Decision Text
EG,
Complainant,
-versus-
JI, RO, and RR
Respondent.
x----------------------------------------------------x
NAGA, P.C.;
Before this Commission is a Complaint filed by EG against JI, RO, and RR (collectively, Respondents) for an alleged violation of Section 32 of Republic Act No. 10173, or the Data Privacy Act of 2012 (DPA).
Facts
On 01 June 2021, EG filed a Complaint-Affidavit with the NPC’s Complaints and Investigation Division (CID), alleging that he was a resident of Chateau Elysée, a condominium in Parañaque City, while Respondents JI works as an Administrative (Admin) Assistant, RO works as the Admin Manager, and RR as the Chief Security of Chateau Elysée Condominium.
In his Complaint-Affidavit, EG alleged that he “had a verbal argument with another tenant in his building, a British-Filipino citizen, which alerted the security agency, including the respondent RR.” EG averred that “when things escalated, matters were reported to the building administrators and the British Filipino nurse, conducted their (sic) own private investigation about [the Complainant].”
EG claimed that “[t]hey talked to the security and was able to secure a video footage of the Complainant, his identity, whereabouts, and other footage containing his personal information without his consent.”
EG alleged that “[i]n the meeting with the Barangay, Respondents JI and RO (sic), employees of Chateau Elysee Condominium, admitted that they [had] released the video footage to the British-Filipino Nurse and admitted that they did so without the consent of EG.”
EG further alleged that there was no privacy notice from the Condominium Corporation informing the tenants that the building administration was processing personal data.
Subsequently, EG filed a complaint with the barangay due to alleged privacy violations.
EG attached in his Complaint-Affidavit a letter addressed to the Respondents dated 01 December 2020. In the letter, EG informed the Respondent of the alleged privacy violation and demanded “for damages as reparation and indemnity for [the] unauthorized disclosure of personal information.”
An Order to Comment dated 30 June 2021 was issued ordering Respondents to file a verified comment within fifteen (15) calendar days from receipt of the Order.
On 27 August 2021, an Order to Appear for Preliminary Conference was issued ordering the parties to appear virtually for Preliminary Conference on 13 October 2021 and 27 October 2021.
Respondents filed their Comment dated 25 September 2021 praying that the complaint be dismissed for lack of merit. Respondents averred that they were deployed in the condominium, with RO working as the “Admin Manager of Maininvest General Services Inc.”; JI as an “Admin Assistant” of the same agency; and RR as a “Security Officer of Commander Security Services Inc[.]”
Respondents stated that “EG [had] a misunderstanding or quarrel [with] one of the tenant [s] namely [JM and PM] at the lobby of Cluster 5.” Respondents alleged that EG filed a complaint before the Barangay due to the incident, and that Spouses JM and PM went to the Property Management Office and requested for the closed-circuit television (CCTV) footage to prove “that there [wa s] no physical interaction between the two parties and to enlightened (sic) the Barangay Lupon [on] what really happened [during] that time.”
Though not explicitly stated, the “British Filipino nurse” mentioned in EG’s Complaint-Affidavit can reasonably be inferred to be PM as mentioned in the subsequent submissions of the parties. This is bolstered by the fact that EG, in his Memorandum, alleged that he had a verbal argument with PM sometime in January 2020.
Respondents also alleged that EG went to the administrative office to complain about RR for releasing the CCTV footage to the Spouses JM and PM.
Respondents averred that as part of the protocol for this kind of request for investigation, JI, as the Admin Assistant, will only receive the complaint or request and collate relevant details which will then be endorsed to the Head of Security or Shift-in-Charge for investigation. Here, JI forwarded the request to obtain the CCTV to RR, who was the Security-in-Charge at that time. Respondents alleged that JI had no authority nor jurisdiction to approve the release of any documents, personal information, or CCTV footage to any person without the approval of the proper authority.
Respondents alleged that RR interviewed and investigated the Spouses JM and PM request and retrieved the CCTV footage as evidence to show the lack of physical altercation between Spouses JM and PM and EG. Respondents averred that “[the Spouses JM and PM] presented a letter to RR from Barangay Moonwalk, a Subpoena, and a request letter requesting the evidence on the said incident.” Thus, RR was convinced to release the CCTV footage to assist the Spouses JM and PM “without the approval of the Management or the Security Agency.”
