NPC Issuance Wiki

NPC 21-167: MAF v. Shopee Philippines, Inc.

Issued Decision

Decision Text

MAF,

Complainant,

-versus-

SHOPEE PHILIPPINES, INC.,

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before this Commission is a complaint filed by MAF against Shopee Philippines, Inc. (Shopee) for an alleged violation of Section 28 (Processing for an Unauthorized Purpose) and Section 32 (Unauthorized Disclosure) of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

On 12 August 2021, the National Privacy Commission (NPC), through its Complaints and Investigation Division (CID), received MAF’s Complaints-Assisted Form (CAF).1 MAF alleged that on 06 August 2021, “[her] minor child’s picture was used as proof of delivery. The courier service took his picture without his consent and was not told of the purpose.”2 She contended that instead of the rider taking a picture of her son as proof of delivery, “the rider should have at least taken a [picture] of his arm and package or have done the geotagging as said in their guidelines.”3

She claimed that “[w]hen the seller asked for proof of delivery, Shopee forwarded [her] son’s photo to the seller and was sent to [her] as proof of delivery.”4 She also claimed that she requested Shopee “to remove [her] son’s photo out of their system”5 but Shopee refused her request.6

MAF asserted that Shopee violated Section 28 (Processing for an Unauthorized Purpose) and Section 32 (Unauthorized Disclosure) of the DPA.7 MAF also prayed for a fine to be imposed on Shopee and for Shopee to remove her son’s photo and to “include in their guidelines that [under] no circumstance [should] a minor’s picture be taken as proof of delivery.”8

On 02 November 2021, an Order was issued directing Shopee to file a verified comment within fifteen (15) calendar days from receipt of the Order.9 The parties were also ordered to appear virtually for a preliminary conference on 26 January 2022.10

On 17 November 2021, Shopee filed its Verified Comment.11 Shopee contended that when “MAF signed up for an account, she agreed to the Terms of Service and expressly consented to the Privacy Policy.”12 Shopee’s Privacy Policy provides:

  1. INFORMATION ON CHILDREN

9.1 The Services are not intended for children under the age of 13. We do not knowingly collect or maintain any personal data or non-personally-identifiable information from anyone under the age of 13 nor is any part of our Platform or other Services directed to children under the age of 13. As a parent of legal guardian, please do not allow such children under your care to submit personal data to Shopee. In the event that personal data of a child under the age of 13 in your care is disclosed to Shopee, you hereby consent to the processing of the child’s personal data and accept and agree to be bound by this Policy on behalf of such child. We will close any accounts used exclusively by such children and will remove and/or delete any personal data we believe was submitted without parental consent by any child under the age of 13.13

Shopee alleged that on 04 August 2021, the Third-Party Logistics Rider (rider) attempted to deliver the package directly to MAF.14 Shopee claimed that MAF, however, was unavailable to receive the delivery and it was her son who answered the door to receive the package.15

Shopee further alleged that MAF had initially filed a request for refund prior to the delivery of the package on 04 August 2021.16 Shopee claimed that because the seller tagged the Order as “Completed”, MAF reached out to the seller to question the tagging of the Order.17

Shopee stated that the photo was “taken as proof that the package was safely delivered or the status of delivery, for the protection buyers, sellers, and partners, and for audit purposes.”18 Contrary to MAF’s assertions that Shopee provided a copy of the proof of delivery to the seller, Shopee stated that “unlike the buyer, the seller cannot readily access the [proof of delivery].”19

On 16 December 2021, Shopee filed a Manifestation.20 Shopee stated that as of 06 December 2021, it updated its Guidelines to prohibit the taking of a minor’s picture as proof of delivery.21 It added the following statement to the Guidelines: “Packages shall not be delivered to or left with minors except upon the written instructions of the buyer who is the minor’s parent or guardian. Photos of minors shall not be taken under any circumstances.”22

On 26 January 2022, both parties were present at the Preliminary Conference.23 During Discovery Proceedings, MAF requested Shopee to produce its data retention policy. Shopee, on the other hand, requested MAF “to show any document or proof showing that the seller was the one who sent her the picture of her supposed son as proof of delivery” based on the statement MAF made in her CAF.24 MAF clarified that the proof of delivery can be accessed through a link in the Shopee application that directs the Shopee account holder to the picture as proof of delivery.25

