NPC Issuance Wiki

NPC 21-010 to NPC 21-015: MVC, et al. v. DSL

Issued Decision

Decision Text

NPC 21-010

MVC,

Complainant,

-versus-

DSL,

Respondent.

x----------------------------------------------------x

NPC 21-011

RRB,

Complainant,

-versus-

DSL,

Respondent.

x----------------------------------------------------x

NPC 21-012

NMB,

Complainant,

-versus-

DSL,

Respondent.

x----------------------------------------------------x

NPC 21-013

RMP,

Complainant,

-versus-

DSL,

Respondent.

x----------------------------------------------------x

NPC 21-014

NDL,

Complainant,

-versus-

DSL,

Respondent.

x----------------------------------------------------x

NPC 21-015

MBN,

Complainant,

-versus-

DSL,

Respondent.

x----------------------------------------------------x

DECISION

AGUIRRE, D.P.C.:

Before this Commission are six separate Complaints filed against DSL for an alleged violation of Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA).

Facts

MVC, RRB, NMB, RMP, NDL, and MBN (Complainants) filed separate complaints against DSL.1

Complainants are condominium unit owners of GA Tower I, a condominium managed by GA Tower 1 Condominium Corporation (GATICC).2 DSL, allegedly as the President of GATICC, published a letter containing Complainants’ personal information.3

Complainants alleged that DSL caused the posting of a letter dated 23 November 2020 which contains a list of delinquent unit owners, their respective addresses, and their corresponding unpaid dues.4 The letter was posted in the public spaces of the condominium and published in a magazine distributed to other unit owners.5 Complainants assert that DSL’s act resulted in the disclosure of their personal information. Complainants pray for damages and a fine imposed against DSL for maligning their integrity.6 Complainants also pray that the Commission find DSL liable for unlawfully disclosing their personal information which results in a violation of the DPA.7

On 21 July 2021, the Commission issued an Order directing DSL to file a verified comment within fifteen (15) calendar days from receipt of this Order.8

On 02 September 2021, DSL filed his Comment (Consolidated).9 He alleged that GATICC is within its right to assess and collect unpaid condominium dues from delinquent unit owners, which includes Complainants.10 He maintains that there was no violation of the DPA since GATICC necessarily processed Complainants’ personal information for compliance with a legal obligation to which it, as a personal information controller (PIC), is subject.11 It explains that its legal obligation to collect reasonable assessments and dues stems from Republic Act No. 4726 or the Condominium Act, which recognizes that assessments may be made against unit owners:

Section 20. An assessment upon any condominium made in accordance with a duly registered declaration of restrictions shall be an obligation of the owner thereof at the time the assessment is made.12

It also maintains that its Master Deed states that assessments for common expenses may be made against unit owners:

Section 24. ASSESSMENTS: (a) Assessments against units owners, purchaser or tenants for common expenses, particularly but not by way of limitation, common expenses shall include: expenses for administration of the project, and expenses of maintenance, operation, repair or replacement of common areas.13

Its By-Laws further provide:

Article V.

Section 2. Regular Assessments for Operating Expenses. The Board of Directors shall from time to time, and at least annually prepare an estimate of the operating expenses of the corporation and against the member, proportion to such members’ appurtenant propriety interest or participation in the corporation, such as shall be necessary to meet the operating expenses.14

Its House Rules and Regulations state:

  1. PAYMENT OF CONDOMINIUM ASSESSMENTS (sic)

All unit owners will be ultimately liable (regardless whether or not the unit is occupied by the owner/ lessee) for the duly authorized Association expenses and projects which will be assessed against each one of them and paid to the Association subject to requirements of Master of Deeds. The condominium corporation shall time to time determine the amount of fees, dues, assessments (Realty Estate Tax, Insurance Premium, etc.) that shall be levied against unit owners, which are necessary for the maintenance, operation, preservation, protection, improvements and enhancement of the condominium building and its facilities. All interests are compounded monthly.15