At the hearing before the Barangay, the Spouses JM and PM presented the CCTV footage received from RR which “is one of the pieces of evidence in helping the Barangay to resolve the issues of both parties and to amicably settle the issue between the conflicting parties.”
As their defense, Respondents alleged the following:
-
At the onset, [Respondents] were not furnished [with] a copy of the complaint and thus, had no opportunity to contest the allegations of the complainant.
-
The Complainant failed to comply [with] the substantial requirements for PRE-INVESTIGATION PHASE for failure to give the Respondent the opportunity to address the issue when it sent a defective demand letter as stated in Rule IV Section 1.
Respondents further argued that EG “improperly informed the Respondents of the sufficient factual circumstances surrounding the alleged violation by failing to specify on the demand letter sufficient information on what is [sic] necessary action to be done and the nature of the alleged violation.”
Respondents argued that RO and JI should not be liable for the release of the CCTV footage. RO was out of the office when the Spouses JM and PM requested the said footage and was unaware of the request. Further, Respondents alleged that “JI was only performing her duty as an administrative assistant in recording, receiving the complaint, and endorsing the concerns or issues to the investigating department.”
Moreover, Respondents alleged that the actions RR took by providing the CCTV footage to the Spouses JM and PM, upon their request, was a “lawful exercise of rights and duties and not violative of any existing privacy laws, guidelines, or policies and done in good faith” to resolve the issues arising from the contending parties and to amicably settle the issue between the conflicting parties.
After the preliminary conference on 13 October 2021, both parties manifested that they were willing to undergo mediation proceedings.
In an Order dated 13 October 2021, the CID stated that:
DL manifested that while respondents received the Order to Virtually Appear for Preliminary Conference dated 17 August 2021, no copy of the complaint and its annexes was attached as raised in the verified comment they have filed. Hence, he requested that respondents be given additional period of time to file amended or supplemental verified comment after receiving a copy of the complaint. Complainant, through counsel, opposed no objection thereto.
The CID ordered that “a copy of the complaint and its attachments, Order to Comment dated 30 June 2021 and all verified comments be furnished” to the parties’ specified addresses.
Subsequently, EG filed a Manifestation with Motion dated 31 October 2021 with a prayer to terminate the mediation proceedings. In the Manifestation, it was alleged that EG emailed his counsel and expressed his unwillingness to enter into mediation with the Respondents.
An Order dated 07 December 2021 was issued granting the motion to terminate the mediation process. Moreover, the Respondents were ordered to submit their amended/supplemental verified comment within fifteen (15) days from receipt of the Order. Further, the parties were ordered to appear for a preliminary conference on 26 January 2022.
The Respondents filed their Joint Counter-Affidavit dated 28 December 2021 wherein they reiterated the discussions made in their initial Comment.
In the Joint Counter-Affidavit, Respondents further alleged that:
- The releasing of video footage (sic) in favor of JM and PM, the British-Filipino nurse, was decided solely by RR;
a. RR is the Security Officer/CCTV System Operator, who assisted JM and PM do during the investigation of the facts and circumstances that transpired between subjects of the video footage. He released the same to JM and PM upon their request and consent as part of the evidence to prove that there was no physical interaction that transpired between them and the complainant during their confrontation last 9 January 2020.
b. That JM and PM are one of the registered tenants of Chateau Elysee Condominium who provided all documents necessary for the release of the video footage involving them for proper investigation such investigation request form and waiver declaring that the CCTV footage requested will be used only to resolve their issues with the complainant in the Barangay Moonwalk and not to post in social media or other media platforms. They [JM and PM] also declared taking full responsibility of any legal consequences that may arise from request especially the Data Privacy Act of 2012.
The CID issued an Order dated 04 January 2022 noting the submission of the Joint Counter Affidavit.
In the second preliminary conference on 26 January 2022, the parties stipulated the following issues to be resolved:
whether or not the release of the CCTV footage constitutes a violation of the Data Privacy Act; and
whether or not Respondents RO and JI, who have not participated in the release of the video coverage would be held liable.
The parties were ordered to simultaneously submit their respective memoranda.
Respondents filed their Memorandum dated 22 February 2022, wherein they reiterated their claims and defenses in their past submissions and further made additional allegations.
