NPC Issuance Wiki

NPC 21-122: JBZ v. Metropolitan Bank & Trust Company

Issued Decision

Decision Text

JBZ,

Complainant,

-versus-

METROPOLITAN BANK & TRUST COMPANY AND CDR AS VP CARDS AND PERSONAL CREDIT SECTOR,

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before this Commission is a Complaint filed by JBZ against Metropolitan Bank & Trust Company (Metrobank) and CDR as Vice President, Cards and Personal Credit Sector for alleged violation of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

On 08 February 2021, JBZ filed a complaint against Metrobank and CDR for violations of the DPA.1

JBZ alleged that he has been a Metrobank cardholder with credit card ending in [ ] since July 2013.2 He regularly received his billing from Metrobank through his mobile number, and his Statement of Account through his email address.3

He claimed that he received an email dated 18 March 2020 from CDR, on behalf of Metrobank, informing him that Metrobank already endorsed his account to its collection agents.4 He alleged that the endorsement was done “without [his] approval.”5

To support his allegation, he attached a letter signed by CDR on behalf of Metrobank.6 CDR explained in the letter that JBZ sent an email to the Consumer Empowerment Group of the Bangko Sentral ng Pilipinas (BSP) on 24 February 2020 to complain that Metrobank failed to respond to his request for a balance restructuring program.7 CDR also stated that the BSP forwarded the matter to Metrobank “for appropriate action” on 10 March 2020.8

CDR explained that Metrobank did not receive any request for restructuring from JBZ.9 Metrobank’s collection agents tried contacting JBZ through his declared phone numbers from 12 to 16 March 2020 to no avail.10 As a result, Metrobank requested JBZ to provide other contact numbers and a schedule to discuss available payment options through a phone call.11

JBZ alleged that he began receiving anonymous calls and emails as a result of the endorsement of his account to Metrobank’s collection agents.12 He claimed that as a result of the alleged disclosure, he began receiving demands for the collection of his unsettled obligation through emails and phone calls from several senders he did not recognize.13 JBZ submitted screenshots of his mobile phone call logs that showed incoming phone calls from several untagged numbers from May 2020 to August 2020.14 According to the evidence JBZ attached to his complaint, the senders represented themselves as collection agents of Metrobank through email and Short Message Service (SMS):

  1. By email dated 03 September 2020, from a certain RS, MIS, representing Cendana Neri Credit and Collection Services;15
  2. By Short Message Service (SMS) dated 08 September 2020, from LE, representing Bernales & Associates;16
  3. By email dated 08 December 2020, from GM representing Anonuevo Credit and Collection Services, Inc. (ACCSI Cebu);17 and
  4. By email dated 15 November 2020, from ET representing Admerex Solutions.18

JBZ claimed that he also received scam offers from the Pacquiao Foundation through SMS19 and one AP through a Facebook message.20

JBZ also alleged that on 15 December 2020, he received an email from Metrobank informing him that his card ending in [ ] was being cancelled and that he should no longer use it to avoid inconvenience.21 JBZ presented an email dated 14 December 2020 from “Collections – MCC [ ]”:

Dear Cardholder,

Please be informed we have cancelled your credit card privileges and we advise you to refrain from using the card ending in [ ] to avoid any inconvenience.

For inquiries, you may contact our representatives at [ ] or [ ] (toll free) during regular office hours or through [ ]

Sincerely,

Collections Department

Consumer Business Sector

Metropolitan Bank & Trust Company22

JBZ categorically stated that he does not have a Metrobank card ending in [ ] “as [his Metrobank] Card ends in xxxx [ ].”23 He likewise submitted a photocopy of his Metrobank Titanium Credit Card, which shows that its last four digits are [ ].24

JBZ alleged that the numerous anonymous emails and calls resulted in him being “practically in chaos and mentally tortured asking who really was/were trying to fool [him] or were trying to snare [him] in a scam.”25

JBZ prayed for “damages pursuant to the DPA,” and “for the appropriate complaint/case be filed against Metrobank Card Corporation for culpable violation” of Sections 19 and 20 of the DPA.26