DSL prays for dismissal of the case.16

On 28 September 2021, the Commission ordered the parties to submit their respective Memoranda within fifteen (15) calendar days from receipt of the Order.17

On 08 October 2021, DSL filed his Memoranda (Consolidated).18 He reiterated that GATICC’s lawful basis to process Complainants’ personal information for the compliance of a legal obligation to assess and collect unpaid dues.19 He further states that Complainants, as members of GATICC, are bound by the Condominium Act, Master Deed, By-Laws, and its House Rules and Regulations.20

DSL asserts that GATICC, through DSL, its President, was well within its right to post the names of delinquent unit owners in order to collect reasonable dues and assessments.21

On 11 October 2021, Complainants RRB, NMB, RMP, NDL, and MBN filed their respective Memoranda.22 They allege that DSL acted in bad faith and malice and had no authority to post the letter dated 23 November 2020, and process their personal information, since he was no longer the President of GATICC when the letter was published in the magazine distributed to other unit owners. They further claim that the House Rules and Regulations cited by DSL is different from that they received as unit owners. The relevant provision states:

M. CONDOMINIUM DUES, CHARGES, AND ASSESSMENTS

  1. In order to operate and maintain the condominium building as well as to sustain the delivery of common utilities and services, all unit owners and/or tenants are under obligation to pay the condominium dues, charges and assessments, whether the unit concerned is occupied or not by the owner/ lessee, constructive delivery of the unit being sufficient.

…

  1. All unit owners and/or tenants will be proportionately liable for common area expenses or other duly authorized expenses and project costs, which shall be assessed against each unit owner and/or tenant and these shall be paid to (each DECLARANT and shall be forwarded) to the Condominium Corporation.23

Issue

I. Whether DSL’s publication of the 23 November 2021 letter containing Complainants’ personal information is necessary for compliance under a legal obligation that GATICC is subject to, pursuant to Section 12 (c) of the DPA.

II. Whether DSL’s publication of the 23 November 2021 letter containing Complainants’ personal information violates Section 32 (Unauthorized Disclosure) of the DPA.

Discussion

At the onset, it bears stressing that the 23 November 2021 letter contains personal information, particularly the names of some delinquent unit owners. Matters concerning the processing of personal information is within the scope of the DPA and under the jurisdiction of the Commission.24

The publication of the 23 November 2021 letter in a magazine distributed to other unit owners was without lawful basis of processing under Section 12 (c) of the DPA. Thus, it is a violation of Section 32 of the DPA on Unauthorized Disclosure.

The Commission did not consider in this Decision the notices posted in GA Tower I’s premises since the contents of the notices cannot be deciphered from the photos attached in the complaints. Aside from this, the Complainants hardly discussed the notices such that the Commission cannot determine who posted the notices and the purpose behind the posting of such notices.

DSL claims that the disclosure of Complainants’ personal information is based on the lawful criterion of fulfilment of a necessary obligation to which the personal information controller (PIC) is subject under Section 12 (c) of the DPA. Contrary to his assertions, DSL’s act of publishing the letter dated 23 November in a magazine distributed to the unit owners of GA Tower I is not necessary for compliance under a legal obligation that GATICC is subject to. As such, it cannot be construed as processing based on lawful criteria under Section 12 (c) of the DPA. Section 12 (c) of the DPA provides:

Section 12. Criteria for Lawful Processing of Personal Information.

— The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

…

(c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;25

When a PIC claims lawful processing on the basis of a legal obligation, the burden is on the PIC to show that all that is required by that particular lawful criterion is present. A PIC must be able to prove that the legal obligation it cites as basis exists and applies to the processing it performed, and that the processing is necessary to comply with the legal obligation.

In this case, DSL maintains that the disclosure of Complainants’ personal information is for the purpose of complying with GATICC’s legal obligation to assess and collect unpaid dues. While GATICC is entitled to undertake the processing of Complainants’ personal information based on the Condominium Act, its By-Laws, Master Deed, and the different versions of the House Rules presented by the parties, DSL’s actions were not pursuant to the declared and specified purpose.

