NPC Issuance Wiki

NPC 19-758 and NPC 19-1846: Spouses MCD and JJD v. Victorias Milling Company, et al.

Issued Decision

Decision Text

MCD,

Complainant,

-versus-

VICTORIAS MILLING COMPANY,

MOC, EVR, GEK,

AND SC,

Respondent.

x----------------------------------------------------x

JJD,

Complainant,

-versus-

VICTORIAS MILLING COMPANY,

MOC, EVR, GEK,

AND SC,

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before this Commission are the consolidated cases filed by Spouses MCD and JJD (collectively, Complainants) against Victorias Milling Company (VMC), MOC, EVR, GEK, and SC (Respondents) for alleged violations of Section 25 (Unauthorized Processing), Section 26 (Access due to Negligence), Section 28 (Processing for Unauthorized Purposes), Section 29 (Unauthorized Access or Intentional Breach), Section 31 (Malicious Disclosure), Section 32 (Unauthorized Disclosure), and Section 33 (Combination or Series of Acts) of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

Complainants were employees of VMC.1 MCD narrated that during his employment as Head of the Asset Management Department from January 2016 to May 2018, VMC required him to submit a Disclosure Statement of all his financial interests and that of the members of his family up to the second degree of consanguinity or affinity.2 This included a declaration of “the sugarcane farms [he] owned, leased, or managed, and the businesses that [he] and [his] family members may have an interest in that deals with VMC.”3 JJD, as the Administrative Assistant of the Asset Protection and Safety Department, was also required to submit a Disclosure Statement with the same contents.4

Complainants explained that “the Disclosure Statement is a highly sensitive document which contained [their] private matters which could not be disclosed or published without [their] knowledge and consent.”5 He further stated that the submission of the Disclosure Statement does not give VMC the right to process their personal data contained in the document.6

In January 2018, Complainants claimed that Respondents conducted field investigations, verifications, inspections, interviews, and inquiries to validate the sugarcane farms that they declared in their Disclosure Statements.7 Complainants alleged that GEK, one of the respondents, surreptitiously took and carried away the sugarcane that they already harvested.8 They also contended that GEK submitted to VMC her observations and findings that two haciendas located in the municipality of E.B. Magalona were not declared in the Disclosure Statements of the Complainants.9 They further alleged that GEK discovered that Complainants are “in the business of financing the farming activities of certain sugarcane planters who bring their produce to VMC for milling.”10

As a result, Complainants received Notices to Explain directing them to explain the alleged violations of the VMC Employee Code of Conduct and Discipline and other VMC Policy and Procedures.11 As stated in the Notices, Complainants, as VMC employees, held “positions that can exert influence on other VMC employees and workers to [their] benefit and advantage, hence at the least, [their] disclosures became imperative as [their] personal business transactions could have run in conflict with [their positions].”12

In their Written Explanations, Complainants stated that when they submitted their Disclosure Statements in October 2017, the two haciendas were no longer leased nor operated by them.13 They explained that the contracts of lease for both farms had already expired in 2013.14 MCD also explained that financing the farming activities of sugarcane planters, buying standing and cut sugarcanes, and delivering them to VMC for milling does not amount to a conflict of interest.15 In his Complaint-Affidavit, MCD added that as far as he knows, VMC does not engage in buying standing sugarcanes.16

Despite their explanations, Complainants received Notices of Suspension from VMC, suspending them for seven (7) days for “blatant disregard or any deviation from established control and other VMC Policies and Procedures.”17 They were also not allowed to mill their sugarcanes with VMC.18

Because of this, MCD requested a grievance conference.19 In his Request for Grievance, MCD argued that it was not clear in the Notice of Suspension what specific policies and procedures were disregarded by him that would merit his suspension.20 He further argued that the Disclosure Statement “does not even state the corresponding sanction in case of incomplete or erroneous statement.”21 Finally, he argued that the investigation in relation to his Disclosure Statement was performed without his knowledge and consent.22

Complainants explained that despite the valid grounds they alleged, VMC disregarded their explanations and decided to suspend them and disallow them from milling sugar until further notice.23 Because of this, Complainants claimed that they were “forced to render [their] voluntary resignation from employment.”24

Due to the incident, Complainants filed their respective Complaint-Affidavits dated 27 June 2019, against Respondents for violations of the DPA.25

Complainants alleged that VMC violated the DPA when Respondents conducted an investigation and validation of the sugarcane farms that they stated in their Disclosure Statements without their knowledge and consent.26 They prayed for the Commission to find Respondents guilty of violations of the DPA.27 They also claimed that they are entitled to moral damages, exemplary damages, and attorney’s fees.28

On 18 December 2020, the National Privacy Commission (NPC), through its Complaints and Investigation Division (CID), consolidated the two (2) cases and directed the parties to Confer for Discovery.29

On 11 March 2021, Respondents filed their Entry of Appearance.30

On 23 March 2021, only Complainants, through their representative, appeared for the discovery conference, while Respondents failed to appear.31 Complainants manifested that they are not willing to reset the discovery conference.32 Thus, in view of Complainants’ manifestation and the effectivity of NPC Circular 2021-01 (2021 NPC Rules of Procedure), the CID ordered Respondents to file their verified comment within fifteen (15) days from receipt of the Order.33

On 30 September 2021, the CID issued an Order stating that it has not received a verified comment from Respondents.34 As a result, to give due course to the cause of both parties, it gave Respondents a final period of fifteen (15) days from receipt of the Order to file its verified comment to the complaint.35

On 18 October 2021, Respondents filed their Consolidated Comment.36

In their Consolidated Comment, Respondents explained that in the course of its business operations, it collects, uses, and processes the personal data of its employees, consultants, visitors, clients, and other stakeholders.37

