NPC Issuance Wiki

NPC 22-006: MDT vs. BDO Unibank, Inc.

Issued Decision

Decision Text

MDT,

Complainant,

-versus-

BDO UNIBANK, INC.,

Respondent.

x----------------------------------------------------x

NAGA, P.C.;

Before this Commission is a Complaint filed by MDT against BDO Unibank, Inc. (BDO) for alleged violations of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

On 21 January 2022, MDT filed his Complaints-Assisted Form (CAF) dated 20 January 2022.1 In his CAF, he alleged that he received a phone call from JAC JAC (Caller) on 04 November 2021 who introduced himself as someone from BDO.2 MDT stated:

He asked if my name is MDT. After I replied “yes”, [JAC] said there is an upgrade on my credit card and the scammer gave my earned points and he promised a PHP 5,000 – Lazada voucher for the upgrade. The scammer then said my credit limit now of ₱200,000.00 will be increase (sic) to Php 250,000. To mail the Lazada voucher, the scammer then asked me if my address is *****. I replied “yes”. The scammer said he will block my credit card and he will issue a new card. The scammer then asked if my credit card number is -xxxx-xxxx-. I replied “yes”. The scammer then asked for the expiration date and the CV number, which I gave to him.3

MDT alleged that based on the phone call, the caller knew his complete name, phone number, address, credit card limit, and credit card number.4 Further, he alleged that only BDO has access to these private information.5 MDT concluded that the caller had access to his private information, and consequently realized that he was scammed with a total amount of eighty-three thousand and twenty-eight pesos (Php 83,028.00).6

To support his claim, MDT attached his two Bangko Sentral ng Pilipinas (BSP) complaints dated 02 December 2021 and 12 January 2022 respectively which narrated the sequence of events of the incident.7 MDT also attached in his CAF the screenshot of the transaction confirmation8 received from BDO-Alert with Shopee Philippines Inc. amounting to eighty-three thousand and twenty-eight pesos (Php 83,028.00) as reflected in MDT’s statement of account dated 25 November 2021.9

Thus, MDT prayed for a reversal of the sum of money charged in his credit card amounting to eighty-three thousand and twenty-eight pesos (Php 83,028.00) as well as all the charges in relation to the fraudulent transaction.10 MDT also prayed for the Commission to find BDO to have violated Sections 26 and 32 of the DPA.11

On 11 February 2022, BDO was ordered by the Commission, through its Complaints and Investigation Division (CID), to file its Verified Comment.12 The same Order also ordered the parties to appear for a preliminary conference on 25 May 2022 and 22 June 2022 via Microsoft Teams.13

On 23 February 2022, BDO filed its Verified Comment dated 21 February 2022 praying that the complaint be dismissed with prejudice for lack of merit.14

In the Verified Comment, BDO denied MDT’s request to cancel the transaction because it was processed and validated using a one-time password (OTP) sent to his mobile number, which had an advisory not to share it with anyone.15 In a letter addressed to MDT, BDO alleged that they could not cancel the transaction because it was processed and validated using the OTP sent to him.16 It further stated that there is nothing in the complaint to prove that BDO was the party liable for the disclosure of the personal information to the caller.17

Further, BDO argued that it did not commit any violation of the DPA since there was no unlawful disclosure of any information, and no unauthorized processing and accessing since it was MDT who provided all the confirmation of his personal information to the caller.18 BDO also averred that MDT failed to state a cause of action in supporting his allegation of breach of data privacy against the former.19 Moreover, BDO alleged that there is no intervention or participation on its part with regard to the confirmation of personal information that warrants the dismissal of the complaint, thus:

xxx

Complainant’s confession to the existence of fraud, and voluntarily confirming his personal information to the caller, without intervention or participation on the part of the Bank whatsoever, warrant the dismissal of present complaint against BDO as there is clearly no breach of data privacy committed by the Bank. Complainant clearly responded to phishing, and even provided the expiration date and CVV of his credit card that allowed the questioned transaction to proceed.20