The PIC should only process as much information as is proportional or necessary to achieve its clearly defined and stated purposes.26 In this case, it is the collection of unpaid dues provided under a valid contract with its unit owners.

While it is necessary to process the delinquent unit owners’ personal information in order to assess and collect payments pursuant to a contract, the processing in the form of issuing the letter was neither necessary nor proportional. The purpose of the letter was not for the collection of delinquent dues. Rather, the evidence on record shows that DSL disclosed Complainants’ personal information as delinquent unit owners to cast doubt on their capability to manage the affairs of the condominium corporation in light of the recently held election of the Board of Directors. As DSL stated in his letter dated 23 November 2020:

I have been informed that a few unit owners are attempting to surreptitiously and illegally take charge of the management of the Condominium Corporation. Please be guided that these individuals are continuously tagged by the present management as delinquent unit owners. Hence they lack the minimum qualification and moral ascendancy to direct the affairs of the Condominium Corporation.

…

Now, in case the management of the Condominium Corporation be in the hands of those delinquent unit owners aspiring to become members of the Board, what will happen to our building?

…

Now, do you want to risk the management of the Condominium Corporation to some delinquent unit owners?27

DSL claims that he wrote the letter on behalf of the condominium corporation as its President.28 A mere claim that it was done on behalf of the condominium corporation is not sufficient. Had it truly been on behalf of the Board of Directors, then DSL would have been able to present something other than a mere statement in the letter.

Thus, DSL’s processing of Complainants’ personal information is not based on a lawful criterion under Section 12 (c) of the DPA.

II. DSL is liable for Section 32 (Unauthorized Disclosure) of the DPA when he published the 23 November 2021 letter containing Complainants’ personal information.

DSL violated Section 32 of the DPA on Unauthorized Disclosure. Section 32 of the DPA states:

Section. 32. Unauthorized Disclosure. – (a) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).29

Section 32 of the DPA refers to the “immediately preceding section” or Section 31 of the DPA on Malicious Disclosure, which provides:

Section 31. Malicious Disclosure. – Any personal information controller or personal information processor or any of its officials, employees or agents, who, with malice or in bad faith, discloses unwarranted or false information relative to any personal information or personal sensitive information obtained by him or her, shall be subject to imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).30

A PIC or a PIP may be held liable for Malicious Disclosure if it discloses unwarranted or false personal or sensitive personal information with malice or in bad faith.31 Malicious disclosure is committed when the following requisites concur:

  1. the perpetrator is a personal information controller or personal information processor or any of its officials, employees, or agents;
  2. the perpetrator disclosed personal or sensitive personal information;
  3. the disclosure was with malice or in bad faith; and
  4. the disclosed information relates to unwarranted or false information.

Malicious Disclosure requires the disclosure of personal information is malicious or in bad faith. The existence of malice or bad faith cannot be presumed.32 In this case, the evidence on record does not show that DSL’s disclosure of their personal information was malicious or done in bad faith. Section 131 of the 2019 Amendments to the Revised Rules of Evidence provides:

Section 1. Burden of proof and burden of evidence. – Burden of proof is the duty of a party to present evidence on the facts in issue necessary to establish his or her claim or defense by the amount of evidence required by law. Burden of proof never shifts.33

Thus, it was incumbent upon Complainants to prove their claim that DSL’s acts were malicious or in bad faith. The quantum of proof necessary for a finding of guilt in administrative proceedings is substantial evidence:

In administrative proceedings, the quantum of proof necessary for a finding of guilt is substantial evidence, which is that amount of relevant evidence that a reasonable mind might accept as adequate to support a conclusion. Further, the complainant has the burden of proving by substantial evidence the allegations in his complaint. The basic rule is that mere allegation is not evidence and is not equivalent to proof. Likewise, charges based on mere suspicion and speculation cannot be given credence.34

Complainants failed to present substantial evidence to show that DSL’s actions were malicious or amounting to bad faith. Absent the third requisite of Malicious Disclosure, the offense falls under Section 32 or Unauthorized Disclosure.