Respondents claimed that VMC believes in the importance of good corporate governance as part of sound strategic management.38 Therefore, they undertake the necessary efforts to create awareness and ensure compliance with the same, which includes the creation of the Manual on Corporate Governance.39

Further, Respondents explained that VMC, as a publicly listed corporation, must comply with the Securities and Exchange Commission Code of Corporate Governance for Publicly Listed Companies under SEC Memorandum Circular 19 Series of 2016 which provides for “the adoption of programs that mitigate corrupt practices such as but not limited to bribery, fraud, extortion, collusion, conflict of interest and money laundering.”40

Respondents stated that as part of its compliance with the SEC’s Memorandum Circular 19 Series of 2016, guided by its Manual on Corporate Governance and pursuant to good corporate governance, it required all of its employees and consultants to execute the VMC Disclosure Statement yearly or as often as required.41 The disclosure was designed “to prevent and address any actual or potential conflict of interest that may adversely affect the interest of the company and its stakeholders, such as personal dealings between employees, consultants and VMC.”42

Through its Disclosure Statements, Respondents explained that it collects from each employee and consultant his or her name, position, VMC ID number, other positions held outside VMC, names of family members related to any director, officer, employee, or consultant of VMC group, relationships, and signature.43

Respondents then narrated that in early 2018, VMC conducted a validation of the information contained in the submitted Disclosure Statements.44 It then discovered that “there were certain sugarcane farms and financing activities linked to Complainants that were not divulged in their Disclosure Statements.”45 Hence, in accordance with its company procedures and the Labor Code of the Philippines, it initiated its internal administrative process which resulted in the suspension of Complainants.46

Respondents alleged that during the entire process of investigation, assessment, and action about Complainants, they complied with the DPA and other applicable laws.47 They explained that “to maintain the confidentiality of personal data, only authorized personnel whose functions included participation in the conduct of internal administrative proceedings under the Labor Code (i.e., HR, Legal, Audit) were given access to information which includes the other respondents.”48 They further alleged that the individual respondents only carried out their tasks by virtue of their positions as officers or employees of VMC.49

For her part, Ms. GEK has authority to access personal information in relation to the Disclosure Statement as Head of the Transformation Department and Internal Audit being that she is responsible in auditing information/processes and providing reports thereon that could adversely affect the business of VMC, one of which is the violation of the company’s policy on conflict of interest. For their part, Ms. MOC, Ms. EVR and Ms. SC have authority to access personal information being signatories of the Notice to Explain and other necessary processes by the company.50

They claimed that prior to the effectivity of Complainants’ resignation, they had amicable discussions and considered their demands.51 After negotiation, both Complainants received a sum of money, that is One Million Five Hundred Thousand Pesos (Php 1,500,000.00) for MCD and Five Hundred Thousand Pesos (Php 500,000.00) for JJD.52 On 26 April 2018, Complainants also executed a Release, Waiver and Quitclaim on account of the received settlement.53

On 28 June 2019, the Respondents disclosed that VMC filed before the Regional Trial Court of Silay a complaint for breach of contract against Complainants.54 It was after the filing of the aforementioned complaint that the Respondents discovered the present case filed before the Commission.55

Respondents argued that the complaint should be dismissed on the grounds that Complainants are guilty of forum shopping, that the claim or demand set forth in the complaint has been paid, waived, abandoned, or otherwise extinguished, and that the complaint lacks merit.56

Respondents contended that the information contained in the Disclosure Agreement only pertained to personal information as defined under the DPA and their processing was based on contracts under Section 12 (b), compliance with a legal obligation under Section 12 (c), and legitimate interest under Section 12 (f) of the DPA.57

They explained that the processing of personal data was based on a contract.58 Further, they stated that at the time of processing, an employment relationship existed between them and Complainants which is governed by an employment contract.59 This allows them to process certain information that are necessary and related to the fulfillment of the contract:

Processing of personal data based on contract

It is of no issue that there is an employment relationship between Complainants and VMC at the time when the processing of the personal information was done. Such relationship is governed by the contract entered into by the parties. In an employment relationship, certain information are processed which are necessary and is related to the fulfillment of the contract between the parties. Such information includes personal data which is needed to benefit the employee like those data needed to process salary as well as those for the benefit of the employer, VMC in this case, needed to protect its interest such as disclosures of information involving conflict of interest. When the Complainants entered into a contract with the respondent VMC, they were made aware that certain information will be collected and processed by the company, failure of which may result in the severance of their employment contract.60

They further stated that as a Personal Information Controller (PIC), VMC has a legal obligation to process personal data to comply with the law, especially since it is a publicly listed company subject to compliance with regulatory requirements, particularly SEC Memorandum Circular 19 Series of 2016:

Processing of personal data based on legal obligation

VMC, being a publicly listed company, is subject to certain legal obligations set out by its regulators. Regulatory requirements also qualify as a legal obligation.

In relation to the Disclosure Statement which is the subject of this present case, the pertinent issuance of the Securities and Exchange Commission, i.e., SEC Memorandum Circular No. 19, Series of 2016 applies. The said memorandum requires that the Company must adopt programs that mitigate corrupt practices such as but not limited to bribery, fraud, extortion, collusion, conflict of interest and money laundering. As previously stated, the VMC Disclosure Statement is part of VMC’s compliance to the said SEC-mandated Code of Corporate Governance for Publicly-Listed Companies which is designed to prevent and address any actual or potential conflict of interest that may adversely affect the interest of the company and its stakeholders such as personal dealings between employees, consultants and VMC.61

They also stated that VMC has a legitimate interest in processing Complainants’ personal information, being a publicly listed company with a responsibility towards its investors.62 Also, part of its good corporate governance initiatives is “to ensure that all possible conflicts of interest of its employees and consultants are addressed.”63 They explained that VMC processes personal information in relation to the Disclosure Statement to protect its legitimate interest of preventing fraud and violations of its policies which may affect the business:

Processing of personal data based on legitimate interest

In this case, the processing of the personal information contained in the Disclosure Statement is necessary for the purposes of the legitimate interest of VMC. VMC as a publicly listed company has a responsibility towards its investors. It holds its shareholders’ best interests as a priority and is committed in maintaining stockholder confidence and optimism at all times.

