NPC Issuance Wiki

NPC 21-031: JCB v. FRL

Issued Decision

Decision Text

JCB,

Complainant,

-versus-

FRL,

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.:

Before this Commission is a Complaint filed by JCB against FRL for an alleged violation of the Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

On 02 February 2021, JCB filed a Complaint against FRL.1 In his Complaint Affidavit, JCB stated that he is a teacher at Don Andres Soriano National High School.2 FRL is a teacher, guidance counselor, and a member of the Grievance Committee in the same school.3

JCB alleged that on 26 August 2020, MSG, a co-teacher, filed an administrative complaint against him before the Office of the Regional Director of the Department of Education (DepEd) Region VII. The administrative complaint was filed for dishonesty, grave misconduct, being notoriously undesirable, and violation of the Code of Ethics for Professional Teachers.4

One of the attachments in the administrative complaint was FRL’s sworn statement that narrated several incidents involving JCB. JCB alleged that the incidents mentioned in FRL’s affidavit were already settled amicably by the parties involved.5 He also asserted that the settlement should be treated as confidential to preserve its integrity.6

In disclosing confidential information relating to the incidents, JCB claimed that FRL should be held liable for violating the DPA.7

On 02 September 2021, the Commission issued an Order giving due course to JCB’s Complaint and ordering FRL to file her Comment within fifteen (15) calendar days from receipt of the Order.8 The Order also provided the schedule for the preliminary conference.9

On 30 September 2021, the preliminary conference was held, however, only JCB attended. Thus, the preliminary conference was reset to 28 October 2021.10

FRL failed to appear for the second time in the preliminary conference. Therefore, the Commission issued an Order dated 28 October 2021 stating that FRL was deemed to have waived her rights to the benefits of the preliminary conference.11

On 03 November 2021, FRL filed her Comment.12 She argued that the Complaint should be dismissed for JCB’s failure to exhaust administrative remedies.13

Particularly, FRL alleged that JCB failed to comply with Section 2, Rule II of NPC Circular No. 2021-01 (2021 NPC Rules of Procedure). She cited JCB’s statement in his Complaint-Assisted Form that he did not contact FRL because “she is not a person-in-interest and has no legal standing.”14

Further, FRL alleged that JCB’s Complaint was not verified and did not contain a certification against forum shopping. As such, FRL argued that the Complaint should be dismissed for failure to comply with Section 3 (1) and (10), Rule II of NPC Circular No. 2021-01.15

Nonetheless, FRL argued that she did not violate the DPA because the processing of personal information was exempted from the coverage of the law.16

In applying Section 4 (a) of the DPA, FRL argued that she merely processed the information of JCB, who is an employee of DepEd, a government institution.17 She also claimed that the information processed were related to JCB’s position or function as a government employee.18

Further, FRL stated that the processing of information was exempted under Section 13 (f) of the DPA.19 According to her, the affidavit was executed to support the administrative case filed by MSG, who intended “to exercise her legal right and responsibility to the Republic of the Philippines in helping it to get rid of unfit government officials and employees.”20

Issue

I. Whether the case should be dismissed on procedural grounds.

II. Whether FRL had lawful basis in processing JCB’s personal information.

III. Whether FRL is liable under Section 31 (Malicious Disclosure) of the DPA.

IV. Whether FRL is liable under Section 32 (Unauthorized Disclosure) of the DPA.

Discussion

The Commission shall limit its disposition of the case to the issues on the processing of personal information. Therefore, it shall not discuss the alleged violations of laws and administrative orders that are beyond its jurisdiction.21

I. The case should be dismissed outright on procedural grounds.

FRL argued that the case should be dismissed because JCB failed to inform her of the alleged privacy violation or personal data breach as required under Section 2, Rule II of NPC Circular No. 2021-01.22

Further, FRL asserted that JCB’s Complaint was not verified and did not contain a certification against forum shopping in violation of the procedural requirement under Section 3, Rule II of NPC Circular No. 2021-01.23 She alleged that “the Complaint is defective on its face and should be dismissed outright.”24

Section 2, Rule II of NPC Circular No. 2021-01 provides:

Section 2. Exhaustion of remedies. – No complaint shall be given due course unless it has been sufficiently established and proven that:

  1. the complainant has informed, in writing, the personal information controller (PIC), personal information processor (PIP), or concerned entity of the privacy violation or personal data breach to allow for appropriate action on the same; and
  2. the PIC, PIP, or concerned entity did not take timely or appropriate action on the claimed privacy violation or personal data breach, or there is no response from the PIC, PIP, or concerned entity within fifteen (15) calendar days from receipt of written information from the complainant.