On 02 March 2022, CID issued an Order dated 01 March 2022, noting the Verified Comment submitted by BDO.21

On 07 March 2022, MDT filed his Reply dated 05 March 2022 to the Verified Comment dated 21 February 2022.22

In his Reply, MDT repeatedly argued that the caller JAC knew his phone number, complete name, credit card number and limit, and his address which are considered his personal data.23

MDT further argued that BDO failed to protect and safeguard his personal data.24 Thus, MDT stated that his personal data that were provided to BDO was unlawfully accessed and used by the caller to make him believe that the caller was from BDO.25

In addition, MDT stated that BDO only made an investigation on the validity of the transaction and not the fraud that involves breach of data privacy.26 He questioned BDO on how the caller had access to his personal data and why its customer service representatives are not trained to analyze possible violation of breach of personal data.27

Furthermore, MDT argued that there is no phishing or vishing involved since the caller knew his personal data, and he merely confirmed the information provided by the caller.28 He also stated that there is a cause of action due to the “unlawful access and fraudulent misuse of the personal data” of MDT.29 Based on his submissions, MDT maintained that “there was an act or omission on the part of [BDO] … to ensure appropriate privacy and security safeguard on [MDT’s] personal data.”30

Thus, MDT prayed a judgment in his favor, asking the Commission to order BDO to reverse the charged amount and all the finance charges associated with the subject transaction.31 MDT also prayed for the Commission to order BDO the payment of attorney’s and appearance fees, and to impose applicable penalties against BDO provided in Sections 26 and 32 of the DPA.32

On 11 March 2022, CID issued an Order noting the reply filed by MDT.33

On 25 May 2022, CID issued an Order after the first preliminary conference wherein both MDT and BDO were represented and assisted by their counsels, MTD and ABA, respectively.34

In the said Order, it was stated that during the discovery proceedings, MDT required the production of the phone call records made on 04 November 2021 at 05:54 P.M., 04 November 2021 at 10:40 PM, and 05 November 2021 at approximately 04:00 P.M. by Capas, Tarlac Waltermart BDO Branch, to the respondent.35

BDO manifested that if the phone calls were made through a landline, the recording might not be available; otherwise, a recording might have been made if it was made through a hotline number.36 MDT reiterated that a confirmation number was provided for the 05 November 2021 phone call.37

During the first preliminary conference, MDT manifested that the caller who called MDT, pretended to be from BDO which was denied by BDO and stated that MDT must prove this fact.38

MDT also manifested that the caller confirmed his name and address, but BDO denied having any personal knowledge of the manifested fact.39 As to the Shopee transaction charged to the BDO credit card of MDT amounting to eighty-three thousand and twenty-eight pesos (Php 83,028.00) and that MDT replied to the BDO alert, it was admitted by the Respondent Counsel.40

Additionally, MDT manifested that the phone calls shall be discussed one by one to simplify the facts while BDO stated that these phone calls will be verified first to see if these were recorded in the BDO’s system. Further, MDT made a stipulation stating that the caller has provided the credit card number and limit.41 The stipulation was denied by BDO since it was not a privy to the said conversation between the caller and MDT.42

BDO manifested that MDT has provided the expiration date, and CVV number of his credit card to the caller and MDT has the physical possession of his credit card.43 These manifestations were admitted by MDT.44

BDO also manifested that the OTP was sent to MDT which he disclosed to the caller.45 MDT admitted such manifestation with qualification that “the caller asked the 6-digit number in his phone in order to process the Lazada voucher” and while he was on the phone call with the caller, another phone call came in from another number of BDO, asking for a confirmation of the Shopee transaction in which he denied and he was assured that his credit card will be blocked.46

