NPC Issuance Wiki

NPC 21-064: GSS v. Global Dominion Financing Inc.

Issued Decision

Decision Text

GSS,

Complainant,

-versus-

GLOBAL DOMINION FINANCING INC.,

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before this Commission is a complaint filed by GSS against Global Dominion Financing Inc. (GDFI) for an alleged violation of Section 25 (Unauthorized Processing) and Section 28 (Processing for Unauthorized Purposes) of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

On 22 March 2021, GSS filed a complaint with the National Privacy Commission (NPC) against Global Dominion Financing Inc. (GDFI).1

GSS alleged that on 02 March 2021, he applied for a car loan with GDFI.2 In GSS’s complaint, he stated that he followed up on his application with GDFI and received a reply via email on 04 March 2021,3 which stated “Good morning po. [P]inapaunlock ko lang po yung name sa affiliate namin. [P]ossible po common name. [R]equested na po ito. Thank you [.]”4

On 05 March 2021, GSS again asked GDFI for an update on the status of his loan but there was no response from GDFI.5 He claimed that he “felt something suspicious about why [his] namesake from [GDFI’s] affiliate is not yet cleared.”6

On 11 March 2021, GSS cancelled his car loan application and requested an explanation regarding the unlocking of his account with GDFI’s affiliate.7 He claimed that he had no personal knowledge of applying for other loan products from them or any of their affiliates.8 He further averred that “[he] fears that someone might have used the personal data [he] had with GDFI without [his] knowledge whatsoever.”9

GSS alleged that GDFI violated Section 25 (Unauthorized Processing) and Section 28 (Processing for Unauthorized Purposes) of the DPA.10 GSS also prayed for damages and a fine to be issued against GDFI.11

On 23 June 2021, the Commission, through its Complaints and Investigation Division (CID), issued an Order directing GDFI to file its comment within fifteen (15) calendar days from receipt of the Order.12

On 12 July 2021, GDFI filed its Verified Comment.13 GDFI averred that it did not violate any provision of the DPA.14 GDFI claimed that it informs its clients of its Privacy Notice and secures the consent of its clients through the Privacy Notice and Consent Form which states:

The privacy and security of your personal data (“Personal Information”) which we collect from you is important to us. It is equally important that you understand how we handle this data.

In conducting our business, we must collect “Personal Information” from you. It will be strictly used to administer your account and to provide the products and services you have requested from us and to further meet your needs and the standard procedures of our business.

We will treat your “Personal Information” confidential. It will only be disclosed, subject to our permission to our affiliates such as credit bureaus, collection companies and other financial institutions for the purpose of assisting you in your financial needs and for the effective handling of your account.

Further, for the proper assessment of your loan application, you hereby allow GDFI to collect information from any institutions that you are connected with or related to such as but not limited to bank, agencies, employer, airlines and supplier.

Furthermore, in case of restructuring your loan obligation, you are giving consent and allowing GDFI to disclose and collect information from the above mentioned institutions and people.

For further information regarding the privacy policy, you may visit our website at www.gdfi.com.ph.[^15]

GDFI claimed that it secured GSS’s consent before it proceeded with handling his personal data.15

On 12 July 2021, an Order was issued, ordering both parties to appear for a preliminary conference on 26 August 2021.16 After the Preliminary Conference held on 26 August 2021, both parties agreed to undergo mediation proceedings of this Commission to explore the possibility of an amicable settlement.17 The complaint proceedings were suspended for the conduct of mediation proceedings.18

On 29 September 2021, the mediation officer, however, issued a Notice of Non-Settlement of Dispute as the parties were unable to reach a settlement.19 The parties were then ordered to submit their respective memoranda.20

