.9

On 14 October 2021, the CID issued an Order directing SBG to file her comment and scheduling the preliminary conference on 18 January 2022.10

On 10 December 2021, SBG filed her Comment.11 She denied all the allegations of the Complainants and argued that her acts “were in accordance with her function as Audit and Compliance Officer (ACO).”12

She claimed that:

On or about June 2019, as part of her duty to render report to the CEO/BOD that reflect audit result on all discrepancies, deficiencies or any unusual noted in the course of audit, [SBG] was tasked by the CEO of [the Cooperative] and wife of Complainant GBA, JTA, to review the 2017 Risk-Based Evaluation Report of [the Cooperative], comparing the same to the performance of the Cooperative for the years 2018 and 2019, and providing a report indicating any developments during the said reporting periods.13

She further narrated that while she was reviewing the Cooperative’s accounts, she discovered questionable transactions that involved JTA, who is the Cooperative’s Chief Executive Officer (CEO), and LPL, who is the Cooperative’s accountant and bookkeeper.14 SBG further alleged that the transactions also involved the Complainants, who are family members of JTA and LPL.15

According to SBG, after she resigned from the Cooperative, she received a letter from the Cooperative’s Audit Committee requesting for her assistance in the conduct of an audit in relation to the questionable transactions she previously discovered.16

SBG alleged that during the audit, the Board of Directors and the Audit Committee requested LPL “to print a copy of the journal vouchers, ledgers, and financial statements.”17 She denied the allegation of the Complainants that she accessed the accounts and claimed that it was actually LPL who “searched, accessed, and printed the copies of the Journal Vouchers.”18

SBG argued that the processing of the Complainants’ personal data was “necessary for the legitimate interest of [the Cooperative] and its General Assembly”19 and “necessary for the protection of the lawful rights and interests of the [Cooperative] and its members as well as for the establishment and exercise of a legal claim”.20 She further asserted that “[a]sking the consent of the persons involved prior to the audit is not only impractical but will also run counter to the goal of the [C]ommittee to investigate possible fraudulent transactions.”21

In addition, SBG asserted that she did not violate the general privacy principles of transparency, legitimate purpose, and proportionality.22 SBG argued that during the pre-membership seminar, the members of the Cooperative are “apprised of the data/information that he or she needs to provide to the [C]ooperative, as well as the purpose of collecting the said data” and the duties and responsibilities of the Cooperative’s Board of Directors, officers, and committees.23 Thus, SBG claimed that the Complainants “cannot feign ignorance as to the necessity of processing [their] information for audit purposes.”24 She also alleged that as the ACO, she “was well within the scope of her duty to look into irregular and unusual transactions involving the money of the cooperative members.”25

During the Preliminary Conference on 18 January 2022, the Complainants’ counsel moved for the consolidation of the cases on the ground that both have the same facts and issues.26 The CID granted the motion to consolidate the cases and directed the parties to submit their respective pre-trial briefs and their respective comments to the pre-trial briefs.27

The Complainants submitted their Joint Pre-Trial Brief dated 28 January 2022, which included their proposed facts for stipulation and admission and their manifestation to present additional documentary evidence.28 SBG filed her Compliance with Pre-Trial Brief dated 02 February 2022, which also included her proposed stipulation of facts and the list of documents she manifested to offer as evidence.29

Thereafter, the Complainants filed their Comment to the Stipulations of Fact Proposed by the Respondent dated 15 February 2022.30 SBG filed her Comment/Objection to the Pre-Trial Brief of the Complainants dated 16 February 2022.31

On 27 May 2022, the Complainants filed their Memorandum.32 They alleged that SBG violated the provisions of the DPA when she accessed and processed the Complainants’ personal information without their consent.33

The Complainants argued that the fulfillment of the Cooperative’s legitimate interest does not excuse SBG from securing the consent of the data subjects.34 They questioned SBG’s authority since she was neither an employee nor an officer of the Cooperative at the time of her processing of their personal information.35