On 22 June 2022, an Order after the 2nd Preliminary Conference was issued by the CID.47 In the same Order, for the continuation of stipulation of facts, BDO admitted the existence of two phone calls on 04 November 2021 with MDT and on the same date the subject credit card was blocked and the transaction was still pending.48 However, BDO denied the existence of the phone call made on 05 November 2021 by BDO Capas, Tarlac, Waltermart branch for lack of record.49 In response, MDT “questioned the essence of the confirmation number given to him via the 05 November 2021 telephone call.”50 Thus, BDO was ordered by the CID to submit compliance with regard to the verification of the nature of the confirmation number provided in the 05 November 2021 phone call.51

On 28 June 2022, CID issued an Order to Mediate to approve the Applications for Mediation dated 27 June 2022 and 24 June 2022, of MDT and BDO, respectively.52 Thus, the proceedings of the case were suspended by virtue of the Order to Mediate.53

On 29 June 2022, BDO submitted its compliance dated 28 June 2022 to the Order dated 22 June 2022, stating that the confirmation number provided by MDT is a tracing number of the recorded call.54 Thereafter, on the same date, CID issued an Order noting the compliance filed by BDO.55

Subsequently, MDT submitted its Manifestation dated 01 July 2022 to the Compliance of BDO dated 28 June 2022.56 MDT alleged that the compliance of BDO is incomplete since it merely confirmed that the confirmation number provided on the 05 November 2021 phone call is a tracing number.57 Further, MDT reiterated that “there is a confirmation number issued, which means there is a record for the third phone call.”58 Thus, MDT sought that the recording of the 05 November 2021 phone call be produced and prayed that an Order be issued for BDO to complete its compliance.59

On 19 July 2022, a Notice of Non-Settlement of Dispute was issued for failure of the parties to reach a settlement.60

On 21 July 2022, a Resolution was issued for MDT’s Manifestation dated 01 July 2022, stating that BDO’s compliance is insufficient and ordering the same to submit additional evidence to prove that the 05 November 2021 phone call recording is no longer available and to provide justifiable reason for its unavailability.61 Thereafter, on the same date, the CID issued an Order (for Resumption of Complaints Proceedings and Requiring the Parties to Submit Simultaneous Memoranda) ordering the parties to submit their respective Memoranda discussing and summarizing their causes of action, claims, and defenses together with a list of evidence presented to prove their respective claims or defenses.62

On 27 July 2022, BDO filed its Compliance dated 26 July 2022 to the Resolution dated 21 July 2022. BDO stated that during the preliminary conference held on 25 May 2022, BDO’s understanding of what is being asked is the actual voice recording of the phone call in BDO Waltermart, Capas, Tarlac Branch. BDO denied the existence of the phone call due to its understanding that what is being asked is the actual voice recording of the said conversation or phone call.63

Moreover, BDO states that the tracing number exists but is not exclusively associated with the actual voice record of the phone call since it was not recorded nor preserved.64

On 29 July 2022, CID issued an Order noting BDO’s Compliance dated 21 July 2022.65

On the same date, MDT filed its Manifestation and Motion to the Compliance of BDO dated 26 July 2022.66 MDT alleged that the Compliance of BDO is misleading since the issue being raised is the fraudulent charge in his credit card, BDO Waltermart, Capas, Tarlac branch is just a venue of the phone call, and there was a confirmation number to identify the phone call issued by the credit card department of BDO and not BDO Capas Branch.67

Thus, MDT prayed that an Order be issued requiring BDO to explain on why it should not be cited in contempt for its continual failure to comply with the Order of the Commission.68

On 30 July 2022, MDT filed its Second Manifestation to the Compliance of BDO to the Order dated 26 July 2022, to correct a typographical error with regard to one of the dates mentioned.69

On 01 August 2022, BDO filed its Memorandum dated 26 July 2022.70

In its Memorandum, BDO stated that even if MDT reported the incident, it does not automatically cancel the subject transaction since an investigation on the matter shall be made before it acts on the request for the cancellation of the transaction.71 Furthermore, BDO denied MDT’s request since based on its investigation, the transaction was validated through an OTP.72 BDO further averred that its denial of request to cancel the transaction is not considered as a breach of obligation on their part.73 Thus, BDO prayed for the dismissal of the complaint for lack of merit.74