Part of its good corporate governance initiatives is to ensure that all possible conflict interest of its employees and consultants are addressed. Hence, it has mandated all those connected to the company to submit their Disclosure Statements.

…

In this case, the processing of the personal information contained in the Disclosure Statement is based on the legitimate interest of the organization to prevent fraud and violation of its policies which may affect the business.64

Respondents argued that assuming the Disclosure Statements contained sensitive personal information, they still have lawful basis in processing the information because it is necessary for the protection of its lawful rights and interest pursuant to Section 13 (f) of the DPA.65

The act of Complainants in withholding information which VMC requires from all its employees and consultants gave rise for VMC to process the information in order to protect its lawful rights and interest and implement company policies.66

Respondents added that there was a need to assess whether Complainants can reasonably expect their data to be processed in such manner.67 They argued that because of the employment contract entered into between the parties and VMC’s legitimate interest, Complainants have a lesser expectation of privacy in relation to the disclosures made by Complainants to VMC and its authorized persons.68

Respondents also contended that Complainants failed to particularly identify which information was processed and how the individual respondents were able to unlawfully access or disclose their information as they were performing such in their official capacity:69

Aside from mentioning Ms. GEK performing her function to validate the contents of the Disclosure Statement, Ms. EVR and Ms. SC as issuer and signatory of the Notice to Explain, Complainants did not give any material information which can substantiate their allegation that respondents MOC, EVR, GEK and SC unlawfully processed, used or disclosed their personal data.70

Finally, Respondents alleged that “the allegations lack the necessary information to establish [Complainants’] claims and that indeed the crime alleged has been committed.”71

In relation to Sections 25, 28, and 32, Respondents stated that they have clearly explained that there was lawful basis in the processing of the information based on contract, legitimate interest and/or protection of lawful rights and interests, or the establishment, exercise, or defense of legal claims.72 Therefore, the allegations that Respondents committed unauthorized processing, processing personal data for unauthorized purpose/s, and unauthorized disclosure must not prosper.73

As to Sections 26, 29, and 31, Respondents contended that the allegations do not provide for the acts or facts that result in a violation of these sections.74 They argued further that the imputation that Respondents maliciously and fraudulently conducted the investigation to validate Complainants’ sugarcane farms is not within the purview of Sections 26, 29, and 31 of the DPA.75 There was no allegation of disclosure of unwarranted or false information with malice or bad faith on the part of Respondents.76

Respondents thus averred that they did not violate Sections 25, 26, 28, 29, 31, 32, and 33 of the DPA and prayed for the dismissal of the complaint with prejudice for failure to substantiate and prove the allegations.77

During the 26 October 2021 preliminary conference, only Respondents appeared.78 The CID noted the receipt of Complainants’ Urgent Motion for Postponement and the preliminary conference was reset for the last time.79

On 16 November 2021, during the Preliminary Conference, Complainants manifested that they are requesting for the minutes or records of the grievance proceedings held on 01 March 2018. Respondent’s counsel, however, raised the relevance which the document may serve as the same had nothing to do with the allegations in the complaint.80 Complainants, through counsel, answered that the minutes of the grievance proceedings will show the basis of Complainants’ suspension and that some of Complainants’ vital records were violated.81 Respondents opposed the production of the document considering that the grievance proceedings tackled a different matter and is not connected with data privacy.82 As a result, the CID ordered Respondents to submit a Comment/Opposition to the Discovery of the Document.83

During the Preliminary Conference, both parties, however, manifested that they are willing to undergo mediation proceedings.84 Therefore, the proceedings were suspended.85

On 19 and 20 November 2021, Respondents86 and Complainants87 respectively, signed and submitted their Applications for Mediation.

On 05 January 2022, the CID issued an Order to Mediate and for the parties to appear for a preliminary mediation conference.88 The CID, however, ordered the termination of the mediation proceedings due to the parties’ repeated delays in rescheduling the preliminary mediation conference for more than two (2) months.89

On 10 March 2022, the Mediation Officer issued a Notice of Non-Settlement to the parties.90 On 15 March 2022, the CID lifted the suspension of the complaints proceedings and ordered the parties to file their memoranda.91 The CID also ordered Respondents to submit their Comment/Opposition to the Discovery of the Document.92

On 30 March 2022, Respondents submitted their Comment/Opposition to the Discovery of the Document dated 30 March 2021.93 Respondents argued that the disclosure of the internal documents and communications, specifically the minutes of the grievance meeting, was “irrelevant, protected by a form of privilege, and must be excluded for legitimate reasons such as but not limited to internal policies, labor relations policy, dispute resolution rules, among others.”94

The fact in issue in the instant case is the alleged violation sometime on or before 23 January 2018 and the Disclosure Statements. The minutes of the grievance meeting was on 18 March 2018 in relation to work suspension. Thus, the request has no bearing on the allegations in the complaint.95

On 01 April 2022, the CID noted the Respondents’ Comment/Opposition to the Discovery of the Document.96

On 18 April 2022, Respondents filed their Memorandum.97 They reiterated that aside from the bare allegations of Complainants, nothing in the complaint “provided any detail as to who among the Respondents processed personal data, what kind of personal data, and how could they have used [the] personal data.”98 Further, they restated their arguments that there was lawful processing based on contract, legal obligation, legitimate interest, and protection of lawful rights and interest.99

On 11 August 2022, Complainants filed their Memorandum.100 They maintained that the acts of Respondents in “processing, validating, spying, [and] publishing the contents of the Disclosure Statements of the complainants is a gross violation of the [DPA]” because the submission of their Disclosure Statements do not give Respondents absolute authority to process its contents.101 Complainants further alleged that Respondents conducted their investigations and inquiries with bias because “they came up with an unverified report that is grossly erroneous, having no factual basis but hearsays and assumptions, full of malice and ill-intent.”102

Issue

I. Whether there is substantial evidence to find Respondents liable for a violation of the DPA;

II. Whether Respondents’ act of processing the contents of the Disclosure Statements is a violation of the DPA.

Discussion

The Commission dismisses the case for lack of substantial evidence.