On 10 September 2021, the Commission, through the Complaints and Investigation Division (CID), issued an Order directing Metrobank to file its Verified Comment within fifteen (15) days from receipt of the Order and to appear for preliminary conferences on 09 November 2021 and 07 December 2021.27

Metrobank filed its Verified Comment dated 23 September 2021.28

Metrobank claimed that it emailed JBZ, through CDR, to inform him that Metrobank “may possibly accept the offer as to Balance Restructuring Program.”29 Metrobank explained that it did not grant JBZ’s request because could not be contacted through any of his numbers on record, and he failed to respond to the email.30

As of 07 April 2020, JBZ’s unpaid obligation on the Credit Card amounted to Eighty-eight Thousand Four Hundred Two Pesos (Php 88,402.00), with the minimum amount of Four Thousand Four Hundred Twenty Pesos and Ten Centavos (Php 4,420.10) due for payment on or before 28 April 2020.31 Of the outstanding amount, Metrobank claimed JBZ only paid Two Thousand Pesos (Php 2,000.00).32

Metrobank explained that on 11 July 2020, it sent another letter to JBZ reminding him of his unpaid obligation.33 It reminded JBZ of Section 30 of the Metrobank Terms and Conditions Governing the Issuance and Use of the Credit Card (Terms and Conditions), which provides:

  1. COLLECTION

a. ENDORSEMENT TO COLLECTION AGENCIES. The Card Member consents and authorizes Metrobank to process, share or transfer his/ her personal data to Metrobank’s agency/ agent for collections should the account be referred to an agency/ agent for collection activity.34

Metrobank stated that a cardholder “must agree to Section 30 prior to the usage of its credit card.”35 Metrobank explained that JBZ already consented to such endorsement and authorized Metrobank to share his personal data should his account be referred to its collection agents, when he signed the Application Form.36

Metrobank claimed that the outsourcing of JBZ’s account is valid under Republic Act No. 10870, or the Philippine Credit Card Industry Regulation Law (R.A. No. 10870).37 R.A. No. 10870 provides:

Section 21. Endorsement of Credit Card Debt Collection by the Credit Card Issuer to a Collection Agency. A credit card issuer shall inform its cardholder in writing of the endorsement of the collection of the account to a collection agency, or the endorsement of the account from one collection agency to another, prior to the actual endorsement. The notification shall include the full name of the collection agency and its contact details. The requirement to notify a cardholder in writing about the endorsement of the account to the collection agency shall be included in the terms and conditions of the credit card agreement: Provided, That the credit card issuer shall refer the collection of an account to only one collection agency at any one time.38

Metrobank argued that even in the absence of Section 21 of R.A. No. 10870, Section 14 of the DPA recognizes outsourcing of personal data:

Section 14. Subcontract of Personal Information. A personal information controller may subcontract the processing of personal information: Provided, That the personal information controller shall be responsible for ensuring that proper safeguards are in place to ensure the confidentiality of the personal information processed, prevent its use for unauthorized purposes, and generally, comply with the requirements of this Act and other laws for processing of personal information. The personal information processor shall comply with all the requirements of this Act and other applicable laws.39

Metrobank also cited NPC Advisory Opinion 2018-1540 to support its argument:

Whether processing is based on consent, law, or some other criteria for lawful processing, the PIC is not required to obtain a separate consent from the data subject before entering into an outsourcing agreement as the purpose of the processing remains to be the same and the PIC remains to be the same.

…

Nevertheless, considering the right of data subjects to be informed and notified of the processing of their personal data, the PIC must indicate in its privacy notice or privacy policy the particular data processing activities that are outsourced.41

Metrobank claimed that its collection agents are “governed by the same strict level of privacy policy with the Bank”, which includes the secure storage of information and deletion of information once the service has been performed.42 Metrobank also stated it referred JBZ’s account to only one collection agency at any one time.43

Metrobank further argued that JBZ failed to discharge the burden of proving the messages resulted from a data breach on Metrobank’s part:

  1. Here, the Complainant merely assumed that he began receiving anonymous calls and emails after Metrobank endorsed his account to the collection agencies, without establishing:

a. How a breach occurred from the side of Metrobank;

b. The connection between the anonymous messages from Pacquiao Organization, AP, and DOH, which are obviously sent in random; and

c. The details as to how each of the privacy offenses were committed by Respondents Metrobank/Ms. CDR.

