NPC Issuance Wiki

NPC 21-054: RGC v. JK Incorporated and Recovery, Inc.

Issued Decision

Decision Text

RGC

Complainant,

-versus-

JK INCORPORATED & RECOVERY, INC.

Respondent.

x----------------------------------------------------x

NAGA, P.C.;

Before this Commission is a Complaint filed by RGC against JK Incorporated & Recovery, Inc. (JK Incorporated) for alleged privacy violations of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

On 19 March 2021, the Commission, through its Complaints and Investigation Division (CID), received RGC Complaints-Assisted Form dated 25 February 2021 (CAF).1 RGC alleged:

MS of [JK Incorporated] – accredited agency of PSBank contacted me via phone call and sent some messages to my relatives and friends at around 11 AM on Facebook disclosing [that I have] an obligation [with] them.2

To support his claim, RGC attached a screenshot of a message purportedly from MS:

Good Day! may we ask for your assistance regarding one of your friend/colleague/relative of RGC to relay to the person to coordinate with us the soonest time possible likewise, the person may refer to all our contact details indicated herewith. Thanks and hoping for your urgent feedback. Please look for any officer of under legal counsel of JTF Tel. no. XXX/XXX.3

RGC also claimed that the message was sent to his sister, RMC to disclose his obligation to JK Incorporated.4

Thus, RGC argued that based on the foregoing incident, JK Incorporated violated the DPA.5 He also prayed that damages and a fine be imposed against JK Incorporated.6

On 23 June 2021, JK Incorporated was ordered by the CID to file a verified comment within fifteen (15) calendar days from the receipt of the Order.7 The same Order also stated that after the lapse of the reglementary period, the parties shall be ordered to appear for a preliminary conference.8

On 15 July 2021, JK Incorporated filed its Comment with Affirmative Defense/s dated 08 July 2021 praying that the complaint be dismissed for lack of cause of action and lack of merit.9 JK Incorporated averred that RGC CAF “states no cause of action and is frivolous, vexatious and made in bad faith.”10

JK Incorporated argued that no personal data or information of RGC was divulged to any person.11 It further stated that the screenshot attached to the CAF “does not mention of any obligation which the Complainant alleged.”12 JK Incorporated also stated that RGC claims about his relatives being contacted regarding his obligation is but a “product of his lies and/or imagination.”13

JK Incorporated further argued that the filing by RGC of the case is “a desperate attempt on his part to evade payment of his obligation.”14

On 12 July 2021, the parties were ordered by the CID to appear for preliminary conferences on 05 August 2021 and 18 August 2021.15

On 05 August 2021, an Order (After 1st Preliminary Conference held on 05 August 2021) was issued wherein both parties manifested that they were willing to undergo mediation proceedings to explore the possibility of amicable settlement.16

After both parties filed their Applications for Mediation,17 the CID issued an Order to Mediate dated 09 September 2022, wherein the complaint proceedings were to be suspended for sixty (60) days for the conduct of the mediation proceedings.18

On 13 October 2021, a Notice of Non-Settlement of Dispute was issued for failure of the parties to reach a settlement.19 Thereafter, on the same date, the CID issued an Order (for Resumption of Complaints Proceedings and Submission of Documents and Memoranda) ordering the parties to submit their respective Memoranda together with a list of evidence presented to prove their respective claims or defenses.20

RGC filed his Memorandum dated 25 October 2021, alleging that in 2017, he applied for a “revolving loan/Flexi loan” from PS Bank, with the loan being approved for three (3) years in a row.21 RGC alleged that during his application and the credit investigation, “the bank never asked for a list of contact reference[s] to which the bank may contact in case Complainant failed to make good his obligation.”22

In addition, RGC alleged that in April 2020, he could no longer avail of the loan scheme.23 The bank demanded from him the payment of his full obligation and in November 2020, he received the Statement of Account.24

RGC claimed that on 07 December 2020, JK Incorporated contacted him about his outstanding loan via e-mail.25 RGC tried to reason with JK Incorporated that he could not pay the obligation and asked for more time to pay it.26 RGC averred that throughout January and February 2021, JK Incorporated flooded him with calls to pay his obligation.27

On 25 February 2021, RGC alleged that his Facebook friends received a message that read:

Good Day! may we ask for your assistance regarding one of your friend/colleague/relative of RGC to relay to the person to coordinate with us the soonest time possible likewise, the person may refer to all our contact details indicated herewith. Thanks and hoping for your urgent feedback. Please look for any officer of under legal counsel of JTF Tel. no. XXX/XXX.28

As a result, RGC alleged that his Facebook friends contacted him to inform him that the message is circulating among his Messenger contacts.29 Thus, this prompted RGC to inform JK Incorporated that it was illegal to access his personal information and that the latter maliciously disclosed his information to parties who were not privy to the transaction.30 RGC claimed that after informing JK Incorporated, “the message was suddenly ‘unsent’.”31

RGC Memorandum provided the following pieces of evidence: 1) a screenshot of the purported Facebook message subject of the complaint,32 the affidavit of RMC,33 and the affidavit of RC.34 JK Incorporated’s act, according to RGC, was a violation of Section 29 (Unauthorized Access or Intentional Breach)35 and Section 31 (Malicious Disclosure)36 of the DPA. RGC further argued that none of the circumstances in Section 12 of the DPA were present to justify the use of RGC personal information.37

JK Incorporated filed its Memorandum dated 29 October 2021, alleging that it was the collecting agent of PS Bank.38 On 03 December 2020, it received an endorsement from PS Bank regarding RGC loan.39

According to JK Incorporated, since RGC refused to answer its calls and emails, it resorted to the practice of “skip tracing”.40 Particularly, JK Incorporated alleged that since RGC could no longer be contacted despite several messages and calls, it visited his Facebook account.41 JK Incorporated claimed that RGC Facebook Account contained a public post with several comments.42 One of the comments came from RMC calling RGC “Kuya” (brother), and to whom RGC responded to as “Sis”.43 JK Incorporated inferred that they were related, thus, it messaged RMC.44

JK Incorporated posited that instead of settling the obligation, RGC filed the subject Complaint against it.45

It argued that RGC failed to state a cause of action since the complaint failed to allege the “manner and circumstances” of the commission of the offense charged.46

Further, JK Incorporated argued that it could not be liable for Section 29 of the DPA (Unauthorized Access or Intentional Breach) since it should be proven that “the offender [broke] in any way into the system where personal and sensitive personal information is stored.”47 Here, JK Incorporated contended that it could not have committed unauthorized access when the information was readily and publicly available on the internet, particularly on Facebook.48

JK Incorporated further argued that it could not be liable for Section 32 of the DPA (Malicious Disclosure) since the message only requested to relay the message to RGC and it never mentioned his loan obligation.49 JK Incorporated also disputed RGC allegation that it sent messages to both RMC and to RC, since RMC was the only one identified by JK Incorporated through skip tracing.50

Thus, JK Incorporated prayed that the RGC complaint be dismissed.51

Issue

Whether JK Incorporated committed a violation of the DPA.

Discussion

The Commission dismisses the Complaint.

The Commission shall first discuss the act that was allegedly a violation of the DPA. RGC does not dispute the authority of JK Incorporated to collect outstanding obligations. Indeed, in his CAF, RGC mentions that JK Incorporated was an accredited agency of PS Bank.52 Rather, he specifically claims that JK Incorporated’s act of contacting persons in his social media list was violative of the DPA.53

JK Incorporated can be considered to have engaged in the practice of skip tracing after messaging at least one person, RMC, on Facebook in order to reach RGC. To recall, the message that was sent to RMC states:

Good Day! may we ask for your assistance regarding one of your friend/colleague/relative of RGC to relay to the person to coordinate with us the soonest time possible likewise, the person may refer to all our contact details indicated herewith. Thanks and hoping for your urgent feedback. Please look for any officer of under legal counsel of JTF Tel. no. XXX/XXX.54

The Commission explained the concept of skip tracing in relation to the DPA in its Advisory Opinion No. 2018-059:

The DPA does not prohibit the collection of personal information through skip tracing or probing, provided that the collection or any further processing is done in accordance with the law. In general, processing of personal data should adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality. There should be procedures in place for data subjects to exercise their rights and appropriate security measures for data protection.

xxx

Collection agencies are considered personal information processors (PIPs) to whom a personal information controller (PIC) has outsourced the processing of personal data of borrowers. This is due to the nature of their business, which, in general, performs the processing of personal data for the benefit of other companies. As PIPs, collection agencies are expected to process personal data only in accordance with their agreement with a PIC.55

Thus, though skip tracing is not prohibited, the practice still has to comply with the DPA.

