NPC Issuance Wiki

NPC 21-086: RTB v. East West Banking Corporation

Issued Decision

Decision Text

RTB,

Complainant,

-versus-

EAST WEST BANKING CORPORATION,

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before this Commission is a Complaint filed by RTB against East West Banking Corporation (EWBC) for an alleged disclosure of his personal information without a lawful basis under the Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA).

Facts

On 25 July 2017, RTB applied for a car loan with Philippine Bank of Communications (PBComm). He executed a Promissory Note with Chattel Mortgage with PBComm.1

On 25 June 2019, EWBC and PBComm entered into a Deed of Assignment where PBComm assigned and transferred several mortgage amortized loan accounts to EWBC.2 RTB’s loan account and the rights and obligations accruing to PBComm was included in the assignment.3

In November 2020, RTB furnished EWBC with several post-dated checks for the payment of his loan.4

In December 2020, EWBC’s system tagged RTB’s loan account as past due despite RTB’s submission of post-dated checks.5 EWBC then referred the matter to its third-party collection agency which resulted in RTB’s harassment in the form of misleading phone calls and attempts to take away his car.6

Sometime in January 2021, RTB brought the issue to EWBC’s attention and stated that his loan account is current since he submitted the necessary post-dated checks for the payment of the loan.7

EWBC conducted an internal investigation and determined that its branch personnel inadvertently failed to deposit RTB’s post-dated check designated for the payment due on 28 December 2020.8 EWBC’s inaction resulted in the system’s classification of RTB’s account as past due and consequently, the referral of the account to its third-party collection agency for collection.9

On 25 May 2021, RTB filed a Complaint dated 14 May 2021 against EWBC.10 He alleges that EWBC processed and disclosed his personal information to third-party collection agents.11 He argues that EWBC violated Section 25 (Unauthorized Processing), Section 26 (Access due to Negligence), Section 28 (Processing for Unauthorized Purpose), and Section 32 (Unauthorized Disclosure) of the DPA.12 He prays for damages, issuance of a fine against EWBC, and a waiver of the outstanding balance of the car loan.13

On 24 June 2021, the Commission issued an Order directing EWBC to file a verified comment within fifteen (15) calendar days from receipt of this Order.14

In EWBC’s Comment dated 28 July 2021, it maintains that RTB consented to the sharing of his personal information with third parties when he entered into the car loan.15 EWBC explained that RTB signed a Promissory Note with Chattel Mortgage with PBComm and agreed to the Terms and Conditions of the car loan. The relevant provision of the Terms and Conditions states:

  1. The MORTGAGEE may appoint or designate a representative, agent, attorney-in-fact, or upon written notice, a collection agency to perform any and all acts which may be required or necessary to enforce MORTGAGEE’S right. For such purpose, the MORTGAGOR hereby gives his consent as to the disclosure of all relative information in connection with the subject loan or his account to such authorized representative, agent or attorney-in-fact and agrees to hold PBComm free and harmless against any and all damages, cost, or liability arising from such disclosure.16

Given the foregoing, EWBC argues that it is within its authority to share RTB’s loan account with its third-party collection agency. EWBC prays for the dismissal of the case.17

On 06 October 2021, the parties conferred for mediation but failed to reach a settlement.18 On 03 November 2021, the Commission issued an Order for the resumption of complaint proceedings and ordered the parties to submit their respective Memoranda within fifteen (15) calendar days from receipt of the Order.19

On 15 November 2021, RTB, by email, reiterated the arguments he raised in his Complaint.20 He maintained that EWBC should have exercised, as expected from banks, extraordinary diligence in handling his loan account.21 EWBC, however, failed to do so and forwarded his personal information to its third-party collection agent even if he submitted the necessary post-dated checks for payment of his car loan.22 He alleged that EWBC’s carelessness resulted in “scandalous situations” in his neighborhood thus, besmirching his reputation.23

On 13 December 2021, EWBC filed its Memorandum.24 It reiterated that RTB executed a Promissory Note with Chattel Mortgage with PBComm and consequently, agreed to the Terms and Conditions of the car loan.25 It stated that it should not be held liable for damages since the collecting personnel conducting the standard collection efforts acted in good faith.26 Contrary to RTB’s assertions, neither unnecessary harassment nor public humiliation occurred.27 Thus, EWBC prays for the dismissal of the case.28

Issue

Whether EWBC has a lawful basis to process RTB’s personal information, particularly the referral of RTB’s loan account to its third-party collection agency.

Discussion

EWBC has lawful basis to process RTB’s personal information under Section 12 (b) of the DPA, which provides:

Section 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

…

(b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract;29

In this case, RTB executed a Promissory Note with Chattel Mortgage for his car loan. The Promissory Note with Chattel Mortgage includes a set of Terms and Conditions, which RTB also agreed to.

Although RTB initially entered into a loan agreement with PBComm, the loan contract was assigned to EWBC pursuant to a Deed of Assignment between PBComm and EWBC.

As stated in Section 29 of the Terms and Conditions of the loan agreement, EWBC, as the mortgagee, may designate a collection agency to perform acts necessary to enforce its right, including debt collection. Section 29 of the Terms and Conditions provides:

  1. The MORTGAGEE may appoint or designate a representative, agent, attorney-in-fact, or upon written notice, a collection agency to perform any and all acts which may be required or necessary to enforce MORTGAGEE’S right. For such purpose, the MORTGAGOR hereby gives his consent as to the disclosure of all relative information in connection with the subject loan or his account to such authorized representative, agent or attorney-in-fact and agrees to hold PBComm free and harmless against any and all damages, cost, or liability arising from such disclosure.30

For this reason, EWBC’s act of processing RTB’s personal information is necessary and related to the fulfillment of a contract, which is a lawful basis for processing under Section 12 (b) of the DPA.