MAF manifested during the Preliminary Conference that she will submit additional evidence to counter Shopee’s allegations that she allegedly gave consent to the rider that her son will receive the package.26 Shopee’s counsel moved that Shopee be allowed to comment on the additional evidence of MAF.27 This motion was granted.28

The parties manifested that they are both willing to undergo mediation proceedings. They, however, requested to be allowed to submit the documents and pleadings required before mediation.29

On 26 January 2022, MAF submitted her additional evidence composed of screenshots of the text messages allegedly between her and the rider on 08 November 2021 to prove that she did not give consent to let her son receive the package nor take his photo.30 In the series of text messages, the rider apologized for taking her son’s photo and explained that the reason he took the son’s photo was because it was her son who answered the door when he attempted to deliver the package.31

On 14 February 2022, Shopee filed its Comment/Opposition to the additional evidence submitted by MAF.32 Shopee averred that the 08 November 2021 text exchange should not be admitted for being hearsay under the 2019 Amendments to the 1989 Revised Rules on Evidence (Revised Rules of Evidence).33

On 06 April 2022, the parties failed to reach a settlement.34 As such, a Notice of Non-Settlement of Dispute was issued.35

On 07 April 2022, an Order was issued to resume the proceedings and to direct both parties to submit their respective memoranda.36

On 06 May 2022, MAF submitted her Memorandum.37 MAF stated that she specifically instructed the rider to wait for her so that she can personally receive the delivery.38 She alleged that despite her instructions, the rider delivered the package to the person who answered the door, which was MAF’s son, because he was pressed for time.39 She claimed that her son answered the door because he thought that it was his grandfather who had arrived.40 Thereafter, MAF alleged that the rider gave the package to her son and took his picture without his consent and the photo was then uploaded in the Shopee App as proof of delivery.41

MAF also stated that when she reported the incident to Shopee, she discovered that the rider made “an untruthful narration in his incident report, stating that [the rider] notified [MAF] that a minor is not allowed to receive packages. This did not happen.”42 She alleged that the apology in the text exchange between her and the rider is proof that the rider made untruthful statements in his incident report.43

On 10 May 2022, Shopee submitted its Memorandum.44 Shopee reiterated the facts it narrated in its Verified Comment. Shopee argued that it already complied with MAF’s prayers by deleting the son’s photo in their system and updated its Guidelines that prohibits the taking of a minor’s picture as proof of delivery, thus, making the case moot.45 Hence, Shopee prays for the dismissal of the case.46

Issue

I. Whether Shopee is liable under Section 28 (Processing for an Unauthorized Purpose) of the DPA.

II. Whether Shopee is liable under Section 32 (Unauthorized Disclosure) of the DPA.

III. Whether Shopee violated the general privacy principle of proportionality.

Discussion

Shopee, as the Personal Information Controller (PIC), is responsible for the actions of the Personal Information Processor (PIP), the Third-Party Logistics Provider and consequently, its rider. Section 21 of the DPA discusses the principle of accountability:

Section 21. Principle of Accountability. Each personal information controller is responsible for personal information under its control or custody, including information that have been transferred to a third party for processing, whether domestically or internationally, subject to cross-border arrangement and cooperation.

(a) The personal information controller is accountable for complying with the requirements of this Act and shall use contractual or other reasonable means to provide a comparable level of protection while the information are being processed by a third party.47

While Shopee, as the PIC, subcontracted the processing of personal information to the Third-Party Logistics Provider, its PIP, Shopee remains responsible for the Third-Party Logistics Provider’s actions following the principle of accountability. This includes the processing of the photo as proof of delivery.

Nevertheless, Shopee is not liable under Section 28 (Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes) of the DPA and Section 32 (Unauthorized Disclosure) of the DPA. Shopee, however, violated the general privacy principle of proportionality.

I. Shopee is not liable under Section 28 (Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes) of the DPA.

MAF alleged that Shopee is liable for violation of Section 28 of the DPA when Shopee processed a photo of her son as proof of delivery when the rider delivered the package to MAF’s residence. Section 28 (a) of the DPA provides:

Section. 28. Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes. (a) the processing of personal information for unauthorized purposes shall be penalized by imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00) shall be imposed on persons processing personal information for purposes not authorized by the data subject, or otherwise authorized under this Act or under existing laws.48

To be held liable under Section 28 or the Processing of Personal or Sensitive Personal Information for Unauthorized Purposes, the following requisites must concur:

  1. A person processed information of the data subject;
  2. The information processed is classified as personal or sensitive personal information;
  3. The person processing the information obtained consent of the data subject or is granted authority under the DPA or existing laws; and
  4. The processing of personal or sensitive personal information is for a purpose that is neither covered by the authority given by the data subject and could not have been reasonably foreseen by the data subject nor otherwise authorized by the DPA or existing laws.49

The first three (3) requisites are present in this case.

