NPC Issuance Wiki

NPC 19-1273: NFM v. Bank of the Philippine Islands

Issued Decision

Decision Text

NFM,

Complainant,

-versus-

BANK OF THE PHILIPPINE ISLANDS FAMILY – CREDIT CARD DIVISION,

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before the Commission is a complaint filed by NFM against the Bank of the Philippine Islands Family – Credit Card Division (BPI) for an alleged violation of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

On 29 October 2018, NFM, a BPI Family MasterCard credit card holder, alleged that her credit card was used for an unauthorized transaction amounting to Eleven Thousand Seven Hundred Ninety Pesos (Php 11,790.00) on Lazada Philippines (Lazada).1 She claimed that her username and password in BPI Express Online, BPI’s internet banking facility, was accessed by changing her registered mobile number without her knowledge.2 The mobile number was then used in authenticating the online transaction via a One-Time Password (OTP).3

On 07 November 2018, NFM discovered the purported transaction when she checked her BPI account through its mobile application.4 As a result, NFM filed a complaint with BPI through its hotline number.5

On 08 November 2018, NFM also called Lazada’s hotline and reported the incident.6 She later received a reference number and the matter was referred to Lazada’s Payment Team.7

On 09 January 2019, BPI’s Fraud Control Team sent a Liability Letter, stating that NFM should still pay for the credit card transaction with Lazada amounting to Eleven Thousand Seven Hundred Ninety Pesos (Php 11,790.00).8 BPI explained that:

[E]ach of the credit card transactions was made online and would not have gone through without the concurrence of the following:

  1. Your 16-digit credit card number;
  2. Your 3-digit CVC printed at the back of your credit card;
  3. The expiry date of your credit card; and
  4. Authentication of each transaction via a One-Time Password (OTP) that you opted sent to your registered mobile number at the time of the transaction.9

BPI reiterated that an OTP can be received only by one who has access to the registered mobile number.10 BPI concluded that the circumstances show that the transaction was only made by NFM or by anyone to whom NFM had given her credit card details and access to her registered mobile number.11

BPI also emphasized that based on the records, the registered mobile number was amended from [ ] to [ ] through the BPI Express Online Account Maintenance Services for Credit Card.12 BPI explained that a request for a change of mobile number requires the correct BPI Express Online username and password.13

On 10 January 2019, NFM wrote another letter to BPI disputing the BPI Fraud Control Team’s decision.14 In the letter, NFM reiterated that she had nothing to do with the transaction.15 She also claimed that she neither changed her mobile number nor shared any personal information, such as her credit card details, username, and password, with anyone.16

On 01 March 2019, NFM requested BPI to provide a copy of the record of the charge slip evidencing the transaction allegedly done through Lazada using her credit card.17 She also requested the following information: (1) items purchased and the amounts of each, (2) name of Merchant, (3) person who did the transaction and their respective contact numbers, (4) IP Address used, (5) date and time of the delivery of the item, and (6) the recipient of the items purchased.18 NFM also requested BPI to provide a written explanation on “how BPI fulfill [its] duty to protect its customers’ personal information and ensure a safer online transaction, if it allows personal information to be easily changed online through the online account and why no message in any form about the mobile update is given to the owner of the account.”19

On the same day, NFM also wrote a letter addressed to Lazada asking for the same information.20 In the letter, NFM provided a summary of the communications made between her and various Lazada representatives.21

On 17 September 2019, NFM filed a complaint against BPI.22 She alleged that because of the unauthorized transaction, BPI processed her online banking username, password, mobile number, and credit card in violation of Section 25 of the DPA (Unauthorized Processing of Personal Information and Sensitive Personal Information).23

NFM prayed for the reversal of payment with interest of the unauthorized transaction and for damages, and sought an Order to stop the temporary or permanent processing of her data.24

On 24 October 2019, the National Privacy Commission (NPC), through the Complaints and Investigation Division (CID), issued an Order for the parties to confer for discovery.25

On 27 November 2019, both parties appeared for the discovery conference but failed to reach an agreement. NFM required the following documents from BPI:

  1. Details of the subject transaction in the complaint;
  2. Documents showing that the transaction complained of was referred to Lazada for appropriate action; and
  3. Personal information of complainant recorded with respondent.26