In their Memorandum, Respondents claimed that they “informed JM and PM regarding the legal action taken by [EG] for releasing the requested CCTV Footage.” Moreover, the Spouses JM and PM “provided a signed a letter to the Property Management Office of Chateau Elysée declaring the CCTV Footage they [got] from Chateau Elysee will be used as evidence to enlighten the Barangay Moonwalk on what truly happened during their confrontation with EG.”
Respondents alleged that “the CCTV System installed at the Chateau Elysée Condominium was provided by the Commander Security Services Inc. to the Condominium Corporation as part of the Contract Service Agreement and was publicly conveyed to all the members and unit owners based on this contract.” Respondents alleged that RR was “assigned to [the] position [of] Security Officer who will conduct [the] review, [restoration], and make (sic) an investigation report pertaining to the CCTV System operation as part of his duties and responsibilities.”
Respondents, as part of their defense, argued that the release of the CCTV footage was justified since it was in accordance with Section 7 of NPC Advisory No. 2020-04 in relation to Section 13 of the DPA.
Moreover, the Respondents argue that the “consent of the other party (like [EG]) is not necessary particularly when its release is contrary to the interest of the non-consenting [party] and necessary for the defense of the data subject, which is considered a legitimate interest.”
Respondents also argued that the data subjects whose personal information were processed are those of Spouses JM and PM personal information, which was necessary for their defenses against EG’s accusation in the barangay proceedings.
EG submitted his Memorandum dated 23 February 2022, alleging that he is a “data subject and that his personal information is being processed by the building administrator and security personnel.” Moreover, EG alleged that “the release of PM’s personal information for whatever purpose may be achieved without disclosure of the personal information of non-consenting subjects by masking portions of the video.”
Further, EG argued that as the personal information controller (PIC), Respondents were bound “to safeguard [the] personal information and not disclose said information without the data subject’s consent.” EG further alleged that Respondents admitted that the CCTV was released without his consent and was therefore unauthorized. EG also argued that the access to the CCTV Footage did not comply with the provisions of NPC Advisory No. 2020-04. He also averred that “the lack of CCTV Notice on the premises shows their unawareness of their responsibilities under the law and of the sanctions it can bring.”
Issue
Whether Respondents committed a violation of the DPA.
Discussion
The Commission dismisses the complaint for lack of merit.
EG, as the complainant, has the obligation to prove by substantial evidence that either JI, RO, or RR committed a privacy violation under Section 32 of the DPA.
As already established in past rulings, in administrative proceedings such as in this Commission, the burden is on the Complainant to prove by substantial evidence that the allegations in the complaint are true. In the case of Billanes vs. Latido, the Supreme Court defined substantial evidence as “that amount of evidence which a reasonable mind might accept as adequate to justify a conclusion.”
In EG’s Memorandum, it was averred that Respondents “committed a violation upon the release of the video containing the personal information of a non-consenting subject.” Further, EG alleged that “the purpose could be achieved without disclosing personal information of a non-consenting subject by the testimony of witnesses or, should the video be indispensable, by masking of personal information of the non-consenting subject.” Lastly, EG averred that as a “[PIC], [Respondents] have the duty to safeguard personal information and may only release personal information with the consent of the subject concerned.” EG alleged that such unauthorized disclosure is penalized under Section 32 of DPA.
Respondents, in their defense, argued that the “consent of the other party (like [EG]) is not necessary particularly when its release is contrary to the interest of the non-consenting [party] and necessary for the defense of the data subject, which is considered a legitimate interest.” Further, Respondents alleged that “the action made by [RR] by providing [the] CCTV footage [to] JM and PM upon their request is a lawful exercise of [their] rights and duties and [is] not violative of any existing privacy laws, guidelines or policies and done in good faith” to resolve the issues arising from the contending parties and to facilitate an amicable settlement between them.
The Commission, after extensively reviewing the evidence and claims of both parties, finds that there is no substantial evidence to conclude that Respondents are liable since EG failed to establish that the processing of the CCTV footage was violative of Section 32 of the DPA or his data privacy rights.
Section 32 of the DPA provides:
Section 32. Unauthorized Disclosure. – (a) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).