  1. It appears that Complainant himself is not even certain about his charges to Metrobank, as he cannot specify when and how the alleged “data breach” occurred. All he knows is that there are anonymous emails and calls, and he concluded (without aptly describing how) that it is Metrobank’s fault.44

Metrobank noted that JBZ, without settling his dues, sent an email on 26 August 2020.45 Metrobank stated that JBZ claimed that he received “hundred [sic] calls from unknown callers”46 alleging to be from Metrobank, and that he will only pay once the issue is cleared and he is assured his data privacy rights are not violated.47 Metrobank argued, however, that these calls were from generic and unidentified numbers, with only one tagged as “MB”.48 Metrobank also argued that even if the calls were from Metrobank, one to two calls a day with gaps in between is not, by its own, intrusive in nature.49 Further, it stated that the scam messages from the Pacquiao Foundation and AP were widely known to be sent in random.50

Metrobank noted that the breach occurred in September 2020, but JBZ only filed the case in February 2021, or “after he was sternly reminded about his obligation to pay and cancellation of his credit card perks.”51

Metrobank concluded that JBZ failed to show a data breach on its part, and that “his intention to file the instant case is certainly not to admonish Metrobank for the data breach (because there is none), but for a purpose that would only serve the convenience of [JBZ].”52

Further, Metrobank argued that JBZ failed to state a cause of action against CDR.53 Metrobank explained that CDR’s name was only mentioned in the complaint as the one who sent the letter dated 18 March 2020 on behalf of Metrobank and that there were no other claims on CDR’ involvement in the alleged data breach.54

Metrobank argued that none of the circumstances in Section 34 of the DPA on the liability of responsible officers applies to CDR.55 Metrobank explained that she only signed the letter for and on behalf of Metrobank.56 Metrobank concluded that it would be unjust to drag the name of a bank officer without clear basis on her involvement in the alleged violations of the DPA.57

Metrobank also argued that it is not liable for violating Section 26 (Access Due to Negligence), Section 27 (Improper Disposal), Section 31 (Malicious Disclosure), and Section 32 (Unauthorized Disclosure) of the DPA.58 Metrobank maintained that it disclosed JBZ’s information to its collection agents with his consent, and that JBZ neither raised clear allegations nor presented evidence to substantiate his allegations.59

Metrobank argued it is not liable for Section 26 (Access due to Negligence):

  1. In the absence of clear allegations and evidence as to how Metrobank disregarded its duty to protect Complainant’s personal data resulting in carelessness or indifference, or how Metrobank failed to give proper attention to the Personal Data that it is handling, Complainant’s claim is certainly bereft of merit.60

Metrobank also argued it is not liable for Section 27 (Improper Disposal):

  1. Metrobank has defined policies on how to dispose its personal data, being an institution highly-regulated by the Bangko Sentral ng Pilipinas. Both hard copies and soft copies are being disposed in accordance with standards acceptable to the BSP, and for a period of five years from the closure of the account.61

Metrobank argued that it is not liable for Section 31 (Malicious Disclosure):

  1. In “Manila Bulletin Publishing Corporation vs. VD”, the Supreme Court defined malice as:

“Malice connotes ill will or spite and speaks not in response to duty but merely to injure the reputation of the person defamed, and implies an intention to do ulterior and unjustifiable harm. Malice is bad faith or bad motive. It is the essence of the crime of libel.” (Emphasis supplied)

  1. As culled from the above case, for a disclosure to be malicious under Sec. 31 of the DPA, the same must be attended with bad motive or bad faith.

  2. Conversely, disclosure of Complainant’s information to the collection agents is simply for the purpose of collecting his unpaid balance, pursuant to Sec. 30 of the Terms and Conditions, Sec. 21 of R.A. 10870, and Sec. 14 of the DPA.