On 03 August 2022, MDT submitted his Memorandum dated 03 August 2022, alleging that BDO has committed personal data breach against him for failure to protect and safeguard from the unlawful access and fraudulent misuse of his personal data.75 MDT also stated that BDO violated its contractual obligation since it failed to heed his instructions to not allow or process the Shopee transaction.76

Thus, MDT alleged that BDO is liable for violating Sections 26 and 32 of the DPA.77 He therefore prayed that a judgment be rendered in his favor,78 and for the Commission to order BDO the reversal of the amount charge from his credit card and all finance charges in relation to the subject transaction.79 MDT also prayed to order BDO to pay attorney’s fees and appearance fee as well as actual, moral, and exemplary damages.80

On 04 August 2022, the CID issued a Resolution denying MDT’s Manifestation and Motion dated 29 July 2022, and ordering BDO to submit additional evidence or to provide justifiable reason for the unavailability of the 05 November 2021 phone call with confirmation number ********.81

Subsequently, BDO submitted its Compliance dated 09 August 2022 to the Resolution of the CID dated 04 August 2022.82 BDO submitted a notarized sworn affidavit bearing the name of JDS who was in-charge of complaints with credit and debit cards under the Fraud Management Unit of BDO.83 JDS stated that she was aware of the complaint of MDT and that the “05 November 2021 phone call is not presently available based on the routine and good faith operation of its electronic system and procedure.”84 Further, it was stated that “Our Team needs time to coordinate with the appropriate unit/s of the Bank to check the archives and verify its existence and/or availability, and retrieve the same, if feasible.”85

Issue

Whether BDO violated Section 26 (Accessing Personal Information and Sensitive Personal Information Due to Negligence) and Section 32 (Unauthorized Disclosure) of the DPA.

Discussion

The Commission dismisses the Complaint for lack of merit and substantial evidence.

In this case, MDT has the burden to prove by substantial evidence that BDO violated Sections 26 and 32 of the DPA. However, MDT failed to provide sufficient information and evidence to substantiate the allegations he made in his complaint. As ruled in one of the cases decided by the Commission, “in administrative proceedings, the burden is on the Complainant to prove by substantial evidence the allegations in his Complaint are true.”86

Based on the records and submissions, it was alleged that BDO violated the DPA. To support his claim, MDT attached in his CAF the Bangko Sentral ng Pilipinas (BSP) complaints form, screenshots of BDO-Alert messages, screenshots of correspondences, and letters from BDO.87 However, the submitted evidence does not suffice to prove that there was unauthorized disclosure of information.

For complaints before the Commission to prosper, the burden of proof required is substantial evidence, or “that amount of relevant evidence that a reasonable mind might accept as adequate to support a conclusion.”88 The Supreme Court has explained that:

[T]he complainant has the burden of proving by substantial evidence the allegations in his complaint. The basic rule is that mere allegation is not evidence and is not equivalent to proof. Charges based on mere suspicion and speculation likewise cannot be given credence.89

Rule 131 of the 2019 Amendments to the Revised Rules on Evidence also provides:

Section 1. Burden of proof and burden of evidence. - Burden of proof is the duty of a party to present evidence on the facts in issue necessary to establish his or her claim or defense by the amount of evidence required by law. Burden of proof never shifts.

Burden of evidence is the duty of a party to present evidence sufficient to establish or rebut a fact in issue to establish a prima facie case. Burden of evidence may shift from one party to the other in the course of the proceedings, depending on the exigencies of the case.90

In this case, MDT has the burden of proof to present evidence to support his claims against BDO, which he failed to establish. MDT did not deny that he provided his OTP and confirmed his personal information to the caller or an unverified person. The fact that the caller provided the information of MDT does not mean that BDO provided the information, which would result in unauthorized disclosure of data, nor would it result to negligence on the part of BDO.

