NPC Issuance Wiki

NPC 22-012: RJC v. DL

Issued Decision

Decision Text

RJC,

Complainant,

-versus-

DL,

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before this Commission is a Complaint filed by RJC against DL for an alleged violation of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

On 31 January 2022, RJC, a student at the University of the Philippines Cebu (UP Cebu), filed a Complaint against DL, the College Secretary of the university’s College of Science.1

RJC alleged that he filed a complaint before the Office of the Ombudsman Region VII (Ombudsman case) against some personnel from UP Cebu, including DL.2 He claimed that DL attached a copy of his transcript of records in DL’s counter-affidavit for the Ombudsman case.3 According to RJC, DL used his transcript of records without his consent to prove that he is incapable of completing his Master of Science (MS) degree on time.4 Thus, RJC argued that DL’s use of his transcript of records without his consent is in violation of the DPA.5

Further, RJC claimed that “it is against the law to process and disclose personal data […] that is subject to vilification and harassment without the consent of the subject.”6

On 11 February 2022, the Commission, through its Complaints and Investigation Division (CID), issued an Order directing DL to file his comment within fifteen (15) calendar days from receipt of the Order.7 It also directed the parties to appear for preliminary conferences on 06 April 2022 and on 17 May 2022.8

In his Comment, DL denied RJC’s allegations and claimed that he did not violate the DPA.9 Thus, he prayed that the Complaint against him should be dismissed.10 He stated that RJC filed the Ombudsman case claiming that the respondents in that case, including DL, “were deliberately and/or negligently delaying his graduation for no valid reason.”11 He claimed that RJC made material allegations in the case, “which if not controverted by documentary evidence, may lead to the erroneous conclusion that [the] respondents in said Ombudsman cases [sic] abused their authority and committed grave misconduct in allegedly delaying the graduation of [RJC].”12 He further argued that:

  1. While students, in general, have a reasonable expectation of privacy as regards their school records, and granting arguendo that school records are protected by some measure of confidentiality, the confidentiality of such records is deemed waived by the student when he himself expressly makes a factual claim under oath, the falsity of which can only be substantiated by the presentation of his school records.13

DL argued that his act of attaching RJC’s transcript of records as evidence in the Ombudsman case is necessary for the exercise or defense of legal claims.14 He claimed that the transcript of records contained specific information “which would debunk the claims made by [RJC] that [DL] along with other professors of UP Cebu deliberately and/or negligently caused his failure from earning his master’s degree.”15 Further, he emphasized that:

  1. In the University of the Philippines (UP) Privacy Notice for Students (Revised as of the 1st Semester/Trimester 2019-2020), it is stated that sensitive personal information (e.g. educational records) may be processed when needed for the protection of lawful rights and interests of natural or legal persons in court proceedings; and for the establishment, exercise or defense of legal claims; or where provided to government or public authority.16

On 06 April 2022, RJC and DL attended the first preliminary conference.17 The CID, however, rescheduled it to 12 July 2022.18

On 12 July 2022, the CID ordered both parties to submit their respective memoranda within fifteen (15) days from receipt of the Order.19

In his Memorandum dated 04 August 2022, RJC claimed that in accordance with Batas Pambansa Blg. 232 (Education Act of 1982), “schools shall maintain and preserve the confidentiality of school records.”20 He also argued that school records are sensitive personal information, the processing of which is prohibited, unless authorized by law.21

RJC alleged that the disclosure of his grades before the Office of the Ombudsman was “unauthorized, malicious, and in direct violation of the principles of transparency, proportionality, and legitimate purpose.”22 He claimed that DL’s processing was done without his consent and was not authorized under the DPA.23

RJC further alleged that DL’s disclosure of his transcript of records “despite the marking ‘for advising purposes only’ on such copy is a clear, patent[,] and direct violation of the authorized purpose of the processing, issuance and disclosure of [his] sensitive personal information.”24

RJC asserted that DL’s disclosure of his transcript of records was malicious and unwarranted since it is irrelevant to the allegations in the Ombudsman case:

  1. [DL] tried to argue that the school records contained relevant information that refutes [RJC’s] accusations and allegations. However, [DL] failed to specify with clarity why the entire scholastic grades of [RJC] in UP Cebu be [sic] relevant and necessary in his Counter-Affidavit[.]25

Aside from this, he claimed that it was “clearly an attempt to demean, discredit and embarrass [RJC] in the attempt to refute the latter’s assertion that he has a ‘pretty solid background in Computer Science’.”26

Lastly, RJC argued that he is entitled to moral, exemplary, and nominal damages considering DL’s violation of the DPA.27

In his Memorandum, DL argued that he did not violate the DPA and claimed that the submission of RJC’s transcript of records to the Office of the Ombudsman was in accordance with Section 13 (f) of the DPA.28 DL alleged that:

  1. [RJC] in the above-said complaint before the Office of the Ombudsman built his legal claims on the basis of his own supposed solid academic background, contrasting this with the therein respondents’ alleged incompetence and negligence, and blaming the latter for his supposed ignorance of the school’s Maximum Residency Rule (MRR).