The existence of a lawful basis to process personal information must be properly applied based on the factual conditions of the case. Here, EWBC was remiss in its obligation as a Personal Information Controller (PIC) despite the lawful criterion to process based on the fulfillment of a contract. More so, it failed to exercise extraordinary diligence as is expected from a banking institution.31

Section 11 of the DPA requires PICs, such as EWBC, to ensure that the personal information of the data subject is kept up to date:

Section 11. General Data Privacy Principles. The processing of personal information shall be allowed, subject to compliance with the requirements of this Act and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.

Personal information must, be:

…

(c) Accurate, relevant and, where necessary for purposes for which it is to be used the processing of personal information, kept up to date; inaccurate or incomplete data must be rectified, supplemented, destroyed or their further processing restricted;32

As a PIC, EWBC should have complied with its obligation under Section 11 (c) of the DPA and practiced proper record-keeping. Corollary to this, it should have been mindful of the corresponding deposit dates of the post-dated checks that RTB submitted. Its inadvertence to deposit a post-dated check on the designated date resulted in the unnecessary disclosure of RTB’s personal information to EWBC’s third-party collection agency.

EWBC also failed to strictly comply with the provisions of Section 29 of the Terms and Conditions attached to the Promissory Note with Chattel Mortgage when it did not provide RTB a written notice of its intention to designate a third-party collection agency to conduct debt collection.

EWBC was sorely remiss in its duty to exercise the diligence required from it as a banking institution. Had EWBC complied with its obligations under Section 11 (c) of the DPA and the loan contract, then it would not have unnecessarily disclosed RTB’s personal information.

Nonetheless, EWBC’s carelessness is insufficient to warrant a recommendation for its prosecution. After all, EWBC’s processing of RTB’s personal information is still based on a lawful basis to process under Section 12 (b) of the DPA.

EWBC’s actions and consequently, the third-party collection agency’s inaccurate use of RTB’s personal information, however, justify an award of nominal damages. Section 16 (f) of the DPA provides:

Section 16. Rights of the Data Subject. The data subject is entitled to:

…

(f) Be indemnified for any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information;33

Indeed, it is part of the Commission’s mandate to award indemnity on matters affecting any personal information.34 The DPA does not require actual or monetary damages for data subjects to exercise the right to damages.35 As provided in the law, the consequences of processing inaccurate information are enough for the right to arise.36

WHEREFORE, premises considered, the Commission resolves to DISMISS the Complaint of RTB against East West Banking Corporation (EWBC). The Commission AWARDS nominal damages, in the amount of Fifteen Thousand Pesos (P15,000.00), to RTB for EWBC’s failure to fulfill its obligation as a Personal Information Controller under Section 11 (c) of the Data Privacy Act of 2012. EWBC is ORDERED to submit its compliance within fifteen (15) days from receipt of this Decision.

SO ORDERED.

Pasay City, Philippines.

03 February 2022.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

I CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

Copy furnished:

RTB

Complainant

ONA PAMFILO & BUBAN LAW OFFICES

Counsel for East West Banking Corporation

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

National Privacy Commission

Footnotes

  1. Memorandum, 13 December 2021, at 2, in RTB v. East West Banking Corporation, NPC 21-086 (NPC 2021). ↩

  2. Id. at 3. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. ↩

  6. Id. ↩

  7. Complaints-Assisted Form, 25 May 2021, Annex A, in RTB v. East West Banking Corporation, NPC 21-086 (NPC 2021). ↩

  8. Memorandum, 13 December 2021, at 3, in RTB v. East West Banking Corporation, NPC 21-086 (NPC 2021). ↩

  9. Id. ↩

  10. Complaints-Assisted Form, 25 May 2021, in RTB v. East West Banking Corporation, NPC 21-086 (NPC 2021). ↩

  11. Id. at 4. ↩

  12. Id. at 3. ↩

  13. Id. at 5. ↩

  14. Order to Comment, 24 June 2021, in RTB v. East West Banking Corporation, NPC 21-086 (NPC 2021). ↩

  15. Comment (To Complaint dated 14 May 2021), 28 July 2021, at 3, in RTB v. East West Banking Corporation, NPC 21-086 (NPC 2021). ↩

  16. Id. at 7. ↩

  17. Id. at 7. ↩

  18. Order to Mediate, 15 September 2021, in RTB v. East West Banking Corporation, NPC 21-086 (NPC 2021). ↩

  19. Order to Mediate, 03 November 2021, in RTB v. East West Banking Corporation, NPC 21-086 (NPC 2021). ↩

  20. Email from RTB to Complaints and Investigation Division, National Privacy Commission (15 November 2021). ↩

  21. Id. ↩

  22. Id. ↩

  23. Id. ↩

  24. Memorandum, 13 December 2021, in RTB v. East West Banking Corporation, NPC 21-086 (NPC 2021). ↩

  25. Id. at 8. ↩

  26. Id. at 10. ↩

  27. Id. ↩

  28. Id. at 11. ↩

  29. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act No.10173 § 12 (b) (2012). ↩

  30. Comment (To Complaint dated 14 May 2021), 28 July 2021, at 3, in RTB v. East West Banking Corporation, NPC 21-086 (NPC 2021). ↩

  31. Banta v. Equitable Bank, Inc., et al., G.R. No. 223694 (2021). ↩

  32. Data Privacy Act of 2012, § 11 (c). ↩

  33. Id. § 16 (f). ↩

  34. Data Privacy Act of 2012, § 7 (b). ↩

  35. NPC 18-038, 21 May 2020 (NPC 2020) (unreported). ↩

  36. Id. ↩

Backlinks