NPC Issuance Wiki

NPC 18-004 and NPC 18-005: CA v. WestParc Condominium and VP v. WestParc Condominium

Issued Decision

Decision Text

CA,

Complainant,

-versus-

WESTPARC CONDOMINIUM,

Respondent.

x----------------------------------------------------x

VP,

Complainant,

-versus-

WESTPARC CONDOMINIUM,

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before this Commission is a Complaint filed by CA and VP (Complainants) against Westparc Condominium (Westparc) for an alleged violation of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

In January 2018, Westparc’s Condominium Association posted Circular No. WPCC-001-2018 (Circular) on the condominium’s bulletin board.1 The Circular urged condominium residents to submit a Unit Owner Information Sheet (201 File) for the purpose of updating and correcting inaccurate information in specific 201 files related to Westparc Condominium.2 In the Circular, Westparc requested the submission of the following documents:

If Owned:

  1. Completed Information Sheet of the Unit Owner with two Recent Colored Photos (2x2) with White Background
  2. Completed Information Sheet of the Occupants of the Condominium Unit with two Recent Colored Photos (2x2) with White Background
  3. At least 2 Valid Government Issued I.D. with picture
  4. Condominium Certificate of Title (CCT)
  5. Condominium Transfer Certificate of Title and Deed of Absolute Sale if not the First Owner of the Property
  6. Completed Parking Sticker Application form as approved by the Building Manager (if with parking)
  7. If unit is mortgaged or under financing, Certification or Clearance from Bank or any Financial Institution for purposes of move-in of either unit buyer or tenant
  8. Copy of Passport if not a Filipino3

If Leased:

  1. Completed Information Sheet of the Unit Owner with two Valid Government Issued I.D.s with photo, two Recent Colored Photos (2x2) with White Background and a Copy of Passport if not a Filipino
  2. Completed Information Sheet of the Lessee with two Valid Government Issued I.D.s with photo, two Recent Colored Photos (2x2) with White Background and a Copy of Passport if not a Filipino
  3. Completed Information Sheet of the Occupants of the Condominium Unit with two Valid Government Issued I.D.s, two Recent Colored Photos (2x2) with White Background and a Copy of Passport if not a Filipino
  4. Notarized Lease Contract as Approved by the Building Manager
  5. Condominium Certificate of Title (CCT)
  6. Condominium Transfer Certificate of Title and Deed of Absolute Sale if Unit Owner is not the First Owner of the Property
  7. Completed Parking Sticker Application form as approved by the Building Manager (if with parking)
  8. If unit is mortgaged or under financing, Certification or Clearance from Bank or any Financial Institution for purposes of move-in of either unit buyer or tenant
  9. Broker’s Accreditation Form as Approved by the Building Manager (if Leased through a Broker)
  10. Special Power Of Attorney (SPA) from the Unit Owner for all authorized representatives of the Unit Owner4

Subsequently, Complainants alleged that they attempted to access their respective 201 files on multiple occasions by personally visiting the administration office, but they were unsuccessful.5

Due to the administration office’s refusal to accommodate their verbal requests, on 07 February 2018, both Complainants, through counsel, sent letters to Westparc’s administration office with the following demands:

  1. The Association FURNISH COPIES OF RELEVANT BOARD RESOLUTIONS, MEETING MINUTES, OR SIMILAR DOCUMENTS SUPPORTING SUCH REQUIREMENT FOR SUBMISSION OF 201 FILES;

  2. The Association TO ALLOW ACCESS AND INSPECTION OF, AND FURNISH COPIES OF THE 201 FILES OF OUR CLIENTS, MS. CA and MS. VP SO WE MAY INSPECT THE PERSONAL INFORMATION AND SENSITIVE PERSONAL INFORMATION IN POSSESSION OF THE CONDOMINIUM ASSOCIATION AND DETERMINE WHETHER THE CONDOMINIUM MISPLACED OR LOST ANY OF THE DOCUMENTS PERTAINING TO MS. CA AND MS. VP;

  3. The Association FURNISH COPIES OF REGISTRATION WITH THE NATIONAL PRIVACY COMMISSION AS PERSONAL INFORMATION CONTROLLER; and

  4. In case the Association is not registered as a personal information controller with the National Privacy Commission, that the ASSOCIATION IMMEDIATELY CEASE AND DESIST FROM IMPLEMENTING WPCC-001-2018. Should you fail to comply, we shall be constrained to avail any and all remedies available in law and equity to ensure the rights of Ms. VP and Ms. CA to peaceable enjoyment of their property.6

On the same date, Complainants sent another demand letter to Westparc “pertaining to the conduct of JAC, purportedly the ‘Security Officer’ of Westparc Condominium.”7 After receiving a memorandum alleging that Complainants “inspected the installed

CCTV cameras and asked about details of the CCTV system,” JAC reported an incident to the PNP against Complainants claiming that they violated a city ordinance and the Cybercrime Law.8 Complainants claim that JAC cannot validly act as security officer because he was not appointed as such:

JAC purports to be the in-house security officer of Westparc. We find this claim incongruous as Westparc engaged the services of ISSI as its security forces provider.