They asserted that they are entitled to damages considering that SBG “accessed and processed their personal information without their knowledge and consent.”36

In her Memorandum, SBG claimed that she was authorized to assist with the audit “by virtue of a decision from the Board of Directors ordering the Audit Committee to request for [her] assistance.”37 She further argued that the audit was for the protection of the legitimate interest of the Cooperative and its General Assembly and for the establishment of a legal claim.38 She alleged that as a result of the audit, a criminal case was filed against the Complainants, GBA, LPL, and other persons involved.39

SBG asserted that the processing of Complainants’ personal information was proportionate and necessary to pursue the Cooperative’s legitimate interest:

The processes employed by the Audit Committee, as well as [SBG] in the conduct of the audit are in accordance with the cooperative [sic] policies, and are proportionate and necessary to pursue the cooperative’s legitimate interest. In the conduct of the audit, [SBG] did not disclose to third persons the contents of the information that were subjected to audit. […] In fact, throughout the audit proceedings, [SBG] made sure that the information handed to her would not be leaked prior to the validation and verification of the irregular transactions.40

Lastly, SBG claimed that she is entitled to damages “for the baseless and unwarranted filing of these cases.”41

Issue

Whether SBG is liable for Unauthorized Processing of Personal Information or Sensitive Personal Information under Section 25 of the DPA.

Discussion

The Commission finds that SBG is not liable for Unauthorized Processing of Personal Information or Sensitive Personal Information under Section 25 of the DPA. Her processing of the Complainants’ personal information was lawful in accordance with Section 12 (f) of the DPA.

To determine whether there is an Unauthorized Processing of Personal Information or Sensitive Personal Information, the following requisites must concur:

  1. The perpetrator processed the information of the data subject;
  2. The information processed was personal information or sensitive personal information; and
  3. The processing was done without the consent of the data subject, or without being authorized under the DPA or any existing law.42

As to the first requisite, SBG did not refute the allegation that she processed the personal information of the Complainants. While it is not clear who really accessed the accounts of the members of the Cooperative, it is undisputed that SBG obtained a printed copy of the ledgers and account transactions of some of the members of the Cooperative and used the documents for the audit investigation.43 The acquisition and use of the printed copy of the ledgers and account transactions are within the definition of “processing” under Section 3 (j) of the DPA:

Section 3. Definition of Terms. Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

(j) Processing refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.44

Thus, SBG processed personal data when she obtained and used the printed copy of the ledgers and account transactions.

As to the second requisite, the information processed was personal information. Section 3 (g) of the DPA defines personal information:

Section 3. Definition of Terms. Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

(g) Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.45

The printed ledgers and account transactions include the names and the account numbers of the Cooperative members.46 These names and account numbers, when put together with other information, can directly and certainly identify the members of the Cooperative. Thus, they are considered personal information under the DPA.

The third requisite is not present. The members of the Cooperative claimed that SBG did not obtain their consent before processing their personal information.47 SBG’s processing, however, is still pursuant to a lawful criterion for processing personal information. Section 12 (f) of the DPA provides:

Section 12. Criteria for Lawful Processing of Personal Information. The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

…

(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.48

The Commission previously identified the following requisites for processing based on a legitimate interest:

Processing based on legitimate interest requires the fulfillment of the following conditions: (1) the legitimate interest is established; (2) the processing is necessary to fulfill the legitimate interest that is established; and (3) the interest is legitimate or lawful and it does not override fundamental rights and freedoms of data subjects.49

In this case, SBG clearly established that the processing of Complainants’ personal information was not for her own interest, but for the interests of the Cooperative and upon the request and under the authority of the Board of Directors. As proof, she submitted the letter she received from the Audit Committee requesting her presence and assistance in the audit.50 She also submitted a copy of the minutes of the meeting of the Board of Directors where they agreed to conduct an audit and to ask SBG’s assistance in the audit.51

Further, SBG established that the Cooperative has the legitimate interest to protect its assets and its members.52 She claimed that when the Cooperative confirmed, through the audit, that there were fraudulent transactions, it filed a criminal complaint against the persons involved in those transactions.53 In order to substantiate these allegations, she submitted a copy of the Investigation Data Form and the Affidavit-Complaint of the Board of Directors in relation to the criminal complaint.54

As to the second and third requisites of legitimate interest, not only must the interest established be legitimate but the manner in which that legitimate interest is sought to be achieved is equally important. It must be done in a way that does not override the fundamental rights and freedoms of the data subjects taking into consideration the principles of proportionality and fairness.