Second, for complaints before the Commission to prosper, the burden of proof required is substantial evidence, or “that amount of relevant evidence that a reasonable mind might accept as adequate to support a conclusion.”56 The Supreme Court has explained that:

[T]he complainant has the burden of proving by substantial evidence the allegations in his complaint. The basic rule is that mere allegation is not evidence and is not equivalent to proof. Charges based on mere suspicion and speculation likewise cannot be given credence.57

Thus, RGC has the burden to prove by substantial evidence that a privacy violation was committed. However, in this case, RGC provided a screenshot of an alleged Facebook message to RMC from a certain MS and an affidavit supporting the said screenshot.58 Such cannot be considered sufficient evidence to prove that unauthorized access and malicious disclosure was committed by JK Incorporated.

The mere screenshot of a message from MS does not show that JK Incorporated actually broke into a data system where his personal or sensitive personal information is stored. Further, such screenshot does not substantiate that the disclosure was malicious or was done in bad faith or involved unwarranted or false information relative to his personal data, since the screenshot only shows a message from MS asking for assistance to relay their message to RGC.

Consequently, absent the supporting evidence that JK Incorporated indeed broke into the system and that there is malice or bad faith in the disclosure of his personal information, such allegations cannot be given credence by the Commission.

In addition, the Commission stresses, “[t]he burden to establish the charges rests upon the complainant. The case should be dismissed for lack of merit if the complainant fails to show in a satisfactory manner the facts upon which his accusations are based. The respondent is not even obliged to prove his exception or defense.”59

Taken all together, RGC pieces of evidence were not sufficient to prove that a privacy violation was committed since RGC failed to establish that the message sent by JK Incorporated was violative of his data privacy rights or that its actions rose to the level of a DPA violation, as will be further discussed below.

I. JK Incorporated adhered to the general data privacy principles of transparency, legitimate purpose, and proportionality.

There is no substantial evidence to prove that JK Incorporated violated the general data privacy principles of transparency, legitimate purpose, and proportionality.60

The Commission notes that based on the record, RGC did not adequately discuss how JK Incorporated’s actions violated the general data privacy principles. There is insufficient evidence on record to show that JK Incorporated did not adhere to the principles.

As discussed, the act of skip tracing is not per se prohibited. Thus, JK Incorporated’s actions do not automatically mean that it was contrary to law, morals, or public policy. There is no substantial evidence to show that JK Incorporated did not provide a specific or declared purpose for its processing of personal data or that the processing was incompatible with a declared or specified purpose. The record shows that the message was sent in relation to the collection of RGC’s debt. This was resorted to because RGC was not responsive in settling his obligation.61 Debt collection is not a prohibited purpose to process personal data. As long as it complies with the relevant laws, like the DPA and related NPC issuances, the processing of personal data for debt collection is a legitimate purpose.

Here, JK Incorporated’s message to RMC was straightforward in its purpose, which was to ask for assistance in contacting RGC in order for him to coordinate with JK Incorporated. In fact, the message did not even disclose that RGC had a loan obligation. It was just a message asking for assistance to reach RGC.

As to transparency, JK Incorporated has been in contact62 with RGC prior to the skip tracing and that RGC is aware of the purpose to which his personal information is being processed by the former. Also, in terms of proportionality, the screenshot shows that JK Incorporated did not disclose any information other than his name, which is relevant and necessary for JK Incorporated to identify RGC in its request for assistance from RMC. Moreover, the message to RMC is proportional and not excessive since it did not disclose excessive information such as RGC’s loan obligation.

Taken all together, the prevailing circumstances do not show any violation of the general data privacy principles. Thus, given the context of debt collection and JK Incorporated’s position as a collecting agent, the message to RMC was transparent, legitimate, and proportional to the purpose in collecting RGC debt.

