NPC Issuance Wiki

NPC 22-175: MEA v. MU

Issued Decision

Decision Text

MEA,

Complainant,

-versus-

MU,

Respondent.

x----------------------------------------------------x

NAGA, P.C.;

Before the Commission is the Complaint filed by MEA (Complainant) against MU (Respondent) for an alleged violation of Sections 31 and 32 of the Data Privacy Act of 2012 or Republic Act No. 10173 (“DPA”).

Facts

On 10 August 2022, the Commission, through its Complaints and Investigation Division (CID) received the Complaints-Assisted Form (CAF) of the Complainant.1

In the CAF, the Complainant narrated that the Respondent invited her to open a business.2 However, due to the insufficient salary of the Complainant, the Respondent proposed to lend money to the former through a loan scheme.3 In their loan agreement, the Complainant surrendered her Automated Teller Machine (ATM) card payroll account to the Respondent until the payment of the loan commodity.4

However, in January 2022, the Complainant tried to plead with the payment of the subject loan, reasoning that her relatives were infected with the COVID-19 virus.5 Thereafter, the Complainant sent a copy of the COVID-19 test results to prove her claim, however, the Respondent did not grant the Complainant’s plea.6

After this, the Complainant claimed that the Respondent started to commit scandalous actions against the former to collect the proceeds of the loan.7

On 15 February 2022, the Respondent posted the ATM [card] of the Complainant with their conversation that has a picture.8 On 16 February 2022, the Respondent went to the barangay hall where the Complainant resides and thereafter, posted the barangay details, such as address, contact number, and email address.9 The post was captioned as:

Time is up my dear. No more reminder, no more drama. Hanapan pala gusto mo edi sana naglaro nalang tayo. [sic] I’ll come find you and you’ll see me, okay? Baka maghabulan pa tayo wag naman tiring yun girl. [sic] Unahin moa ko ah balita ko ilan kaming may complaint sa yo. [sic]

utangserye10

Thereafter, the Respondent filed a complaint in the court since there was no barangay amicable settlement between the parties.11 As a result, the court has issued a ruling on the filed complaint.12 However, Respondent continued to embarrass the Complainant on social media.13

Finally, on 04 August 2022, the Respondent posted on social media the ATM card of the Complainant with its full name, card number, and account number.14 The post was captioned as, “Oi balita ko bago na atm mo? Dedma na to for 30k? Refresh ko lang memory mo baka nakalimot ka na sa kaso. Nagpahinga lang ako saglit pero never kita nakalimutan. Pramis.”

Thus, the Complainant filed the instant Complaint alleging that the actions of the Respondent violate the DPA.15

In her Complaint, the Complainant averred that the incident caused mental stress not only to her but also to her family who were common friends with the Respondent on social media.16 The incident also affected the Complainant’s work performance due to the threat by the Respondent.17

On 17 August 2022, the CID issued an Order (To File Verified Comment and Appear Virtually for Preliminary Conference) requiring the Respondents to file their Verified Comment within fifteen (15) days from receipt of the Order.18 The CID likewise ordered the parties to appear virtually for a Preliminary Conference on 28 October 2022, and 25 November 2022.19

On 19 September 2022, Respondent filed her Verified Comment through email.20 Respondent argued that she never posted anything with the name of the Complainant before 04 August [2022].21 Respondent also stated that she tried to pursue the Complainant to collect the loan obligation.22 However, the Respondent claimed that the Complainant stated that she would not pay the subject loan.23 Moreover, the Respondent claimed that the Complainant’s ATM card has no remaining balance since the latter found a way to transfer her salary from the payroll account to another, hence, the former cannot withdraw the payment for the subject loan.24 Thus, the former stated she posted the ATM [card] on 04 August [2022] after the latter acquired a new ATM card.25 The new ATM card was obtained by the Complainant reasoning out that her initial ATM card was lost, but in fact, it is with the Respondent.26

As a result, the Respondent claimed that it could not withdraw the salary of the Complainant.27 Consequently, the incident has caused stress to the Respondent since she paid for the remaining balance of the Complainant as her guarantor.28 Further, the Respondent stated that:

“Soc med is the biggest platform where you can reach a person na nagtatago sayo pagdating sa utang, dahil tama ako makakarating sa kanya. Walang paninirang puri ang nagaganap dahil pawang katotihanan [sic] and lahat. She blocked me, di xa[sic] nakikipagusap kung balak niang[sic] makipagayos at magbayad dapat day1 palang nakipagcoordinate na xa[sic]. Whatever reasons she have on top of her debts, labas na po ako dun as I said sa screenshot nia[sic] na ako pa humingi ng pasensya and take note after that conversation na nanghingi xa[sic] ng leeway to pass, never na xa[sic] ulit nagbayad saken. SS ng atm machine with 0 balance account was posted dahil payday nia[sic] dapat ako mag withdraw ng 5k as our payment agreed per sahod wala 0 agad kasi transferred nia[sic] na sa Gcash ginawa nia[sic] akong tanga.”29