On the same day, the CID then issued an Order directing BPI to submit the documents within ten (10) days from 27 November 2019.27 It also ordered BPI within ten (10) days from the expiration of the period to submit the required documents to file its responsive comment to the complaint, together with any supporting documents the respondent may have, including affidavits of the respondent’s witnesses, if any.28

The CID also gave NFM ten (10) days from receipt of the responsive comment to file her reply and BPI ten (10) days from receipt of the reply to file its rejoinder.29

On 17 December 2019, BPI filed an Urgent Motion for Extension of Time to File a Responsive Comment asking for an additional twenty (20) days from 17 December 2019 or until 06 January 2020 within which to file a responsive comment.30 BPI explained that it needed to review the facts and circumstances of the case because of its heavy workload.31

On 06 January 2020, BPI filed an Urgent Second Motion for Extension of Time to File a Responsive Comment and asked for an additional ten (10) days from 06 January 2020 or until 16 January 2020 to file a responsive comment.32 BPI reasoned that the holiday season and consequent non-working days prevented it from collating all the documents pertaining to the case.33

On 15 January 2020, BPI filed its Comment.34 BPI refuted NFM’s claim and explained that NFM has no cause of action against BPI under Section 25 (Unauthorized Processing of Personal Information and Sensitive Personal Information) and Section 30 (Concealment of Security Breaches Involving Sensitive Personal Information) of the DPA.35 BPI explained that:

It must be noted that Complainant voluntarily and expressly authorized Respondent [BFSB] BPI to process her personal data as a credit card holder. This is specifically provided in the terms and conditions she acceded to during card application. Hence, it is peculiar that she is accusing Respondent [BFSB] BPI of processing her personal data without her consent.

…

It cannot be emphasized enough that the foregoing details, particularly the card number, CVC, and expiry date, are supposed to be known only to the cardholder. There is no way that anyone would know the same unless disclosed by the cardholder, or someone had possession of the credit card at the time of the transaction.

…

Based on the foregoing, the Complainant has the burden of proving that the transactions were unauthorized. Unfortunately, she failed to present even an iota of evidence to prove the same. The present complaint only contains self-serving allegations and mere speculations.

…

However, assuming for the sake of argument that the disputed transaction was not made by the Complainant, it is humbly submitted that she also failed to present substantial evidence to prove that the same was made possible by means of personal data breach.36

Relying on the legal doctrine of res ipsa loquitor, BPI asserted that:

The fact that someone was able to make the disputed transaction using personal data and log-in details known only to the Complainant is prima facie evidence of negligence on the [latter’s] Complainant’s part in securing or safeguarding her data.37

BPI also explained that the transaction was deemed properly authenticated through the OTP.38 It stated that is the reason why it remitted payment to Lazada and that it could no longer reverse the disputed transaction.39

Thus, BPI prayed that the Commission dismiss the complaint outright for lack of merit.40

On 10 February 2020, NFM filed a Reply with Motion to Admit.41 In her Reply, she emphasized that BPI failed to comply with the production of documents as stated in the Order dated 27 November 2019.42

NFM denied any involvement in the disputed transaction.43 She stated that based on her record history, she never made a purchase in an amount higher than Ten Thousand Pesos (Php 10,000.00).44 She reiterated that her mobile number was changed without her consent:

Complainant’s mobile number was changed online without her consent and there were no means of communication forwarded to the Complainant by respondent suggesting/informing her of this change. Thus, the One-Time Password (OTP), which is supposed to be a security feature, proves to be a means to make unauthorized transactions, to the prejudice of the Complainant.45

NFM maintained that she is not only disputing the unauthorized transaction in her credit card, but also the failure of BPI to secure her personal information which led to the fraudulent transaction.46

NFM also contended that BPI’s supposed failure to implement security measures and to safeguard her personal information resulted in a breach of her confidential personal information.47 Further, she alleged that BPI concealed the data breach which facilitated the change of her mobile number and resulted in the successful authentication of the disputed transaction.48

BPI did not file any Rejoinder.