On 19 October 2021, GSS submitted his Memorandum.21 GSS admitted that he was a former client of GDFI.22 GSS stated that he previously applied and was granted a car loan by GDFI sometime in the year 2016.23 GSS contended that he has settled and paid his previous car loan with GDFI.24 According to him, “[p]art of the process prior to the grant of the [2016] loan, [GSS] disclosed vital personal information such as his name, age, address, sex, marital status, occupation, financial capacity, and other relevant information to [GDFI].”25 He then reiterated the events that happened from 02 March 2021 to 11 March 2021 regarding his application for a car loan in 2021.26 He claimed that GDFI failed to explain and provide a straightforward answer on the use of his personal information as well as the existence of his namesake with respect to the car loan application.27

GSS contended that GDFI violated Section 25 (Unauthorized Processing) and Section 28 (Processing for Unauthorized Purposes) of the DPA28 and the general data privacy principle of transparency.29 GSS also claimed that GDFI violated his rights as a data subject, specifically the right to be informed and the right to access.30 Further, GSS prayed for damages.31

On 20 October 2021, GDFI submitted its Memorandum.32 GDFI alleged that the filing of the present case is grounded on suspicion and fear.33 GDFI claimed that it is compliant with the mandate of the DPA as it ensures that the personal information of its clients are secured and protected.34 It submitted a copy of the Loan Application Form that bears GSS’s signature.35 It claimed that the signed Loan Application Form shows GSS authorizing GDFI to process GSS’s personal data for an authorized purpose that is solely in relation with his loan application.36

GDFI alleged that it met the criteria for lawful processing of personal information stating Section 12 (a) and (b), and Section 13 (a) of the DPA as bases for its lawful processing.37 GDFI prayed that the case be dismissed for lack of merit.38

Issue

Whether the complaint should have been dismissed outright on procedural grounds.

Discussion

I. The complaint should not have been given due course pursuant to Section 2 of Rule II of NPC Circular No. 2021-01 (2021 NPC Rules of Procedure).

Section 2 of Rule II of the 2021 NPC Rules of Procedure provides:

Section 2. Exhaustion of remedies. – No complaint shall be given due course unless it has been sufficiently established and proven that:

  1. the complainant has informed, in writing, the personal information controller (PIC), personal information processor (PIP), or concerned entity of the privacy violation or personal data breach to allow for appropriate action on the same; and

  2. the PIC, PIP, or concerned entity did not take timely or appropriate action on the claimed privacy violation or personal data breach, or there is no response from the PIC, PIP, or concerned entity within fifteen (15) calendar days from receipt of written information from the complainant.

The NPC may waive any or all of the requirements of this Section at its discretion upon (a) good cause shown, properly alleged and proved by the complainant; or (b) if the allegations in the complaint involve a serious violation or breach of the Data Privacy Act of 2012, taking into account the risk of harm to the affected data subject.39

In order for the complaint to be given due course, Section 2 of Rule II of the 2021 NPC Rules of Procedure requires that the complainant must first inform, in writing, the concerned entity of the alleged privacy violation or personal data breach.40 Following the written notification, the concerned entity did not take timely or appropriate action on the alleged privacy violation nor did it respond within fifteen (15) calendar days from receipt of written information from the complainant.41 The fifteen (15) calendar days granted by the 2021 NPC Rules of Procedure affords the concerned entity an opportunity to address the alleged privacy violation by either taking timely or appropriate action, or responding to the written information given by the complainant.42 These two requisites should have been sufficiently established and proven before a complaint is given due course.43

The Commission finds that GSS’s complaint should not have been given due course by the CID because GSS failed to comply with exhaustion of remedies. In MRS v. National Conciliation and Mediation Board (NCMB) and Department of Labor and Employment (DOLE), the Commission dismissed the case for failure to exhaust remedies.44 The Commission held that “where circumstances permit, it is a condition precedent to the filing of complaints that complainants give the respondents the opportunity to address the complaints against them.”45

In this case, GSS cancelled his application for a car loan through email on 11 March 2021.46 In the email, GSS did not inform GDFI in writing of the alleged privacy violation committed against him but merely notified GDFI of the cancellation of his application for the car loan.47 Subsequently, on 22 March 2021, eleven (11) calendar days after GSS cancelled his application for the car loan with GDFI, GSS filed a complaint with the NPC.48

Even assuming that GSS was able to inform GDFI of the alleged privacy violation in his Notice of Cancellation, GSS failed to observe the fifteen-day period in Section 2 (1) of Rule II of the 2021 NPC Rules of Procedure. GSS filed a complaint before the lapse of fifteen (15) calendar days from receipt of written information to GDFI, giving an opportunity for it to take timely or appropriate action or respond to GSS’s written notification.

