NPC Issuance Wiki

NPC 22-113: JBM vs. PPHI

Issued Decision

Decision Text

JBM,

Complainant,

-versus-

PPHI,

Respondent.

x----------------------------------------------------x

DE JESUS, D.P.C:

Before this Commission is a complaint filed by Complainant JBM against Respondent PPHI for alleged violation of Section 32 of the Data Privacy Act (DPA) of 2012.1

Facts

JBM is an overseas Filipino worker based in Sxxxxxxxx2 who owns a certain house and lot unit in Pxxxx, Bxxxxxx, which she and her spouse bought from PPHI, a corporation duly registered with the Securities and Exchange Commission and engaged in housing development.3

On 20 May 2022, the Commission, through its Complaints and Investigations Division (CID) received the Complaints Assisted Form of Complainant (CAF)4 JBM, where she alleged that on 07 February 2022, her attorney-in-fact, JDM, received a call and text from a certain “Jxxxx” who introduced herself as an employee of PPHI and asked about her marital status for BIR TIN Verification purposes.5 In a text message, this “Jxxxx” also asked Job to submit a “Notarized/Consularized Special Power of Attorney.”6

As JBM was overseas and could not verify if the call was legitimate, she inquired from PPHI’s sales agent, B G (“Bxxxx”), through Facebook messenger,7 and in response, Bxxxx stated: “sir matagal na po resigned si jessa x x x”.8

JBM further tried to verify the identity of “Jxxxx” from PPHI’s account officers - “Txxxx” and “Cxxxxx”.9 Thereafter, a certain “Jxxxx” called her and introduced herself as an employee of PPHI and asked her marital status.10

JBM alleged that after the conversation with “Jxxxx,” she sent her another message to confirm if she was a “real/legit staff from PPHI,” but she did not reply.11 JBM also tried to confirm with PPHI’s account officers, [] and [], but they also did not reply to her inquiry.12

Later on, JBM learned that Jxxxx and Jxxxx are two different PPHI employees.13 As such, in a text exchange between JBM and Jhesa on 14 February 2022, JBM forwarded a screenshot of the text message sent to Job on 07 February 2022, and asked Jxxxx if the sender of the said text message was also her.14 Jxxxx then confirmed that it was her.15

On 20 May 2022, JBM filed her complaint before the Commission, attaching thereto as supporting documents several screenshots of conversations she had with PPHI agents.16

On 30 May 2022, the Commission, through its CID, issued an Order requiring the Respondent to file its verified comment within fifteen (15) days from receipt thereof.17 The CID likewise ordered the parties to appear virtually for a Preliminary Conference on 19 July 2022 and 16 August 2022.18

On 27 June 2022, PPHI filed its Comment through email.19 The physical copies of which were received by the Commission on 06 July 2022.20

In its Comment, PPHI alleged that JBM indeed tried to verify the identity of the caller by inquiring with its sales agents.21 One of its sales agents, Bxxxx, responded that a certain “Jxxxx ha[d] already left Respondent Corporation.”22

JBM claimed that she inquired further from PPHI’s account officers, Txxxx and Cxxxxx, from the Bank Financing and Documentation Team.23 According to Cxxxxx the cellphone number used is that of “Jxxxx” from the Title Transfer Group of Respondent.24

PPHI claimed that Bxxxx mistakenly identified a certain “Jxxxx,” a former employee under the Sales Department of PPHI, as being the same person as “Jxxxx” from the Title Transfer Group.25

Similarly, PPHI contended that on 10 March 2022, the day JBM reported the incident to the Commission via email, its Customer Service Specialist responded to JBM’s email, confirming once again that “the cellphone number is owned by Ms. Jxxxx [] who is part of the Respondent Corporation’s Title Transfer Group under the Customer Care Department.”26

Additionally, it was emphasized by PPHI that “Jxxxx” is an employee of Respondent and was duly authorized to handle the transaction with JBM.27 This affirmation was substantiated by the affidavit executed by the Customer Care Department on 27 June 2022.28

In its Comment, PPHI explained that during the processing of reservations, sales, and the subsequent transfer of house and lot titles to buyers, several personal and confidential information necessary for the transaction is obtained from the buyers.29

Accordingly, “[t]o ensure compliance with the Data Privacy Act of 2012 and other relevant privacy laws, the Corporation obtains, at the outset, the consent of the buyers to maintain the quality and deliver efficient and effective services to its transactions.”30 In this instance, PPHI claimed that JBM and her spouse signified their consent to the processing of their personal information, as evidenced by their signatures on the Data Privacy Consent Form attached to the Comment.31

PPHI, in its Comment, also argued that there was no unauthorized disclosure of Complainant’s personal data in this case.32 PPHI emphasized that Jxxxx (referred to as Ms. [] in the Comment) is part of the Respondent Corporation’s Title Transfer Group,33 as such, she is “authorized by the Respondent Corporation, with the consent of the Complainant, to use and/or process personal information as may be needed to comply with the Respondent Corporation’s contractual obligations.”34

PPHI averred that there was no violation of the DPA and prayed for the dismissal of the complaint for lack of merit.