As discussed by the Commission in NPC 21-010 to 21-015,
Based on a literal reading of Section 32 of the DPA, a PIC or a PIP is liable if it discloses to a third party personal or sensitive personal information without the consent of the data subject. Following a literal reading, a PIC or PIP will have committed Unauthorized Disclosure if the disclosure is without the consent of the data subject even in the disclosure is justified by another lawful criterion for processing. It does not recognize that such disclosure may be based on other criteria for lawful processing enumerated in Sections 12 and 13 of the DPA. As such a literal reading of Section 32 of the DPA will result in absurdity.
To be liable for Section 32 of the DPA, the following elements must concur:
- The perpetrator is a personal information controller or personal information processor or any of its officials, employees or agents;
- The information relates to personal or sensitive personal information;
- The perpetrator disclosed personal or sensitive personal information;
- The disclosure was made to a third party;
- The personal or sensitive personal information disclosed is neither unwarranted nor false information;
- The disclosure was not malicious nor done in bad faith; and
- The disclosure was without any of the lawful bases for processing under Section 12 and 13 of the DPA.
As will be discussed below, not all of the elements for a Section 32 violation of the DPA are present in this case.
I. Respondent RR Is an Employee of a Personal Information Processor
The first element is present in this case as to RR. For clarity, a PIC “refers to a person or organization, who controls the collection, holding, processing, or use of personal information, including a person or organization, who instructs another person or organization to collect, hold, process use, transfer or disclose personal information on his or her behalf.”
Meanwhile, a personal information processor (PIP) “refers to any natural or juridical person qualified to act as such under this Act to whom a [PIC] may outsource the processing of personal information pertaining to a data subject.”
Respondents averred that they were employed in the condominium, with RO working as the “Admin Manager of Maininvest General Services Inc.”; JI as an “Admin Assistant” of the same agency; and RR as a “Security Officer of Commander Security Services Inc[.]”
Further, in Respondents’ Memorandum, it was stated that the CCTV System installed at Chateau Elysée Condominium was provided by Commander Security Services Inc. to the Condominium Corporation as part of the Contract Service Agreement. From the circumstances, Commander Security Services Inc. acts as a PIP by virtue of its contract with the Condominium Corporation to install and operate a CCTV system within their premises. It can be inferred that the processing of information through the CCTV medium is being processed on behalf of the Chateau Elysée Condominium. It is Chateau Elysée Condominium that controls the processing of personal information through CCTV. Thus, based on the foregoing, the PIC in relation to the CCTV system is the Condominium Corporation.
In this respect, RR, as an employee of Commander Security Services Inc., is an agent acting on behalf of the PIP.
However, it is unclear from the records whether JI and RO may be considered PIPs in relation to EG complaint. It should be noted that JI and RO belong to a different agency from RR. They are employed by Maininvest General Services Inc. This agency’s role as a PIP was not fully elaborated in this case. It fell to EG, as the complainant, to prove with substantial evidence how JI and RO actions are within the scope of the DPA either as agents acting on behalf of the PICs or PIPs.
In EG Memorandum, he lumps all the respondents together as violators of the DPA since they are allegedly PICs. However, as the complainant, he had the burden of explaining how each respondent acted in violation of the DPA. After scrutinizing the records, the Commission cannot adequately conclude that JI and RO may fall under the same category as agents acting on behalf of the PIPs. There was no adequate discussion on the role of Mainvest General Services Inc., what personal data was processed by the agency or by JI and RO, and how their actions may characterize them as agents of the PICs or PIPs.
Thus, the first element is present for RR since he is an agent acting on behalf of the PIP. However, the first element is absent for JI and RO.
II. The CCTV Footage Contains Personal Information
Personal information “refers to any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information or, when put together with other information, would directly and certainly identify an individual.”
A CCTV “refers to closed-circuit television or camera surveillance system in a fixed or stationary location that can capture images of individuals or other information relating to individuals.” In NPC Advisory Opinion No. 2019-023, “if a camera surveillance footage is of sufficient quality, a person with the necessary knowledge will be able to reasonably ascertain the identity of an individual from the footage.”
Here, the CCTV footage contains personal information since it could identify parties such as EG through its system of recording videos or capturing images of the data subjects. Thus, the second element is present.
III. Respondent RR Disclosed the Personal Information of EG
In EG Complaint-Affidavit, it was alleged that the Spouses JM and PM were able to secure the CCTV footage of the incident without his consent. In Respondents’ Comment, it was admitted that the CCTV footage was released after RR investigated the request and was convinced that the footage will be used in the barangay proceedings involving the dispute between EG and the Spouses JM and PM.