Further, MDT failed to establish that the information provided by the caller originated from BDO.

Hence, based on the submitted pieces of evidence, MDT failed to establish by substantial evidence that BDO was negligent in protecting his personal information.

I. BDO is not liable for Section 26 (Accessing Personal Information and Sensitive Personal Information Due to Negligence) of the DPA.

MDT alleged that BDO should be penalized for violating Section 26 of the DPA since BDO is the only one who should have access to his private information.91

Section 26 of the DPA provides:

SEC. 26. Accessing Personal Information and Sensitive Personal Information Due to Negligence. – (a) Accessing personal information due to negligence shall be penalized by imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00) shall be imposed on persons who, due to negligence, provided access to personal information without being authorized under this Act or any existing law.

(b) Accessing sensitive personal information due to negligence shall be penalized by imprisonment ranging from three (3) years to six (6) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Four million pesos (Php4,000,000.00) shall be imposed on persons who, due to negligence, provided access to personal information without being authorized under this Act or any existing law.92

To be held liable under Section 26, the following requisites must be met:

  1. There is personal information or sensitive personal information;
  2. The access was not authorized under the DPA or any existing law; and
  3. The unauthorized access was due to the negligence of any person.93

The first element is present in this case since name, address, and contact number of MDT,94 are considered personal information. Section 3 (g) of the DPA defines personal information as:

Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.95

Further, in this case, there is no sensitive personal information present since the data on a credit card does not fall within the definition under the DPA.96 Sensitive personal information is defined by Section 3(l) of the DPA as personal information:

(1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;

(2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;

(3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and

(4) Specifically established by an executive order or an act of Congress to be kept classified.97

Based on the foregoing, none of the enumerations provided for under Section 3 (l) of the DPA is present in this case. It should be concluded that the data found on the credit card are not sensitive personal information. Additionally, in the discussion of sensitive personal information enumerations, it was held in NPC 18-G-077 that, “if the information does not fall under any of the enumerations, directly or indirectly, such information cannot be considered a sensitive personal information”.98 Hence, the details found on a credit card such as credit card number, CVV and expiration date are not sensitive personal information contemplated under the DPA.

As to the second element, MDT has failed to establish his claim that BDO, due to negligence, provided access to his personal or sensitive personal information without being authorized under the DPA or existing law. He was not able to show that BDO is privy to the alleged breach. The mere statement that his credit card information was known to the caller beforehand, and then confirmed the same, is insufficient to prove that it was BDO who negligently provided access to his personal information to the caller. Further, there is no evidence presented that only BDO is the only possible source of the information given by the caller to MDT.

Since MDT was not able to prove and present substantial evidence of BDO’s involvement in the alleged breach, nor that his personal information was accessed due to BDO’s negligence. Thus, it can be inferred that there is no negligence on the part of BDO in this case. To reiterate, there is nothing on the records which shows that BDO gave access to MDT’s information to the caller due to its negligence. Hence, the third element is not present.

Hence, failing to prove the second and third requisites under Section 26 are present, BDO cannot be held liable Section 26 of the DPA.

II. BDO is not liable for Section 32 (Unauthorized Disclosure) of the DPA.

Section 32 of the DPA provides:

SEC. 32. Unauthorized Disclosure. – (a) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).

(b) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party sensitive personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from three (3) years to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00).99

The case of NPC 21-111, enumerated the requisites for violation Section 32 of the DPA:

  1. The perpetrator is a personal information controller or personal information processor or any of its officials, employees or agents;
  2. The information relates to personal or sensitive personal information;
  3. The perpetrator disclosed personal or sensitive personal information;
  4. The disclosure was made to a third party;
  5. The personal or sensitive personal information disclosed is neither unwarranted nor false information;
  6. The disclosure was not malicious nor done in bad faith; and
  7. The disclosure was without any of the lawful bases for processing under Section 12 and 13 of the DPA.100

To be liable under Section 32, the above-mentioned elements must be present. As defined under the DPA, a Personal Information Controller (PIC) “controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.”101

Here, BDO is a PIC as defined in the DPA. As a financial institution, it collects personal information and has control of the process in order to cater its banking purpose to its clients. Hence, the first element is present in this case.