Although Section 2 of Rule II of the 2021 NPC Rules of Procedure provides exceptions to the requirement of exhaustion of remedies, nothing in the records show that GSS’s case warrants a waiver of the requirement of exhaustion of remedies. The Commission finds that there is neither a serious violation nor breach of the DPA that gives rise to a risk of harm to the affected data subject.49 Thus, the complaint filed by GSS should not have been given due course.

II. The case should have been dismissed outright pursuant to Section 1 (3) and (4) of Rule IV of the 2021 NPC Rules of Procedure.

GSS’s case should have been dismissed outright as there was no privacy violation. Section 1 (3) of Rule IV of the 2021 NPC Rules of Procedure provides:

Section 1. Outright dismissal, when allowed. – Within thirty (30) calendar days from receipt of the complaint, the investigating officer may give the complaint due course or dismiss the complaint without prejudice, on any the following grounds:

…

  1. The complaint does not pertain to a violation of the Data Privacy Act of 2012 or does not involve a privacy violation or personal data breach.50

A privacy violation pertains to the processing of personal information in violation of a person’s reasonable expectation of confidentiality or privacy or in violation of any law, rules, or regulation relating to the protection of personal data, such as the DPA. It includes but is not limited to a violation of the general principles of privacy, a violation of the rights of the data subjects, unauthorized processing, improper disposal of personal data, processing for an unauthorized purpose, concealment of security breaches, and unauthorized or malicious disclosure.51

In this case, the complaint filed by GSS does not involve a privacy violation. GSS filed the case primarily based on speculation and fear. As admitted by GSS in his Memorandum, he states that “[he] feared that he might be exposed to identity theft considering someone might have used the personal data he had with GDFI without his knowledge”.52

Mere speculation of a supposed privacy violation cannot be considered ripe for adjudication. The Supreme Court has held:

A question is ripe for adjudication when the act being challenged has had a direct adverse effect on the individual challenging it. For a case to be considered ripe for adjudication, it is a prerequisite that something has then been accomplished or performed by either branch before a court may come into the picture, and the petitioner must allege the existence of an immediate or threatened injury to himself as a result of the challenged action. He must show that he has sustained or is immediately in danger of sustaining some direct injury as a result of the act complained of.53

The challenged act must have been accomplished or performed and must have a direct adverse effect against the complainant for the case to be considered ripe for adjudication. The complainant must also show that the act complained of has an immediate and direct injury to himself or herself.

In this case, the act that GSS is complaining of is GDFI’s delay in processing his car loan application due to his having a namesake in GDFI’s records. GSS, however, failed to substantiate how GDFI processed his personal information in violation of the DPA. To substantiate his claim, GSS presented the written communication between him and GDFI, which shows his inquiry about his car loan application and GDFI’s response and explanation that he has a namesake in its records.54 There is nothing in the complaint and evidence presented that credibly supports his fear of being “exposed to identity theft,”55 any unauthorized processing of his personal information, or processing of his personal information for an unauthorized purpose. GSS failed to show that he has sustained or is immediately in danger of sustaining some direct injury as a result of the act complained of.

