NPC Issuance Wiki

NPC 21-032: JCB v. JME

Issued Decision

Decision Text

JCB,

Complainant,

-versus-

JME,

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before this Commission is a complaint filed by JCB against JME for an alleged violation of the Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

JCB and JME are public school teachers at Don Andres Soriano National High School.1 In JCB’s complaint, he alleged that he had a confrontation with JME on 24 June 2019 when the latter tried to occupy his working area.2 According to JCB, the incident was thereafter settled through the help of the school principal and some members of the school’s Grievance Committee.3

JCB alleged that despite the parties’ agreement to not file formal charges, JME filed a report about the incident before the Barangay Public Safety Office on 25 June 2019.4 He further alleged that JME also narrated about the incident in an Incident Report dated 24 June 2019 and an Affidavit dated 24 August 2020, which were attached to an administrative complaint filed by Maria Sheryl D. Gepitulan against JCB before the Department of Education (DepEd).5 JCB argued that JME’s disclosure of the incident constituted malicious disclosure of confidential information.6

On 27 August 2021, the Commission issued an Order requiring JME to file a verified comment within fifteen (15) calendar days from receipt of the Order.7 The Order also provided the schedule for the preliminary conference.8

During the Preliminary Conference on 30 September 2021, only JCB was present; thus, it was reset to 28 October 2021.9

JME once again failed to appear in the Preliminary Conference dated 28 October 2021.10 He, however, sent an e-mail requesting for its resetting since he only received the link to the meeting conference a minute before the schedule and he was not admitted to the meeting.11 In a Resolution dated 02 November 2021, the Commission granted JME’s request and required the parties to appear for the Preliminary Conference on 01 December 2021.12

On 08 November 2021, JME filed a Comment.13 He denied JCB’s allegation that the Affidavit dated 24 August 2020 was malicious.14 He argued that the Affidavit was executed under oath and was based on his personal knowledge.15

JME also denied JCB’s allegation that he committed a data privacy breach when he disclosed the incident between them.16 He argued that following JCB’s reasoning would result in an “absurd situation wherein witnesses will be afraid to testify even when it is in defense of the rights of other people – in fear and under threat that the witness will be sued for [a] data privacy breach, which is not the essence of [the DPA].”17 Further, he argued that if there was indeed sensitive personal information that was processed, the processing is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings in accordance with Section 13 (f) of the DPA.18

As affirmative defenses, JME argued that JCB’s complaint should be dismissed on the following grounds:

(1) the complaint failed to state a cause of action;19

(2) the complaint is “frivolous, vexatious, and made in bad faith”;20

(3) the complaint lacks verification and certification against forum shopping;21

(4) JCB failed to exhaust administrative remedies;22 and

(5) the act of executing an affidavit does not constitute a violation of the DPA.23

During the Preliminary Conference on 01 December 2021, JCB requested a period of forty-five (45) calendar days to file his memorandum, to which JME did not object.24 Both parties were thus ordered to submit their respective memoranda within forty-five (45) calendar days from receipt of the Order.25

On 06 January 2022, JCB submitted his Memorandum.26 He alleged that JME should have respected his right to privacy and his rights as a data subject in accordance with the DPA.27

On 12 January 2022, JME submitted his Memorandum, which contained similar arguments that he had raised in his Comment.28

Issue

I. Whether the case should be dismissed on procedural grounds.

II. Whether JME had lawful basis in processing JCB’s personal information.

III. Whether JME is liable under Section 31 (Malicious Disclosure) of the DPA.

IV. Whether JME is liable under Section 32 (Unauthorized Disclosure) of the DPA.

Discussion

I. The case should be dismissed outright on procedural grounds.

JME argued that the case should be dismissed because JCB failed to exhaust administrative remedies as required under Section 2, Rule II of NPC Circular No. 2021-01 (2021 NPC Rules of Procedure).29

He also argued that JCB did not observe Section 3, Rule II of the 2021 NPC Rules of Procedure because the complaint was not verified and did not contain a certification against forum shopping.30 He argued that “a pleading that lacks proper verification is treated as unsigned pleading, which produces no legal effect” and that the complaint is “clearly defective on its face and thus, should be dismissed.”31

Section 2, Rule II of the 2021 NPC Rules of Procedure provides:

Section 2. Exhaustion of remedies. – No complaint shall be given due course unless it has been sufficiently established and proven that:

  1. the complainant has informed, in writing, the personal information controller (PIC), personal information processor (PIP), or concerned entity of the privacy violation or personal data breach to allow for appropriate action on the same; and

  2. the PIC, PIP, or concerned entity did not take timely or appropriate action on the claimed privacy violation or personal data breach, or there is no response from the PIC, PIP, or concerned entity within fifteen (15) calendar days from receipt of written information from the complainant.