  3. Since there are clear grounds on why the said disclosure was made, the same could not fall as “malicious”. Again, the claim of the Complainant falls short of any legal basis.62

Finally, Metrobank argued that it is also not liable for Section 32 (Unauthorized Disclosure):

  1. For this offense to be considered as Unauthorized Disclosure, the disclosure must not be supported by any legal basis.

  2. In contrast, Complainant agreed to the Terms and Conditions of the Credit Card, which allows disclosure of his personal data to Metrobank’s collection agents, as shown by the frequency of his usage.

  3. Again, the said disclosure is likewise supported by Sec. 21 of R.A. 10870 and Sec. 14 of the DPA.

  4. As such, it is clear that there are both CONSENT and LEGAL BASIS under the law on the disclosure made by Metrobank. The contentions of the Complainant are hence, bereft of merit.63

Metrobank’s arguments against JBZ’s allegation of its violation of the DPA hinged on the insufficiency of JBZ’s evidence to support his allegation. It prayed that the complaint be dismissed and that other reliefs as may be just and equitable be granted.64

On 09 November 2021, Metrobank, through counsel, appeared for the first preliminary conference and expressed its willingness to undergo mediation proceedings.65 JBZ, however, did not appear and instead informed the Commission that he was experiencing technical difficulties due to heavy rains.66

On 07 December 2021, both parties appeared and manifested that they will not require any documents and evidence from each other.67 JBZ manifested that he was not willing to undergo mediation proceedings and that he will be adopting his notarized complaint and the attached evidence as his Memorandum.68

On 07 December 2021, the CID directed Metrobank to file its Memorandum within fifteen (15) calendar days from receipt of the Order.69

On 17 December 2021 Metrobank filed its Memorandum where it restated the statements and arguments it previously presented in its Comment.70

On 03 June 2022, Metrobank submitted its Manifestation and Compliance dated 03 June 2022, and attached the version of the Terms and Conditions and the Certified True Copy of the Application Form that were signed by JBZ in response to the CID’s Order dated 27 May 2022.71 Metrobank manifested that as a practice, its clients only sign the Application Form containing the undertaking and declaration.72 Since JBZ signed his Application Form, he consented to be bound by the Terms and Conditions.73

Issues

I. Whether Metrobank’s outsourcing of the collection of unpaid accounts is a violation of the DPA;

II. Whether there is substantial evidence to find Metrobank and CDR liable for a violation of the DPA.

Discussion

I. Metrobank’s outsourcing of the collection of unpaid accounts is not a violation of the DPA.

Metrobank is not liable for outsourcing JBZ’s unsettled account to its collection agents.

Outsourcing by an issuing bank of a credit card holder’s unpaid account to its collection agents is allowed under Section 14 of the DPA. Section 14 of the DPA provides:

Section 14. Subcontract of Personal Information. A personal information controller may subcontract the processing of personal information: Provided, That the personal information controller shall be responsible for ensuring that proper safeguards are in place to ensure the confidentiality of the personal information processed, prevent its use for unauthorized purposes, and generally, comply with the requirements of this Act and other laws for processing of personal information. The personal information processor shall comply with all the requirements of this Act and other applicable laws.74

Section 43, Rule X of the Implementing Rules and Regulations of the DPA (IRR) provides that a Personal Information Controller (PIC) shall use contractual or other reasonable means to ensure proper safeguards are in place:

Section 43. Subcontract of Personal Data. A personal information controller may subcontract or outsource the processing of personal data: Provided, that the personal information controller shall use contractual or other reasonable means to ensure that proper safeguards are in place, to ensure the confidentiality, integrity and availability of the personal data processed, prevent its use for unauthorized purposes, and generally, comply with the requirements of the Act, these Rules, other applicable laws for processing of personal data, and other issuances of the Commission.75

The outsourcing or subcontracting of the processing of personal data to third parties is permitted under the DPA and its IRR. In such cases, a PIC, such as Metrobank, is accountable for the actions of collection agents, or its Personal Information Processors (PIP). The PIC also remains responsible for ensuring the confidentiality of the personal data processed, prevention of any unauthorized processing, and compliance with relevant laws.76

Section 21 of the DPA provides for the Principle of Accountability and concomitant obligations of PICs:

Section 21. Principle of Accountability. Each personal information controller is responsible for personal information under its control or custody, including information that have been transferred to a third party for processing, whether domestically or internationally, subject to cross-border arrangement and cooperation.