  2. Thus, the natural and legal recourse for the respondents in the said complaint before the Ombudsman, including [DL], was to controvert [RJC’s] unfounded claims by documentary evidence on record. Otherwise, [RJC’s] sole, uncontroverted averments could lead to the erroneous conclusion that respondents in said Ombudsman case abused their authority and committed grave misconduct in allegedly delaying the graduation of [RJC].29

DL claimed that his purpose in attaching RJC’s transcript of records to his counter-affidavit was to controvert RJC’s “false material claims.”30 DL further argued that:

  1. Attaching as evidence during the Ombudsman administrative and criminal proceedings a copy of the student’s scholastic record comprises a different context as compared to releasing such record to any third party or publicizing it in a social media platform or website. The former is necessary and proportional to the exercise or defense of legal claims, while the latter is unnecessary and disproportional for any purpose.31

Considering that he had a lawful basis for processing RJC’s transcript of records, DL asserted that the complaint should be dismissed for lack of merit.32

Issue

Whether DL’s processing of RJC’s personal data violated the DPA.

Discussion

DL did not violate the DPA when he processed RJC’s personal data. The use of RJC’s transcript of records in DL’s counter-affidavit was lawful in accordance with Section 13 (f) of the DPA.

RJC correctly argued that school records are sensitive personal information. Section 3 (l) of the DPA provides an enumeration of what constitutes sensitive personal information:

Section 3. Definition of Terms. – Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

(l) Sensitive personal information refers to personal information:

(1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;

(2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;

(3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and

(4) Specifically established by an executive order or an act of Congress to be kept classified.33

The DPA considers information about an individual’s education as sensitive personal information. In a previous case, the Commission stated that educational records are considered sensitive personal information.34 The Commission, however, emphasizes that not all information related to education should automatically be considered as sensitive personal information.

The enumeration provided in Section 3 (l) of the DPA includes information from which an individual can be personally identified. Such interpretation of Section 3 (l) should be observed in determining what particular information about an individual’s education is deemed as sensitive personal information. Following the rules of statutory construction:

[U]nder the maxim noscitur a sociis, where a particular word or phrase is ambiguous in itself or is equally susceptible of various meanings, its correct construction may be made clear and specific by considering the company of words in which it is founded or with which it is associated. This is because a word or phrase in a statute is always used in association with other words or phrases, and its meaning may, thus, be modified or restricted by the latter. The particular words, clauses and phrases should not be studied as detached and isolated expressions, but the whole and every part of the statute must be considered in fixing the meaning of any of its parts and in order to produce a harmonious whole. A statute must be so construed as to harmonize and give effect to all its provisions whenever possible. In short, every meaning to be given to each word or phrase must be ascertained from the context of the body of the statute since a word or phrase in a statute is always used in association with other words or phrases and its meaning may be modified or restricted by the latter.35

In construing Section (3) (l) of the DPA as a whole and considering the company of words in this Section, the information enumerated, which includes “education”, may be used to profile an individual. Thus, to harmonize and give effect to the provision as a whole, only information about education which can profile a particular individual falls within the definition of sensitive personal information.

Granular or detailed information relating to the education of an individual can be used to profile that particular individual. For instance, transcript of records containing a comprehensive breakdown of a student’s grades and other definitive administrative information, such as a student identification number, can be used to personally identify the student.