Based on a literal reading of Section 32 of the DPA, a PIC or a PIP is liable if it discloses to a third party personal or sensitive personal information without the consent of the data subject.35 Following a literal reading, a PIC or a PIP will have committed Unauthorized Disclosure if the disclosure is without the consent of the data subject even if the disclosure is justified by another lawful criterion for processing. It does not recognize that such disclosure may be based on other criteria for lawful processing enumerated in Sections 12 and 13 of the DPA. As such, a literal reading of Section 32 of the DPA will result in absurdity. Following the rules of statutory construction:

Where a literal meaning would lead to absurdity, contradiction, or injustice, or otherwise defeat the clear purpose of the lawmakers, the spirit and reason of the statute may be examined to determine the true intention of the provision.36

Since a literal reading of Section 32 of the DPA will result in absurdity, the provision should be further examined. It should be read together with other provisions of the DPA:

A law must not be read in truncated parts; its provisions must be read in relation to the whole law. It is the cardinal rule in statutory construction that a statute’s clauses and phrases must not be taken as detached and isolated expressions, but the whole and every part thereof must be considered in fixing the meaning of any of its parts in order to produce a harmonious whole. Every part of the statute must be interpreted with reference to the context, i.e., that every part of the statute must be considered together with other parts of the statute and kept subservient to the general intent of the whole enactment.37

Thus, Section 32 of the DPA on Unauthorized Disclosure should be read together with Sections 12 and 13 on the criteria for lawful processing of personal and sensitive personal information. The presence of any of the criteria listed in Sections 12 and 13 is sufficient to justify the processing of personal or sensitive personal information, as the case may be, including its disclosure.38 Reading Section 32 of the DPA in isolation will render Sections 12 and 13 of the DPA inoperative violating a basic rule of statutory construction:

The rule is that a construction that would render a provision inoperative should be avoided; instead, apparently inconsistent provisions should be reconciled whenever possible as parts of a coordinated and harmonious whole.39

Given the foregoing, Section 32 of the DPA on Unauthorized Disclosure should be read and understood as follows: Unauthorized Disclosure is committed when the perpetrator processes personal information without any of the lawful basis for processing under Sections 12 and 13.40 This reading is more in line with the principle that “when two or more interpretations are possible, that interpretation which is favorable or beneficial to the accused must be adopted.”41

This interpretation benefits the accused since it narrows the extent to which the disclosure of personal information may be considered as Unauthorized Disclosure.42

A finding of Unauthorized Disclosure requires that the following requisites are satisfied:

  1. The perpetrator is a personal information controller or personal information processor;
  2. The perpetrator disclosed information;
  3. The information relates to personal or sensitive personal information;
  4. The perpetrator disclosed the personal or sensitive personal information to a third party;
  5. The disclosure was without any of the lawful basis for processing, consent or otherwise, under Sections 12 and 13 of the DPA; and
  6. The disclosure is neither malicious nor done in bad faith and the information disclosed is not unwarranted or false information.

Here, DSL disclosed Complainant’s personal information to third parties when he caused the publication of their names in the magazine distributed to other unit owners of GA Tower I. Contrary to DSL’s assertions, the disclosure of Complainants’ personal information was not according to a valid criterion of lawful processing, particularly Section 12 (c) of the DPA. As previously discussed, DSL cannot rely on compliance of a legal obligation because he disclosed Complainants’ personal information for a completely different purpose. In fact, he did not issue the letter in the interest of the condominium corporation. Thus, DSL is liable under Section 32 of the DPA on Unauthorized Disclosure.