(a) The personal information controller is accountable for complying with the requirements of this Act and shall use contractual or other reasonable means to provide a comparable level of protection while the information are being processed by a third party.

(b) The personal information controller shall designate an individual or individuals who are accountable for the organization’s compliance with this Act. The identity of the individual(s) so designated shall be made known to any data subject upon request.77

A PIC does not need to secure separate consent from the data subject before subcontracting or outsourcing the processing of personal information to a PIP, provided the purpose for processing remains the same. Under an outsourcing agreement, a PIP merely carries out the processing under the instruction of the PIC and with the safeguards set by the same pursuant to Section 14 of the DPA78 and Section 43, Rule X of the IRR, and taking into consideration the Principle of Accountability provided in Section 21 of the DPA.79 As such, the initial consent to process personal information secured by the PIC from the data subject is sufficient for purposes of entering a subcontracting or outsourcing agreement.

Here, Metrobank’s purpose in outsourcing was to enforce its right against JBZ to recover his unpaid obligation. The purpose for processing JBZ’s personal data remained the same when Metrobank outsourced the collection to its PIPs.

In any case, JBZ also failed to show that he had no knowledge of the outsourcing. In several instances, Metrobank informed JBZ that his account was overdue and that it had been endorsed for collection:

  1. the email dated 18 March 2020 to JBZ from Metrobank dated reminding him of his unpaid account and informing him of their attempts to contact him by phone call80;
  2. the Statement of Account dated 7 April 2020 reminding JBZof his unpaid account81;
  3. the System-Generated Letter dated 11 July 2020 similarly reminding JBZ of his unpaid account82 that Metrobank attached it to its Memorandum filed on 17 December 2021.

Given the foregoing, Metrobank’s referral of JBZ’s account to its PIPs pursuant to an outsourcing agreement is permitted under the DPA.

II. There is no substantial evidence to find Metrobank and CDR liable for a violation of the DPA.

Metrobank and CDR cannot be held liable for violation of the DPA based on the allegations and evidence submitted by JBZ.

JBZ claims that as a result of a breach on the part of Metrobank, his personal data was disclosed without authorization and he was subjected to numerous anonymous emails, calls, and scam offers that caused him distress.83 He alleged Metrobank was liable for violation of Section 26 (Access due to Negligence), Section 27 (Improper Disposal), Section 31 (Malicious Disclosure), and Section 32 (Unauthorized Disclosure).84 To substantiate his complaint, JBZ submitted his e-mail correspondences with Metrobank,85 a copy of the System-Generated Letter reminding him of his unpaid obligation,86 screenshots of text messages and emails from collection agents,87 of call logs from untagged numbers,88 and scam messages from the Pacquiao Foundation89 and AP.90

Section 1 of Rule 131 of the 2019 Amendments to the Revised Rules on Evidence provides:

Section 1. Burden of proof and burden of evidence. Burden of proof is the duty of a party to present evidence on the facts in issue necessary to establish his or her claim or defense by the amount of evidence required by law. Burden of proof never shifts.

Burden of evidence is the duty of a party to present evidence sufficient to establish or rebut a fact in issue to establish a prima facie case. Burden of evidence may shift from one party to the other in the course of the proceedings, depending on the exigencies of the case.91

Section 6 of Rule 133 of the 2019 Amendments to the Revised Rules on Evidence provides:

Section 6. Substantial Evidence. In cases filed before administrative or quasi-judicial bodies, a fact may be deemed established if it is supported by substantial evidence, or that amount of relevant evidence which a reasonable mind might accept as adequate to justify a conclusion.92

In this case, JBZ, as the complainant, has the burden of proof in alleging violation of the DPA. He did not discharge this, however, as he failed to support his allegations with substantial evidence.