The NPC may waive any or all of the requirements of this Section at its discretion upon (a) good cause shown, properly alleged and proved by the complainant; or (b) if the allegations in the complaint involve a serious violation or breach of the Data Privacy Act of 2012, taking into account the risk of harm to the affected data subject, including but not limited to:

i. when there is grave and irreparable damage which can only be prevented or mitigated by action of the NPC; ii. when the respondent cannot provide any plain, speedy or adequate remedy to the alleged violation; or iii. the action of the respondent is patently illegal.25

In this case, there is no showing that JCB informed FRL of the alleged privacy violation or personal data breach. He even stated in his Complaint-Assisted Form that he did not contact FRL because she “is not a person-in-interest and has no legal standing.”26 Contrary to JCB’s allegation, FRL should have been informed prior to the filing of his Complaint. Otherwise, pursuant to Section 2, Rule II of NPC Circular No. 2021-01, the Complaint should not be given due course.

While it is true that Section 2, Rule II of NPC Circular No. 2021-01 provides for instances where the Commission may exercise its discretion to waive any or all of the requirements, none of these are present in this case.

The allegations in JCB’s Complaint do not establish a good cause or a potential serious violation or breach of the DPA that would warrant the waiver of the procedural requirements. The facts alleged in his Complaint, even assuming they were all true, still do not support his claim that FRL violated the DPA or that FRL acquired the personal information complained of in her role as a guidance counselor. Furthermore, JCB failed to support any of his allegations with substantial proof. Given that JCB’s case does not fall under the instances provided under Section 2, Rule II of NPC Circular No. 2021-01, the Commission, therefore, finds no reason to waive the procedural requirements.

As regards verification and certification against forum shopping, Section 3, Rule II of NPC Circular No. 2021-01 provides:

Section 3. Form and contents of the complaint. – The complaint should be in the proper form, as follows:

  1. The complaint must be in writing, signed by the party or his or her counsel, and verified in the format prescribed under the Rules of Court.

…

  1. A certification against forum shopping must accompany the complaint. The complainant shall certify under oath in the complaint, or in a sworn certification annexed and simultaneously filed with the pleading: (a) that he or she has not commenced any action or filed any claim involving the same issues in any court, tribunal or quasi-judicial agency and, to the best of his or her knowledge, no such other action or claim is pending with such court, tribunal or quasi-judicial agency; (b) if there is such other pending action or claim, a complete statement of its present status; and (c) if he or she should thereafter learn that the same or similar action or claim has been filed or is pending, he or she shall report that fact within five (5) calendar days therefrom to the NPC.

Failure to comply with the proper form and contents of the complaint may cause for outright dismissal under Section 1(1), Rule IV: Provided, an application that does not comply with the foregoing requirements may be acted upon if it merits appropriate consideration on its face, or is of such notoriety that it necessarily contains sufficient leads or particulars to enable the taking of further action.27

As such, Complaints filed before the Commission should be “verified in the format prescribed under the Rules of Court.”28

Section 4, Rule 7 of the Rules of Court provides:

Section 4. Verification. –

…

A pleading is verified by an affidavit of an affiant duly authorized to sign said verification. The authorization of the affiant to act on behalf of a party, whether in the form of a secretary’s certificate or a special power of attorney, should be attached to the pleading, and shall allege the following attestations:

(a) The allegations in the pleading are true and correct based on his personal knowledge, or based on authentic documents;

(b) The pleading is not filed to harass, cause unnecessary delay, or needlessly increase the cost of litigation; and

(c) The factual allegations therein have evidentiary support or, if specifically so identified, will likewise have evidentiary support after a reasonable opportunity for discovery.