Complainants failed to substantiate their allegations on how the Respondents violated the DPA. Other than the general statements made in their complaints and Memorandum, the Complainants neither specified the personal data that was unlawfully processed nor alleged the Respondents’ specific acts that amount to a violation of the DPA.

Nevertheless, Respondents’ acts of processing the contents of Complainants’ Disclosure Statements was pursuant to its legitimate interest and did not go beyond what Complainants can reasonably expect upon submission of their Disclosure Statements.

I. There is no substantial evidence to find Respondents liable for a violation of the DPA.

Respondents, who are VMC and its officers and employees, cannot be held liable for a violation of the DPA based on the allegations of and evidence submitted by Complainants.

Complainants claimed that Respondents violated Sections 25, 26, 28, 29, 31, 32, and 33 of the DPA by processing their personal data without their authority and consent.103 To substantiate their complaint, Complainants submitted their Disclosure Statements,104 a copy of the blotter report that records the incident where Respondent GEK surreptitiously took and carried away their sugarcane for milling,105 the Notices to Explain issued by Respondents to MCD and JJD,106 the written Explanations of MCD and JJD,107 the Notices of Suspension,108 the Request for Grievance submitted by MCD,109 the Letter giving VMC the opportunity to reply before filing a complaint with the NPC,110 the Certification from Negros Del Norte Planters Association that JJD informed them about the expiration of the lease of one of the undisclosed haciendas,111 and the Letter from VMC stating that they are referring the matter to their legal counsel.112

Section 1 of Rule 131 of the 2019 Amendments to the Revised Rules on Evidence provides:

Section 1. Burden of proof and burden of evidence. Burden of proof is the duty of a party to present evidence on the facts in issue necessary to establish his or her claim or defense by the amount of evidence required by law. Burden of proof never shifts.

Burden of evidence is the duty of a party to present evidence sufficient to establish or rebut a fact in issue to establish a prima facie case. Burden of evidence may shift from one party to the other in the course of the proceedings, depending on the exigencies of the case.113

Section 6 of Rule 133 of the 2019 Amendments to the Revised Rules on Evidence provides:

Section 6. Substantial Evidence. In cases filed before administrative or quasi-judicial bodies, a fact may be deemed established if it is supported by substantial evidence, or that amount of relevant evidence which a reasonable mind might accept as adequate to justify a conclusion.114

In this case, Complainants, had the burden of proof in alleging a violation of the DPA. Complainants, however, did not discharge this burden as they failed to support their allegations with substantial evidence.

In BSA Tower Condominium Corporation v. Reyes,115 the Supreme Court held that:

The basic rule is that mere allegation is not evidence and is not equivalent to proof. Likewise, charges based on mere suspicion and speculation cannot be given credence.116

As correctly stated by Respondents, nothing in the complaint “provided any detail as to who among the Respondents processed personal data, what kind of personal data, and how could they have used [the] personal data.”117

In their submissions, Complainants only mentioned that Respondent GEK validated the contents of the Disclosure Statements by conducting a field investigation.118 They failed to prove how Respondents MOC, EVR and SC, as issuers and signatories of the Notice to Explain, unlawfully processed their information.

Further, they failed to particularly identify which information Respondents processed and how Respondents unlawfully accessed or disclosed Complainants’ personal data. They neither specified nor discussed the provisions of the DPA that Respondents supposedly violated.

In sum, Complainants failed to discharge their burden and to submit substantial evidence to support their claim against Respondents. Thus, the case must be dismissed for lack of substantial evidence.

II. Respondents’ act of processing and validating the contents of Complainants’ Disclosure Statements was pursuant to its legitimate interest.

While it has been established earlier that Complainants failed to identify which information Respondents processed, a perusal of the records shows that the personal data in the Disclosure Statements only involves personal information.

Section 3 (g) of the DPA defines personal information:

Section 3. Definition of Terms. Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

(g) Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.119

The Disclosure Statements included the names, positions, I.D. numbers, employment information, personal relationships, and financial interests of the employees and consultants of VMC.120 The employees and consultants’ names clearly fall under the definition of personal information. Further, these information, when put together, can directly and certainly identify the members of VMC. Thus, they are considered personal information under the DPA.

Nevertheless, Respondents processed the personal information involved according to a lawful criterion under Section 12 (f) of the DPA. Section 12 (f) of the DPA allows for the processing of personal information when it is necessary for the purposes of the legitimate interests pursued by the PIC:

Section 12. Criteria for Lawful Processing of Personal Information.

The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

…

(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.121

Processing based on legitimate interest requires the fulfillment of the following conditions: (1) the legitimate interest is established; (2) the means to fulfill the legitimate interest is both necessary and lawful; and (3) the interest is legitimate and lawful and it does not override fundamental rights and freedoms of data subjects.122

In this case, Respondents have clearly established that the processing and validating of the Disclosure Statements were done pursuant to the VMC’s legitimate interest of preventing and addressing any actual or potential conflict of interest that may adversely affect the interest of the company in its stakeholders, such as dealings between employees, consultants and VMC.123

A. Respondents established their legitimate interest in processing Complainants’ Disclosure Statements.

The first requisite of processing based on Section 12 (f) of the DPA is that the legitimate interest is established.124 This focuses on what the PIC seeks to accomplish with the specific processing activity. To determine whether this has been established, the PIC must comply with the general privacy principles of (1) legitimate purpose and (2) transparency.