JBZ could have utilized the discovery proceedings during preliminary conference to obtain other pieces of evidence to substantiate his allegations. Rule V, Section 1 of the 2021 NPC Rules of Procedure provides:

Section 1. Order to confer for preliminary conference. No later than thirty (30) calendar days from the lapse of the reglementary period to file the comment, the investigating officer shall hold a preliminary conference to determine:

  1. whether alternative dispute resolution may be availed by the parties;

  2. whether discovery is reasonably likely to be sought in the proceeding;

  3. simplification of issues;

  4. possibility of obtaining stipulations or admissions of facts and of documents to avoid unnecessary proof; or

  5. such other matters as may aid in the prompt disposition of the action.93

Discovery proceedings are essential, such as in this case, where the complainant cannot simply rely on the evidence it has to properly substantiate its allegations. The Supreme Court held:

The basic rule is that mere allegation is not evidence and is not equivalent to proof. Likewise, charges based on mere suspicion and speculation cannot be given credence.94

The Supreme Court explained the purpose of discovery proceedings:

What is chiefly contemplated is the discovery of every bit of information which may be useful in the preparation for trial, such as the identity and location of persons having knowledge of relevant facts; those relevant facts themselves; and the existence, description, nature, custody, condition, and location of any books, documents, or other tangible things.95

The evidence that JBZ could have presented to prove the existence of a privacy violation and Metrobank’s supposed liability are most likely in the hands of Metrobank, such as evidence of the outsourcing agreement with collection agencies and details surrounding the outsourcing of the collection of JBZ’s unpaid obligations.

The documents attached to his complaint can only serve to prove that Metrobank and its collection agents were attempting to collect on his unpaid obligation incurred using the credit card. The CAF and attached documents do not show, nor does JBZ even allege, any connection between Metrobank’s outsourcing of his account and the supposed data breach that resulted in a violation of Section 26 (Access due to Negligence), Section 27 (Improper Disposal), Section 31 (Malicious Disclosure), and Section 32 (Unauthorized Disclosure). In the absence of any substantial evidence, the connection between any supposed action or inaction on the part of Metrobank and the numerous anonymous emails, calls, and scam offers that JBZ alleged to have caused him distress with is only speculative.

Instead of availing himself of discovery proceedings during the preliminary conference to seek additional information and documents from Metrobank to substantiate his claims, JBZ merely relied on the insufficient evidence he submitted with his complaint.96 Thus, Metrobank cannot be held liable for the violating the DPA.

Aside from Metrobank, JBZ also impleaded CDR as a respondent in his complaint.97 JBZ, however, failed to substantiate CDR’s participation in Metrobank’s alleged violation of the DPA.

Under Section 34 of the DPA, an officer of a corporation, partnership, or any juridical person may be held liable if they participated in or allowed the commission of the crime by their gross negligence:

Section 34. Extent of Liability. If the offender is a corporation, partnership or any juridical person, the penalty shall be imposed upon the responsible officers, as the case may be, who participated in, or by their gross negligence, allowed the commission of the crime. If the offender is a juridical person, the court may suspend or revoke any of its rights under this Act. If the offender is an alien, he or she shall, in addition to the penalties herein prescribed, be deported without further proceedings after serving the penalties prescribed. If the offender is a public official or employee and lie or she is found guilty of acts penalized Under Sections 27 and 28 of this Act, he or she shall, in addition to the penalties prescribed herein, suffer perpetual or temporary absolute disqualification from office, as the case may be.98

In this case, JBZ failed not only to allege, but also to submit evidence, that CDR was involved in Metrobank’s supposed violation of the DPA, either by her direct participation or by allowing the supposed violation to happen through her gross negligence.

CDR was mentioned only one time in the complaint:

  1. On March 18, 2020 A certain CDR, VP Cards and Personal Credit Sector Metro Bank and Trust Company sent me an email informing me that my account had been endorsed to a collection agent but no specific names given; and without my approval (Annex 3)99

Other than this statement, JBZ neither specified nor discussed the provisions of the DPA that CDR supposedly violated. He failed to specify whether she is liable for violating the same provisions of the DPA as Metrobank, or liable for an entirely different violation.