Lacking appointment as Security Officer, JAC has NO BUSINESS AT ALL to require the security forces to furnish him copies of reports pertaining to our clients, residents of Westparc. Needless to say, this is a violation of the rights to privacy and peaceable enjoyment of property of our clients.9

Thus, Complainants demanded copies of the board resolutions appointing JAC as Security Officer.10 Complainants also demanded that Westparc immediately cease allowing JAC to act as a Security Officer and retrieve any documents related to Westparc residents from him, if Westparc fails to comply with its request and if it did not officially appoint him as Security Officer.11

Complainants allege that as of 28 February 2018, they have not received any response from Westparc with regard to both demand letters.12

On 02 March 2018, Complainants filed two Complaint-Affidavits before the National Privacy Commission (NPC) accusing Westparc of violating the DPA.13

On 10 April 2018, the NPC, through its Complaints and Investigation Division (CID), issued an Order directing the parties to attend a discovery conference set on 03 May 2018.14

During the Discovery Conference held on 03 May 2018, only Complainants and their representatives were present.15 Complainants expressed their intent to request for the production of their 201 files and also sought copies of all documents related to them.16

Complainants stated that they would “like to demand for [the] authority by which the association is requiring all of the residents to comply with that [sic] directives to furnish personal and sensitive personal information to them.”17

Complainants expressed concerns about the security of the documents, as they have no means to verify whether the “personal and sensitive personal information in [Westparc’s] custody are appropriately protected by physical and technological safeguards.”18 Complainants also mentioned that given the issue on the security of the documents, there is potential unauthorized access that could harm their rights.19

During the discovery conference, Complainants discussed that after the filing of the complaint, they discovered the installation of a close-circuit television (CCTV) system with audio recording capabilities in the condominium.20 They aver that the CCTV system is an “undue violation of their privacy rights [e]specially the privacy of their homes.”21 Complainants manifested that they will file a supplemental pleading regarding the installation of CCTV with audio system.22

On 04 May 2018, the CID directed Westparc to produce the documents that Complainants requested.23 Complainants required Westparc to produce the following:

a. 201 files of Complainants

b. Actual copies of all documents that Respondent have pertaining to the Complainants

c. Authority by which the association is requiring all of the residents to comply with the directives to furnish personal information and sensitive personal information

d. Security measures implemented by the Respondent to protect personal information and sensitive personal information in their custody24

The deadline for the submissions was set for 13 May 2018.25 CID also set another hearing for 15 May 2018.26

Westparc failed to comply with the deadline set by the CID for the submission of the required documents.27 Further, during the 15 May 2018 Discovery Conference, only the Complainants’ counsel was present.28

On 23 July 2018, Complainants filed a Supplemental Complaint raising concerns regarding the CCTV installation in Complainants’ building.29 They stated that “the unsecured layout of cables and network devices may have resulted in unauthorized access by third parties, thereby causing violation of [Complainants’] right to privacy.”30 According to Complainants, there is a “possibility that there may be unauthorized persons who may access and control the playback and recording system, as well as have the capability to generate copies of any and all captured data by the CCTV system, whether audio or video.”31 Thus, Complainants sought the intervention of the NPC to look into whether there was a violation of their privacy rights and take appropriate action accordingly.32

On 23 August 2018, the CID directed the conduct of an Onsite Investigation on Westparc – Cedar Condominium.33

On 27 December 2022, the CID issued an Order directing Westparc to submit the required documents enumerated in the 04 May 2018 Order and to submit a Verified Comment within fifteen (15) days from receipt of the Order.34 Moreover, the CID required all parties to attend the preliminary conference set on 31 January 2023 and 28 February 2023.35

On 31 January 2023, none of the parties attended the Preliminary Conference.36 Thus, it was reset to 28 February 2023.37

On 28 February 2023, both parties failed to attend the Preliminary Conference.38 Hence, in an Order dated 28 February 2023, the CID directed the parties to submit their respective memoranda and emphasized that upon the lapse of the given periods for submission the case will be submitted for resolution.39

To date, the Commission has not received any submission from either party.