The signature of the affiant shall further serve as a certification of the truthfulness of the allegations in the pleading.29

In the case at bar, the Complaint filed by JCB does not specifically state the attestations enumerated under the Rules of Court. While the Supreme Court has previously ruled that technical rules of procedure do not strictly apply to administrative bodies,30 the notarized Complaint still failed to effectively provide the attestations required because the only thing certified by the notarization is the fact that it was personally executed by JCB.

Additionally, Section 3 (10), Rule II of NPC Circular No. 2021-01 provides that the complaint should be accompanied by a certification against forum shopping.31 JCB, however, similarly failed to observe this procedural requirement when he did not attach any certification with his Complaint, nor provided any attestation enumerated in the Section.

The Supreme Court explained the mandatory nature of the requirement on certification:

[T]he rules on forum shopping, which were designed to promote and facilitate the orderly administration of justice, should not be interpreted with such absolute literalness as to subvert its own ultimate and legitimate objective. Strict compliance with the provision regarding the certificate of non-forum shopping underscores its mandatory nature in that the certification cannot be altogether dispensed with or its requirements completely disregarded.32

The Court further elucidated on the difference between non-compliance and substantial compliance with procedural requirements:

A distinction must be made between non-compliance with the requirement on or submission of defective verification, and non-compliance with the requirement on or submission of defective certification against forum shopping.

…

As to certification against forum shopping, non-compliance therewith or a defect therein, unlike in verification, is generally not curable by its subsequent submission or correction thereof, unless there is a need to relax the Rule on the ground of “substantial compliance” or presence of “special circumstances or compelling reasons.”

Here, JCB’s failure to attach any certification with his Complaint shows non-compliance with the mandatory procedural requirement. Further, there can be no substantial compliance since he did not provide any attestation that could effectively be considered as certification against forum shopping.

As JCB failed to observe the procedural requirements provided under Sections 2 and 3, Rule II of NPC Circular No. 2021-01, JCB’s Complaint should have been dismissed outright and not be given due course.

Nevertheless, the Commission proceeds to explain the substantial aspect of the case for the education and guidance of the public.

II. FRL had lawful basis in processing JCB’s personal information.

A. The information included in the affidavit is personal information.

FRL’s affidavit narrates the incidents involving JCB and his colleagues and contained the names of JCB and his co-teachers.33

Personal information is defined under Section 3 (g) of the DPA:

Section 3. Definition of Terms. – Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

(g) Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.34

The names stated in the affidavit can reasonably and directly ascertain the identities of the individuals involved in the incidents. The names, therefore, are considered personal information, the processing of which must be in accordance with the DPA.

B. The processing of personal information is lawful.

Apart from the claim that FRL violated Sections 32 and 36 of the DPA,35 JCB’s Complaint-Affidavit did not contain a specific allegation on the unlawful processing of his personal information. Despite this, the Commission takes into consideration his narration of facts and proceeds to discuss the lawfulness of the processing of personal information.

FRL’s processing of personal information is based on a lawful criteria under Section 12 (f) of the DPA. Section 12 (f) of the DPA provides:

Section 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

…

(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.36

The Commission previously ruled that the protection of lawful rights and interests under Section 13 (f) of the DPA is considered as legitimate interest pursuant to Section 12 (f) of the DPA, thus:37

Although Section 13 (f) applies to sensitive personal information while the information involved in this case is just personal information, the protection of lawful rights and interests under Section 13 (f) by the Respondent is considered as legitimate interest pursuant to Section 12 (f) of the DPA. This section provides that it is lawful to process personal information if it is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.38

Section 13 (f) of the DPA provides:

Section 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

…

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.39

The phrase “for the protection of lawful rights and interests of natural or legal persons in court proceedings” cannot be interpreted to relate only to the person asserting the lawful basis of the processing of personal information. It also contemplates situations where those persons whose lawful rights and interests are protected in court proceedings may not be the same individuals who processed the personal information, such as in the case of witnesses. Similarly, the next clause “establishment, exercise or defense of legal claims” may be interpreted to refer to the legal claims of persons other than those who processed the personal information.