On the first and second requisites, there is no question that Shopee, as the PIC, processed the son’s personal information. Section 3 of the DPA defines personal information and processing as follows:

Section 3. Definition of Terms. Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

(g) Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.

…

(j) Processing refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.50

Without doubt, a photo is personal information because the identity of an individual, MAF’s son, is apparent. Processing of personal information occurred when the rider took the photo of MAF’s son and uploaded the photo as proof of delivery in the Shopee platform. Thus, the first and second requisites are present.

The third requisite is also present in this case. Shopee processed personal information according to a lawful criterion under Section 12 of the DPA. Section 12 of the DPA allows for the processing of personal information when it is necessary for the purposes of the legitimate interests pursued by the PIC:

Section. 12. Criteria for Lawful Processing of Personal Information. The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

…

(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.51

Processing based on legitimate interest requires the fulfillment of the following conditions: (1) the legitimate interest is established; (2) the processing is necessary to fulfil the legitimate interest that is established; and (3) the interest is legitimate or lawful and it does not override fundamental rights and freedoms of data subjects.52

Shopee had legitimate interest to process the photo as proof of delivery. Shopee’s Terms of Service provides that it “acts as an intermediary that brings together the Seller and the Buyer.”53 As such, “[it] is responsible for facilitating reports/ complaints from [b]uyers if the [b]uyer has not received the product within the estimated timeframe.”54 To effectively do so, it is necessary for Shopee to secure proof by taking a photo that proves that the package has been delivered to the buyer, as explained in its Verified Comment:

  1. The POD plays a crucial role in the confirmation of delivery for the consummation of the sale transactions through the Shopee App.

47.1. It is only upon receiving confirmation from the buyer and clicking “Order Received” in the Shopee App that Shopee releases the amount to be paid to the sellers. Otherwise, the seller will have to wait for a certain period from actual delivery, without getting any complaint, before receiving payments. Prior to confirmation or the lapse of the foregoing period, the seller will not receive the buyer’s payment, thereby preventing the consummation of the sale transaction between the buyers and sellers using the Shopee App.

47.2. If there are any issues relating to delivery of the orders made through the Shopee App, the buyer should not click “Order Received”, which suspends the release of payment to the seller. The POD is one of the means in resolving issues relating to deliveries of such orders, and taken for the protection of both the buyer and the seller (i.e. processing refunds for incomplete or wrong orders), as well as the Company, 3PL service providers and their respective service providers (i.e. mis-delivery or non-delivery). Said photos are used as evidence in case of issues relating to the delivery and receipt of the items ordered via the Shopee App.55

There is legitimate interest in taking a photo as proof of delivery as is necessary in this case. Thus, the third requisite is present.

The fourth requisite, however, is lacking in this case. MAF could have reasonably foreseen that the processing is for a purpose that is necessary and related to Shopee’s legitimate interest. In fact, it was MAF herself who filed for a refund because of a missing item on her order. A complaint for incomplete or wrong orders necessarily gives rise to a review of the proof of delivery of the package for the buyer, seller, and Shopee to resolve the issue. Thus, MAF cannot claim that the proof of delivery was processed for an unauthorized purpose.

Given the absence of the fourth requisite, Shopee is not liable under Section 28 (Processing of Personal or Sensitive Personal Information for Unauthorized Purposes) of the DPA.

II. Shopee is not liable under Section 32 (Unauthorized Disclosure) of the DPA.

MAF alleged that Shopee committed Unauthorized Disclosure under Section 32 of the DPA when Shopee disclosed her son’s photo as proof of delivery to the seller. Section 32 (a) of the DPA provides:

Section. 32. Unauthorized Disclosure. (a) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party personal information not covered by the immediately preceding section without the consent of the data subject, shall he subject to imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).56

The Commission has previously explained that a strict and literal reading of Section 32 of the DPA will result in absurdity:

A strict and literal reading of Section 32 of the DPA on Unauthorized Disclosure shows that a personal information controller (PIC) or personal information processor (PIP) is liable if it discloses to a third party personal information without the consent of the data subject. Such reading, however, will result in absurdity since it penalizes a PIC or a PIP if the disclosure is without the consent of the data subject even if such disclosure is justified under some other criteria for lawful processing in Sections 12 and 13 of the DPA.57