The second element is also present. As discussed, MDT’s name, address and contact number are personal information.

However, although the alleged breach involves personal information, there is no substantial evidence to prove that BDO has disclosed the personal data to the caller. For failure to prove that BDO disclosed the information of MDT to the caller, there is no doubt that there is no disclosure of information as an element of the third requisite. As such, the third element is not present in this case.

As to the fourth element, there is no evidence to prove that there was a disclosure of BDO to a third party. There is no unwarranted nor false information disclosed, as provided by the fifth element. There is no malicious nor disclosure done in bad faith, in relation to the sixth element. Lastly, since there is no disclosure of information on the part of BDO, the seventh element is evidently absent in this case.

Taking everything into account, the third, fourth, fifth, sixth and seventh elements are not present in this case since MDT failed to prove that BDO is involved in the disclosure of his personal data to the caller. There is also nothing on the record that BDO disclosed MDT’s information to a third party. Additionally, there is no evidence to prove that bad faith nor malice was committed by BDO. Therefore, BDO cannot be held liable for the penalties provided for under Section 32 of the DPA.

Furthermore, MDT’s request to produce the third phone call recording is not within the jurisdiction of this Commission to resolve. The request does not involve a data privacy issue. Moreover, assuming arguendo that the requested audio recording of the phone call made by MDT to BDO on 05 November 2021 was presented, it is beyond the authority and mandate of this Commission to decide the matter since it is not a data privacy issue. The production of the phone audio recording does not involve a processing of personal information nor will prove an unauthorized disclosure and/or access to sensitive information.

The purpose of presenting the audio recording is to prove that there was a conversation between MDT and BDO with regard to the action of the latter to block the credit card of the former.102 This matter does not fall under the authority and jurisdiction of this Commission to resolve. Thus, regardless of the production and presentment of the audio phone recording, the subject recording is beyond the ambit of this Commission as provided for under the Data Privacy Act.

Further, as to MDT’s prayer for the reversal of the unauthorized transaction credited against his account, the same is beyond the scope and jurisdiction of this Commission to resolve.

Based on the foregoing discussions, this Commission cannot find BDO liable for violation of the DPA. It must be noted that the safeguarding of personal information must be a joint obligation between the data subjects and the data controller or processor. Although PICs, like BDO, have the obligation to protect the privacy of data subjects, the data subjects on the other hand must exercise due diligence in protecting their personal information. One should not bear the loss or consequence arising from the negligence of another.

WHEREFORE, premises considered, this Commission resolves that the Complaint filed by MDT against BDO Unibank, Inc. (BDO) is hereby DISMISSED.

The Compliance and Monitoring Division is hereby DIRECTED to conduct a Compliance Check on the process of BDO in sending out its statement of accounts.

SO ORDERED.

City of Pasay, Philippines. 19 January 2023.

Sgd.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

Sgd.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

Sgd.

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

MTD Counsel for Complainant

MBA BDO UNIBANK, INC., LEGAL SERVICES GROUP Counsel for Respondent

COMPLAINTS AND INVESTIGATION DIVISION COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Complaints-Assisted Form dated 26 January 2022 of MDT ↩