In this case, FRL asserted in her Comment that the purpose of the affidavit was to support the administrative complaint filed by MSG against JCB.40 She argued that the narration of the incidents in the affidavit would help “in establishing the facts surrounding the undesirability of JCB to teach in DepEd.”41 Given that Section 13 (f) may refer to the legal claims of persons other than those who processed the personal information, the act of FRL in issuing the affidavit to support MSG’s legal claim filed before the DepEd can, therefore, be considered as lawful processing.

III. FRL did not violate Section 31 of the DPA (Malicious Disclosure).

Section 31 of the DPA provides that a PIC or a PIP may be held liable for Malicious Disclosure if he discloses unwarranted or false personal information or sensitive personal information with malice or in bad faith.42

The requisites of Malicious Disclosure are:

  1. The perpetrator is a personal information controller or personal information processor or any of its officials, employees, or agents;
  2. The perpetrator disclosed personal or sensitive personal information;
  3. The disclosure was with malice or in bad faith; and
  4. The disclosed information relates to unwarranted or false information.43

In this case, FRL disclosed personal information, particularly the names of JCB and his co-teachers, when she narrated the incidents involving him in her affidavit.

The disclosure, however, was done without malice or bad faith. The existence of malice or bad faith cannot be presumed.44 In this case, JCB alleged that FRL acted with malice or in bad faith in disclosing the incidents that were already amicably settled.45 Further, he attempted to demonstrate the existence of malice or bad faith by claiming that the information disclosed were confidential and were obtained by FRL in her official position.46 He, however, failed to substantially provide evidence to support this claim. It is fundamental that he who alleges has the burden to prove his allegation with the quantum of evidence prescribed by law.47

Section 6, Rule 133 of the Rules of Court provides for the quantum of evidence required in administrative proceedings, thus:

Section 6. Substantial evidence. – In cases filed before administrative or quasi-judicial bodies, a fact may be deemed established if it is supported by substantial evidence, or that amount of relevant evidence which a reasonable mind might accept as adequate to justify a conclusion.48

Mere allegations that the information were confidential and were obtained by FRL in her official capacity are not sufficient to substantiate that there was indeed malice or bad faith. JCB, who made the allegations, has the burden to provide substantial evidence to establish his claim. He, however, was unable to discharge this burden as his allegations failed to show that there was a violation of the DPA.

JCB also argued that the information disclosed were privileged communication under Section 24 (e), Rule 130 of the Rules of Court,49 which provides:

Section 24. Disqualification by reason of privileged communication. – The following persons cannot testify as to matters learned in confidence in the following cases:

…

(e) A public officer cannot be examined during or after his or her tenure as to communications made to him or her in official confidence, when the court finds that the public interest would suffer by the disclosure.50

He alleged that FRL acquired these information in her role as a guidance counselor, thus making it privileged information.51 These claims, however, remained to be unfounded since JCB failed to provide any proof to substantiate his claim. Aside from this, in detailing how FRL acquired the information, his own narration of events belies his claim that FRL received the information in her capacity as a guidance counselor.

Considering the foregoing, the information relating to the incidents were, therefore, not privileged communication.

The last element of Malicious Disclosure is also lacking in this case since the disclosure does not relate to unwarranted nor false information. Here, the personal information disclosed were the names of JCB and his co-teachers. The inclusion of the names are justified to identify the individuals involved in the incidents and to help establish the legal claim against JCB. Lastly, the truthfulness of the names were not refuted by JCB and were bolstered by the affidavits of the other persons involved.

Absent the third and fourth requisite, FRL cannot be deemed to have violated Section 31 of the DPA on Malicious Disclosure.