Lastly, the Respondent claimed that she filed a small claims complaint against the Complainant and that the case is already in Execution for Motion.30

On 22 August 2022, the CID issued an Order (Noting the Respondent’s Email Manifestation and its Attachments and Furnishing Complainant with a Copy Thereof).31

On 23 August 2022, the Respondent submitted through email a copy of the Order granting the Motion for Execution issued by the Metropolitan Trial Court.32

On the same date, the CID issued an Order (Noting the Respondent’s Submission of an Order Granting the Motion for Execution Issued by the Metropolitan Trial Court Branch 26 of Manila docketed as Civil Case No. M-MNL-22-03269-SMC).33

On 20 October 2022, the Respondent submitted additional evidence through email stating that “a demand letter sent to her [Complainant] last April for her to settle the amount balance from her full debt of 70k[sic] and was received by her boyfriend JG on April 19 but still ignored.”34 Further, the Complainant stated that she would file a perjury case against the Respondent for submitting false information that the subject ATM card was lost, but in fact, it was pawned.35

On 24 October 2022, the CID issued an Order (Noting the Respondent’s Additional Evidence, Furnishing Complainant a Copy thereof, and Reminding the Parties to Appear in the Preliminary Conference).36

On 28 October 2022, the Complainant submitted her manifestation37 through email stating:

Good day! The case she filed in the Metropolitan Trial Court regarding the small claim is over and it is now on garnishment. And I’m just waiting for the court for its actions. Regarding the ATM that the security officer said, can she send her proof & evidence here that the security officer told her so. Also Everything about the case she file against me is all published on her social media account which we know is public, even the position of my partner in government she posted it on facebook, another thing is that my safety was considered, I became anxious around me because of this. here are additional evidences.

Please see attached file for your reference.

Thank you!38

The Complainant included in the above-mentioned manifestation some screenshots of the Facebook post of the Respondent regarding the debt, the ATM card of the Complainant, information on the filed case in court, and some other relevant statements.39

In response, the Respondent replied through email stating:

xxx

Please enlighten me on which of the allegations MER filed including all evidences against me would fall under data Privacy Act of 2012. I believe others are not considered relevant to the case. Seeking your explanation on this so I can provide a clear, and brief responses on those data going forward.

xxx40

On 02 November 2022, the CID issued an Order (After the 1st Preliminary Conference held on 28 October 2022, Cancelling the 2nd Preliminary Conference on 25 November 2022, Requiring the Complainant to Submit Additional Evidence, Requiring the Respondent to Submit a Comment, Reminding the Respondent to Submit Compliance to the Order dated 17 August 2022, and Requiring the Parties to Submit Simultaneous Memoranda)41

On 03 November 2022, the CID issued an Order (Noting the Parties Email Manifestations)42

On 11 November 2022, the Respondent submitted her “Evidence Responses.”43 She also attached some photos to prove its claim that the Complainant did not suffer any threat since she attended a birthday party in the area where the Respondent resides.44

The Respondent stated that there is no name mentioned in her shared post on 19 September, and that the Complainant was accusing the Respondent and her friend of threat by mere comments.45 The Respondent further averred that “Posting my own opinion and emotions regarding this case and with the previous case I filed does not concern you as long as your name is not being mentioned.”46

Moreover, the Respondent manifested that her post is not a privacy violation and that mentioning the name of the Complainant without malicious content is not a crime.47 In line with this, the Respondent claimed that she did the posting since the Complainant was hiding and avoiding her messages regarding the collection of debt.48

The Respondent also claimed that she has the right to access the information of the Complainant since the ATM card was pawned to her, thus:

ATM posted with your name was due to the fact that you ignored your obligation with me to pay your debt. I have the right to access it due to it was pawned to me with your consent.49

On 15 November 2022, the CID issued an Order (Noting the Respondent’s Email Submission).50

Thereafter, on the same day, the Complainant submitted her statements regarding the Respondent’s allegations.51

The Complainant claimed that the posting of her ATM card with the full name and account number in a public platform would constitute unauthorized processing of sensitive personal information as contemplated in the DPA.52 Further, the Complainant claimed that the Respondent had malicious intent in posting her information since the latter wanted to put shame on the Complainant’s name.53

On the same day, 15 November 2022, the Respondent submitted her response to Complainant’s statements.54 The former reiterated that her post “has no mentioned name.”55 Further, the Respondent claimed that the Complainant has a new ATM card with a new card number since it was declared lost, and it cannot invoke data privacy rights since the ATM card was pawned and the Complainant partly owns it since the card was considered as collateral to the debt.56

On 16 November 2022, the CID issued an Order (Noting the Complainant’s Statement and Reminding the Parties to Submit their Simultaneous Memoranda).57

On 18 November 2022, the CID issued an Order (Noting the Respondent’s Statement and Reminding the Parties to Submit their Simultaneous Memoranda).58

On 25 December 2022, the Complainant submitted its Compliance to the Order dated 18 November 2022.59 The Complainant alleged that the Respondent “has the habit of exposing and collecting private data and private conversations without the permission of the owner.”60 Further, she also alleged that exposing her full name and active account number to a public platform is a violation of data privacy.61 Lastly, the Complainant attached as proof of her allegation the screenshot of the post of the Respondent with the subject ATM card.62

Thereafter, the Respondent also submitted her Compliance to the above-mentioned Order on 25 December 2022.63 Respondent claimed that the deactivated ATM card was exposed because the Complainant ignored her messages to pay for the remaining debt balance.64

Further, the Respondent asserted that she was authorized to have the ATM card and that she knows the Personal Identification Number (PIN) because she obtained the consent of the Complainant as payment for the debt in installments.65 Moreover, it was also affirmed by the Respondent that “Account number can be exposed, unless used with malice and in bad faith.”66 It was also questioned whether exposing a deactivated ATM card would constitute bad faith.67

Finally, the Respondent claimed that she had the consent of the Complainant and was likewise authorized to use the ATM card as debt collateral.68

On 27 December 2022, the Complainant submitted her answers to the previous statements of the Respondent.69 The Complainant expressed that the posting of the ATM card without hesitations on social media is a violation of the DPA.70 Further, the Complainant claimed that her full name and account number were seen in the post of the Respondent.71 Finally, the Complainant asserted that she did not give the right to the Respondent to publicize her data on social media.72

Accordingly, the Respondent submitted her response on 27 December 2022 to the statements of the Complainant.73 Respondent stated that the root cause as to why she posted the deactivated ATM card was because the Complainant did not have the intention of paying her debt.74 Respondent also stated that she was provoked by the Complainant to post the ATM card of the latter.75

On 09 January 2023, the CID issued an Order (Noting Parties’ Email Submissions).76

Issue

Whether Respondent is liable for violating Section 31 of the DPA.

Discussion

The Commission finds that there is a violation of Section 31 of the DPA for malicious disclosure of personal information.

Section 31 of the DPA provides:

SEC. 31. Malicious Disclosure. – Any personal information controller or personal information processor or any of its officials, employees or agents, who, with malice or in bad faith, discloses unwarranted or false information relative to any personal information or personal sensitive information obtained by him or her, shall be subject to imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).77

To be held liable for Malicious Disclosure, the following elements should be present:

The perpetrator is a personal information controller or a personal information processor or any of its officials, employees or agents;78

Section 3 (h) of the DPA provides the definition of a personal information controller (PIC), thus:

xxx

(h) Personal information controller refers to a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.79

In this case, Respondent as the holder of the subject ATM card is a PIC, considering that she has control over the information on the ATM card in her possession. It was also admitted by the Respondent that she possessed the ATM card of the Complainant since it was pawned to her.80

The perpetrator disclosed personal or sensitive personal information;81

Under the DPA, disclosing Complainant’s personal or sensitive personal information is considered an act of processing. As defined, processing refers to “any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure, or destruction of data.”82

In this case, Respondent disclosed Complainant’s personal information when she posted her ATM card on Facebook. In this regard, Section 3 (g) of the DPA provides:

(g) Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.83

Accordingly, it was clearly shown that in the submitted evidence by the Complainant, the posted ATM card has her full name and account details such as account number and card number. The act of posting the ATM card of the Complainant by the Respondent constitutes the act of processing of personal information. Moreover, the identity of the Complainant can be ascertained considering that the name was evidently visible on the ATM card.

The disclosed information relates to unwarranted or false information;84 and

The information disclosed in this case pertains to Complainant’s full name, account number, and card number. Although it cannot be said that the disclosed information was false since Complainant did not dispute their correctness, the presence of the third element was still established because the disclosed information was unwarranted.

To reiterate, the Complainant averred that she never granted the Respondent the right to publicize her data on social media.

xxx

That is my name not your AND I NOW STATED HERE AS MY LAST STATEMENT THAT I HAVE NOT GRANTED YOU THE RIGHT TO PUBLICIZE MY DATA SPECIALLY ON SOCIAL MEDIA.

xxx85

Here, it is clear that the posting of the ATM card was unwarranted. The claim of the Respondent that she was provoked by the Complainant due to non-payment of the debt or disregarding her messages is not a valid ground for posting the personal data of the Complainant. It should be emphasized that the act of the Respondent in posting personal information is not necessary nor justified, considering that it is a violation of the data privacy rights of the Complainant.

Moreover, the posting of the Respondent of the ATM card with the Complainant’s personal information to get the attention of the latter is unjustifiable, taking into consideration that the act of posting personal information without valid grounds as provided in the DPA is a clear violation of data privacy rights. Thus, the third element is present in this case due to the disclosure of unwarranted information.

The disclosure was made with malice or in bad faith.86

In this case, the Respondent has admittedly stated in her manifestations and submissions that the posting of the ATM card was because of the evasion of messages regarding the debt by the Complainant. To quote, the Respondent stated in her submission that:

11.) xxx. I posted that due to the fact that you’ve been hiding from me and avoiding all my chats, texts and email regarding your debt. You blocked me in all your social media accounts.

7.) ATM posted with your name was due to the fact that you ignored your obligation with me to pay your debt. I have the right to access it due to it was pawned to me with your consent.87

Accordingly, the Supreme Court defined bad faith in the case of Jaime P. Adriano and Legaspi Towers 300, Inc. v. Alberto Lasala and Lourdes Lasala, thus:

Bad faith does not simply connote bad judgment or negligence. It imports a dishonest purpose or some moral obliquity and conscious doing of a wrong, a breach of known duty through some motive or interest or ill will that partakes of the nature of fraud. It is, therefore, a question of intention, which can be inferred from one’s conduct and/or contemporaneous statements.88

Here, the statement of the Respondent connotes her purpose of getting the attention of the Complainant to pay for the remaining debt. In this regard, the Commission recognizes the right of the Complainant to collect the proceeds of the subject loan. Nonetheless, it should be done properly and in accordance with the law.

However, the unauthorized posting of the ATM card on a social media platform which contains personal information and financial information such as account number and card number for debt collection as admitted by the Respondent exhibits a dishonest purpose. Accordingly, the posting of the ATM card exposes the Complainant to possible harm and identity theft. Thus, the act of the Respondent in posting personal information demonstrates an intention to cause harm and to humiliate the Complainant.

In addition, Respondent posited that mentioning the name of the Complainant without malicious content is not a crime.89 This contention does not hold water.

It must be noted that it is not the content that has to be malicious in order to be liable under Section 31 of the DPA.90 Rather, it is the intention of the Respondent, inferred from her conducts, that determines whether she was motivated by bad faith.

To recall, Respondent admittedly stated that she posted Complainant’s ATM card in order to get the latter’s attention because she was blocked in all her social media platforms. Given that Respondent already knows that she will not be able to reach Complainant in social media since she was blocked, it can be concluded that through such conduct, there was a deliberate intent on her part to inform the public, particularly the individuals who have access in the posted information that the Complainant has an unpaid loan and to make it known that the same has blocked her. Hence, this act of the Respondent connotes malice or bad faith.

Accordingly, all the elements for violation of Section 31 of the DPA are present in this case.

Moreover, as purported in Section 16 (f) of the DPA, data subjects have the right to indemnification for any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information.91

Article 2221 of the New Civil Code, which provides for the restitution of any party aggrieved in relation to the DPA,92 states:

Art. 2221. Nominal damages are adjudicated in order that a right of the plaintiff, which has been violated or invaded by the defendant, may be vindicated or recognized, and not for the purpose of indemnifying the plaintiff for any loss suffered by him.93

Thus, given the foregoing, the malicious disclosure of personal information by posting the ATM card on social media is a violation of Section 31 of the DPA and is sufficient to warrant an award of nominal damages in favor of the Complainant.

WHEREFORE, premises considered, this Commission hereby:

  1. FINDS Respondent MU liable for Malicious Disclosure, violating Section 31 of Republic Act No. 10173 also known as the Data Privacy Act of 2012;

  2. AWARDS the Complainant MEA with nominal damages in the amount of thirty thousand pesos (₱30,000.00) for Respondent’s malicious disclosure of her personal information, pursuant to Section 16 (f) of the DPA; and

  3. FORWARDS this Decision and a copy of the pertinent case records to the Secretary of Justice and recommends the prosecution of MU for Malicious Disclosure of Personal Information under Section 31 of the DPA.