Section 11 of the DPA discusses legitimate purpose as follows:

Section 11. General Data Privacy Principles. The processing of personal information shall be allowed, subject to compliance with the requirements of this Act and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.

Personal information must, be:

(a) Collected for specified and legitimate purposes determined and declared before, or as soon as reasonably practicable after collection, and later processed in a way compatible with such declared, specified and legitimate purposes only;

…

(e) Retained only for as long as necessary for the fulfillment of the purposes for which the data was obtained or for the establishment, exercise or defense of legal claims, or for legitimate business purposes, or as provided by law[.]125

Elaborating on this, Section 18 of the Implementing Rules and Regulations of the DPA (IRR) provides:

Section 18. Principles of Transparency, Legitimate Purpose and Proportionality. The processing of personal data shall be allowed subject to adherence to the principles of transparency, legitimate purpose, and proportionality.

…

b. Legitimate purpose. The processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy.126

The legitimate purpose principle requires that: (1) the purpose of processing must be specified; and (2) that purpose must not be contrary to law, morals, or public policy.127

The first element requires that there should be a specific purpose, such that the purpose of processing is clearly defined and not vague or overbroad. While this does not require an exhaustive enumeration of each and every purpose, the purpose must be specific enough for the data subject to understand the purpose of processing. The second element requires the purpose to be within the limitations of the law, which should be understood to include the entire body of laws, rules, and regulations.128 Additionally, the purpose of processing should not go against prevailing morals or run counter to public policy.129

Both elements of legitimate purpose are satisfied in this case. The processing of Complainants’ information was done pursuant to a legitimate purpose, which was to comply with existing regulations and to ensure that there were no deviations from the company’s policies that could be detrimental to the business of VMC. Further, such purpose is not contrary to any law, rule, or regulation or against morals and policy.

VMC, as a publicly listed corporation, has a responsibility towards its investors and must comply with the Securities and Exchange Commission Code of Corporate Governance for Publicly Listed Companies under SEC Memorandum Circular 19 Series of 2016.130 The SEC Memorandum Circular requires such corporations “to establish corporate disclosure policies and procedures that are practical and in accordance with best practices and regulatory expectations.”131 This includes the adoption of anti-corruption programs to mitigate corrupt policies which include conflict of interest.132

Further, VMC has legitimate business interest to prevent and address conflicts of interest that may adversely affect the company and its stakeholders.133 VMC, in compliance with the SEC Circular and pursuant to good corporate governance, required all of its employees and consultants to execute the Disclosure Statements. Clearly, Respondents have a real and present interest in the processing of the Disclosure Statements of its employees.134

Further, the transparency principle requires that the claimed interest is declared to the data subject.135 The PIC should inform the data subject of the nature, purpose, and extent of the processing, using clear and plain language that is easy to access and understand.136

In this case, Respondents clearly and adequately communicated to the employees, including Complainants, VMC’s legitimate interest in processing Complainants’ information through the provisions found in the Disclosure Statements. As stated in the Disclosure Statements, the disclosure is done “in accordance with the VMC Group policy on good corporate governance to ensure transparency in (the) working relations with all parties.”137 Further, the Disclosure Statements stated who are covered and what would amount to a conflict of interest.138

Thus, Respondent established their legitimate interest and satisfied the first requisite of processing based on Section 12 (f) of the DPA. They have communicated their specific purpose in processing Complainants’ Disclosure Statements and such purpose is not contrary to law, morals, or public policy.

B. The means that Respondents used to fulfill its legitimate interest were both necessary and lawful.

The second requisite of processing based on Section 12 (f) of the DPA is that the means to fulfill the legitimate interest is both necessary and lawful.139 For this requisite, the PIC must evaluate how it is accomplishing its legitimate interest as previously established. The PIC must show that the means or the specific processing activity undertaken is (1) necessary and (2) lawful.140

As the Commission previously held, the qualifier “necessary” refers to the general privacy principle of proportionality.141 Following this principle, the processing must be adequate, relevant, suitable, and necessary, such that it is not excessive in relation to the declared and specified purpose.142

Section 11 of the DPA provides:

Section 11. General Data Privacy Principles. The processing of personal information shall be allowed, subject to compliance with the requirements of this Act and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.

Personal information must, be:

…

(c) Accurate, relevant and, where necessary for purposes for which it is to be used the processing of personal information, kept up to date; inaccurate or incomplete data must be rectified, supplemented, destroyed or their further processing restricted;

(d) Adequate and not excessive in relation to the purposes for which they are collected and processed[.]143

Section 18 of the Implementing Rules and Regulations of the DPA (IRR) elaborates on proportionality:

Section 18. Principles of Transparency, Legitimate Purpose and Proportionality. The processing of personal data shall be allowed subject to adherence to the principles of transparency, legitimate purpose, and proportionality.

…

c. Proportionality. The processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.144

Given this, processing is deemed proportional when (1) processing is adequate, relevant, and necessary to the declared and specified purpose; and (2) the means by which processing is performed is the least intrusive means available.145

In Philippine Stock Exchange Inc. v. Secretary of Finance, the Supreme Court explained “necessary” to mean that “the personal data sought by the State must be acquired through ‘narrowly tailored’ means, which are only necessary to accomplish the regulatory agencies’ given mandate.”146 As applied in this case, the PIC must adopt means that are only necessary to accomplish its legitimate interest to prevent abuses.