IV. FRL did not violate Section 32 of the DPA (Unauthorized Disclosure).

With respect to Unauthorized Disclosure, Section 32 of the DPA provides:

Section 32. Unauthorized Disclosure. – (a) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).52

A strict and literal reading of Section 32 of the DPA shows that a PIC or PIP is liable if it discloses to a third party personal information without the consent of the data subject.53 This interpretation, however, will result in absurdity as a PIC or a PIP will be held liable for Unauthorized Disclosure if the disclosure is without the consent of the data subject even if the disclosure is justified under Section 12 or Section 13 of the DPA. Following the rules of statutory construction:

Where a literal meaning would lead to absurdity, contradiction, or injustice, or otherwise defeat the clear purpose of the lawmakers, the spirit and reason of the statute may be examined to determine the true intention of the provision.54

Thus, the provision should be further examined and be read together with other provisions of the DPA:

A law must not be read in truncated parts; its provisions must be read in relation to the whole law. It is the cardinal rule in statutory construction that a statute’s clauses and phrases must not be taken as detached and isolated expressions, but the whole and every part thereof must be considered in fixing the meaning of any of its parts in order to produce a harmonious whole. Every part of the statute must be interpreted with reference to the context, i.e., that every part of the statute must be considered together with other parts of the statute and kept subservient to the general intent of the whole enactment.55

Thus, Section 32 of the DPA should be read and interpreted as follows: Unauthorized Disclosure is committed when the perpetrator processes personal information without any of the lawful basis for processing under Sections 12 and 13.56 This reading is more in line with the principle that “when two or more interpretations are possible, that interpretation which is favorable or beneficial to the accused must be adopted.”57 This interpretation benefits the accused since it narrows the extent to which the disclosure of personal information may be considered as Unauthorized Disclosure.58

To determine whether there is Unauthorized Disclosure, the following requisites must concur:

  1. The perpetrator is a personal information controller or personal information processor;
  2. The perpetrator disclosed information;
  3. The information relates to personal or sensitive personal information;
  4. The perpetrator disclosed the personal or sensitive personal information to a third party;
  5. The disclosure was without any of the lawful basis for processing, consent or otherwise, under Sections 12 and 13 of the DPA; and
  6. The disclosure is neither malicious nor done in bad faith and the information disclosed is not unwarranted or false information.59

In this case, FRL disclosed personal information to third parties when she narrated the incidents involving JCB in her affidavit. As previously discussed, the disclosure does not relate to unwarranted or false information. Further, the disclosure was based on a lawful criteria under Section 12 (f) in relation to Section 13 (f) of the DPA. FRL’s processing of personal information is a legitimate interest to establish the legal claims against JCB. Considering that the requisites are lacking, FRL cannot, therefore, be held liable under Section 32 of the DPA on Unauthorized Disclosure.

WHEREFORE, premises considered, the Commission resolves that the case filed by JCB against FRL is hereby DISMISSED.

SO ORDERED.

City of Pasay, Philippines.

03 March 2022.

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

I CONCUR:

JOHN HENRY D. NAGA

Privacy Commissioner

Copy furnished:

JCB

Complainant

FRL

Respondent

IAL

Counsel of Respondent

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Complaint-Assisted Form, 02 February 2021, in JCB v. FRL, NPC 21-031 (NPC 2021). ↩

  2. Complaint Affidavit, 26 January 2021, ¶1, in JCB v. FRL, NPC 21-031 (NPC 2021). ↩

  3. Id. ¶3. ↩

  4. Id. ¶4. ↩

  5. Id. ¶5. ↩

  6. Id. ¶25. ↩

  7. Id. ¶43. ↩

  8. Order, 02 September 2021, at 1, in JCB v. FRL, NPC 21-031 (NPC 2021). ↩

  9. Id. ↩

  10. Order, 30 September 2021, in JCB v. FRL, NPC 21-031 (NPC 2021). ↩

  11. Order, 28 October 2021, in JCB v. FRL, NPC 21-031 (NPC 2021). ↩

  12. Comment, 03 November 2021, at 1, in JCB v. FRL, NPC 21-031 (NPC 2021). ↩

  13. Id. at 3-4. ↩

  14. Id. at 4. ↩

  15. Id. at 4-6. ↩

  16. Id. at 6. ↩

  17. Id. at 7. ↩

  18. Comment, 03 November 2021, at 7, in JCB v. FRL, NPC 21-031 (NPC 2021). ↩

  19. Id. ↩

  20. Id. ↩

  21. See Complaint Affidavit, 26 January 2021, ¶¶33, 36-38, 40, in JCB v. FRL, NPC 21-031 (NPC 2021); Complainant’s Memorandum, 12 November 2021, ¶¶32-34, 49-58, 63-64, 66, 71, in JCB v. FRL, NPC 21-031 (NPC 2021). ↩