In this case, the Commission finds that this interest is legitimate and does not override the fundamental rights and freedoms of the data subjects, including the Complainants. The Cooperative has the right to protect its interests, especially the savings and investments of its members. This legitimate interest does not, in any way, disregard the fundamental rights and freedoms of the Complainants.

SBG’s processing of the Cooperative members’ personal information was necessary for the conduct of the audit investigation to verify questionable transactions.55 The Cooperative’s interest to conduct the audit investigation is necessary to ensure that the financial information relating to the Cooperative is accurately recorded and to detect any irregular transactions.

It is within the legitimate interest of the Cooperative, through its Board of Directors, to authorize the conduct of the audit and the person who will conduct the same. The documents submitted56 demonstrate that the Board of Directors authorized SBG to process the Complainants’ personal information for the audit investigation. In this case, the totality of the evidence on record shows that when SBG processed the members’ personal information, she was doing so under the authority granted to her and for the protection of the interests of the Cooperative and ultimately, its members. Further, from the evidence on record, the manner in which the audit was conducted was both proportional and fair to the Complainants. It involved only the information necessary to achieve its purpose and took steps to ensure the confidentiality of the audit.

All these circumstances taken together leads the Commission to reasonably conclude that SBG had authority to process the personal information of the Complainants for the purpose of the audit investigation. Further, there is nothing on record showing that SBG processed the Complainants’ personal information for a purpose that is unrelated to the audit investigation. Given these, SBG lawfully processed the Complainants’ personal information.

Considering that the third requisite is not present, SBG cannot be held liable for Unauthorized Processing of Personal Information or Sensitive Personal Information under Section 25 of the DPA.

WHEREFORE, premises considered, the Commission resolves that the Complaints filed by GBA and LPL against SBG is hereby DISMISSED for lack of merit.

This is without prejudice to the filing of appropriate civil, criminal, or administrative cases against the Respondent SBG before any other forum or tribunal, if any.

SO ORDERED.

City of Pasay, Philippines.

13 October 2022.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

I CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

Copy furnished:

GBA Complainant

LPL Complainant

PABLITO, KIAT-ONG, CAPUYAN AND ASSOCIATES LAW OFFICE Counsel for the Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Complaints-Assisted Form, 01 December 2020, in GBA v. SBG, NPC 20-317 (NPC 2020); Complaints-Assisted Form, 03 December 2020, in LPL v. SBG, NPC 20-318 (NPC 2020). ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. ↩

  6. Id. ↩

  7. Order, 18 August 2021, in GBA v. SBG and LPL v. SBG, NPC 20-317 and 20-318 (NPC 2021). ↩

  8. Submission and Offer of Documentary Evidence, 23 August 2021, Exhibit A, in GBA v. SBG and LPL v. SBG, NPC 20-317 and 20-318 (NPC 2022); Submission and Offer of Documentary Evidence, 24 August 2021, Exhibit A, in GBA v. SBG and LPL v. SBG, NPC 20-317 and 20-318 (NPC 2020). ↩