On 19 July 2022 and 16 August 2022, the first35 and second36 Preliminary Conferences for this case were held with only the counsel of PPHI present.

Thus, in an Order issued by CID dated 16 August 2022, it stated that “[c]onsidering JBM’s absence for the second time, the Commission has deemed Complainant to have waived her right to the benefits of a preliminary conference, including but not limited to mediation, discovery, and/or stipulation of facts, and the parties were ordered to submit their respective memoranda.”37

On 05 September 2022, PPHI filed its Memorandum.38 In the Memorandum PPHI substantially raised the same factual and legal arguments mentioned in its Comment.39 Additionally, PPHI averred that Complainant is not entitled to fines and damages in this case as she failed to prove that she sustained an injury or that there was a breach of contract or tort, or that Respondent committed a violation.40

No Memorandum, however, was filed by JBM.

Subsequently, on 24 January 2023, PPHI filed a Motion for Early Resolution praying for the early resolution of the case in the interest of the speedy disposition of the case.41

On 16 March 2023, the CID issued a Notice to the parties informing them that the case is submitted for the decision of the Commission.42

Issue

Whether there is substantial evidence to find PPHI liable for a violation of Section 32 (Unauthorized Disclosure) of the DPA.

Discussion

The Commission dismisses the case for lack of substantial evidence. PPHI cannot be held liable for a violation of the DPA based on the allegations and evidence submitted by JBM.

In the CAF, JBM alleged a violation of Section 32 of the DPA for unauthorized disclosure.43 To substantiate this claim, JBM submitted the printed screenshot of the conversations she had with PPHI’s sales agents.44

Apart from this, no further evidence was submitted by JBM. Notably, JBM even failed to attend the scheduled preliminary conferences, nor did she submit a memorandum to substantiate her allegations against PPHI.

Here, JBM, as the complainant, had the burden of proof in alleging that PPHI violated the provisions of the DPA. However, she did not discharge this burden when she failed to support her allegations with substantial evidence.

Rule 131 of the 2019 Amendments to the Revised Rules on Evidence provides:

Section 1. Burden of proof and burden of evidence. Burden of proof is the duty of a party to present evidence on the facts in issue necessary to establish his or her claim or defense by the amount of evidence required by law. Burden of proof never shifts. xxx45

Further, Rule 133 of the 2019 Amendments to the Revised Rules on Evidence states:

Section 6. Substantial Evidence. In cases filed before administrative or quasi-judicial bodies, a fact may be deemed established if it is supported by substantial evidence, or that amount of relevant evidence which a reasonable mind might accept as adequate to justify a conclusion.46

Based on the records, and as correctly pointed out by PPHI, the alleged unauthorized disclosure of JBM’s personal data is untenable, considering that there was, in fact, no disclosure of the information to a third party.47

As reiterated by PPHI, and as evidenced by the affidavit executed by its Customer Care Department,48 “Jhesa” is an employee of the corporation under its Title Transfer Group, as such, she was duly authorized to handle the transaction with JBM.49

Anent JBM’s allegation that PPHI violated Section 32 of the DPA, which provides:

Section 32. Unauthorized Disclosure.

(A) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third-party personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).

(b) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party sensitive personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from three (3) years to five (5) years and a fine of not less than Five hundred thousand pesos (Php 500,000.00) but not more than Two million pesos (Php2,000,000.00).50

On the other hand, Section 31 of the DPA, as referred to in Section 32, provides:

Section 31. Malicious Disclosure. – Any personal information controller or personal information processor or any of its officials, employees or agents, who, with malice or in bad faith, discloses unwarranted or false information relative to any personal information or personal sensitive information obtained by him or her, shall be subject to imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).51

The distinction, however, between Malicious Disclosure (Section 31) and Unauthorized Disclosure (Section 32) hinges on whether there is evidence of malice or bad faith and whether the disclosed information relates to unwarranted or false information.