The rules of statutory construction provide that:

Where a literal meaning would lead to absurdity, contradiction, or injustice, or otherwise defeat the clear purpose of the lawmakers, the spirit and reason of the statute may be examined to determine the true intention of the provision.58

Given this, Section 32 of the DPA must be read together with other provisions of the DPA:

A law must not be read in truncated parts; its provisions must be read in relation to the whole law. It is the cardinal rule in statutory construction that a statute’s clauses and phrases must not be taken as detached and isolated expressions, but the whole and every part thereof must be considered in fixing the meaning of any of its parts in order to produce a harmonious whole. Every part of the statute must be interpreted with reference to the context, i.e., that every part of the statute must be considered together with other parts of the statute and kept subservient to the general intent of the whole enactment.59

Thus, Unauthorized Disclosure is committed when:

[T]he perpetrator processes personal information without any of the lawful basis for processing under Sections 12 and 13 of the DPA. The interpretation is in line with the principle that “when two or more interpretations are possible, that interpretation which is favorable or beneficial to the accused must be adopted.” It benefits the accused since it narrows the extent to which the disclosure of personal information may be considered as Unauthorized Disclosure.60

Unauthorized Disclosure under Section 32 requires that personal information or sensitive personal information is disclosed to a third party without any of the lawful criteria under Sections 12 and 13, as applicable.61

Here, MAF claimed that Shopee, as the PIC that acted through its PIP, allegedly disclosed personal information to the seller, a third party, without her consent.

As previously discussed, Shopee, through its PIP, processed the photo because it was necessary for its legitimate interest. Consent is not the only the lawful basis for processing personal information. Aside from consent, processing of personal information is allowed when the disclosure is done under one of the lawful criteria for processing in Section 12 of the DPA.62

Further, the seller is not considered a third party to the online shopping transaction. As previously stated, Shopee “acts as an intermediary that brings together the Seller and the Buyer.”63 The parties to the sale remain the buyer and the seller. Thus, the supposed disclosure of Shopee to the seller of the photo as proof of delivery cannot be considered as Unauthorized Disclosure under Section 32 of the DPA.

III. Shopee violated the general privacy principle of proportionality.

Shopee violated the proportionality principle when the PIP’s rider took the photo as proof of delivery. The general privacy principle of proportionality requires that the processing is adequate, relevant, suitable, and necessary processing that is not excessive in relation to the declared and specified purpose.

Section 11 of the DPA provides principles that rest on proportionality:

Section 11. General Data Privacy Principles. The processing of personal information shall be allowed, subject to compliance with the requirements of this Act and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.

Personal information must, be:

…

(c) Accurate, relevant and, where necessary for purposes for which it is to be used the processing of personal information, kept up to date; inaccurate or incomplete data must be rectified, supplemented, destroyed or their further processing restricted;

(d) Adequate and not excessive in relation to the purposes for which they are collected and processed.64

Section 18 of the Implementing Rules and Regulations of the DPA (IRR) elaborates on proportionality:

Section 18. Principles of Transparency, Legitimate Purpose and Proportionality. The processing of personal data shall be allowed subject to adherence to the principles of transparency, legitimate purpose, and proportionality.

…

c. Proportionality. The processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.65

Given this, processing is deemed proportional when (1) processing is adequate, relevant, and necessary to the declared and specified purpose; and (2) the means by which processing is performed is the least intrusive means available.66

In this case, Shopee’s act of taking the son’s photo as proof of delivery is disproportional to the declared and specified purpose. The act of taking the son’s photo is not necessary to the declared and specified purpose and the means is not the least intrusive means available. Shopee could have fulfilled the declared and specified purpose of securing proof of delivery with less intrusive means such as by taking a picture of an arm with the package.

In fact, Shopee’s Privacy Guidelines for Shipments and Delivery provides that an arm of recipient and package, or house and package is sufficient in cases where the recipient of the package does not consent to his photo being taken. It states:

Manner of Collection

Consent is an essential element for taking the delivery photo. Before taking a delivery photo of the Customer/Recipient/Data Subject with the parcel, a consent from the Customer/Recipient/Data Subject should always be secured by the 3PL Rider.