  9. Id., 23 August 2021, Exhibits B-I; Id., 24 August 2021, Exhibits B-I. ↩

  10. Order, 14 October 2021, at 1, in GBA v. SBG and LPL v. SBG, NPC 20-317 and 20-318 (NPC 2021). ↩

  11. Comment, 10 December 2021, in GBA v. SBG and LPL v. SBG, NPC 20-317 and 20-318 (NPC 2021). ↩

  12. Id. at 2. ↩

  13. Id. at 3. ↩

  14. Id. at 3-4. ↩

  15. Id. ↩

  16. Id. at 5. ↩

  17. Comment, 10 December 2021, at 5, in GBA v. SBG and LPL v. SBG, NPC 20-317 and 20-318 (NPC 2021). ↩

  18. Id. ↩

  19. Id. at 8. ↩

  20. Id. at 10. ↩

  21. Id. at 5. ↩

  22. Id. at 5-8. ↩

  23. Comment, 10 December 2021, at 6, in GBA v. SBG and LPL v. SBG, NPC 20-317 and 20-318 (NPC 2021). ↩

  24. Id. at 7. ↩

  25. Id. at 8. ↩

  26. Order, 18 January 2022, at 1, in LPL v. SBG, NPC 20-318 (NPC 2022). ↩

  27. Id. ↩

  28. Joint Pre-Trial Brief for the Complainants, 28 January 2022, in GBA v. SBG and LPL v. SBG, NPC 20-317 and 20-318 (NPC 2022). ↩

  29. Compliance with Pre-Trial Brief, 02 February 2022, in GBA v. SBG and LPL v. SBG, NPC 20-317 and 20-318 (NPC 2022). ↩

  30. Comment to the Stipulations of Fact Proposed by Respondent, 15 February 2022, in GBA v. SBG and LPL v. SBG, NPC 20-317 and 20-318 (NPC 2022). ↩

  31. Comment/Objection to the Pre-Trial Brief of the Complainants, 16 February 2022, in GBA v. SBG and LPL v. SBG, NPC 20-317 and 20-318 (NPC 2022). ↩

  32. Memorandum for the Complainants, 27 May 2022, in GBA v. SBG and LPL v. SBG, NPC 20-317 and 20-318 (NPC 2022). ↩

  33. Id. at 5-9. ↩

  34. Id. at 10. ↩

  35. Id. at 14. ↩

  36. Id. at 15. ↩

  37. Memorandum for the Respondent, 27 May 2022, at 8, in GBA v. SBG and LPL v. SBG, NPC 20-317 and 20-318 (NPC 2022). ↩

  38. Id. at 10-11. ↩

  39. Id. at 11. ↩

  40. Id. ↩

  41. Id. at 12. ↩

  42. NPC SS 21-006, 16 May 2022, at 31 (NPC 2022) (unreported). ↩

  43. Memorandum for the Respondent, 27 May 2022, at 11, in GBA v. SBG and LPL v. SBG, NPC 20-317 and 20-318 (NPC 2022). ↩

  44. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 § 3 (j) (2012). ↩

  45. Id. § 3 (g). ↩

  46. See Comment, 10 December 2021, Annex F, in GBA v. SBG and LPL v. SBG, NPC 20-317 and 20-318 (NPC 2022). ↩

  47. Complaints-Assisted Form, 01 December 2020, in GBA v. SBG, NPC 20-317 (NPC 2022); Complaints-Assisted Form, 03 December 2020, in LPL v. SBG, NPC 20-318 (NPC 2022). ↩

  48. Data Privacy Act of 2012, § 12 (f). ↩

  49. NPC 21-167, 22 September 2022, at 9 (NPC 2022) (unreported). ↩

  50. See Comment, 10 December 2021, Annex G, in GBA v. SBG and LPL v. SBG, NPC 20-317 and 20-318 (NPC 2021). ↩

  51. See Id. Annex H. ↩

  52. Memorandum for the Respondent, 27 May 2022, at 11, in GBA v. SBG and LPL v. SBG, NPC 20-317 and 20-318 (NPC 2022). ↩

  53. Id. ↩

  54. See Comment, 10 December 2021, Annex K & L, in GBA v. SBG and LPL v. SBG, NPC 20-317 and 20-318 (NPC 2021). ↩

  55. See Id. at 3-4. ↩

  56. See Id. Annex G & H. ↩

Backlinks