In the case at bar, RJC’s transcript of records contained the breakdown of the grades he obtained for each course he took. These particular grades are considered sensitive personal information considering that these information can profile RJC. Given that these are sensitive personal information, the processing in relation to them should be in accordance with Section 13 of the DPA. DL alleged that his purpose in using RJC’s transcript of records in his counter-affidavit was to disprove RJC’s “false material claims.”36

Such purpose may be deemed for the “establishment, exercise or defense of legal claims” under Section 13 (f) of the DPA:

Section 13. Sensitive Personal Information and Privileged Information. The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

…

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.37

When determining whether there is lawful processing under Section 13 (f) of the DPA, the Commission clarifies that it cannot rule on the admissibility of evidence or its probative value to a particular case outside its jurisdiction. As previously discussed by the Commission:

The DPA should not be seen as curtailing the practice of law in litigation. Considering that it is almost impossible for Congress to determine beforehand what specific data is ‘necessary’ or may or may not be collected by lawyers for purposes of building a case, applying the qualifier ‘necessary’ to the second instance in Section 13 (f) therefore, serves to limit the potentially broad concept of ‘establishment of legal claims’ consistent with the general principles of legitimate purpose and proportionality.38

In this case, however, it is the Complainant, RJC, who raised his academic records as an issue in the Ombudsman case. The Commission stresses that DL would not have to present RJC’s transcript of records if it were not for RJC’s presentation of the issue on his academic records. Thus, it was RJC who opened the door for the submission of these types of evidence. Given that the processing of RJC’s personal data had lawful basis under Section 13 (f) of the DPA, DL cannot be held liable for violating the DPA.

WHEREFORE, premises considered, the Commission resolves that the Complaint filed by RJC against DL is hereby DISMISSED for lack of merit. This is without prejudice to the filing of appropriate civil, criminal, or administrative cases before any other forum or tribunal, if any.

SO ORDERED.

City of Pasay, Philippines. 10 November 2022.

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

I CONCUR:

JOHN HENRY D. NAGA

Privacy Commissioner

Copy furnished:

RJC

Complainant

DL

Respondent

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Complaints-Assisted Form, 31 January 2022, Annex, in RJC v. DL, NPC 22-012 (NPC 2022). ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. ↩

  6. Id. ↩

  7. Order, 11 February 2022, at 1, in RJC v. DL, NPC 22-012 (NPC 2022). ↩

  8. Id. ↩

  9. Comment, 07 March 2022, ¶¶ 6-7, in RJC v. DL, NPC 22-012 (NPC 2022). ↩

  10. Id. ↩

  11. Id. ¶ 11. ↩

  12. Id. ¶ 12. ↩

  13. Id. ¶ 10. ↩

  14. Id. ¶ 20. ↩

  15. Comment, 07 March 2022, ¶ 24, in RJC v. DL, NPC 22-012 (NPC 2022). ↩

  16. Id. ¶ 22. ↩

  17. Order, 06 April 2022, at 1, in RJC v. DL, NPC 22-012 (NPC 2022). ↩

  18. Id. at 2. ↩

  19. Order, 12 July 2022, at 1-2, in RJC v. DL, NPC 22-012 (NPC 2022). ↩

  20. Memorandum, 04 August 2022, at 5, in RJC v. DL, NPC 22-012 (NPC 2022). ↩

  21. Id. at 5-7. ↩

  22. Id. at 1. ↩

  23. Id. at 9-10. ↩

  24. Id. at 12. ↩

  25. Id. at 14. ↩

  26. Memorandum, 04 August 2022, at 17, in RJC v. DL, NPC 22-012 (NPC 2022). ↩

  27. Id. at 18-20. ↩

  28. Id. at 3. ↩

  29. Id. at 5-6. ↩

  30. Id. at 7-8. ↩

  31. Id. at 8. ↩

  32. Memorandum for Respondent, 04 August 2022, at 10, in RJC v. DL, NPC 22-012 (NPC 2022). ↩

  33. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 § 3 (l) (2012). Emphasis supplied. ↩

  34. MHH v. VCF and SFPS, NPC 18-141, 09 June 2020, at 7 available at https://www.privacy.gov.ph/wp-content/uploads/2022/01/Decision-NPC-Case-No.-18-141-MHH-v.-VCF-SPFS-1.pdf (last accessed 23 December 2022). ↩

  35. Francisco Chavez v. Judicial and Bar Council, Sen. Francis Escudero, and Rep. Niel Tupas, Jr., G.R. No. 202242 (2012). ↩

  36. Memorandum for Respondent, 04 August 2022, at 7-8, in RJC v. DL, NPC 22-012 (NPC 2022). ↩

  37. Data Privacy Act of 2012, § 13 (f). Emphasis supplied. ↩

  38. EA and TA v. EJ, EE, and HC, NPC 17-018, 15 July 2019, at 8, available at https://www.privacy.gov.ph/wp-content/uploads/2022/04/NPC-17-018-EA-and-TA-v-EJ-Decision-2019.07.15-.pdf (last accessed 01 December 2022). ↩

Backlinks