II. JK Incorporated is not liable for Section 29 (Unauthorized Access or Intentional Breach) of the DPA.

RGC alleged that JK Incorporated violated Section 29 of the DPA since “he never gave any contact information of any person to …[JK Incorporated]. However, without his authority, [JK Incorporated] accessed his Friends List [on] Facebook and started messaging the said contacts [through] Facebook Messenger.”63

Section 29 of the DPA provides:

SEC. 29. Unauthorized Access or Intentional Breach. – The penalty of imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00) shall be imposed on persons who knowingly and unlawfully, or violating data confidentiality and security data systems, breaks in any way into any system where personal and sensitive personal information is stored.64

The case of ACN v. DT enumerated the elements of a violation of Section 29:

  1. The data system stores personal or sensitive personal information;
  2. The accused breaks into the system; and
  3. The accused knowingly and unlawfully broke into the system in a manner which violates data confidentiality and security of the same.65

The first element is present. Though there was no substantial discussion on whether the data system stored personal data, the Commission notes that Facebook’s Privacy Policy, at the time the message was sent, states: “[w]e collect the content and other information you provide when you use our Services, including when you sign up for an account, create or share, and message or communicate with others.”66 As to managing the information, it is stated that “[w]e store data for as long as it is necessary to provide products and services to you and others, including those described above. Information associated with your account will be kept until your account is deleted, unless we no longer need the data to provide products and services.”67 Thus, Facebook, particularly its Messenger platform, may be considered a data system that stores personal data.

However, there is a lack of substantial evidence to prove that the second and third elements exist. RGC has not proven that JK Incorporated broke into his Facebook account or into his Messenger platform to access his contacts, much more that it did so knowingly and unlawfully.68

On the contrary, JK Incorporated stated that it was able to message Rica by visiting RGC’s Facebook Account.69 Further, it alleged that it was able to get RMC details through the comments of RGC’s public Facebook post.70 On this note, JK Incorporated argued that there could not be unauthorized access to information when it is available “readily and publicly” on Facebook.

The Commission emphasizes that the availability of personal data in the public sphere does not mean that the DPA no longer applies, given that the DPA looks into the processing of personal data, regardless of whether it is publicly available or not. As provided in NPC Advisory Opinion No. 2018-059:

It should be clarified that the public availability of personal information does not exclude it from the scope of the DPA. This law applies to the processing of all types of personal information, publicly available or not, and to any natural and juridical person involved in personal information processing. ‘Processing’ in this context refers to the collection, use, storage, disposal and any other operation performed upon personal information.71

There was also no evidence provided that RGC fully utilized the Facebook privacy tools, or that his intention was to keep his posts private. Nevertheless, in this case, the Commission finds that between the two allegations of the parties, it is more reasonable to conclude that JK Incorporated was able to get RGC and RMC’s details by searching for their respective Facebook profiles.

Thus, there is no substantial evidence to find that JK Incorporated violated Section 29 of the DPA.

III. JK Incorporated is not liable for Section 31 (Malicious Disclosure) of the DPA.

RGC alleged that JK Incorporated violated Section 31 of the DPA since “people who were not listed by [RGC] as reference list received messages from [JK Incorporated] about the fulfillment of [RGC’s obligations.]”72

Section 31 of the DPA provides:

SEC. 31. Malicious Disclosure. – Any personal information controller or personal information processor or any of its officials, employees or agents, who, with malice or in bad faith, discloses unwarranted or false information relative to any personal information or personal sensitive information obtained by him or her, shall be subject to imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).73

The elements of Section 31 are:

  1. The perpetrator is a personal information controller or a personal information processor or any of its officials, employees or agents;
  2. The perpetrator disclosed personal or sensitive personal information;
  3. The disclosure was made with malice or in bad faith; and
  4. The information disclosed was unwarranted or false information.74

Here, JK Incorporated claimed that it is the collecting agent of PS Bank and received the endorsement of RGC’s loan obligation.75

Section 3 (i) of the DPA provides:

(i) Personal information processor refers to any natural or juridical person qualified to act as such under this Act to whom a personal information controller may outsource the processing of personal data pertaining to a data subject.

As PS Bank’s collecting agent, JK Incorporated may be considered a personal information processor (PIP). PS Bank is the one who has control over RGC’s information, which it outsourced to JK Incorporated in order for it to collect RGC’s outstanding loan balance. Thus, the first element is present.

As to the second element, RGC alleged that:

MS of [JK Incorporated] – accredited agency of PSBank contacted me via phone call and sent some messages to my relatives and friends at around 11 AM on Facebook disclosing [that I have] an obligation [with] them.76

JK Incorporated’s act of contacting the “relatives” of RGC, is considered an act of disclosure since it divulged the full name of RGC in the Facebook message. Thus, the second element is present.