SO ORDERED.

City of Pasay, Philippines.

08 February 2024.

JOHN HENRY D. NAGA

Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

NERISSA N. DE JESUS

Deputy Privacy Commissioner

Copy furnished:

MEA

Complainants

MU

Respondents

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Complaints-Assisted Form dated 09 August 2022 of MEA. ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. Complaints-Assisted Form dated 09 August 2022 of MEA. ↩

  6. Id. ↩

  7. Id. ↩

  8. Id. ↩

  9. Complaints-Assisted Form dated 09 August 2022 of MEA. ↩

  10. Id. ↩

  11. Id. ↩

  12. Id. ↩

  13. Complaints-Assisted Form dated 09 August 2022 of MEA. ↩

  14. Id. ↩

  15. Id. ↩

  16. Id. ↩

  17. Complaints-Assisted Form dated 09 August 2022 of MEA. ↩

  18. Order dated 17 August 2022. ↩

  19. Id. ↩

  20. Verified Comment dated 19 September 2022 of MU. ↩

  21. Id. ↩

  22. Id. ↩

  23. Id. ↩

  24. Verified Comment dated 19 September 2022 of MU. ↩

  25. Id. ↩

  26. Id. ↩

  27. Id. ↩

  28. Verified Comment dated 19 September 2022 of MU. ↩

  29. Id. ↩

  30. Id. ↩

  31. Order dated 22 August 2022. ↩

  32. Motion for Execution issued by the Metropolitan Trial Court dated 12 August 2022. ↩

  33. Order dated 23 August 2022. ↩

  34. Email from MU dated 20 October 2022. ↩

  35. Id. ↩

  36. Order dated 24 October 2022. ↩

  37. Manifestation sent through email by MEA dated 28 October 2022. ↩

  38. Id. ↩

  39. Id. ↩

  40. Email dated 1 November 2022 from MU. ↩

  41. Order dated 02 November 2022. ↩

  42. Id. ↩

  43. Letter dated 11 November 2022 of MU. ↩

  44. Id. ↩

  45. Id. ↩

  46. Id. ↩

  47. Letter dated 11 November 2022 of MU. ↩

  48. Id. ↩

  49. Id. ↩

  50. Order dated 15 November 2022. ↩

  51. Email submission dated 15 November 2022 of MEA. ↩

  52. Id. ↩

  53. Id. ↩

  54. Email submission dated 15 November 2022 of MU. ↩

  55. Id. ↩

  56. Id. ↩

  57. Order dated 16 November 2022. ↩

  58. Id. ↩

  59. Email submission dated 25 December 2022 of MEA. ↩

  60. Id. ↩

  61. Id. ↩

  62. Id. ↩

  63. Email submission dated 25 December 2022 of MU. ↩

  64. Email submission dated 25 December 2022 of MEA. ↩

  65. Id. ↩

  66. Id. ↩

  67. Id. ↩

  68. Email submission dated 25 December 2022 of MEA. ↩

  69. Id. ↩

  70. Id. ↩

  71. Id. ↩

  72. Email submission dated 27 December 2022 of MEA. ↩

  73. Email submission dated 27 December 2022 of MU. ↩

  74. Id. ↩

  75. Id. ↩

  76. Order dated 09 January 2023. ↩

  77. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter VIII, § 31 (2012). ↩

  78. Id. ↩

  79. Data Privacy Act of 2012, chapter I, § 3 (h). ↩

  80. Email submission dated 27 December 2022 of MU. ↩

  81. Data Privacy Act of 2012, chapter II, § 31. ↩

  82. Data Privacy Act of 2012, chapter I, § 3 (j). ↩

  83. Data Privacy Act of 2012, chapter I, § 3 (g). ↩

  84. Data Privacy Act of 2012, chapter VIII, § 31. ↩

  85. Email submission dated 27 December 2022 of MEA. ↩

  86. Data Privacy Act of 2012, chapter VIII, § 31. ↩

  87. Email Submission dated 11 November 2022 of MU. ↩

  88. Adriano v. Lasala, G.R. No. 197842, [October 9, 2013], 719 PHIL 408-421. ↩

  89. Letter dated 11 November 2022 of MU. ↩

  90. Data Privacy Act of 2012, chapter VIII, § 31. ↩

  91. Data Privacy Act of 2012, chapter IV, § 16 (f). ↩

  92. An Act to Ordain and Institute the Civil Code of the Philippines [Civil Code of the Philippines], Republic Act No. 386, book IV, chapter 3, § 3, Art. 2221 (1949). ↩

  93. Id. ↩

Backlinks

  • No backlinks found