Further, Section 34 of the DPA assumes that the PIC committed a violation of the provisions of the DPA when its responsible officers are held liable.100 Thus, CDR cannot be held liable as a responsible officer of Metrobank under Section 34 of the DPA.

Given the lack of substantial evidence presented by JBZ, the Commission cannot find Metrobank and CDR liable for violating the DPA. JBZ failed to prove that Metrobank committed a violation of the DPA through the allegations in his complaint or by the evidence he submitted. He likewise failed to prove that CDR was responsible for any violation of the DPA, whether in her official or personal capacity.

The Commission also cannot award damages to JBZ for the erroneous email from Metrobank regarding the cancellation of another client’s credit card. While Metrobank sent the wrong email to JBZ, it neither contained personal information of another card holder nor involved JBZ’s personal information. As such, the Commission has no reason to award damages to JBZ.

Nevertheless, the Commission sternly warns Metrobank to ensure that proper safeguards are in place when referring unpaid accounts such as JBZ’s to its collection agents, and that the processing of personal information is accurate and up to date following Section 11 of the DPA:

Section. 11. General Data Privacy Principles. The processing of personal information shall be allowed, subject to compliance with the requirements of this Act and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.

Personal information must, be:

…

(c) Accurate, relevant and, where necessary for purposes for which it is to be used the processing of personal information, kept up to date; inaccurate or incomplete data must be rectified, supplemented, destroyed or their further processing restricted[.]101

The Commission also sternly reminds Metrobank that it remains responsible for the processing of its clients’ personal information. While Metrobank claims to be compliant with the proper requirements under the law, it is nevertheless duty-bound as a PIC to remind its collection agents, as PIPs, to ensure compliance with the DPA and related laws. Metrobank remains responsible for the outsourced processing of personal information and will be held accountable for any data breach, even if the personal data involved was outsourced to its collection agents for processing.

WHEREFORE, premises considered, this Commission resolves that the instant Complaint filed by JBZ against Metropolitan Bank & Trust Company and CDR as VP Cards and Personal Credit Sector is hereby DISMISSED for lack of merit.

This is without prejudice to the filing of an appropriate civil, criminal, or administrative case before any other forum or tribunal, if any.

SO ORDERED.

City of Pasay, Philippines.

19 January 2023.

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA

Privacy Commissioner

NERISSA N. DE JESUS

Deputy Privacy Commissioner

Copy furnished:

JBZ

Complainant

METROPOLITAN BANK & TRUST COMPANY

OFFICE OF THE GENERAL COUNSEL

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Complaints-Assisted Form, 08 February 2021, at 5-6, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  2. Id. at 3. ↩

  3. Id. Annex 3. ↩

  4. Id. at 3. ↩

  5. Id. ↩

  6. Id. Annex 3. ↩

  7. Complaints-Assisted Form, 08 February 2021, Annex 3, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  8. Id. ↩

  9. Id. ↩

  10. Id. ↩

  11. Id. ↩

  12. Id. ↩

  13. Complaints-Assisted Form, 08 February 2021, at 5, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  14. Id. Annex 4. ↩

  15. Id. at 5. ↩

  16. Id. Annex 7. ↩

  17. Id. Annex 8. ↩

  18. Id. Annex 9. ↩

  19. Complaints-Assisted Form, 08 February 2018, Annex 12, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  20. Id. Annex 13. ↩

  21. Id. Annex 10. ↩

  22. Id. at 10. ↩

  23. Id. at 4. ↩

  24. Id. Annex 1. ↩

  25. Complaints-Assisted Form, 08 February 2021, at 5, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  26. Id. at 6-7. ↩

  27. Order, 10 September 2021, at 1, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  28. Comment, 23 September 2021, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  29. Id. at 2. ↩

  30. Id. at 2-3. ↩

  31. Complaints-Assisted Form, 08 February 2021, Annex 2, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  32. Comment, 23 September 2021, at 3, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  33. Id. ↩