In the event the Customer/Recipient/Data Subject refuses the above, the 3PL rider will request for the consent of the Customer/Recipient/Data Subject to capture proof of the following:

a. An arm of Recipient and package or; b. House and parcel

In every instance, the delivery photo will focus on the placement of the package.67

Here, Shopee violated its own Guidelines when it took the photo of the son as proof of delivery. Shopee could have instead taken a photo of the son’s arm and package, or house and package as its proof of delivery.

Further, Shopee mishandled the situation when MAF exercised her son’s data subject rights. MAF exercised her son’s right to have the photo removed when she initiated the “Live Chat” with a Customer Service (CS) Agent in the Shopee App and demanded that her son’s photo be removed. Although the CS Agent tried to file a request, it was not immediately acted upon because the son’s photo was used as the proof of delivery.68 The CS Agent merely informed MAF that “[u]sers were advised that this was a standard procedure to take photos for proof of delivery” and provided MAF with a link to Shopee’s Privacy Guidelines for Shipments and Delivery.69

Shopee was remiss in its obligation as a PIC. As a PIC, it should have complied with the principle of proportionality under Section 11 (c) and (d) of the DPA. Although Shopee outsourced the delivery and consequently, securing proof of delivery to its PIP, it remains responsible for the PIP’s actions following the principle of accountability. Nonetheless, Shopee’s actions are insufficient to warrant a recommendation for its prosecution since the processing of personal information is still based on a lawful basis to process under Section 12 (f) of the DPA.

Shopee’s actions, however, is sufficient to warrant an award of nominal damages.

Nominal damages are awarded in order to vindicate or recognize the complainant’s right that was violated by the respondent even if no actual loss was shown.70 The relevant provision in the New Civil Code, which governs the restitution of any party aggrieved in relation to the DPA, states:

Art. 2221. Nominal damages are adjudicated in order that a right of the plaintiff, which has been violated or invaded by the defendant, may be vindicated or recognized, and not for the purpose of indemnifying the plaintiff for any loss suffered by him.

The Supreme Court explained that no actual present loss is required to warrant the award of nominal damages:

Nominal damages are recoverable where a legal right is technically violated and must be vindicated against an invasion that has produced no actual present loss of any kind or where there has been a breach of contract and no substantial injury or actual damages whatsoever have been or can be shown.71

The DPA does not require actual or monetary damages for data subjects to exercise the right to damages.72 Shopee’s violation of the proportionality principle and the mishandling of the situation when MAF exercised the son’s right to be removed from Shopee’s system, are sufficient to award nominal damages.

WHEREFORE, premises considered, the Commission resolves to DISMISS the Complaint of MAF against Shopee Philippines, Inc. The Commission AWARDS nominal damages, in the amount of Fifteen Thousand Pesos (Php 15,000.00), to MAF for Shopee Philippines, Inc.’s violation the general privacy principle of proportionality.

This is without prejudice to the filing of appropriate civil, criminal or administrative cases against Shopee Philippines, Inc. before any other forum or tribunal, if any.

SO ORDERED.

City of Pasay, Philippines.

22 September 2022.

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

I CONCUR:

JOHN HENRY D. NAGA

Privacy Commissioner

Copy furnished:

MAF

Complainant

SHOPEE PHILIPPINES, INC.

Respondent

MARTINEZ VERGARA GONZALEZ & SERRANO (MVGS) LAW FIRM

Counsel for Respondent

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Complaints Assisted Form, 12 August 2021, in MAF v. Shopee Philippines, Inc. NPC 21-167 (NPC 2021). ↩