In any case, GSS’s complaint should have been dismissed outright because there is insufficient information to substantiate the allegations in the complaint. Section 1 (4) of Rule IV of the 2021 NPC Rules of Procedure provides:

Section 1. Outright dismissal, when allowed. – Within thirty (30) calendar days from receipt of the complaint, the investigating officer may give the complaint due course or dismiss the complaint without prejudice, on any the following grounds:

…

  1. There is insufficient information to substantiate the allegations in the complaint.56

The 2021 NPC Rules of Procedure allows the outright dismissal of the case when there is insufficient information to substantiate the allegations in the complaint.57 In this case, GSS alleges that GDFI committed unauthorized processing and processing for an unauthorized purpose.58 GSS’s evidence, however, failed to substantiate how the personal information was processed. The evidence merely showed GDFI informing GSS of a namesake in its records that caused the delay of granting his application for a car loan.59

Contrary to GSS’s allegations, having a namesake in the database of the company or its affiliate by itself does not automatically result to unauthorized processing or processing for an unauthorized purpose. GSS’s fear of someone else using his personal information is primarily based on speculation. Thus, the Commission finds that the written communication between GSS and GDFI and the documents related to the application of a car loan that GSS submitted as evidence failed to substantiate GSS’s claim of unauthorized processing or processing for an unauthorized purpose committed by GDFI.

The Commission observes that although there may be fraud-related issues that fall under the DPA, the filing of cases pertaining solely to fraud-related issues without a privacy issue is not within the jurisdiction of the Commission. For the education of the public, the DPA covers data privacy-related issues. It cannot be used to seek redress against fraud-related issues that do not involve any privacy violations. Thus, the Commission’s jurisdiction to hear and decide a case is based on whether the allegations in the complaint sets forth a violation of the DPA, its IRR, and other issuances of the Commission. Otherwise, the case is not within the jurisdiction of the Commission and it should be heard and decided by other appropriate bodies.

As discussed, the complaint should not have been given due course not only because GSS failed to comply with the requirement of exhaustion of remedies but also because the complaint did not involve any privacy violation. Further, GSS failed to present anything aside from fear and speculation to substantiate the allegations in his complaint.

WHEREFORE, premises considered, this Commission resolves that the instant Complaint filed by GSS against Global Dominion Financing Inc. (GDFI) is hereby DISMISSED for lack of merit.

This is without prejudice to the filing of appropriate civil, criminal, or administrative cases against GDFI before any other forum or tribunal, if any.

SO ORDERED.

City of Pasay, Philippines.

16 June 2022.

Sgd

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

Sgd.

JOHN HENRY D. NAGA Privacy Commissioner

Sgd.

DUG CHRISTOPER B. MAH Deputy Privacy Commissioner

Copy furnished:

GSS

Complainant

GLOBAL DOMINION FINANCING INC.

Respondent

RVL

Counsel for Complainant

MCS

Counsel for Respondent

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

National Privacy Commission

Footnotes

  1. Complaints Assisted Form, 22 March 2021, at 3, in GSS v. Global Dominion Financing Inc., NPC 21-064 (NPC 2021). ↩

  2. Id. ↩

  3. Id. ↩

  4. Complainant’s Memorandum, Exhibit A, 22 October 2021, in GSS v. Global Dominion Financing Inc., NPC 21-064 (NPC 2021). ↩

  5. Complaints Assisted Form, 22 March 2021, at 3, in GSS v. Global Dominion Financing Inc., NPC 21-064 (NPC 2021). ↩

  6. Id. ↩

  7. Id. ↩

  8. Id. ↩

  9. Id. at 4. ↩

  10. Id. at 3. ↩

  11. Complaints Assisted Form, 22 March 2021, at 5, in GSS v. Global Dominion Financing Inc., NPC 21-064 (NPC 2021). ↩

  12. Order to Comment, 23 June 2021, in GSS v. Global Dominion Financing Inc., NPC 21-064 (NPC 2021). ↩

  13. Respondent’s Verified Comment, 15 July 2021, in GSS v. Global Dominion Financing Inc., NPC 21-064 (NPC 2021). ↩

  14. Id. at 2. ↩

  15. Id. at 3. ↩

  16. Order to Appear for Preliminary Conference, 12 July 2021, in GSS v. Global Dominion Financing Inc., NPC 21-064 (NPC 2021). ↩