In this case, Respondents’ act of validating the VMC employees’ Disclosure Statements was necessary to verify the accuracy of the entries and detect discrepancies in the Disclosure Statements. Respondents conducted field investigations, verifications, inspections, interviews, and inquiries simply to verify the entries of Complainants on their Disclosure Statements.147 By doing so, Respondents can ensure that all possible conflicts of interests of the VMC employees and consultants are addressed. Further, as stated by Respondents, the validation was done with utmost confidentiality as “only authorized personnel whose functions included participation in the conduct of internal administrative proceedings under the Labor Code were given access” to Complainants’ information.148

Specifically, GEK, as the Head of the Transformation Department and Internal Audit, is responsible for auditing information and providing reports thereon that could adversely affect the business of VMC.149 Thus, it was necessary for her to process the information in the Disclosure Statements.

The second element is also present as the means chosen by Respondents were lawful. For this element, it requires that the means chosen to accomplish the legitimate interest is itself lawful.150 The PIC cannot violate any law in the process of accomplishing its legitimate interest. Considering that the determination of lawfulness goes into the means chosen to accomplish the legitimate interest, it is different from the lawfulness of the purpose under the general privacy principle of legitimate purpose (i.e. purpose must not be contrary to law, morals, and public policy). Section 11 of the DPA provides:

Section 11. General Data Privacy Principles. The processing of personal information shall be allowed, subject to compliance with the requirements of this Act and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.

Personal information must, be:

…

(b) Processed fairly and lawfully;

Respondents’ adopted means for validating the information in the Disclosure Statements were lawful. The field investigation and the inquiries done by Respondents did not violate any existing law or regulation, company policy, or contractual agreement between VMC and Complainants.

C. Respondents’ interest is legitimate and lawful and it does not override fundamental rights and freedoms of data subjects.

The third requisite is that the interest is legitimate and lawful and it does not override fundamental rights and freedoms of data subjects.151

This requisite focuses on the effect of accomplishing the legitimate interest such that it does not override the fundamental rights and freedoms of the data subjects.

A determination of the effect of accomplishing legitimate interest requires an analysis of the totality of the three (3) requisites. Given that the legitimate interest of the PIC has been established (first requisite) and the PIC’s means to fulfill that legitimate interest is both necessary and lawful (second requisite), it must now be determined whether the processing undertaken does not override the Complainants’ fundamental rights and freedoms (third requisite).

In determining the effect of the PIC’s legitimate interest on the data subject, aside from the categories of personal information that is processed, the Commission considers the general privacy principle of fairness and the reasonable expectation of the data subjects with regard to the processing of their personal information.

Section 11 (b) of the DPA states that the personal information must be processed fairly.152

Section 11. General Data Privacy Principles.

The processing of personal information shall be allowed, subject to compliance with the requirements of this Act and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.

Personal information must, be:

…

(b) Processed fairly and lawfully[.]153

Section 19 of the Implementing Rules and Regulations of the DPA (IRR) elaborates on fairness:

Section 19. General principles in collection, processing and retention.

The processing of personal data shall adhere to the following general principles in the collection, processing, and retention of personal data:

…

b. Personal data shall be processed fairly and lawfully.

  1. Processing shall uphold the rights of the data subject, including the right to refuse, withdraw consent, or object. It shall likewise be transparent, and allow the data subject sufficient information to know the nature and extent of processing.

  2. Information provided to a data subject must always be in clear and plain language to ensure that they are easy to understand and access.

  3. Processing must be in a manner compatible with declared, specified, and legitimate purpose.

  4. Processed personal data should be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.

  5. Processing shall be undertaken in a manner that ensures appropriate privacy and security safeguards.154

As discussed, Respondents processed Complainants’ personal data in compliance with the SEC Circular and pursuant to good corporate governance.155 The validation of the Disclosure Statements did not go beyond what can be reasonably expected by Complainants, as employees, when they submitted their Disclosure Statements to VMC.

It is not unreasonable to expect that these Disclosure Statements would be subject to verification and validation as a necessary consequence. The interest of Respondents to comply with regulatory requirements and protect its business from conflicts of interest that may adversely affect the company is legitimate and does not override the fundamental rights and freedoms of the data subjects, including Complainants. This legitimate interest does not, in any way, disregard the fundamental rights and freedoms of Complainants.

In sum, for processing based on Section 12 (f) of the DPA to apply, the PIC must comply with three (3) requisites.156 The first requisite focuses on what the PIC is accomplishing and the legitimate purpose that has been communicated to the data subject. The second requisite refers to how the PIC is accomplishing the legitimate interest, such as the means chosen or the specific processing activity undertaken, which should be necessary and lawful. Finally, the third requisite considers the effect of accomplishing the legitimate interest, such that it does not override the fundamental rights and freedoms of the data subjects.

In this case, Respondents complied with all three requisites for processing based on legitimate interest. Respondents have clearly established the legitimate interest in processing the Disclosure Statements. The investigations and interviews lawfully conducted were necessary to verify the accuracy of the entries in the Disclosure Statements. Further, their acts did not go beyond what could be reasonably expected by Complainants, as employees, when they submitted their Disclosure Statements. Thus, even if Complainants had presented substantial evidence to support their claims, Respondents would still have lawful basis under Section 12 (f) of the DPA when they processed Complainants’ personal information.

Given the foregoing, the Commission cannot find Respondents liable for violating Section 25 (Unauthorized Processing), Section 26 (Access due to Negligence), Section 28 (Processing for Unauthorized Purposes), Section 29 (Unauthorized Access or Intentional Breach), Section 31 (Malicious Disclosure), Section 32 (Unauthorized Disclosure), and Section 33 (Combination or Series of Acts) of the DPA.

WHEREFORE, premises considered, this Commission resolves that the case filed by Spouses MCD and JJD against Victorias Milling Company, MOC, EVR, GEK, and SC is DISMISSED for lack of substantial evidence.