The NPC may waive any or all of the requirements of this Section at its discretion upon (a) good cause shown, properly alleged and proved by the complainant; or (b) if the allegations in the complaint involve a serious violation or breach of the Data Privacy Act of 2012, taking into account the risk of harm to the affected data subject, including but not limited to:

i. when there is grave and irreparable damage which can only be prevented or mitigated by action of the NPC; ii. when the respondent cannot provide any plain, speedy or adequate remedy to the alleged violation; or iii. the action of the respondent is patently illegal.32

In this case, there is no evidence on record that JCB informed JME of the alleged privacy violation or personal data breach. He even admitted in his Complaints-Assisted Form that he did not contact JME and reasoned out that “[t]he Respondent is hostile.”33 Such reasoning, however, is not a valid excuse to disregard the requirement provided in the 2021 NPC Rules of Procedure.

Further, there is nothing to warrant the exercise of the Commission of its discretion to waive the requirement of exhaustion of administrative remedies. JCB failed to properly allege and prove a good cause in his complaint to justify the waiver of the requirement. A review of his complaint did not also show a potential serious violation or breach of the DPA. In fact, and as will be discussed subsequently, the Commission finds that the allegations of JCB do not constitute a privacy violation.

Given the foregoing, the Commission finds no reason to waive the procedural requirement of exhaustion of administrative remedies.

Hence, the complaint should not be given due course for JCB’s failure to sufficiently establish and prove that he has exhausted the remedies under Section 2, Rule II of the 2021 NPC Rules of Procedure.

With regard to the requirement of verification and certification against forum shopping, Section 3, Rule II of the 2021 NPC Rules of Procedure provides:

Section 3. Form and contents of the complaint. – The complaint should be in the proper form, as follows:

  1. The complaint must be in writing, signed by the party or his or her counsel, and verified in the format prescribed under the Rules of Court.

…

  1. A certification against forum shopping must accompany the complaint. The complainant shall certify under oath in the complaint, or in a sworn certification annexed and simultaneously filed with the pleading: (a) that he or she has not commenced any action or filed any claim involving the same issues in any court, tribunal or quasi-judicial agency and, to the best of his or her knowledge, no such other action or claim is pending with such court, tribunal or quasi-judicial agency; (b) if there is such other pending action or claim, a complete statement of its present status; and (c) if he or she should thereafter learn that the same or similar action or claim has been filed or is pending, he or she shall report that fact within five (5) calendar days therefrom to the NPC.

Failure to comply with the proper form and contents of the complaint may cause for outright dismissal under Section 1(1), Rule IV: Provided, an application that does not comply with the foregoing requirements may be acted upon if it merits appropriate consideration on its face, or is of such notoriety that it necessarily contains sufficient leads or particulars to enable the taking of further action.34

The abovementioned provision requires that the complaints filed before the Commission should be “verified in the format prescribed under the Rules of Court.”35

Section 4, Rule 7 of the Rules of Court provides:

Section 4. Verification. –

…

A pleading is verified by an affidavit of an affiant duly authorized to sign said verification. The authorization of the affiant to act on behalf of a party, whether in the form of a secretary’s certificate or a special power of attorney, should be attached to the pleading, and shall allege the following attestations:

(a) The allegations in the pleading are true and correct based on his personal knowledge, or based on authentic documents;

(b) The pleading is not filed to harass, cause unnecessary delay, or needlessly increase the cost of litigation; and

(c) The factual allegations therein have evidentiary support or, if specifically so identified, will likewise have evidentiary support after a reasonable opportunity for discovery.