In this case, to prove violation of Section 32, JBM presented the screenshots of her conversation with the PPHI’s sales agents.52 However, this is not enough to support a finding of a violation of Section 32 of the DPA. If anything, the attached screenshots simply demonstrate that the complaint resulted from misunderstandings and confusion about the names of a past and present employees of PPHI.

To determine whether there is Unauthorized Disclosure, the following requisites must concur:

  1. The perpetrator is a personal information controller or personal information processor;
  2. The perpetrator disclosed information;
  3. The information relates to personal or sensitive personal information;
  4. The perpetrator disclosed the personal or sensitive personal information to a third party;
  5. The disclosure was without any of the lawful basis for processing, consent or otherwise, under Sections 12 and 13 of the DPA; and
  6. The disclosure is neither malicious nor done in bad faith and the information disclosed is not unwarranted or false information.53

The first element requires that the perpetrator is a personal information controller (PIC) or personal information processor (PIP).54

Section 3(h) of the DPA defines a PIC as “a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.”55

The fact that PPHI is a PIC is undisputed in this case. In fact, PPHI, in its submissions, admitted that it collected and processed JBM’s information for purposes of processing reservations, sales, and the subsequent transfer of house and lot titles to buyers.56 As such, the first element is present in this case.

The second element of Section 32 requires that the perpetrator disclosed information.57

Based on the records of this case, JBM alleged that there is “a possible PDPA breach/leakage of [their] information that came from [PPHI].”58 While PPHI did not admit “breach/leakage,” in its Comment, it confirmed that the personal data was disclosed to Ms. Jxxxx [], one of its employees in its Title Transfer Group.59 Hence, the second element is present.

The third element of Section 32 requires that the information relates to personal or sensitive personal information.60

The Data Privacy Act of 2012 (DPA) defined personal information as any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.61

Meanwhile, Section 3 of the DPA defines sensitive personal information as personal information:

Section 3. Definition of Terms. Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

(l) Sensitive personal information refers to personal information:

(1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;

(2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;

(3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and

(4) Specifically established by an executive order or an act of Congress to be kept classified.62

It can be inferred from JBM’s Complaint that the disclosed information she was referring to were her contact numbers and that of their attorney-in-fact, and other details relating to the titling of the property they purchased from PPHI, such as their marital status.63 Verily, marital status is a sensitive personal information, while the rest are personal information that when put together with other information would directly and certainly identify JBM. As such, the third element is present in this case.

But it appears that the fourth element, which requires that the personal or sensitive personal information be disclosed to a third person, is absent in this case.

To recall, the disclosure being complained of was the disclosure by PPHI to Ms. Jxxxx [], one of PPHI’s employees in its Title Transfer Group.64

To the Commission, while Jhesa is not privy to the contract between PPHI and JBM, she can hardly be considered a “third party” considering that Jhesa is actually part of PPHI’s Titles Transfer Group.65

Necessarily, in her capacity as part of the Titles Transfer Group, Jxxxx held responsibility to process the transfer of titles and tax declarations in the names of buyers, on behalf of PPHI. As such, Jxxxx’s processing of the personal data of JBM, in relation to her function within the Titles Transfer Group, cannot also be considered as processing by a third party. Hence, the fourth element is absent.

While the absence of the fourth element would already suffice to support a finding that there is no unauthorized disclosure in this case, the Commission deems it proper to further discuss the fifth and sixth elements of Unauthorized Disclosure.

As to the fifth element, it is required that the disclosure was without any of the lawful basis for processing, consent or otherwise, under Sections 12 and 13 of the DPA.66

Section 12 provides:

SEC. 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

(a) The data subject has given his or her consent;

(b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract;

(c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;

(d) The processing is necessary to protect vitally important interests of the data subject, including life and health;

(e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or

(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.67

While Section 13 provides:

SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

(a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing;

(b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;

(c) The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing;

(d) The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, That such processing is only confined and related to the bona fide members of these organizations or their associations: Provided, further, That the sensitive personal information are not transferred to third parties: Provided, finally, That consent of the data subject was obtained prior to processing;

(e) The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured; or

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.68

It is crucial to note at this point that JBM’s assertion of unauthorized disclosure of her personal data is already negated by the finding that there was really no unauthorized disclosure to a third party in this case, as discussed above.

It must also be noted that JBM and her spouse provided consent to PPHI to process their personal data, when they signed the Data Privacy Consent Form, as a requirement “in processing the reservation, sale and the eventual transfer of the title of the house and lot units to buyers.”69 As provided in Section 13(a) above, consent is one of the lawful bases for processing.