  17. Notice of the First Preliminary Conference, 26 August 2021, in GSS v. Global Dominion Financing Inc., NPC 21-064 (NPC 2021). ↩

  18. Order to Mediate, 13 September 2021, in GSS v. Global Dominion Financing Inc., NPC 21-064 (NPC 2021). ↩

  19. Notice of Non-Settlement of Dispute, 29 September 2021, in GSS v. Global Dominion Financing Inc., NPC 21-064 (NPC 2021). ↩

  20. Order, 05 October 2021, in GSS v. Global Dominion Financing Inc., NPC 21-064 (NPC 2021). ↩

  21. Complainant’s Memorandum, 22 October 2021, in GSS v. Global Dominion Financing Inc., NPC 21-064 (NPC 2021). ↩

  22. Id. at 2. ↩

  23. Id. Exhibit F and G. ↩

  24. Id. Exhibit F and G. ↩

  25. Id. at 2. ↩

  26. Id. at 2-3. ↩

  27. Complainant’s Memorandum, 22 October 2021, at 2, in GSS v. Global Dominion Financing Inc., NPC 21-064 (NPC 2021). ↩

  28. Id. at 7. ↩

  29. Id. at 6. ↩

  30. Id. at 6-7. ↩

  31. Id. at 8-9. ↩

  32. Respondent’s Memorandum, 22 October 2021, in GSS v. Global Dominion Financing Inc., NPC 21-064 (NPC 2021). ↩

  33. Id. at 2. ↩

  34. Id. at 3. ↩

  35. Id. Annex A-1. ↩

  36. Id. at 4. ↩

  37. Id. ↩

  38. Id. ↩

  39. National Privacy Commission, 2021 Rules of Procedure of the National Privacy Commission [NPC 2021 Rules of Procedure], rule II, § 2 (28 January 2021). ↩

  40. Id. ↩

  41. Id. ↩

  42. Id. ↩

  43. Id. ↩

  44. KRL v. Trinity University of Asia, CID Case No. 17-K-003, 19 November 2019, at 6, available at https://www.privacy.gov.ph/wp-content/uploads/2020/10/CID-17-K-003-KRL-v-Trinity-Decision-PSD-10Aug2020.pdf (last accessed 23 June 2022). ↩

  45. MRS v. National Conciliation and Mediation Board (NCMB) and Department of Labor and Employment (DOLE), NPC Case No. 18-152, 08 June 2020, at 4, available at https://www.privacy.gov.ph/wp-content/uploads/2020/12/NPC-18-152-MRS-v-NCMB-Pseudonymized-16Dec2020-ADJ1.pdf (last accessed 1 July 2022). ↩

  46. Id. ↩

  47. Id. ↩

  48. Id. ↩

  49. NPC 2021 Rules of Procedure, rule II, § 2. ↩

  50. Id. rule IV, § 1 (3). ↩

  51. See An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  52. Complainant’s Memorandum, 22 October 2021, at 3, in GSS v. Global Dominion Financing Inc., NPC 21-064 (NPC 2021). ↩

  53. Samahan ng mga Progresibong Kabataan v. Quezon City, G.R. No. 225442 (2017). Emphasis Supplied. ↩

  54. Complainant’s Memorandum, Exhibit A-D, 22 October 2021, in GSS v. Global Dominion Financing Inc., NPC 21-064 (NPC 2021). ↩

  55. Id. at 3. ↩

  56. NPC 2021 Rules of Procedure, rule IV, § 1 (4). ↩

  57. Id. ↩

  58. Complainant’s Memorandum, 22 October 2021, at 5-6, in GSS v. Global Dominion Financing Inc., NPC 21-064 (NPC 2021). ↩

  59. Id. Exhibit A-D. ↩

Backlinks