The signature of the affiant shall further serve as a certification of the truthfulness of the allegations in the pleading.36

In the case at bar, the Complaint-Affidavit filed by JCB was not verified nor did it specifically state the attestations provided under the Rules of Court. While the Supreme Court has previously ruled that technical rules of procedure do not strictly apply to administrative bodies,37 JCB’s complaint still failed to effectively provide the attestations required because it only certified that the complaint was true and based on JCB’s personal knowledge.38 Since the complaint was not verified in the format required under the Rules of Court, it could not be considered to have complied with the form prescribed under the 2021 NPC Rules of Procedure.

Additionally, Section 3, Rule II of the 2021 NPC Rules of Procedure provides that the complaint should be accompanied by a certification against forum shopping.39 JCB failed to observe this procedural requirement when he neither attached the required certification with his Complaint-Affidavit, nor attested to the facts enumerated in Section 3 (10), Rule II of the 2021 NPC Rules of Procedure.

According to the Supreme Court, a certification against forum shopping is mandatory:

[T]he rules on forum shopping, which were designed to promote and facilitate the orderly administration of justice, should not be interpreted with such absolute literalness as to subvert its own ultimate and legitimate objective. Strict compliance with the provision regarding the certificate of non-forum shopping underscores its mandatory nature in that the certification cannot be altogether dispensed with or its requirements completely disregarded.40

The Court also explained that there must be a distinction between non-compliance and substantial compliance with the procedural requirements:

A distinction must be made between non-compliance with the requirement on or submission of defective verification, and non-compliance with the requirement on or submission of defective certification against forum shopping.

…

As to certification against forum shopping, non-compliance therewith or a defect therein, unlike in verification, is generally not curable by its subsequent submission or correction thereof, unless there is a need to relax the Rule on the ground of ‘substantial compliance’ or presence of ‘special circumstances or compelling reasons’.41

Here, JCB’s complaint did not contain a certification against forum shopping. He cannot be considered to have substantially complied with the procedural requirement since he did not submit any attestation that could effectively be considered similar to a certification against forum shopping.

While the 2021 NPC Rules of Procedure provides that the procedural requirements on form may be waived, a review of JCB’s complaint demonstrates that it does not “[merit] appropriate consideration on its face, or is of such notoriety that it necessarily contains sufficient leads or particulars to enable the taking of further action.”42 The allegations of JCB, even assuming they were all true, do not substantially prove his claim that JME violated the DPA nor directly contravene specific portions of the DPA and its related issuances. These allegations on its face, do not serve as sufficient basis nor warrant the exercise of the waiver of the procedural requirements.

Section 1 (1), Rule IV of the 2021 Rules of Procedure also provides that a complaint may be dismissed outright when it is insufficient in form or it did not comply with Section 3, Rule II of the 2021 NPC Rules of Procedure:

Section 1. Outright dismissal, when allowed. – Within thirty (30) calendar days from receipt of the complaint, the investigating officer may give the complaint due course or dismiss the complaint without prejudice, on any the following grounds:

  1. The complaint is insufficient in form or did not comply with Section 3, Rule II of these Rules, unless failure to do so is justified or excused with good cause.43

Considering that JCB failed to observe the formal requirements, the complaint should have been dismissed outright pursuant to Section 1 (1) Rule IV of the 2021 NPC Rules of Procedure.

The Commission, however, shall discuss the substantial aspect of the case for the education and guidance of the public.

II. JME had lawful basis in processing JCB’s personal information.

A. The information included in the Affidavit and in the Incident Report are personal information.

The Affidavit and the Incident Report executed by JME contained personal information, specifically the names of JCB and JME.44

Section 3 (g) of the DPA defines personal information:

Section 3. Definition of Terms. – Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

(g) Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.45

Given that the names stated in the Affidavit and in the Incident Report can reasonably and directly ascertain the identities of the individuals involved in the incident, they are considered personal information. The processing of these personal information must, therefore, be in accordance with the DPA.

B. The processing of personal information is lawful.

JCB’s complaint failed to provide specific allegations of unlawful processing of his personal information committed by JME. It merely contained a general allegation that JME’s act of disclosing the issue between them in his Affidavit and Incident Report amounted to unlawful processing of his personal information.46

Nevertheless, the Commission proceeds to discuss the lawfulness of the processing of personal information.