  22. Comment, 03 November 2021, at 3, in JCB v. FRL, NPC 21-031 (NPC 2021). ↩

  23. Id. at 4-5. ↩

  24. Id. at 6. ↩

  25. National Privacy Commission, 2021 Rules of Procedure of the National Privacy Commission, [NPC 2021 Rules of Procedure], rule II, §2 (28 January 2021). ↩

  26. Complaints-Assisted Form, 02 February 2021, in JCB v. FRL, NPC 21-031 (NPC 2021). ↩

  27. NPC 2021 Rules of Procedure, rule II, §3. ↩

  28. Id. rule II, §3 (1). ↩

  29. 2019 AMENDMENTS TO THE 1997 RULES OF CIVIL PROCEDURE, rule 7, §4. ↩

  30. DP v. Florentino International, Inc., G.R. No. 186967 (2017). ↩

  31. NPC 2021 Rules of Procedure, rule II, §3 (10). ↩

  32. P v. Coca-Cola Philippines, Inc., G.R. No. 157966 (2008). ↩

  33. Complaint Affidavit, 26 January 2021, Annex C, in JCB v. FRL, NPC 21-031 (NPC 2021). ↩

  34. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 §3 (g) (2012). ↩

  35. Complaint Affidavit, 26 January 2021, ¶43, in JCB v. FRL, NPC 21-031 (NPC 2021). ↩

  36. Data Privacy Act of 2012, §12 (f). ↩

  37. CID Case No. 17-K003, 19 November 2019, (NPC 2019) (unreported). ↩

  38. BGM v. IPP, NPC 19-653, 17 December 2020, available at https://www.privacy.gov.ph/wp-content/uploads/2021/02/NPC-19-653-BGM-vs-IPP-Decision-FINAL-Pseudonymized-21Dec2020.pdf (last accessed 17 March 2022). ↩

  39. Data Privacy Act of 2012, §13 (f). ↩

  40. Comment, 03 November 2021, at 7, in JCB v. FRL, NPC 21-031 (NPC 2021). ↩

  41. Id. at 6. ↩

  42. Data Privacy Act of 2012, §31. ↩

  43. NPC 21-015, 03 February 2022, (NPC 2022) (unreported). ↩

  44. Cruz v. Intermediate Appellate Court, G.R. No. 66327 (1984). ↩

  45. Complainant’s Memorandum, 12 November 2021, at 15, in JCB v. FRL, NPC 21-031 (NPC 2021). ↩

  46. Id. at 16. ↩

  47. Tacis v. Shields Security Services, Inc., G.R. No. 234575 (2021). ↩

  48. 2019 AMENDMENTS TO THE 1989 REVISED RULES ON EVIDENCE, rule 133, §6. ↩

  49. Complainant’s Memorandum, 12 November 2021, at 16, in JCB v. FRL, NPC 21-031 (NPC 2021). ↩

  50. AMENDMENTS TO THE 1989 REVISED RULES ON EVIDENCE, rule 130, §24 (e). ↩

  51. Complainant’s Memorandum, 12 November 2021, at 16, in JCB v. FRL, NPC 21-031 (NPC 2021). ↩

  52. Data Privacy Act of 2012, §32. ↩

  53. Id. ↩

  54. Metropolitan Bank and Trust Co. v. Liberty Corrugated Boxes Manufacturing Corp., G.R. No.184317 (2017). ↩

  55. Fort Bonifacio Development Corp. v. Commissioner of Internal Revenue, G.R. Nos. 158885 & 170680 (Resolution) (2009). ↩

  56. See NPC 18-010, 17 December 2020 (NPC 2020) (unreported); NPC 19-134, 10 December 2021 (NPC 2021) (unreported); NPC 21-010, 03 February 2022 (NPC 2022) (unreported). ↩

  57. People v. Liban, G.R. Nos. 136247 & 138330 (2000). ↩

  58. NPC 19-134, 10 December 2021 (NPC 2021) (unreported). ↩

  59. NPC 21-010, 03 February 2022 (NPC 2022) (unreported). ↩

Backlinks