This is without prejudice to the filing of appropriate civil, criminal, or administrative cases before any other forum or tribunal, if any.

SO ORDERED.

City of Pasay, Philippines.

30 June 2023.

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA

Privacy Commissioner

(on official leave)

NERISSA N. DE JESUS

Deputy Privacy Commissioner

Copy furnished:

DEPASUCAT-SAZON & ILIGAN LAW OFFICES

Counsel for Complainants

KAB

Counsel for Respondents

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Complaint-Affidavit of MCD, 27 June 2019, at 1, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019). ↩

  2. Id. ↩

  3. Id. ↩

  4. Complaint-Affidavit of JJD, 27 June 2019, at 1, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019). ↩

  5. Complaint-Affidavit of MCD, 27 June 2019, at 2, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019); Complaint-Affidavit of JJD, 27 June 2019, at 2, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019). ↩

  6. Id. at 3; Id. ↩

  7. Id. at 2; Id. ↩

  8. Id. ↩

  9. Id. ↩

  10. Id. Annex C; Id. Annex C; ↩

  11. Complaint-Affidavit of MCD, 27 June 2019, at 3, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019); Complaint-Affidavit of JJD, 27 June 2019, at 2, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019). ↩

  12. Id. Annex C; Id. Annex C. ↩

  13. Id. Annex D; Id. Annex D. ↩

  14. Id. at 3; Id. at 3. ↩

  15. Explanation of MCD Complaint-Affidavit of MCD, 27 June 2019, Annex D, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019). ↩

  16. Complaint-Affidavit of MCD, 27 June 2019, at 3, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019); Complaint-Affidavit of JJD, 27 June 2019, at 2, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019). ↩

  17. Id. at 4; Id. at 4. ↩

  18. Id. ↩

  19. Request for Grievance dated 17 February 2018, Complaint-Affidavit of MCD, 27 June 2019, Annex F, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019). ↩

  20. Id. ↩

  21. Id. ↩

  22. Id. ↩

  23. Complaint-Affidavit of MCD, 27 June 2019, at 4, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019). ↩

  24. Complaint-Affidavit of MCD, 27 June 2019, at 4, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019); Complaint-Affidavit of JJD, 27 June 2019, at 3-4, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019). ↩

  25. Id. ↩

  26. Id. ↩

  27. Id. at 5; Id. at 4-5. ↩

  28. Id. ↩

  29. Order to Confer for Discovery, 10 February 2021, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2021). ↩

  30. Entry of Appearance dated 01 March 2021, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2021). ↩

  31. Order to File Verified Comment, 23 March 2021, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2021). ↩

  32. Id. ↩

  33. Id. ↩

  34. Order (To File Verified Comment and Appear Virtually for Preliminary Conference), 27 September 2021, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2021). ↩

  35. Id. ↩

  36. Consolidated Comment, 18 October 2021, at 2, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2021). ↩

  37. Id. ↩

  38. Id. ↩

  39. Id. ↩

  40. Id. at 3. ↩

  41. Id. at 2. ↩

  42. Consolidated Comment, 18 October 2021, at 2, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2021). ↩

  43. Id. at 3. ↩

  44. Id. ↩

  45. Id. ↩

  46. Id. ↩

  47. Id. at 4. ↩

  48. Consolidated Comment, 18 October 2021, at 4, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2021). ↩

  49. Id. at 3. ↩

  50. Id. at 19. ↩

  51. Id. at 4. ↩

  52. Id. ↩

  53. Id. ↩

  54. Consolidated Comment, 18 October 2021, at 4-5, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2021). ↩

  55. Id. at 6. ↩

  56. Id. ↩

  57. Id. at 13. ↩

  58. Id. at 14. ↩

  59. Id. ↩

  60. Consolidated Comment, 18 October 2021, at 14, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2021). ↩

  61. Id. ↩

  62. Id. at 15. ↩

  63. Id. ↩

  64. Id. at 15. ↩

  65. Id. at 16-17. ↩

  66. Consolidated Comment, 18 October 2021, at 17, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2021). ↩

  67. Id. ↩

  68. Id. at 18. ↩

  69. Id. at 19. ↩

  70. Id. ↩

  71. Id. at 20. ↩

  72. Consolidated Comment, 18 October 2021, at 20, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2021). ↩

  73. Id. ↩

  74. Id. ↩

  75. Id. ↩

  76. Id. ↩

  77. Id. at 2. ↩

  78. Order, 26 October 2021, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2021). ↩

  79. Fact-Finding Report, 29 December 2022, at 3, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2022). ↩

  80. Order (After the Preliminary Conference on 16 November 2021), 16 November 2021, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2021). ↩

  81. Id. ↩

  82. Id. ↩

  83. Id. at 2. ↩

  84. Id. ↩

  85. Id. ↩

  86. Application for Mediation, 19 November 2021, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2021). ↩

  87. Id. ↩

  88. Order to Mediate, 05 January 2022, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2022). ↩

  89. Notice of Non-Settlement of Dispute, 10 March 2022, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2022). ↩

  90. Id. ↩

  91. Order (for Resumption of Complaints Proceedings, Requiring Respondents to Submit their Comment/Opposition to the Discovery of the Document, and Requiring the Parties to Submit their Simultaneous Memoranda), 15 March 2022, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2022). ↩

  92. Id. ↩

  93. Comment/Opposition to Discovery of Document, 30 March 2022, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2022). ↩

  94. Id. at 2. ↩

  95. Id. at 3. ↩

  96. Order (Noting the Comment/Opposition to Discovery of Document filed by Respondents), 01 April 2022, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2022). ↩