On 04 June 2021, the CID issued an Order reiterating the Order dated 27 November 2019.49 The CID directed BPI to submit details of the transaction, documents showing that the transaction complained of was referred to Lazada for appropriate action, and NFM’s personal information recorded with BPI.50 It also ordered BPI to submit additional information on the circumstances surrounding the change of NFM’s mobile number during the alleged unauthorized transaction and documentation on BPI’s security measures at the time of the incident.51

On 04 August 2022, the CID issued an Order to BPI directing it to show cause why it should not be held in contempt, and to comply with the Orders dated 27 November 2019 and 04 June 2021.52

On 17 October 2022, BPI submitted its Compliance to the Order dated 04 August 2022.53 BPI stated that it sufficiently complied with the information required from the 27 November 2019 Order when it submitted its Comment dated 15 January 2020.54

NFM emphasized that extraordinary diligence is required of banks since their business is imbued with public interest.55 She claimed that BPI has been remiss in ensuring that its own system is fully capable of protecting the security and privacy of data of its clients.56

Issue

Whether BPI’s supposed failure to safeguard NFM’s personal information constitutes a violation of the DPA.

Discussion

The Commission dismisses the case for lack of substantial evidence. NFM did not overcome the burden of proof necessary to shift the burden of evidence to BPI.

In administrative proceedings, the quantum of proof necessary for a finding of guilt is substantial evidence.57 Thus, complainants must carry the burden of proving their allegations with such relevant evidence that a reasonable mind might accept as adequate to support a conclusion.58

Section 1 of Rule 131 of the 2019 Amendments to the Revised Rules on Evidence distinguishes between burden of proof and evidence:

Section 1. Burden of proof and burden of evidence Burden of proof is the duty of a party to present evidence on the facts in issue necessary to establish his or her claim or defense by the amount of evidence required by law. Burden of proof never shifts.

Burden of evidence is the duty of a party to present evidence sufficient to establish or rebut a fact in issue to establish or rebut a fact in issue to establish a prima facie case. Burden of evidence may shift from one party to the other in the course of the proceedings, depending on the exigencies of the case.59

Thus, it is the party who alleges a fact that has the burden of proving it.60

To prove her claim that she did not make the alleged Lazada transaction, NFM provided a record of her previous credit card transactions to show that she has never purchased an item with an amount higher than Ten Thousand Pesos (Php 10,000.00).61 The disputed transaction amounts to Eleven Thousand Seven Hundred Ninety Pesos (Php 11,790.00).62

NFM also provided a Lazada screenshot to show that she placed her latest transaction only on 03 August 2018 and that she did not make any transaction on November 2018.63 Additionally, NFM sought to prove through the same screenshot that her history of purchases in Lazada nowhere exceeded Three Thousand Pesos (Php 3,000.00).64

Further, NFM concluded that the transaction was indeed fraudulent because BPI stated in its Comment that “it conducted a thorough investigation of the incident.”65 NFM contended, however, that BPI actually “failed to coordinate with Lazada” in terms of the reversal of the charges incurred from the alleged transaction.66

Finally, NFM included accusations that she heard similar experiences from different people that their mobile numbers were also allegedly being changed by BPI and that their credit cards were also used for other online transactions.67 NFM narrated that she, along with other credit card holders who are also alleged victims of unauthorized online transactions, went to the Bangko Sentral ng Pilipinas (BSP) and the NPC to file separate complaints.68

These assertions presented by NFM are merely speculative and cannot serve as basis to establish a fact. Other than her bare allegations that someone was able to access her online account and change her registered mobile number without her knowledge, NFM failed to provide evidence to categorically substantiate her claims that a breach occurred and BPI was responsible for such incident. She was not able to provide evidence to support her claim that BPI was at fault for the unauthorized access to her account or that BPI was negligent in allowing changes to her mobile number.

It is not sufficient for a Complainant, such as NFM, to make allegations without substantial evidence to support her claims, considering that:

The basic rule is that mere allegation is not evidence and is not equivalent to proof. Likewise, charges based on mere suspicion and speculation cannot be given credence.69

In this case, NFM did not present substantial evidence to prove that BPI’s supposed failure to implement proper security measures was the cause of the unauthorized transaction and not her own negligence. Thus, the Commission cannot find BPI liable for violating Section 25 (Unauthorized Processing of Personal Information and Sensitive Personal Information) and Section 30 (Concealment of Security Breaches Involving Sensitive Personal Information) of the DPA.

NFM’s contentions cannot give rise to the conclusion that BPI violated the DPA for its lack of security measures.