Issue

Whether Westparc is liable for violation of Complainants’ right to access under Section 16 (c) of the DPA.

Discussion

The Commission finds Westparc liable for violation of the Complainants’ right to access under Section 16 (c) of the DPA.

In administrative proceedings, Complainants carry the burden of proof to establish their allegations with substantial evidence.40

Substantial evidence is defined as such relevant evidence that a reasonable mind may accept as adequate to support a conclusion.41

Section 1, Rule 131 of the Rules of Court provides a distinction between burden of proof and burden of evidence:

Section 1. Burden of proof and burden of evidence. - Burden of proof is the duty of a party to present evidence on the facts in issue necessary to establish his or her claim or defense by the amount of evidence required by law. Burden of proof never shifts.

Burden of evidence is the duty of a party to present evidence sufficient to establish or rebut a fact in issue to establish a prima facie case. Burden of evidence may shift from one party to the other in the course of the proceedings, depending on the exigencies of the case.42

Thus, in this jurisdiction, it is recognized that a party who alleges a fact has the burden of proving it.43

Complainants attached evidence in their submissions such as a photographed copy of the Circular, a photographed copy of a Unit Owner Information Sheet (201 File), and two (2) demand letters.

Once the complainant has established his case, the burden of evidence shifts to the respondent, who, in turn, has the burden to establish his defense.

Westparc, however, neglected to submit the documents as directed by CID in multiple Orders. Westparc also failed to appear without notice or justification, despite several opportunities to address the complaints against it.

NPC Circular 2016-04 (2016 Rules of Procedure) provides:

Section 22. Rendition of decision. The Decision of the Commission shall adjudicate the issues raised in the complaint on the basis of all the evidence presented and its own consideration of the law.44

As such, on the basis of all the evidence presented, there is sufficient support for Complainants’ claim that there is a violation of their right to access.

Under the right to access, individuals can request for access to their personal information held by a personal information controller (PIC). Section 16(c) of the DPA provides:

Section 16. Rights of the Data Subject. The data subject is entitled to:

…

(c) Reasonable access to, upon demand, the following:

(1) Contents of his or her personal information that were processed;

(2) Sources from which personal information were obtained;

(3) Names and addresses of recipients of the personal information;

(4) Manner by which such data were processed;

(5) Reasons for the disclosure of the personal information to recipients;

(6) Information on automated processes where the data will or likely to be made as the sole basis for any decision significantly affecting or will affect the data subject;

(7) Date when his or her personal information concerning the data subject were last accessed and modified; and

(8) The designation, or name or identity and address of the personal information controller.45

As alleged by Complainants, they attempted to access their respective 201 files on multiple occasions by personally visiting the administration office.46 Due to the administration office’s refusal to accommodate verbal requests, on 07 February 2018, both Complainants sent demand letters to Westparc.47

Westparc, however, denied Complainants’ efforts to assert their right to access. Complainants’ attempts to exercise their rights were met with a lack of responsiveness from Westparc, as indicated by its failure to address the data privacy concerns raised in the formal demand letters.48

The records further reveal Westparc’s lack of interest, exemplified by its non-appearance and failure to submit required documents during the proceedings before the NPC. Despite being given sufficient notice, Westparc disregarded the NPC’s orders and did not participate in the scheduled hearings. Given this, it forfeited its right to present its position on the matter.

Westparc’s inaction and disregard for Complainants’ right to access warrants the award of nominal damages.

The DPA provides for restitution for any aggrieved party under the Civil Code.49 Section 37 of the DPA provides:

Section 37. Restitution. Restitution for any aggrieved party shall be governed by the provisions of the New Civil Code.50

Article 2221 of the New Civil Code is clear that nominal damages may be awarded in recognition of the violated legal rights of a plaintiff or complainant:

Article 2221. Nominal damages are adjudicated in order that a right of the plaintiff, which has been violated or invaded by the defendant, may be vindicated or recognized, and not for the purpose of indemnifying the plaintiff for any loss suffered by him.51

The right to access in Section 16(c) of the DPA empowers data subjects to request for access to their personal information.52 In this case, Complainants exercised this right by attempting to access their respective 201 files through verbal and written requests.53 Westparc’s refusal to accommodate these requests and its non-appearance during the proceedings before this Commission reflects a blatant disregard for Complainants’ data privacy rights, specifically their right to access.

As recognition and vindication of Complainants’ right to access, this Commission awards nominal damages in the amount of fifteen thousand pesos (P15,000.00) to each of the Complainants.