WHEREFORE, premises considered, the Commission hereby:

  1. FINDS DSL liable for Section 32 (Unauthorized Disclosure) of the Data Privacy Act of 2012; and

  2. FORWARDS this Decision and a copy of the pertinent case records to the Secretary of Justice and recommends the prosecution of DSL for the offense of Unauthorized Disclosure under Section 32 of the DPA.

SO ORDERED.

Pasay City, Philippines. 03 February 2022.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

I CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

Copy furnished:

MVC Complainant

RRB Complainant

NMB Complainant

RMP Complainant

NDL Complainant

MBN Complainant

ERP Counsel for Respondent

CTB Counsel for Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Complaint-Assisted Form, 08 June 2018, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, and NPC 21-015 (NPC 2021) (pending). ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. ↩

  6. Complaint-Assisted Form, 08 June 2018, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, and NPC 21-015 (NPC 2021) (pending). ↩

  7. Id. ↩

  8. Order, 21 July 2021, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, and NPC 21-015 (NPC 2021) (pending). ↩

  9. Comment (Consolidated), 31 August 2021, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, and NPC 21-015 (NPC 2021) (pending). ↩

  10. Id. at 2. ↩

  11. Id. at 10. ↩

  12. Id. at 11. ↩

  13. Id. at 12-13. ↩

  14. Comment (Consolidated), 31 August 2021, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, and NPC 21-015 (NPC 2021) (pending). ↩

  15. Id. at 13-14. ↩

  16. Id. at 20. ↩

  17. Order, 28 September 2021, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, and NPC 21-015 (NPC 2021) (pending). ↩

  18. Memoranda (Consolidated), 08 October 2021, at 13-14, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, and NPC 21-015 (NPC 2021) (pending). ↩

  19. Id. ↩

  20. Id. ↩

  21. Id. ↩

  22. Memorandum by RRB, 11 October 2021, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, and NPC 21-015 (NPC 2021) (pending). Memorandum by NMB, 11 October 2021, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, and NPC 21-015 (NPC 2021) (pending). Memorandum by RMP, 11 October 2021, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, and NPC 21-015 (NPC 2021) (pending). Memorandum by NDL, 11 October 2021, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, and NPC 21-015 (NPC 2021) (pending). Memorandum by MBN, 11 October 2021, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, and NPC 21-015 (NPC 2021) (pending). ↩

  23. Memorandum by MBN, 11 October 2021, Annex I, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, and NPC 21-015 (NPC 2021) (pending). ↩

  24. See Data Privacy Act of 2012, § 4 on the scope of the DPA which provides “This Act applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing”. ↩

  25. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 § 12 (c) (2012). ↩

  26. Id. § 11. ↩

  27. Complaint-Assisted Form, 08 June 2018, Annex in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, and NPC 21-015 (NPC 2021) (pending). ↩

  28. Id. ↩

  29. Id. § 32. ↩

  30. Id. § 31. ↩

  31. Id. § 31. ↩

  32. Id. § 32. ↩

  33. RSA Tower Condominium Corp. v. Reyes II, A.C. No. 11944 (2018). ↩

  34. Data Privacy Act of 2012, § 3.2. ↩

  35. Metropolitan Bank and Trust Co. v. Liberty Corrugated Boxes Manufacturing Corp., G.R. No.184317 (2017). ↩

  36. Supra note 35. ↩

  37. Fort Bonifacio Development Corp. v. Commissioner of Internal Revenue, G.R. Nos. 158885 & 170680 (Resolution) (2009). ↩

  38. See Data Privacy Act of 2012, § 3(j) on the definition of processing which “refers to any operation or any set of operations performed upon personal information” which necessarily includes the sharing and disclosure of personal information. ↩

  39. Id. § 11. ↩

  40. NPC 19-134, 10 December 2021 (NPC 2021) (unreported). ↩

  41. People v. Liban, G.R. Nos. 136247 & 138330 (2000). ↩

  42. Supra note 40. ↩

Backlinks