JME’s processing of personal information is based on a lawful criteria under Section 12 (f) of the DPA. Section 12 (f) of the DPA provides:

Section 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

…

(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.47

The protection of lawful rights and interests under Section 13 (f) is considered as legitimate interest pursuant to Section 12 (f) of the DPA:48

Although Section 13 (f) applies to sensitive personal information while the information involved in this case is just personal information, the protection of lawful rights and interests under Section 13 (f) by the Respondent is considered as legitimate interest pursuant to Section 12 (f) of the DPA. This section provides that it is lawful to process personal information if it is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.49

Section 13 (f) of the DPA provides:

Section 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

…

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.50

The Commission has previously interpreted the phrase “for the protection of lawful rights and interests of natural or legal persons in court proceedings” in Section 13 (f) of the DPA:

The phrase ‘for the protection of lawful rights and interests of natural or legal persons in court proceedings’ cannot be interpreted to relate only to the person asserting the lawful basis of the processing of personal information. It also contemplates situations where those persons whose lawful rights and interests are protected in court proceedings may not be the same individuals who processed the personal information, such as in the case of witnesses. Similarly, the next clause ‘establishment, exercise or defense of legal claims’ may be interpreted to refer to the legal claims of persons other than those who processed the personal information.51

In this case, JME asserted that the purpose of the Affidavit was to support the administrative complaint filed by Gepitulan against JCB.52 Given that Section 13 (f) of the DPA may refer to the legal claims of persons other than those who processed the personal information, the act of JME in issuing the Affidavit to support Gepitulan’s legal claim can, therefore, be considered as lawful processing.

III. JME did not violate Section 31 of the DPA (Malicious Disclosure).

Under Section 31 of the DPA, a PIC or a PIP may be held liable for Malicious Disclosure if he or she discloses unwarranted or false personal information or personal sensitive personal information with malice or in bad faith.53

The requisites of Malicious Disclosure are:

  1. The perpetrator is a personal information controller or personal information processor or any of its officials, employees, or agents;
  2. The perpetrator disclosed personal or sensitive personal information;
  3. The disclosure was with malice or in bad faith; and
  4. The disclosed information relates to unwarranted or false information.54

JME disclosed personal information, particularly the name of JCB, when he narrated the incident between them in his Affidavit and his Incident Report.

The disclosure, however, was done without malice or bad faith. JCB alleged that JME acted with malice or in bad faith in disclosing “an old and settled issue” between them.55 To support his claim, JCB argued that JME acted in bad faith in disclosing the incident after they have both agreed that “the matter was no longer an issue to be raised again” to support the “malicious administrative complaint” of Gepitulan.56 The Commission, however, finds no malice or bad faith on the part of JME in disclosing the incident in the Affidavit and the Incident Report. The act of disclosing a settled issue in an affidavit or a report does not automatically amount to malice or bad faith.

Further, JME had a lawful purpose in disclosing the incident in the Affidavit, that is, to support the administrative complaint of Gepitulan against JCB.

As to the last element of Malicious Disclosure, the disclosure in this case neither relates to unwarranted nor false information. Here, the personal information disclosed were the names of JCB and JME. The inclusion of the names is necessary to identify the individuals involved in the incident and to support the establishment of the legal claim against JCB.

Considering that the third and fourth requisites are not present, JME cannot be held to have committed Malicious Disclosure under Section 31 of the DPA.

IV. JME did not violate Section 32 of the DPA (Unauthorized Disclosure).

Unauthorized Disclosure is defined and penalized under Section 32 of the DPA:

Section 32. Unauthorized Disclosure. – (a) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).57

The Commission has previously explained the interpretation of Section 32 of the DPA as follows:

A strict and literal reading of Section 32 of the DPA on Unauthorized Disclosure shows that a personal information controller (PIC) or personal information processor (PIP) is liable if it discloses to a third party personal information without the consent of the data subject. Such reading, however, will result in absurdity since it penalizes a PIC or a PIP if the disclosure is without the consent of the data subject even if such disclosure is justified under some other criteria for lawful processing in Sections 12 and 13 of the DPA.58

In the same case, the Commission cited the following rule in statutory construction:

Where a literal meaning would lead to absurdity, contradiction, or injustice, or otherwise defeat the clear purpose of the lawmakers, the spirit and reason of the statute may be examined to determine the true intention of the provision.59

In line with this, Section 32 of the DPA should be further examined and be read together with other provisions of the DPA:

A law must not be read in truncated parts; its provisions must be read in relation to the whole law. It is the cardinal rule in statutory construction that a statute’s clauses and phrases must not be taken as detached and isolated expressions, but the whole and every part thereof must be considered in fixing the meaning of any of its parts in order to produce a harmonious whole. Every part of the statute must be interpreted with reference to the context, i.e., that every part of the statute must be considered together with other parts of the statute and kept subservient to the general intent of the whole enactment.60

Therefore, Unauthorized Disclosure is committed when the perpetrator processes personal information without any of the lawful basis for processing under Sections 12 and 13 of the DPA.61 The interpretation is in line with the principle that “when two or more interpretations are possible, that interpretation which is favorable or beneficial to the accused must be adopted.”62 It benefits the accused since it narrows the extent to which the disclosure of personal information may be considered as Unauthorized Disclosure.63

To determine whether there is Unauthorized Disclosure, the following requisites must concur:

  1. The perpetrator is a personal information controller or personal information processor;
  2. The perpetrator disclosed information;
  3. The information relates to personal or sensitive personal information;
  4. The perpetrator disclosed the personal or sensitive personal information to a third party;
  5. The disclosure was without any of the lawful basis for processing, consent or otherwise, under Sections 12 and 13 of the DPA; and
  6. The disclosure is neither malicious nor done in bad faith and the information disclosed is not unwarranted or false information.64

JME disclosed personal information when JCB’s name was included in his Affidavit and his Incident Report. The personal information was disclosed to third parties since the Affidavit and the Incident Report were submitted together with the administrative complaint filed by Gepitulan before the DepEd.

As previously discussed, however, the disclosure does not relate to unwarranted or false information. Further, the disclosure was based on a lawful criteria under Section 12 (f) in relation to Section 13 (f) of the DPA. Thus, the processing of personal information is a legitimate interest to establish the legal claim against JCB.

Considering that the requisites are lacking, JME cannot be held liable under Section 32 of the DPA on Unauthorized Disclosure.

WHEREFORE, premises considered, the Commission resolves that the case filed by JCB against JME is hereby DISMISSED.

This is without prejudice to the filing of appropriate civil, criminal or administrative cases before any other forum or tribunal, if any.

SO ORDERED.

City of Pasay, Philippines. 16 May 2022.

Sgd. LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

Sgd. JOHN HENRY D. NAGA Privacy Commissioner

Sgd. DUG CHRISTOPHER B. MAH Deputy Privacy Commissioner

Copy furnished:

JCB Complainant

JME Respondent

JRB Counsel for Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Complaint-Affidavit, 26 January 2021, ¶¶ 1-2, in JCB v. JME, NPC 21-032 (NPC 2021). ↩

  2. Complaints-Assisted Form, 02 February 2021, in JCB v. JME, NPC 21-032 (NPC 2021). ↩

  3. Id. ↩

  4. Id. ↩

  5. Complaint-Affidavit, 26 January 2021, ¶¶ 3-4, in JCB v. JME, NPC 21-032 (NPC 2021). ↩

  6. Id. ¶ 13. ↩

  7. Order, 27 August 2021, at 1, in JCB v. JME, NPC 21-032 (NPC 2021). ↩

  8. Id. ↩

  9. Order, 30 September 2021, in JCB v. JME, NPC 21-032 (NPC 2021). ↩

  10. Order, 28 October 2021, in JCB v. JME, NPC 21-032 (NPC 2021). ↩

  11. Respondent’s Email, 28 October 2021, in JCB v. JME, NPC 21-032 (NPC 2021). ↩

  12. Resolution, 02 November 2021, in JCB v. JME, NPC 21-032 (NPC 2021). ↩

  13. Comment, 08 November 2021, at 3, in JCB v. JME, NPC 21-032 (NPC 2021). ↩

  14. Id. ↩

  15. Id. ↩

  16. Id. at 5. ↩

  17. Id. Emphasis omitted. ↩

  18. Id. at 7. ↩

  19. Id. ↩

  20. Comment, 08 November 2021, at 11-12, in JCB v. JME, NPC 21-032 (NPC 2021). ↩

  21. Id. at 7-9. ↩

  22. Id. at 9-10. ↩

  23. Id. at 10-11. ↩

  24. Order, 01 December 2021, in JCB v. JME, NPC 21-032 (NPC 2021). ↩

  25. Id. ↩

  26. Complainant’s Memorandum, 06 January 2022, in JCB v. JME, NPC 21-032 (NPC 2022). ↩

  27. Id. at 11. ↩

  28. Respondent’s Memorandum, 12 January 2022, in JCB v. JME, NPC 21-032 (NPC 2022). ↩

  29. Comment, 08 November 2021, at 9-10, in JCB v. JME, NPC 21-032 (NPC 2021). ↩

  30. Id. at 8. ↩

  31. Id. at 9. ↩

  32. National Privacy Commission, 2021 Rules on Procedure of the National Privacy Commission [NPC 2021 Rules of Procedure], rule II, § 2 (28 January 2021). ↩