However, the third and fourth elements are absent. A reading of the message does not show that JK Incorporated acted in malice or bad faith in disclosing the personal information nor that the message contained any unwarranted or false information. To quote:

Good Day! may we ask for your assistance regarding one of your friend/colleague/relative of RGC. to relay to the person to coordinate with us the soonest time possible likewise, the person may refer to all our contact details indicated herewith. Thanks and hoping for your urgent feedback. Please look for any officer of under legal counsel of JTF Tel. no. XXX/XXX.77

As to the third element, the Supreme Court defined malice as one which “connotes ill will or spite and speaks not in response to duty but merely to injure the reputation of the person defamed and implies an intention to do ulterior and unjustifiable harm.”78 Meanwhile, as to bad faith, it “implies a conscious and intentional design to do a wrongful act for a dishonest purpose or some moral obliquity.”79

Here, RGC failed to adduce sufficient proof that JK Incorporated acted with malice or bad faith in the disclosure of his personal information. In the screenshot that RGC himself provided, the message only shows that JK Incorporated is requesting for assistance from RMC. Nowhere in the message indicates spite, ill will, or any statement to injure RGC’s reputation, and does not imply any intention to do a wrongful act against him since no other information was disclosed aside from his name.

To stress, the message to RMC only disclosed RGC’s full name and did not mention RGC’s loan or financial obligation at all. JK Incorporated only stated that it was seeking assistance to relay to RGC the need to coordinate with the name and contact number of its representative. JK Incorporated’s message was straightforward and was a request for RGC to contact its legal counsel. Aside from RGC’s full name, no other information was disclosed by JK Incorporated besides the name and contact number of its legal counsel. These circumstances are not indicative of bad faith on the part of JK Incorporated, especially given the context that RGC allegedly was no longer responsive to its messages.80 Thus, by itself, the message cannot be considered malicious or made in bad faith.

In terms of the fourth element, there is no indication that the name involved is unwarranted or a false information since RGC did not dispute that the name involved is false and it is, in fact, his full name. Nevertheless, the Commission notes that JK Incorporated only mentioned RGC’s name, and not his loan obligation. The surrounding context shows that the information disclosed was warranted since it was necessary for JK Incorporated to identify RGC in its request for assistance from RMC.

Considering the foregoing, the Commission finds that JK Incorporated did not violate Section 31 of the DPA since not all the elements for Malicious Disclosure are present.

After scrutinizing the evidence and arguments of both parties, the Commission cannot find that JK Incorporated committed a privacy violation under the DPA.

WHEREFORE, premises considered, this Commission resolves that the Complaint filed by RGC against JK Incorporated & Recovery, Inc. is hereby DISMISSED.

SO ORDERED.

City of Pasay, Philippines.

22 September 2022.

JOHN HENRY D. NAGA

Privacy Commissioner

I CONCUR:

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

Copy furnished:

RGC

Complainant

JK INCORPORATED & RECOVERY, INC.

Respondent

JTF

Counsel for Respondent

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Complaints-Assisted Form dated 25 February 2021 of RGC. ↩

  2. Id. at p. 3. ↩

  3. Complaints-Assisted Form dated 25 February 2021 of RGC, See Annex “A”, Screenshot of the Message from MS. ↩

  4. Complaints-Assisted Form dated 25 February 2021 of RGC, at p. 4. ↩

  5. Id. at p. 3. ↩

  6. Id., at p. 5. ↩

  7. RGC v. JK Incorporated & Recovery Inc., NPC 21-054, Order to Comment dated 23 June 2021, at p. 1. ↩

  8. Id. ↩

  9. Comment with Affirmative Defense/s dated 08 July 2021 of JK Incorporated & Recovery Inc. ↩

  10. Id, ¶ 2. ↩

  11. Id. ¶ 3. ↩

  12. Id. ¶ 4. ↩

  13. Comment with Affirmative Defense/s dated 15 July 2021 of JK Incorporated & Recovery Inc., ¶ 4. ↩

  14. Id. ¶ 5. ↩

  15. RGC v. JK Incorporated & Recovery Inc., NPC 21-054, Order to Comment dated 12 July 2021, at p. 1. ↩

  16. Id. ↩

  17. Application for Mediation dated 09 September 2022 of RGC and Application for Mediation of JK Incorporated & Recovery Inc. dated 09 September 2022. ↩