  2. Id. ↩

  3. Id. at p. 1 ↩

  4. Id. ↩

  5. Id. ↩

  6. Id. ↩

  7. Id. ↩

  8. Id. Exhibit “A” ↩

  9. Complaints-Assisted Form dated 26 January 2022 of MDT ↩

  10. Id. ↩

  11. Id. ↩

  12. MDT v. BDO, NPC 22-006, Order to File Verified Comment dated 11 February 2022, at p. 1. ↩

  13. Id. ↩

  14. Verified Comment dated 21 February 2022 of BDO ↩

  15. Id. at p. 2 ↩

  16. Id. Annex “1” ↩

  17. Verified Comment dated 21 February 2022 of BDO at p. 3. ↩

  18. Id. at p. 4. ↩

  19. Id. at p. 4. ↩

  20. Id. at p. 2. ↩

  21. MDT v. BDO, NPC 22-006, Order Noting the Submission of Verified Comment of Respondent dated 01 March 2022 ↩

  22. Reply dated 05 March 2022 of MDT ↩

  23. Id. at p. 1. ↩

  24. Id. at p. 3. ↩

  25. Id. at p. 3. ↩

  26. Reply dated 05 March 2022 of MDT at p. 7. ↩

  27. Id. at p. 7. ↩

  28. Id. at p. 8. ↩

  29. Id. at pgs. 5-6 ↩

  30. Reply dated 05 March 2022 of MDT at pgs. 5-6 ↩

  31. Id. at p. 8 ↩

  32. Id. ↩

  33. MDT v. BDO, NPC 22-006, Order Noting the Reply filed by Complainant dated 11 March 2022 ↩

  34. MDT v. BDO, NPC 22-006, Order After the 1st Preliminary Conference held on 25 May 2022 and Reminding the Parties to Appear for the Second Setting of the Preliminary Conference for the Continuance of the Stipulations and/or Admissions of Facts and/or Documents dated 25 May 2022 ↩

  35. Id. at p. 1. ↩

  36. Id. at pgs. 1-2 ↩

  37. Id. at p. 2 ↩

  38. MDT v. BDO, NPC 22-006, Order After the 1st Preliminary Conference held on 25 May 2022 and Reminding the Parties to Appear for the Second Setting of the Preliminary Conference for the Continuance of the Stipulations and/or Admissions of Facts and/or Documents dated 25 May 2022 at p. 2 ↩

  39. Id. at p. 2 ↩

  40. Id. at pgs. 2-3 ↩

  41. Id. at p. 3. ↩

  42. MDT v. BDO, NPC 22-006, Order After the 1st Preliminary Conference held on 25 May 2022 and Reminding the Parties to Appear for the Second Setting of the Preliminary Conference for the Continuance of the Stipulations and/or Admissions of Facts and/or Documents dated 25 May 2022 at p. 3. ↩

  43. Id. at p. 3. ↩

  44. Id. at p. 3. ↩

  45. Id. at pgs. 3-4 ↩

  46. MDT v. BDO, NPC 22-006, Order After the 1st Preliminary Conference held on 25 May 2022 and Reminding the Parties to Appear for the Second Setting of the Preliminary Conference for the Continuance of the Stipulations and/or Admissions of Facts and/or Documents dated 25 May 2022 at pgs. 3-4 ↩

  47. MDT v. BDO, NPC 22-006, Order After the 2nd Preliminary Conference held on 22 June 2022, Respondent Subjected to Compliance Order and Requiring the Parties to Submit a Filled-Out Application for Mediation Form dated 22 June 2022 ↩

  48. Id. at p. 1. ↩

  49. Id. at p. 1. ↩

  50. Id. at p. 1. ↩

  51. MDT v. BDO, NPC 22-006, Order After the 2nd Preliminary Conference held on 22 June 2022, Respondent Subjected to Compliance Order and Requiring the Parties to Submit a Filled-Out Application for Mediation Form dated 22 June 2022 at p. 1. ↩

  52. MDT v. BDO, NPC 22-006, Order to Mediate dated 28 June 2022, Application for Mediation dated 27 June 2022 of MDT, and Application for Mediation of BDO dated 24 June 2022. ↩