Also, as accurately highlighted by PPHI, the processing of JBM’s personal data was necessary to the fulfillment of the contract between them.70

As such, the fifth element is also absent in this case.

Lastly, the sixth element of Section 32 of the DPA requires that the disclosure is neither malicious nor done in bad faith and that the information disclosed is not unwarranted or false information.71

The Supreme Court has defined “malice” as that which “connotes ill will or spite and speaks not in response to duty but merely to injure the reputation of the person defamed and implies an intention to do ulterior and unjustifiable harm”.72

On the other hand, bad faith “implies a conscious and intentional design to do a wrongful act for a dishonest purpose or some moral obliquity.”73

To hold PPHI liable for Unauthorized Disclosure, JBM must prove that the disclosure of her personal data was done with malice or bad faith.

In this case, however, JBM failed to prove or even allege the presence of malice or bad faith.

Considering further that JBM’s personal data was processed to comply with the Respondent Corporation’s contractual obligations,74 malice or bad faith are both negated.

Considering further that the information involved in this case include JBM’s contact number and that of her attorney-in-fact and other information related to the titling requirements of their property, these can hardly be said to be unwarranted or false. As such, the sixth element is present.

Again, while some of the elements of Unauthorized Disclosure are present in this case, the absence of the other elements, such as the fourth, and fifth, elements negate the finding of Unauthorized Disclosure. Consequently, PPHI, in this case, cannot be held to be in violation of Section 32 of the DPA.

Anent the claim of JBM for damages,75 in certain cases, the Commission awarded damages, particularly nominal damages, as a means to recognize and vindicate the Complainant’s rights, which have been violated by the Respondent.76

Section 37 of the DPA provides that restitution for any aggrieved party shall be governed by the provisions of the New Civil Code,77 particularly Article 2221 thereof, which reads:

Article 2221. Nominal damages are adjudicated in order that a right of the plaintiff, which has been violated or invaded by the defendant, may be vindicated or recognized, and not for the purpose of indemnifying the plaintiff for any loss suffered by him.78

While the Supreme Court has repeatedly held that no actual present loss is required to warrant its award, there must be a legal right violated and invaded for a party to recover nominal damages.79 The Court explained:

Nominal damages are recoverable where a legal right is technically violated and must be vindicated against an invasion that has produced no present loss of any kind or where there has been a breach of contract and no substantial injury or actual damages whatsoever have been or can be shown.80

In this case, however, JBM not only failed to prove, but she also failed to assert that PPHI violated or invaded any of her right.

For its part, the Commission also finds that there is no legal right technically violated and must be vindicated against any invasion so as to warrant an award of nominal damages in this case.

WHEREFORE, premises considered, this Commission resolves that the case filed by JBM against PPHI is DISMISSED for lack of merit.

This is without prejudice to the filing of appropriate civil, criminal, or administrative cases, if any, against PPHI before any other forum or tribunal.

SO ORDERED.

City of Pasay, Philippines. 26 September 2023.

NERISSA N. DE JESUS Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

Copy furnished:

JBM Complainant

[] []

PPHI Respondent

[] []

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Complaints-Assisted Form, 20 May 2022, at 4-9, in JBM v. PPHI, NPC 22-113. ↩

  2. Id. ↩

  3. Comment dated 27 June 2022, in JBM v. PPHI, NPC 22-113. ↩

  4. Complaints-Assisted Form, 20 May 2022, in JBM v. PPHI, NPC 22-113. ↩

  5. Id. ↩

  6. Id. ↩

  7. Id. ↩

  8. Id. ↩

  9. Id. ↩

  10. Id. ↩

  11. Id. ↩

  12. Id. ↩

  13. Id. ↩

  14. Id. ↩

  15. Id. ↩

  16. Id. ↩

  17. Order (To File Verified Comment and Appear Virtually for Preliminary Conference) dated 30 May 2022, in JBM v. PPHI, NPC 22-113. ↩

  18. Id. ↩

  19. Comment dated 27 June 2022, in JBM v. PPHI, NPC 22-113. ↩

  20. Id. ↩

  21. Id. ↩

  22. Id. ↩

  23. Id. ↩

  24. Id. ↩

  25. Id. ↩

  26. Id. ↩

  27. Id. ↩

  28. Id., Annex 3. ↩

  29. Id. ↩

  30. Id. ↩

  31. Id., Annex 2. ↩

  32. Comment dated 27 June 2022, in JBM v. PPHI, NPC 22-113. ↩

  33. Id. ↩

  34. Id. ↩

  35. Order (After the 1st Preliminary Conference held on 19 July 2022 and To Remind the Parties to Appear for the Second Setting of the Preliminary Conference) dated 19 July 2022, in JBM v. PPHI, NPC 22-113. ↩