  97. Memorandum for the Respondents, 18 April 2022, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2022). ↩

  98. Id. at 16. ↩

  99. Id. at 20-22. ↩

  100. Memorandum for Complainant, 20 July 2022, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2022). ↩

  101. Id. ↩

  102. Memorandum for the Respondents, 18 April 2022, at 7, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2022). ↩

  103. Complaint-Affidavit of MCD, 27 June 2019, at 5, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019); Complaint-Affidavit of JJD, 27 June 2019, at 5, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019). ↩

  104. Id. Annex A; Id. Annex A. ↩

  105. Id. Annex B; Id. Annex B. ↩

  106. Id. Annex C; Id. Annex C. ↩

  107. Id. Annex D; Id. Annex D. ↩

  108. Id. Annex E; Id. Annex E. ↩

  109. Complaint-Affidavit of MCD, 27 June 2019, Annex F, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019). ↩

  110. Complaint-Affidavit of MCD, 27 June 2019, Annex G, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019); Complaint-Affidavit of MCD, 27 June 2019, Annex F in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019). ↩

  111. Complaint-Affidavit of MCD, 27 June 2019, Annex F in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019). ↩

  112. Complaint-Affidavit of MCD, 27 June 2019, Annex H, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019); Complaint-Affidavit of MCD, 27 June 2019, Annex G in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019). ↩

  113. 2019 AMENDMENT TO THE 1989 REVISED RULES ON EVIDENCE, A.M. No. 19-08-15-SC, rule 131, §1 (1 May 2020). Emphasis supplied. ↩

  114. Id. rule 133, §6. ↩

  115. BSA Tower Condominium Corp. v. Reyes II, A.C. No. 11944 (2018). ↩

  116. Id. ↩

  117. Memorandum for the Respondents, 18 April 2022, at 20-22, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2022). ↩

  118. Complaint-Affidavit of MCD, 27 June 2019, at 2, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019); Complaint-Affidavit of JJD, 27 June 2019, at 2, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019). ↩

  119. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 § 3 (g) (2012). ↩

  120. Complaint-Affidavit of MCD, 27 June 2019, Annex A, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019); Complaint-Affidavit of JJD, 27 June 2019, Annex A, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019). ↩

  121. Data Privacy Act of 2012, § 12 (f). ↩

  122. MAF v. Shopee, NPC 21-167, 22 September 2022, at 9, available at https://privacy.gov.ph/wp-content/uploads/2023/05/NPC-21-167-2022.09.22-MAF-v.-Shopee-Decision-Final.pdf (last accessed 05 July 2023). ↩

  123. Consolidated Comment, 18 October 2021, at 2, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2021). ↩

  124. MAF v. Shopee, NPC 21-167, at 9. ↩

  125. Data Privacy Act of 2012, § 11 (a)(e). Emphasis supplied. ↩

  126. National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, rule IV, § 18 (a)(b) (2016) Emphasis supplied. ↩

  127. See Data Privacy Act of 2012, § 11; Rules and Regulations Implementing the Data Privacy Act of 2012, rule IV, § 18 (a)(b). ↩

  128. MLF v. MyTaxi.PH Corp., NPC 19-142, 31 March 2022, at 8, available at https://privacy.gov.ph/wp-content/uploads/2023/05/NPC-19-142-MLF-v.-Grab-Philippines-2022.03.31.-Decision.pdf (last accessed 24 August 2023). ↩

  129. Id. at 8. ↩

  130. Consolidated Comment, 18 October 2021, at 3, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2021). ↩

  131. Securities and Exchange Commission, Code of Corporate Governance for Publicly-Listed Companies, Principle 8 (2016). ↩

  132. Id. Recommendation 15.2. ↩

  133. Consolidated Comment, 18 October 2021, at 2, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2021). ↩

  134. Emphasis supplied. ↩

  135. Data Privacy Act of 2012, § 11 (a). ↩

  136. Rules and Regulations Implementing the Data Privacy Act of 2012, rule IV, § 18 (a). ↩

  137. Complaint-Affidavit of MCD, 27 June 2019, Annex F, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019). ↩

  138. Id. ↩

  139. MAF v. Shopee, NPC 21-167, at 9. ↩

  140. See Data Privacy Act of 2012, § 11 (b)(c)(d). ↩

  141. EA and TA v. EJ, EE, and HC, NPC 17-018, 15 July 2019, at 10, available at https://privacy.gov.ph/wp-content/uploads/2023/05/NPC-17-018-EA-and-TA-v-EJ-Decision-2019.07.15-.pdf (last accessed 24 August 2023). ↩

  142. Data Privacy Act of 2012, § 11 (c)(d). ↩

  143. Id. § 11 (b)(c)(d). Emphasis supplied. ↩

  144. Rules and Regulations Implementing the Data Privacy Act of 2012, rule IV, § 18 (c). Emphasis supplied. ↩

  145. MAF v. Shopee, NPC 21-167, at 14. ↩

  146. Philippine Stock Exchange v. Secretary of Finance, G.R. No. 213860 (2022). ↩

  147. Complaint-Affidavit of MCD, 27 June 2019, at 2, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019); Complaint-Affidavit of JJD, 27 June 2019, at 2, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2019). ↩

  148. Consolidated Comment, 18 October 2021, at 4, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2021). ↩

  149. Id. at 19. ↩

  150. See Data Privacy Act of 2012, § 11 (b). ↩

  151. MAF v. Shopee, NPC 21-167, at 9. ↩

  152. Data Privacy Act of 2012, § 11 (b). ↩

  153. Id. Emphasis supplied. ↩

  154. Rules and Regulations Implementing the Data Privacy Act of 2012, rule IV, § 19(b). Emphasis supplied. ↩

  155. Consolidated Comment, 18 October 2021, at 2, in Sps. MCD-JJD v. Victorias Milling Company, NPC 19-758 & 19-1846 (NPC 2021). ↩

  156. MAF v. Shopee, NPC 21-167, at 9. ↩

Backlinks