  34. Id. ↩

  35. Id. ↩

  36. Id. ↩

  37. Id. at 3-4. ↩

  38. Comment, 23 September 2021, at 3-4, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  39. Id. at 10. ↩

  40. See National Privacy Commission, Re: Consent Requirement on Outsourcing Agreement with an External Service Provider, Advisory Opinion No. 15, Series of 2018, at 2 (12 April 2018). ↩

  41. Comment, 23 September 2021, at 10-11, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  42. Id. at 4. ↩

  43. Id. ↩

  44. Id. at 8. ↩

  45. Id. at 4. ↩

  46. Id. at 4-5. ↩

  47. Comment, 23 September 2021, at 4-5, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  48. Id. at 5. ↩

  49. Id. ↩

  50. Id. ↩

  51. Id. at 5-6. ↩

  52. Id. ↩

  53. Comment, 23 September 2021, at 11-12, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  54. Id. at 12. ↩

  55. Id. ↩

  56. Id. ↩

  57. Id. ↩

  58. Id. ↩

  59. Comment, 23 September 2021, at 12-15, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  60. Id. at 12-13. ↩

  61. Id. at 13. ↩

  62. Id. at 13-14. ↩

  63. Id. at 14. ↩

  64. Id. at 15. ↩

  65. Order after the 1st Preliminary Conference, 09 November 2021, at 1, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  66. Fact-Finding Report, 13 January 2022, at 3, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  67. Id. ↩

  68. Id. ↩

  69. Id. ↩

  70. Id. ↩

  71. Manifestation and Compliance, 03 June 2022, Annex A, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  72. Memorandum, 09 June 2022, at 2, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  73. Manifestation and Compliance, 03 June 2022, at 2, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  74. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose aNational Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 § 14 (2012). Emphasis supplied. ↩

  75. Implementing Rules and Regulations of Republic Act No. 10173, known as the “Data Privacy Act of 2012” Implementing Rules and Regulations of the Data Privacy Act of 2012, IRR of Republic Act No. 10173 rule X, § 43 (2016). Emphasis supplied. ↩

  76. Id. ↩

  77. Data Privacy Act of 2012, §21. Emphasis supplied. ↩

  78. Id. §1. ↩

  79. Id. §2. ↩

  80. Complaints-Assisted Form, 08 February 2021, Annex 3, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  81. Id. Annex 2. ↩

  82. Memorandum by the Respondent, 17 December 2022, Annex A, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-222 (NPC 2021). ↩

  83. Complaints-Assisted Form, 08 February 2021, at 5, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  84. Id. at 3. ↩

  85. Id. Annex 1, Annex 3, and Annex 5. ↩

  86. Id. Annex 2. ↩

  87. Id. Annex 7-9. ↩

  88. Id. Annex 4. ↩

  89. Complaints-Assisted Form, 08 February 2021, Annex 12, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  90. Id. Annex 13. ↩

  91. 2019 AMENDMENT TO THE 1989 REVISED RULES ON EVIDENCE, A.M. No. 19-08-15-SC, Rule 131, §1 (1 May 2020). ↩

  92. Id. §6. ↩

  93. National Privacy Commission, 2021 Rules of Procedure of the National Privacy Commission [NPC 2021 Rules of Procedure], rule IV, § 1 (28 January 2021). Emphasis supplied. ↩

  94. BSA Tower Condominium Corp. v. Reyes II, A.C. No. 11944 (2018). ↩

  95. Producers Bank of the Philippines v. Court of Appeals, G.R. No. 11049 (1998). ↩

  96. Order (After the 2nd Preliminary Conference held on 07 December 2021, Granting the Adoption of the Complaint as Complainant’s Memorandum, and for the Respondent to Submit its Memorandum), at 1, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  97. Complaints-Assisted Form, 08 February 2021, at 2, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  98. Data Privacy Act of 2012, §34. ↩

  99. Complaints-Assisted Form, 08 February 2021, at 3, in JBZ v. Metropolitan Bank & Trust Company, CDR as VP Cards and Personal Credit Sector, NPC 21-122 (NPC 2021). ↩

  100. Data Privacy Act of 2012, §34. ↩

  101. Id. Emphasis supplied. ↩

Backlinks

  • No backlinks found