  36. Order (After the 2nd Preliminary Conference held on 16 August 2022, Requiring the Parties to Submit their Simultaneous Memoranda) dated 16 August 2022, in JBM v. PPHI, NPC 22-113. ↩

  37. Id. ↩

  38. Respondent’s Memorandum dated 5 September 2022, in JBM v. PPHI, NPC 22-113. ↩

  39. Id. ↩

  40. Id. ↩

  41. Motion for Early Resolution dated 24 January 2023, JBM v. PPHI, NPC 22-113. ↩

  42. Notice (that the Case is Submitted for Decision of the Commission) dated 16 March 2023, in JBM v. PPHI, NPC 22-113. ↩

  43. Complaints-Assisted Form, 20 May 2022, in JBM v. PPHI, NPC 22-113. ↩

  44. Id. ↩

  45. A.M. No. 19-08-15-SC, Rule 131, §1 (1 May 2020). ↩

  46. Id., Rule 133, §6. ↩

  47. Comment dated 27 June 2022, in JBM v. PPHI, NPC 22-113. ↩

  48. Id., Annex 3. ↩

  49. Comment dated 27 June 2022, in JBM v. PPHI, NPC 22-113. ↩

  50. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter VIII, § 25 (2012). ↩

  51. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter VIII, § 31 (2012). ↩

  52. Complaints-Assisted Form, 20 May 2022, in JBM v. PPHI, NPC 22-113. ↩

  53. EG v. JI, RO, and RR, NPC 21-111, Decision dated 22 September 2022, at pp. 11-12. ↩

  54. Id. ↩

  55. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter I, § 3 (h) (2012). ↩

  56. Comment dated 27 June 2022, in JBM v. PPHI, NPC 22-113. ↩

  57. EG v. JI, RO, and RR, NPC 21-111, Decision dated 22 September 2022, at pp. 11-12. ↩

  58. Complaints-Assisted Form, 20 May 2022, at 4-9, in JBM v. PPHI, NPC 22-113. ↩

  59. Comment dated 27 June 2022, in JBM v. PPHI, NPC 22-113. ↩

  60. EG v. JI, RO, and RR, NPC 21-111, Decision dated 22 September 2022, at pp. 11-12. ↩

  61. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter I, § 3(g) (2012). ↩

  62. Id., Sec. 3(l). ↩

  63. Comment dated 27 June 2022, in JBM v. PPHI, NPC 22-113. ↩

  64. Comment dated 27 June 2022, in JBM v. PPHI, NPC 22-113. ↩

  65. Comment dated 27 June 2022, in JBM v. PPHI, NPC 22-113. ↩

  66. EG v. JI, RO, and RR, NPC 21-111, Decision dated 22 September 2022, at pp. 11-12. ↩

  67. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter III, § 12 (2012). ↩

  68. Id., §13. ↩

  69. Comment dated 27 June 2022, in JBM v. PPHI, NPC 22-113, Annex 2. ↩

  70. Comment dated 27 June 2022, in JBM v. PPHI, NPC 22-113, See also Annex 2. ↩

  71. EG v. JI, RO, and RR, NPC 21-111, Decision dated 22 September 2022, at pp. 11-12. ↩

  72. Delgado v. HRET, G.R. No. 219603, 26 January 2016, cited in NPC 21-054. ↩

  73. Montinola vs. Philippine Airlines, G.R. No. 198656, 8 September 2014, cited in NPC 21-054. ↩

  74. Comment dated 27 June 2022, in JBM v. PPHI, NPC 22-113. ↩

  75. Complaints-Assisted Form, 20 May 2022, at 4-9, in JBM v. PPHI, NPC 22-113. ↩

  76. NPC 19-1260, RAR vs. NADC, 19 January 2023. ↩

  77. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter VIII, § 37 (2012). ↩

  78. An Act to Ordain and Institute the Civil Code of the Philippines [New Civil Code], Republic Act No. 386, art. 2221 (1950). ↩

  79. Seven Brothers Shipping Corporation v. DMC-Construction Resources, G.R. No. 193914. November 26, 2014. ↩

  80. Id. ↩

Backlinks

  • No backlinks found