  33. Complaints-Assisted Form, 02 February 2021, in JCB v. JME, NPC 21-032 (NPC 2021). ↩

  34. NPC 2021 Rules of Procedure, rule II, § 3. ↩

  35. Id. rule II, § 3 (1). ↩

  36. 2019 AMENDMENTS TO THE 1997 RULES OF CIVIL PROCEDURE, rule 7, § 4. ↩

  37. Divina Palao v. Florentino International, Inc., G.R. No. 186967 (2017). ↩

  38. See Complaints-Assisted Form, 02 February 2021, in JCB v. JME, NPC 21-032 (NPC 2021); Complaint-Affidavit, 26 January 2021, in JCB v. JME, NPC 21-032 (NPC 2021). ↩

  39. NPC 2021 Rules of Procedure, rule II, § 3 (10). ↩

  40. Pacquing v. Coca-Cola Philippines, Inc., G.R. No. 157966 (2008). ↩

  41. Altres v. Empleo, G.R. No. 180986 (2008). ↩

  42. NPC 2021 Rules of Procedure, rule II, § 3. ↩

  43. Id. rule IV, § 1 (1). ↩

  44. Complaint-Affidavit, 26 January 2021, Annexes A & B, in JCB v. JME, NPC 21-032 (NPC 2021). ↩

  45. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 § 3 (g) (2012). ↩

  46. See Complaint-Affidavit, 26 January 2021, ¶ 13, in JCB v. JME, NPC 21-032 (NPC 2021); Complainant’s Memorandum, 06 January 2022, at 2-3, 10-12, in JCB v. JME, NPC 21-032 (NPC 2022). ↩

  47. Data Privacy Act of 2012, § 12 (f). ↩

  48. CID Case No. 17-K003, 19 November 2019, (NPC 2019) (unreported). ↩

  49. BGM v. IPP, NPC 19-653, 17 December 2020, available at https://www.privacy.gov.ph/wp-content/uploads/2021/02/NPC-19-653-BGM-vs-IPP-Decision-FINAL-Pseudonymized-21Dec2020.pdf (last accessed 06 June 2022). ↩

  50. Data Privacy Act of 2012, § 13 (f). ↩

  51. NPC 21-031, 03 March 2022, at 11, (NPC 2022) (unreported). ↩

  52. Comment, 08 November 2021, at 10, in JCB v. JME, NPC 21-032 (NPC 2021). ↩

  53. Data Privacy Act of 2012, § 31. ↩

  54. NPC 21-015, 03 February 2022, (NPC 2022) (unreported). ↩

  55. Complainant’s Memorandum, 06 January 2022, at 3, in JCB v. JME, NPC 21-032 (NPC 2022). ↩

  56. Id. at 3-5. ↩

  57. Data Privacy Act of 2012, § 32. ↩

  58. NPC 19-134, 10 December 2021 (NPC 2021) (unreported). ↩

  59. Metropolitan Bank and Trust Co. v. Liberty Corrugated Boxes Manufacturing Corp., G.R. No. 184317 (2017). ↩

  60. Fort Bonifacio Development Corp. v. Commissioner of Internal Revenue, G.R. Nos. 158885 & 170680 (Resolution) (2009). ↩

  61. See e.g., NPC 18-010, 17 December 2020 (NPC 2020) (unreported); NPC 19-134, 10 December 2021 (NPC 2021) (unreported); NPC 21-010, 03 February 2022 (NPC 2022) (unreported). ↩

  62. People v. Liban, G.R. Nos. 136247 & 138330 (2000). ↩

  63. NPC 19-134, 10 December 2021 (NPC 2021) (unreported). ↩

  64. NPC 21-010, 03 February 2022 (NPC 2022) (unreported). ↩

Backlinks