BPI averred in its Comment that there is reasonable, if not, conclusive presumption that NFM effected the change in her registered mobile number.70 BPI explained that the request requires the correct BPI Express Online username and password which are supposed to be confidential and known only to her.71

Further, as part of its security measures at the time the incident took place, BPI implemented a multi-factor authentication method to verify online credit card transactions.72 This method requires the concurrence of the following personal data conclusively presumed to be known only to the cardholder:

a. 16-digit credit card number printed on the face of the credit card; b. expiry date printed on the face of the card; c. 3-digit CVC printed on the back of the card; and d. one-time password (“OTP” for brevity) sent to the cardholder’s registered mobile number.73

BPI’s verification process, using the OTP sent to NFM’s supposed registered mobile number, shows that BPI had some level of security in place during the time of the alleged online transaction.

The Commission sternly reminds Personal Information Controllers (PICs) of their continuing obligation to ensure that the personal data they process, whether offline or online, are properly protected. As such, PICs must monitor, evaluate, and update their security measures considering the developments in technology and the risks that data subjects are exposed to.

Section 20 (a) and (c) of the DPA provide the PIC’s obligation to implement measures for the protection of personal information:

Section 20. Security of Personal Information.

(a) The personal information controller must implement reasonable and appropriate organizational, physical and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.

…

(c) The determination of the appropriate level of security under this section must take into account the nature of the personal information to be protected, the risks represented by the processing, the size of the organization and complexity of its operations, current data privacy best practices and the cost of security implementation. Subject to guidelines as the Commission may issue from time to time, the measures implemented must include:

(1) Safeguards to protect its computer network against accidental, unlawful or unauthorized usage or interference with or hindering of their functioning or availability;

(2) A security policy with respect to the processing of personal information;

(3) A process for identifying and accessing reasonably foreseeable vulnerabilities in its computer networks, and for taking preventive, corrective and mitigating action against security incidents that can lead to a security breach; and

(4) Regular monitoring for security breaches and a process for taking preventive, corrective and mitigating action against security incidents that can lead to a security breach.74

In this case, the security measures implemented by BPI involved sending the OTP to the account holder’s registered mobile number. Considering that the two-factor authentication method it implemented was entirely dependent on the registered mobile number, it should have ensured that any changes to this number was also properly verified and authenticated to secure the integrity of the two-factor authentication. Since the process for changing the registered mobile number is not secure, data subjects are unnecessarily exposed to higher levels of risk.

Thus, this Commission finds that the award of nominal damages to NFM is warranted.

The DPA provides that restitution for any aggrieved party shall be governed by the provisions of the New Civil Code.75 Article 2221 of the New Civil Code provides:

Article 2221. Nominal damages are adjudicated in order that a right of the plaintiff, which has been violated or invaded by the defendant, may be vindicated or recognized, and not for the purpose of indemnifying the plaintiff for any loss suffered by him.76

As stated, there is an obligation for a PIC to observe regular monitoring and processes intended for the protection of personal information.77 An obligation implies not just a duty on the part of one party, but also denotes a correlative right on the other.78 Since there is an obligation on the part of a PIC to implement measures to protect the personal information that it processes, there is also a correlative right on the part of data subjects to expect that their personal information is being protected.

Thus, as a recognition and vindication of this right, this Commission awards nominal damages to NFM in the total amount of Five Thousand Pesos (Php 5,000.00). NFM, as a data subject, has a correlative right to anticipate that BPI is safeguarding her personal information.

Although this case occurred before the effectivity of the NPC Circular 22-01 or the Guidelines on Administrative Fines, the Commission stresses that it will not hesitate to impose fines in order for PICs, such as banks, to adopt optimal levels of data protection and security in handling personal and sensitive personal information of their customers.

On NFM’s prayer on the reversal of unauthorized transactions, such is beyond the jurisdiction of the Commission.

WHEREFORE, premises considered, the Commission DISMISSES the complaint filed by NFM against Bank of the Philippine Islands Family – Credit Card Division (BPI).

The Commission AWARDS nominal damages in the amount of Five Thousand Pesos (Php 5,000.00) to NFM to vindicate her right arising from BPI’s noncompliance with Section 20 (a) and (c) of Republic Act No. 10173 or the Data Privacy Act of 2012.

This is without prejudice to the filing of appropriate civil, criminal, or administrative cases before any other forum or tribunal, if any.

SO ORDERED.

City of Pasay, Philippines.