  18. RGC v. JK Incorporated & Recovery Inc., NPC 21-054, Order to Mediate dated 09 September 2022, at p. 1. ↩

  19. Id. ↩

  20. Id. ↩

  21. Memorandum (Complainant) dated 25 October 2021, ¶ 5. ↩

  22. Id. ¶ 5. ↩

  23. Id. ¶ 6. ↩

  24. Id. ¶ 7. ↩

  25. Memorandum (Complainant) dated 25 October 2021, ¶ 8. ↩

  26. Id. ¶ 9. ↩

  27. Id. ¶ 10. ↩

  28. Id. ¶ 11. ↩

  29. Memorandum (Complainant) dated 25 October 2021, ¶ 13. ↩

  30. Id. ↩

  31. Id. ↩

  32. Memorandum (Complainant) dated 25 October 2021, Annex “A”. ↩

  33. Id, ¶ Annex “B”. ↩

  34. Id, ¶ Annex “C”. ↩

  35. Id. ¶ 20. ↩

  36. Memorandum (Complainant) dated 25 October 2021, ¶ 22. ↩

  37. Id. ¶ 28. ↩

  38. Id. at p. 2. ↩

  39. Id. ↩

  40. Memorandum of the Respondent dated 29 October 2021, at p. 3. ↩

  41. Id. ↩

  42. Id. ↩

  43. Id. ↩

  44. Memorandum of the Respondent dated 29 October 2021, at p. 3. ↩

  45. Complaints-Assisted Form dated 25 February 2021 of RGC. ↩

  46. Memorandum of the Respondent dated 29 October 2021, at p. 4. ↩

  47. Id. at p. 7. ↩

  48. Id. ↩

  49. Id. ↩

  50. Memorandum of the Respondent dated 29 October 2021, at p. 9. ↩

  51. Id. at p. 10. ↩

  52. Complaints-Assisted Form dated 25 February 2021 of RGC, at p. 3. ↩

  53. Memorandum (Complainant) dated 25 October 2021, ¶¶ 21-24. ↩

  54. Id, ¶ 11. ↩

  55. National Privacy Commission Advisory Opinion 2018-059, Skip tracing and probing of contact details through the internet and third parties, (4 October 2018). ↩

  56. De Jesus v. Guerrero III, G.R. No. 171491, 04 September 2009. ↩

  57. Id. ↩

  58. Memorandum (Complainant) dated 25 October 2021, Annex “A”. ↩

  59. National Bureau of Investigation v. Nijera, G.R. No. 237522 (Resolution), 30 June 2020. ↩

  60. Data Privacy Act of 2012, chapter III, § 11. See also National Privacy Commission, Implementing Rules and Regulations of the Data Privacy Act of 2012, rule IV, § 18 (2016) (IRR of the DPA). ↩

  61. See Memorandum of the Respondent dated 29 October 2021, at p. 3; Memorandum (Complainant) dated 25 October 2021, ¶ 10. ↩

  62. Id. ¶ 8. ↩

  63. Id. ¶ 21. ↩

  64. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter VIII, § 29 (2012). ↩

  65. NPC 18-109, 01 June 2021. ↩

  66. Facebook Privacy Policy, 9 September 2016, See “What kinds of information do we collect”. ↩

  67. Id, See “How can I manage or delete information about me”. ↩

  68. On the contrary, JK Incorporated stated that it was able to message Rica by visiting RGC’s Facebook Account. Further, it alleged that it was able to get RMC details through the comments of RGC’s public Facebook post. ↩

  69. Id. ↩

  70. Id. at p. 7. ↩

  71. NPC Advisory Opinion 2018-059, Skip tracing and probing of contact details through the internet and third parties, (4 October 2018). See, DPA definition of processing in footnote. ↩

  72. Memorandum (Complainant) dated 25 October 2021, ¶ 24. ↩

  73. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter VIII, § 31 (2012). ↩

  74. NPC 21-015, 03 February 2022 ↩

  75. Memorandum of the Respondent dated 29 October 2021, at p. 2. ↩

  76. Complaints-Assisted Form dated 25 February 2021 of RGC, at p. 3. ↩

  77. Id. Annex A ↩

  78. Delgado v. HRET, G.R. No. 219603, 26 January 2016. ↩

  79. Montinola vs. Philippine Airlines, G.R. No. 198656, 8 September 2014. ↩

  80. See Memorandum of the Respondent dated 29 October 2021, at p. 3. ↩

Backlinks