  53. MDT v. BDO, NPC 22-006, Order to Mediate dated 28 June 2022 ↩

  54. Compliance dated 28 June 2022 of BDO ↩

  55. MDT v. BDO, NPC 22-006, Order Noting the Respondent’s Compliance dated 01 July 2022 ↩

  56. Manifestation dated 01 July 2022 of MDT ↩

  57. Id. at pgs. 1-2 ↩

  58. Id. at p. 2 ↩

  59. Id. MDT at p. 2. ↩

  60. MDT v. BDO, NPC 22-006, Notice of Non-Settlement of Dispute dated 19 July 2022 ↩

  61. MDT v. BDO, NPC 22-006, Resolution dated 21 July 2022 at pgs. 3-4 ↩

  62. MDT v. BDO, NPC 22-006, Order for Resumption of Complaints Proceedings and Requiring the Parties to Submit Simultaneous Memoranda dated 21 July 2022 ↩

  63. Compliance dated 26 July 2022 to the Resolution dated 21 July 2022 of BDO ↩

  64. Id. at pgs. 4-5 ↩

  65. MDT v. BDO, NPC 22-006, Order Noting the Respondent’s Compliance (To the Resolution dated 21 July 2022) dated 29 July 2022 ↩

  66. Manifestation and Motion dated 29 July 2022 (Regarding Respondent’s Compliance Dated 26 July 2022) by MDT ↩

  67. Id. ↩

  68. Id. ↩

  69. Second Manifestation dated 30 July 2022 (Regarding Respondent’s Compliance Dated 26 July 2022) by MDT ↩

  70. Memorandum dated 26 July 2022 by BDO ↩

  71. Id. at p. 3. ↩

  72. Id. at p. 3. ↩

  73. Id. at p. 3. ↩

  74. Memorandum dated 26 July 2022 by BDO at p. 5. ↩

  75. Memorandum dated 03 August 2022 by MDT at p. 9. ↩

  76. Id. at p. 11. ↩

  77. Complainant’s Memorandum dated 03 August 2022 by MDT ↩

  78. Id. at p. 22 ↩

  79. Id. at p. 22 ↩

  80. Id. at p. 22. ↩

  81. Resolution dated 04 August 2022 (of Complainant’s Manifestation and Motion (Regarding Respondent’s Compliance dated 26 July 2022 dated 29 July 2022; and Second Manifestation (Regarding Respondent’s Compliance dated 26 July 2022) dated 20 July 2022) ↩

  82. Compliance dated 09 August 2022 to the Resolution dated 04 August 2022 ↩

  83. Id. Annex “A” ↩

  84. Id. ↩

  85. Id. ↩

  86. JLB v. Security Bank Corporation, CID-18-D-009, Decision dated 18 March 2021 at p. 4 ↩

  87. Complaints-Assisted Form dated 26 January 2022 of MDT ↩

  88. De Jesus v. Guerrero III, G.R. No. 171491, 04 September 2009. ↩

  89. Id. ↩

  90. 2019 Amendment to the 1989 Revised Rules on Evidence, A.M. No. 19-08-15-SC, Rule 131, Section 1. Emphasis supplied ↩

  91. Complaints-Assisted Form dated 26 January 2022 of MDT ↩

  92. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter VIII, § 26 (2012). ↩

  93. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter VIII, § 26 (2012). ↩

  94. Complaints-Assisted Form dated 26 January 2022 of MDT ↩

  95. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter I, § 3(g) (2012). ↩

  96. Section 3(l)(4) of the DPA: Sensitive personal information refers to personal information which is specifically established by an executive order or an act of Congress to be kept classified. NPC 22-006 ↩

  97. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter I, § 3(l) (2012). ↩

  98. NPC 18-G-077 (unreported), Decision dated 15 April 2021 at p. 9 ↩

  99. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter VIII, § 32 (2012). ↩

  100. NPC 21-111 (unreported), Decision dated 22 September 2022 at p. 12 ↩

  101. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, § 3 (h) (2012). ↩

  102. Manifestation dated 01 July 2022 of MDT ↩

Backlinks