19 January 2023.

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA

Privacy Commissioner

NERISSA N. DE JESUS

Deputy Privacy Commissioner

Copy furnished:

NFM

Complainant

BANK OF THE PHILIPPINE ISLANDS FAMILY – CREDIT CARD DIVISION

Respondent

BANK OF THE PHILIPPINE ISLANDS BPI LEGAL AFFAIRS AND DISPUTE RESOLUTION DIVISION

Respondent

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Letter from NFM to BPI, 02 January 2019, at 1, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2019). ↩

  2. Complaints-Assisted Form, 17 September 2019, at 3, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2019). ↩

  3. Id. ↩

  4. Complaints-Assisted Form, 17 September 2019, at 5, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2019). ↩

  5. Id. ↩

  6. Letter from NFM to BPI, 01 March 2019, at 1, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2019). ↩

  7. Id. ↩

  8. Letter from BPI to NFM, 09 January 2019, at 1, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2019). ↩

  9. Id. ↩

  10. Id. ↩

  11. Id. ↩

  12. Id. ↩

  13. Id. ↩

  14. Letter from NFM to BPI, 10 January 2019, at 1, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2019). ↩

  15. Id. ↩

  16. Id. ↩

  17. Id. ↩

  18. Id. ↩

  19. Id. ↩

  20. Letter from NFM to Lazada, 02 March 2019, at 1, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2019). ↩

  21. Id. ↩

  22. Complaints-Assisted Form, 17 September 2019, at 5, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2019). ↩

  23. Id. at 1. ↩

  24. Complaints-Assisted Form, 17 September 2019, at 6-7, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2019). ↩

  25. Order to Confer for Discovery, 24 October 2019, at 1, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2019). ↩

  26. Order, 27 November 2019, at 1, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2019). ↩

  27. Id. ↩

  28. Id. ↩

  29. Id. ↩

  30. Urgent Motion for Extension of Time to File Responsive Comment, 16 December 2019, at 1, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2019). ↩

  31. Id. ↩

  32. Id. ↩

  33. Id. ↩

  34. Comment, 15 January 2020, at 4, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2020). ↩

  35. Id. ↩

  36. Comment, 15 January 2020, at 5, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2020). ↩

  37. Id. at 7. ↩

  38. Id. ↩

  39. Id. ↩

  40. Id. ↩

  41. Reply with Motion to Admit, 10 February 2020, at 5, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2020). ↩

  42. Id. ↩

  43. Id. at 3. ↩

  44. Id. ↩

  45. Reply with Motion to Admit, 10 February 2020, at 5, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2020). ↩

  46. Id. ↩

  47. Id. ↩

  48. Id. ↩

  49. Order, 04 June 2021, at 1, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2021). ↩

  50. Id. ↩

  51. Id. ↩

  52. Id. ↩

  53. Compliance (re: Order dated 04 August 2022), 17 October 2022, at 1, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2022). ↩

  54. Id. ↩

  55. Reply with Motion to Admit, 10 February 2020, at 7, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2020). ↩

  56. Id. ↩

  57. DOH v. Aquintey, et al., 806 Phil. 763, 772 (2017). ↩

  58. De Jesus v. Guerrero III, 614 Phil. 520, 528-529 (2009). ↩

  59. 2019 AMENDMENT TO THE 1989 REVISED RULES ON EVIDENCE, A.M. NO. 19-08-15-SC, Rule 131, § 1 (1 May 2020). Emphasis supplied. ↩

  60. De Jesus v. Guerrero III, 614 Phil. 520, 528-529 (2009). ↩

  61. Reply with Motion to Admit, 10 February 2020, at 2, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2019). ↩

  62. Id. ↩

  63. Id. ↩

  64. Id. at 3. ↩

  65. Id. ↩

  66. Id. ↩

  67. Letter from NFM to BPI, 10 January 2019, at 2, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2019). ↩

  68. Reply with Motion to Admit, 10 February 2020, at 4, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2020). ↩

  69. BSA Tower Condominium Corp. v. Reyes II, A.C. No. 11944 (2018). ↩

  70. Compliance (re: Order dated 04 August 2022), 17 October 2022, at 1, in NFM v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273 (NPC 2022). ↩

  71. Id. ↩

  72. Id. at 2. ↩

  73. Id. ↩

  74. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 § 20 (a), (c)(4) (2012). ↩

  75. Id. ↩

  76. An Act to Ordain and Institute the Civil Code of the Philippines [NEW CIVIL CODE], Republic Act No. 386, art. 2221 (1950). ↩

  77. Data Privacy Act, § 20 (c) 4. ↩

  78. Serrano v. Court of Appeals, 363 SCRA 223, 231 (2001). ↩

Backlinks