WHEREFORE, premises considered, this Commission:

  1. FINDS Respondent Westparc Condominium LIABLE for violation of CA and VP’s right to access under Section 16 (c) of Republic Act No. 10173 or the Data Privacy Act (DPA); and

AWARDS nominal damages, in the amount of fifteen thousand pesos (P15,000.00) each to CA and VP for violation of their right to access under Section 16 (c) of the DPA.

SO ORDERED.

City of Pasay, Philippines. 13 November 2023.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

NERISSA N. DEJESUS Deputy Privacy Commissioner

Copy furnished:

CA Complainant

VP Complainant

LNO Counsel for Complainant

THE LAW OFFICES OF VILLAGRACIA & OPLE Counsel for Complainant

WESTPARC CONDOMINIUM Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Complaints-Affidavit, 28 February 2018, at 1, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2018). ↩

  2. Id. ↩

  3. Circular No. WPCC-001-2018, 15 January 2018, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2018). ↩

  4. Id. ↩

  5. Complaints-Affidavit, 28 February 2018, at 1, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2018). ↩

  6. Demand Letter (RE: WPCC-001-2018, Demand to Furnish Relevant Documents, and in case of failure therefrom, cease and desist from implementation), 07 February 2018, at 1-2, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2018). ↩

  7. Demand Letter (RE: Demand to provide copy of appointment papers of “Security Officer” JAC), 07 February 2018, at 1, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2018). ↩

  8. Id. ↩

  9. Id. at 2. ↩

  10. Complaints-Affidavit, 28 February 2018, at 1, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2018). ↩

  11. Demand Letter (RE: Demand to provide copy of appointment papers of “Security Officer” JAC), 07 February 2018, at 2, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2018). ↩

  12. Complaints-Affidavit, 28 February 2018, at 2, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2018). ↩

  13. Id. at 1. ↩

  14. Order to Confer for Discovery, 10 April 2018, at 1, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2018). ↩

  15. Attendance Sheet for Discovery Conference, 03 May 2018, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2018). ↩

  16. Transcript (Discovery Hearing/Conference), 05 May 2018, at 1-2, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2018). ↩

  17. Id. at 2. ↩

  18. Id. ↩

  19. Id. ↩

  20. Id. ↩

  21. Id. ↩

  22. Transcript (Discovery Hearing/Conference), 05 May 2018, at 2, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2018). ↩

  23. Order, 4 May 2018, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2018). ↩

  24. Id. ↩

  25. Id. ↩

  26. Id. ↩

  27. Order, 27 December 2022, at 2, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2022). ↩

  28. Attendance Sheet for Discovery Conference, 15 May 2018, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2018). ↩

  29. Supplemental Complaint, 23 July 2018, at 1, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2018). ↩

  30. Id. ↩

  31. Id. at 2. ↩

  32. Id. ↩

  33. Mission Order CID 18-002, 23 August 2018, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2018). ↩

  34. Order, 27 December 2022, at 1, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2022). ↩

  35. Id. at 2. ↩

  36. Order, 31 January 2023, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2023). ↩

  37. Id. ↩

  38. Order, 28 February 2023, at 1, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2023). ↩

  39. Id. at 2. ↩

  40. Office of the Ombudsman v. Fetalvero, G.R. No. 211450 (2018). ↩

  41. Civil Service Commission v. Hernandez, G.R. No. 151095 (2004). ↩

  42. 2019 AMENDMENT TO THE 1989 REVISED RULES ON EVIDENCE, A.M. NO. 19-08-15-SC, Rule 131, § 1 (1 May 2020). Emphasis supplied. ↩

  43. Office of the Ombudsman v. Espina, G.R. No. 213500 (2017). ↩

  44. National Privacy Commission, 2016 Rules of Procedure of the National Privacy Commission [NPC 2016 Rules of Procedure], rule III, § 22 (15 December 2016). Emphasis supplied. ↩

  45. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 § 16 (c) (2012). Emphasis supplied. ↩

  46. Complaints-Affidavit, 28 February 2018, at 1, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2018). ↩

  47. Id. ↩

  48. Id. ↩

  49. Data Privacy Act of 2012, § 37. ↩

  50. Id. ↩

  51. An Act to Ordain and Institute the Civil Code of the Philippines [CIVIL CODE], Republic Act No. 386, art. 2221 (1949). ↩

  52. Data Privacy Act of 2012, § 16(c). ↩

  53. Complaints-Affidavit, 28 February 2018, at 1, in CA v. Westparc Condominium, NPC 18-004 & 18-005 (NPC 2018). ↩

Backlinks

  • No backlinks found