Disclosure has been defined as “the release, transfer, provisions of, access to, or divulgence in any manner of information outside the entity holding the information.”
In this case, the act of RR releasing the CCTV footage to the Spouses JM and PM constituted an act of disclosure. Thus, the third element is present as to RR.
However, the third element is absent when it comes to JI and RO. Based on Respondents’ Comment, JI actions were limited to receiving the complaint and endorsing the concerns to the investigating department. Particularly, JI endorsed the request of the spouses to RR, who was the security-in-charge at that time, who then investigated and eventually released the footage to the Spouses JM and PM.
Further, while RO worked as the “Admin Manager” of the condominium, Respondents argued that he was on official business at the time and was not in the office during the incident. The records do not show any sufficient proof to refute this claim.
Thus, EG has not established with substantial evidence that either JI or RO actively participated in the release of the CCTV footage.
IV. The Spouses JM and PM Are Not Third Parties
In EG Complaint, he alleged that “he did not give his consent in the disclosure of his personal information to strangers conducting their own private investigation about him.”
Respondents further alleged that the Spouses JM and PM requested a copy of the CCTV Footage “as evidence to show lack of physical interaction (sic) between the two parties and to enlighten the Barangay Moonwalk that only [a] simple misunderstanding of both parties had transpired.” Respondents also argued that the data subjects whose personal information was processed are those of Spouses JM and PM personal information, which was necessary for their defenses against EG accusation in the barangay proceedings.
Meanwhile, under Section 7 of NPC Advisory No. 2020-04:
SECTION 7. Data subject request for access. – Any person whose image is recorded on a CCTV system has a right to reasonable access and/or be supplied with a copy of their own personal data from the footage, subject to the provisions of Section 13 of this Advisory.
xxx
Where images of parties other than the requesting data subject and/or the person/s sought to be identified as part of the request (e.g. identification of malefactors for investigation or law enforcement purposes) appear on the CCTV footage, legitimate interest under Section 12(f) of the DPA may apply as basis for disclosing, subject to Section 9 of this Advisory. (Emphasis supplied)
Here, the Spouses JM and PM cannot be reasonably considered third parties, given that they are also data subjects captured in the CCTV footage. As data subjects, Spouses KM and PM has a reasonable claim to access and obtain the CCTV footage used in the barangay dispute between EG and the Spouses JM and PM.
V. The Personal Information Is Neither Unwarranted Nor False Information
For a violation of Section 32 of the DPA to be committed, the personal or sensitive information should neither be unwarranted nor false.
In this case, there is no indication that the CCTV footage was falsified, altered, or considered unwarranted. Though EG alleged that the footage was disclosed without his consent, the disclosure was in relation to the barangay dispute. The presentation of the CCTV footage is warranted and necessary in the barangay dispute to prove the defense of Spouses JM and PM. Moreover, EG did not dispute the veracity of the CCTV footage that it was false or altered. Thus, the fifth element is present.
VI. There Was No Bad Faith or Malice on the Part of Respondents
The Supreme Court has defined “malice” as that which “connotes ill will or spite and speaks not in response to duty but merely to injure the reputation of the person defamed and implies an intention to do ulterior and unjustifiable harm.” As to bad faith, it “implies a conscious and intentional design to do a wrongful act for a dishonest purpose or some moral obliquity.”
Further, the Supreme Court ruled in Wong vs. Wong:
The rule is well-settled that he who alleges a fact has the burden of proving it and a mere allegation is not evidence. Thus once more, his self-serving assertion cannot be given credence. This is especially so in light of the presumption of regularity, which herein ought to prevail due to the absence of any clear and convincing evidence to the contrary.
In this case, EG did not prove that Respondents acted with malice or bad faith in disclosing his personal information. Indeed, EG accused the Respondents of violating Section 32 of the DPA, which is a privacy violation falling outside Malicious Disclosure under Section 31 of the DPA. Thus, the sixth element is also present.
VII. There Is a Lawful Basis on the Part of Respondent RR in Releasing the CCTV Footage to Spouses JM and PM
The seventh element is absent. EG alleged that the release of the CCTV footage was made without his consent. However, consent is not the only criterion for lawful processing under the DPA.