  2. Id. at 3. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. at 4. ↩

  6. Id. ↩

  7. Complaints Assisted Form, 12 August 2021, at 3, in MAF v. Shopee Philippines, Inc. NPC 21-167 (NPC 2021). ↩

  8. Id. at 5. ↩

  9. Order, 02 November 2021, in MAF v. Shopee Philippines, Inc. NPC 21-167 (NPC 2021). ↩

  10. Id. ↩

  11. Respondent’s Verified Comment, 17 November 2021, in MAF v. Shopee Philippines, Inc. NPC 21-167 (NPC 2021). ↩

  12. Id. at 3. ↩

  13. Id. at 4. ↩

  14. Id. at 5. ↩

  15. Id. ↩

  16. Id. at 6. ↩

  17. Respondent’s Verified Comment, 17 November 2021, at 6, in MAF v. Shopee Philippines, Inc. NPC 21-167 (NPC 2021). ↩

  18. Id. at 5. ↩

  19. Id. at 6. ↩

  20. Respondent’s Manifestation, 16 December 2021, at 1, in MAF v. Shopee Philippines, Inc. NPC 21-167 (NPC 2021). ↩

  21. Id. ↩

  22. Id. at 1-2. ↩

  23. Order After 1st Preliminary Conference, 26 January 2022, in MAF v. Shopee Philippines, Inc. NPC 21-167 (NPC 2022). ↩

  24. Id. ↩

  25. Id. ↩

  26. Id. ↩

  27. Id. ↩

  28. Order After 1st Preliminary Conference, 26 January 2022, in MAF v. Shopee Philippines, Inc. NPC 21-167 (NPC 2022). ↩

  29. Id. ↩

  30. Complainant’s Additional Evidence, 26 January 2022, in MAF v. Shopee Philippines, Inc. NPC 21-167 (NPC 2022). ↩

  31. Id. ↩

  32. Respondent’s Comment/Opposition, 14 February 2022, in MAF v. Shopee Philippines, Inc. NPC 21-167 (NPC 2022). ↩

  33. Id. ↩

  34. Notice of Non-settlement of Dispute, 06 April 2022, in MAF v. Shopee Philippines, Inc. NPC 21-167 (NPC 2022). ↩

  35. Id. ↩

  36. Order, 07 April 2022, in MAF v. Shopee Philippines, Inc. NPC 21-167 (NPC 2022). ↩

  37. Complainant’s Memorandum, 06 May 2022, in MAF v. Shopee Philippines, Inc. NPC 21-167 (NPC 2022). ↩

  38. Id. at 1. ↩

  39. Id. ↩

  40. Id. at 2. ↩

  41. Id. ↩

  42. Id. ↩

  43. Id. at 2. ↩

  44. Respondent’s Memorandum, 10 May 2022, in MAF v. Shopee Philippines, Inc. NPC 21-167 (NPC 2022). ↩

  45. Id. ↩

  46. Id. ↩

  47. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 § 21 (2012). Emphasis supplied. ↩

  48. Data Privacy Act of 2012, § 28 (a). Emphasis supplied. ↩

  49. NPC 19-142, 31 March 2022, at 12-13 (NPC 2022) (unreported). ↩

  50. Data Privacy Act of 2012, § 3 (g) & (j). ↩

  51. Data Privacy Act of 2012, § 12 (f). Emphasis supplied. ↩

  52. See Data Privacy Act of 2012, § 12 (f). ↩

  53. Respondent’s Memorandum, 10 May 2022, at 24, in MAF v. Shopee Philippines, Inc. NPC 21-167 (NPC 2022). ↩

  54. Id. ↩

  55. Id. ↩

  56. Data Privacy Act of 2012, § 32 (a). ↩

  57. NPC 19-134, 10 December 2021 (NPC 2021) (unreported). ↩

  58. Metropolitan Bank and Trust Co. v. Liberty Corrugated Boxes Manufacturing Corp., G.R. No.184317 (2017). ↩

  59. Fort Bonifacio Development Corp. v. Commissioner of Internal Revenue, G.R. Nos. 158885 & 170680 (Resolution) (2009). ↩

  60. NPC 21-032, 16 May 2022 (NPC 2022) (unreported). ↩

  61. NPC 21-010, 03 February 2022 (NPC 2022) (unreported). ↩

  62. Data Privacy Act of 2012, § 12. ↩

  63. Respondent’s Memorandum, 10 May 2022, at 24, in MAF v. Shopee Philippines, Inc. NPC 21-167 (NPC 2022). ↩

  64. Data Privacy Act of 2012, § 11. Emphasis supplied. ↩

  65. National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, rule IV, § 18 (c) (2016). ↩

  66. See Rules and Regulations Implementing the Data Privacy Act of 2012, rule IV, § 18 (c). ↩

  67. Id. ↩

  68. Complainant’s Memorandum, 06 May 2022, at 25, in MAF v. Shopee Philippines, Inc. NPC 21-167 (NPC 2022). ↩

  69. Id. at 20-21. ↩

  70. An Act to Ordain and Institute the Civil Code of the Philippines [CIVIL CODE], Republic Act No. 386, art. 2221 (1949). ↩

  71. Seven Brothers Shipping Corporation v. DMC-Construction Resources, Inc. G.R. No. 193914, November 26, 2014. ↩

  72. NPC 18-038, 21 May 2020 (NPC 2020) (unreported). ↩

Backlinks