Sections 12(f) and 13(f) of the DPA state:
SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:
xxx
(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.
SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:
xxx
(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority. (Emphasis supplied)
Further, Section 9 of NPC Advisory No. 2020-04, provides:
SECTION 9. Legitimate interest three-part test. In determining whether the data subject access request, in instances when the CCTV footage includes other data subjects, under Section 7, or the third-party access request under Section 8(E) may be allowed pursuant to legitimate interest as provided for under Section 12(f) of the DPA, the following shall be considered:
A. Purpose test - The existence of a legitimate interest must be clearly established, including a determination of what the particular processing operation seeks to achieve.
B. Necessity test - The processing of personal information must be necessary for the purposes of the legitimate interest pursued by the PIC or third party to whom personal information is disclosed, where such purpose could not be reasonably fulfilled by other means; and
C. Balancing test - The fundamental rights and freedoms of data subjects must not be overridden by the legitimate interests of the PICs or third party, considering the likely impact of the processing on the data subjects.
In this regard, CCTV footages requested for purposes of the protection of lawful rights and interests or the establishment, exercise or defense of legal claims under Section 13(f) of the DPA may be considered as legitimate interest.
It is apparent in the submissions of the parties that the CCTV footage obtained by the Spouses JM and PM was used as part of their defense in a complaint against them before the barangay. The CCTV footage was used to prove that there was no physical altercation between the Complainant and the Spouses JM and PM. Thus, the release of the footage was necessary for the exercise of the spouses’ defenses in the barangay proceeding. The purpose for the release of the footage was adequately shown through the Investigation Request Form, and the Spouses JM and PM’s letter dated 31 January 2020.
In the case of [[decisions/2019/cid-17-k-003-krl-vs-trinity-university-of-asia-aa-mc-ncb-rg-gv-gct-rr-mr-pb|KRL vs. Trinity University of Asia, et. al.]], the Commission ruled:
Although Section 13(f) applies to sensitive personal information while the information involved in this case is just personal information, the protection of lawful rights and interests under Section 13(f) by the respondent faculty members in this case is considered as legitimate interest pursuant to Section 12(f) of the DPA.
In this case, although the CCTV footage is considered as personal information, Section 13(f) is applicable since the processing of the CCTV is pursued under a legitimate interest for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise, or defense of legal claims of Spouses JM and PM.
Moreover, in NPC 21-031, the Commission ruled:
The phrase ‘for the protection of lawful rights and interests of natural or legal persons in court proceedings’ cannot be interpreted to relate only to the person asserting the lawful basis of the processing of personal information. It also contemplates situations where those persons whose lawful rights and interests are protected in court proceedings may not be the same individuals who processed the personal information, such as in the case of witnesses. Similarly, the next clause ‘establishment, exercise or defense of legal claims’ may be interpreted to refer to the legal claims of persons other than those who processed the personal information.
Here, it was admitted that the CCTV footage was released after RR investigated the request and was convinced that the footage will be used in the barangay proceedings involving the dispute between EG and the Spouses JM and PM. Considering that Section 13(f) of the DPA may be invoked by persons other than those who processed the personal information, the act of RR in releasing the CCTV footage for the establishment of the defense of Spouses JM and PM in the Barangay proceeding is considered lawful processing.
Second, the release of the CCTV footage can be considered necessary since it is a crucial piece of evidence to prove the defense of the spouses in the barangay proceeding. It is not shown that there were other means to support their defenses other than the CCTV footage.
Lastly, there is no substantial evidence to show that the fundamental rights and freedom of EG have been overridden by the release of the CCTV footage. Thus, Respondent’s lawful processing of EG’s personal information was for the legitimate interest of Spouses JM and PM for their defense in the barangay proceedings.
In totality, not all of the elements are present to warrant a finding that the Respondents violated Section 32 of the DPA. There is a lack of substantial evidence to prove a privacy violation.
WHEREFORE, premises considered, this Commission resolves that the instant Complaint filed by EG against JI, RO, and RR is hereby DISMISSED for lack of merit.
SO ORDERED.
City of Pasay, Philippines. 22 September 2022.
JOHN HENRY D. NAGA Privacy Commissioner
I CONCUR:
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
Copy furnished:
EG Complainant
LB Counsel for Complainant
JI, RO, and RR Respondents
DL Counsel for Respondents
COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission