NPC Issuance Wiki

NPC 23-036: Spouses JG and AG v. Spouses CP and CC

Issued Decision

Decision Text

Spouses JG and AG,

Complainant,

-versus-

Spouses CP and CC,

Respondent.

x----------------------------------------------------x

NAGA, P.C.;

Before the Commission is the Complaint filed by Spouses JG and AG (Complainants) against Spouses CP (MC) and CC (Respondents) for an alleged violation of Sections 25, 28, 31, and 32 of the Data Privacy Act of 2012 or Republic Act No. 10173 (“DPA”).

Facts

On 15 March 2023, the Commission, through its Complaints and Investigation Division (CID) received the Complaints Assisted Form of Complainants (CAF).1

Complainants alleged that sometime in October 2020, Respondents filed a complaint for Syndicated Estafa against Complainants and several others before the National Bureau of Investigation (NBI).2 The said complaint was eventually endorsed by NBI to the Office of the City Prosecutor of Quezon City (OCP-QC), docketed as NPS Docket No. INV-20B-01419, titled “Spouses CP (MC) and CC vs. Spouses JG and AG, AYG, LA, PN, Spouses JY and CY, and Spouses FC and JY.”3

In the said proceedings before the OCP-QC, Complainants averred that Respondents “brought up and released documents” that pertain to a different case for Syndicated Estafa filed against the said Complainants, by one AL before the NBI, where Respondents were not parties to the said case.4

Complainants, in their CAF, averred that the personal and sensitive personal information pertains to their name, address, marital status, proceedings and documents before the NBI for Syndicated Estafa alleged to have been committed by them, the Disposal of Proceedings before NBI, and its Decision.5

Moreover, the Complainants claimed that in Respondents’ Joint and Consolidated Reply Affidavit dated 22 October 2020 (Reply Affidavit) before the OCP-QC, they “illegally obtained, and subsequently disclosed the following personal and sensitive personal information as well as an Affidavit of Desistance with Mutual Release and Quitclaim filed in said case, despite such having absolutely no bearing on the case before the OCP-QC.”6 In the said Reply Affidavit, Respondents declared that they were able to secure a copy of the Affidavit of Desistance, to wit:

  1. Upon further investigation, Complainant Spouses were able to secure a copy of the “Affidavit of Desistance with Mutual Release and Quitclaim” executed by AL in favor of respondents Spouses G and their daughter, respondent AYG in NBI Case No. 322649 filed against the same and all respondents herein.7

Additionally, in the same Reply Affidavit, Respondents admitted that they secured assistance from “good minded persons” from NBI, to wit:

  1. Interestingly, respondents Spouses G and daughter respondent AYG demanded confidentiality of this settlement from complainant AL. This is precisely the reason why complainant Spouses could not get any assistance from her in instant case. Fortunately, good minded persons with access to NBI records provided complainant Spouses with a copy of settlement.8

Complainants alleged that the acts done by Respondent of “accessing, processing and disclosing [C]omplainants’ G’s personal and sensitive personal information gives rise to criminal liability under the Data Privacy Act.”9 Hence, in their CAF, the Complainants pleaded that the Respondents be held liable under Sections 25, 28, 31, and 32 of the DPA.10 Complainants also stated that “the culpable officers of the NBI may likewise be held liable together with Respondents,” citing Republic Act No. 6713, the Code of Conduct and Ethical Standards for Public Officials and Employees and the Revised Penal Code.11

On 11 April 2023, the CID issued an Order (To File Verified Comment and Appear Virtually for Preliminary Conference) requiring the Respondents to file their Verified Comment within fifteen (15) days from receipt of the Order.12 The CID likewise orders the parties to appear virtually for a Preliminary Conference on 16 May 2023, and 27 June 2023.13

On 04 May 2023, Respondents, through counsel, filed their Verified Comment dated 02 May 2023.14 Respondents argued that they committed no violation, and the said Complaint must be dismissed for sheer and utter want of merit.15

In Respondents’ Verified Comment, they argued that the complaint should be dismissed for not having been brought against the real parties in interest and should have impleaded the NBI in the complaint.16 Respondents averred that NBI, as the Personal Information Controller or PIC, which disclosed the information to them, is “ultimately liable” for the disclosure made to the Respondents.17

Second, Respondents argued that the Complainants failed to exhaust administrative remedies as the latter failed to inform the NBI in writing of the alleged disclosure.18 Moreover, Respondents argued that Complainants failed to exhaust remedies and to show any good cause as to why the complaint should be given merit, as there is no serious violation or breach of the DPA.19

Third, the Respondents claim that they have a legal basis under Section 13 (f) to process Complainants’ information.20 Respondents argued that the disclosures were made to protect their rights and interests in NPS Docket No. INV-20B-01419.21 Respondents posited that “the information obtained was submitted to [OCP-QC] through the Investigating Prosecutor conducting the preliminary investigation and was therefore submitted to it in accordance with its mandate of determining the legal claims of the respondents against the complainants therein, and as such is considered as having been provided to ‘government or public authority,’ under Section 13 (f) of the Data Privacy Act.”22

Fourth, Respondents averred that Complainants’ personal and sensitive personal information: name, address, and marital status, were already disclosed in the pleadings filed in NPS Docket No. INV-20B-01419.23

Next, Respondents also argued that the Complainants are estopped from questioning the disclosure of information relating to the outcome of the case filed by AL against them.24 In Complainants’ Joint-Rejoinder Affidavit, they already voluntarily disclosed the Complaint-Affidavit of AL and the outcome of that case.25

Lastly, Respondents argued that the information disclosed by them in relation to the case filed by AL against Complainants is not inherently false or unwarranted.26

On 08 May 2023, the CID issued an Order (Noting the Complainants Working Email Addresses and Respondents Comment and Reminding the Parties to Appear Virtually for the Preliminary Conference).27

On 16 May 2023, the CID issued an Order (After the 1st Preliminary Conference held on 16 May 2023, Cancelling the 2nd Preliminary Conference on 27 June 2023, Requiring the Respondents to Submit Manifestation, and Requiring the Counsel for Complainants to Submit Special Power of Attorney).28

On 26 May 2023, Respondents, through counsel, filed their Manifestation that they are not “inclined” to undergo mediation proceedings.29 On the same date, the Complainants submitted their Special Power of Attorney appointing their counsel to act on their behalf.30

The CID issued an Order dated 29 May 2023, noting the submissions made by the parties.31 The CID likewise ordered the parties to submit their respective Memoranda.32

On 13 June 2023, the Respondents sent their Memorandum dated 12 June 2023.33 In their Memorandum, Respondents merely reiterated their previous defenses mentioned in their Verified Comment.34

In a Memorandum dated 21 June 2023, Complainants alleged that the Respondents are liable for violating Sections 25, 28, 31, and 32 of the DPA for disclosing their personal information and sensitive personal information with the OCP-QC without their consent, or without being authorized under Sections 12 and 13 of the DPA.35 Moreover, the Complainants averred that the principle of real parties in interest does not apply in criminal cases, such as the violations under the DPA.36

Additionally, the Complainants claim that their complaint falls under the exception provided in the DPA on the rule on exhaustion of administrative remedies because the allegations in the complaint involve a serious violation or breach of the DPA.37 Lastly, Complainants stated that they are not estopped from questioning the disclosure since they only disclosed the information in response to Respondents’ use of the information.38

On 04 October 2023, the CID issued a Notice dated 06 September 2023, informing that the case is submitted for the decision of the Commission.39

Issue

I. Whether the case should be outrightly dismissed for failure of the Complainants to exhaust administrative remedies; and

II. Whether Respondents are liable for violating Section 25 of the DPA.

Discussion

The Commission finds that the case should not be dismissed on procedural grounds and that Respondents are liable for violating Section 25 of the DPA.

I. Complainants did not violate the Rule on Exhaustion of Remedies.

Section 2, Rule II of NPC Circular No. 2021-01 (2021 NPC Rules of Procedure) provides:

SECTION 2. Exhaustion of remedies. – No complaint shall be given due course unless it has been sufficiently established and proven that:

  1. the complainant has informed, in writing, the personal information controller (PIC), personal information processor (PIP), or concerned entity of the privacy violation or personal data breach to allow for appropriate action on the same; and
  2. the PIC, PIP, or concerned entity did not take timely or appropriate action on the claimed privacy violation or personal data breach, or there is no response from the PIC, PIP, or concerned entity within fifteen (15) calendar days from receipt of written information from the complainant.

The NPC may waive any or all of the requirements of this Section at its discretion upon (a) good cause shown, properly alleged and proved by the complainant; or (b) if the allegations in the complaint involve a serious violation or breach of the Data Privacy Act of 2012, taking into account the risk of harm to the affected data subject, including but not limited to:

i. when there is grave and irreparable damage which can only be prevented or mitigated by action of the NPC; ii. when the respondent cannot provide any plain, speedy or adequate remedy to the alleged violation; or iii. the action of the respondent is patently illegal.40

In Complainants’ CAF, they alleged that prior to filing their Complaint before the Commission, they were able to inform the Respondents in writing through the Joint Rejoinder-Affidavit dated 05 November 2020, stating that:

  1. Notably, it is quite alarming, not to mention illegal and criminal, that complainants Spouses C were able to obtain access to the Affidavit of Desistance and Agreement with Revocation of Deed of Assignment despite being non-parties thereto. … We have been informed that information pertaining to any proceeding for any offense committed or alleged to have been committed by an individual, including the disposal of such proceedings, is considered as sensitive personal information protected by Republic Act No. 10173.41

In this case, Complainants’ statement in their Joint Rejoinder-Affidavit is sufficient to inform and alert the Respondents that attaching their Affidavit of Desistance constitutes a possible violation of the DPA because of the alleged unauthorized processing of the Affidavit of Desistance which contains personal information and sensitive personal information.

In addition, the processing of the personal information and sensitive personal information involved, such as Complainants’ names, address, marital status, and information regarding the Syndicated Estafa case, may pose a risk of harm to them as the affected data subjects since unauthorized acquisition of the following information may result to identity fraud, crimes, and other harm when used in a manner that could expose them to harassment, discrimination, or other risks such as the creation of fake accounts or accounts using other identifying information of another person without authority.

Further, assuming arguendo that Complainants’ method of informing the Respondents was insufficient, the Complaint would still not be dismissible. Section 2, Rule II of the 2021 NPC Rules of Procedure states that the NPC may also waive the rule on exhaustion of remedies when the respondent cannot provide any plain, speedy or adequate remedy to the alleged violation,42 such as in this case.

The personal and sensitive personal information of Complainants were already processed by the Respondents when they requested and accessed the Affidavit of Desistance with Mutual Release and Quitclaim which was thereafter submitted to OCP-QC in relation to NPS Docket No. INV-20B-01419.43

Thus, the Rule can no longer apply given that Respondents cannot take any appropriate action to remedy the situation since the Affidavit of Desistance with Mutual Release and Quitclaim was already included in the documents filed before the OCP-QC and cannot be withdrawn.

To emphasize, “the rules of procedure should be viewed as mere tools designed to facilitate the attainment of justice. Their strict and rigid application, which would result in technicalities that tend to frustrate rather than promote substantial justice, must always be eschewed.”44

II. Respondents committed Unauthorized Processing under Section 25 of the DPA.

Section 25 of the DPA penalizes Unauthorized Processing of Personal Information and Sensitive Personal Information:

SEC. 25. Unauthorized Processing of Personal Information and Sensitive Personal Information. – (a) The unauthorized processing of personal information shall be penalized by imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00) shall be imposed on persons who process personal information without the consent of the data subject, or without being authorized under this Act or any existing law.

(b) The unauthorized processing of personal sensitive information shall be penalized by imprisonment ranging from three (3) years to six (6) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Four million pesos (Php4,000,000.00) shall be imposed on persons who process personal information without the consent of the data subject, or without being authorized under this Act or any existing law.45

All the elements of unauthorized processing under Section 25 are present in this case, namely:

  1. The accused processed the information of the data subject;
  2. The information processed was personal information or sensitive personal information; and
  3. The processing was done without the consent of the data subject, or without authority under this Act or any existing law.46

As to the first element, Section 3 (j) of the DPA defines processing as “any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.”47

Respondents processed Complainants’ information when they attached the Affidavit of Desistance with Mutual Release and Quitclaim in the Joint and Consolidated Reply Affidavit dated 22 October 2020, “to establish that complainants had been previously charged with syndicated estafa also arising from the sale of shares of a corporation covering the same properties that were the subject of the estafa case filed by respondents against complainants.”48

With the second element, Section 3 (g) of the DPA defines personal information as “any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.”49

On the other hand, sensitive personal information under Section 3 (l) of the DPA refers to personal information:

(1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; (2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and (4) Specifically established by an executive order or an act of Congress to be kept classified.50

In this case, the Affidavit of Desistance with Mutual Release and Quitclaim contained the Complainants’ personal information and sensitive personal information such as their names, address, marital status, and information regarding the Syndicated Estafa case filed against them.51

Regarding the third element, the Complainants clearly did not consent to the use of their Affidavit of Desistance. Moreover, Respondents failed to show that their action finds basis under Section 12 (c) or Section 13 (b) of the DPA as they only stated that they were able to secure the Affidavit of Desistance from “good minded persons with access to NBI records.”52

In Respondents’ Comment dated 02 May 2023, they posited that there is “legal basis to process the affidavit of desistance under Section 13 (f) of the DPA, since they were complainants in the complaint docketed as NPS Docket No. INV-20B-01419 and the affidavit of desistance was in response to complainants’ allegation during the course of preliminary investigations that the idea of setting up a condominium corporation over the subject properties was respondent MC’s idea and was intended to counter complainants’ allegation that it was respondent MC who caused the dispute that led to the filing of the estafa case; that the affidavit was submitted to the Office of the City Prosecutor as part of preliminary investigations, thus a submission to government or public authority under Section 13 (f); and that complainant’s name, address, and marital status were already disclosed in the pleadings they filed in relation to NPS Docket No. INV-20B-01419.”53

The Commission, however, finds these contentions untenable. Respondents cannot justify their use of Complainants’ Affidavit of Desistance under Section 13 (f) of the DPA as one of the exceptions for processing sensitive personal information and privileged information, to wit:

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.54

The Principle of Legitimate Purpose, as one of the General Data Privacy Principles under the DPA, provides that “personal information must be collected for specified and legitimate purposes determined and declared before, or as soon as reasonably practicable after collection, and later processed in a way compatible with such declared, specified and legitimate purposes only.”55

The Commission has previously held that “processing done for the establishment of a legal claim should not in any manner be outside the limitations provided by law.56 The DPA is neither a tool to prevent the discovery of a crime nor a means to hinder legitimate proceedings.”57

In this case, the personal information and sensitive personal information obtained were secured through unauthorized means as can be clearly inferred from Respondents’ admission that the subject documents were received from “good minded persons with access to NBI records.”58

As to the identity of these “good minded persons,” the evidence presented by the Respondents are bereft of any showing regarding their authority to acquire and release these records. Hence, Respondents’ processing of Complainants’ personal and sensitive personal information failed to comply with the General Data Privacy Principle of Legitimate Purpose as it is incompatible with a declared and specified purpose not contrary to law, morals, or public policy.59

In view of the foregoing, the Commission finds that Respondents’ act of processing Complainants’ personal information and sensitive personal information by attaching and using the Reply Affidavit of Complainants in the proceedings before the OCP-QC without any lawful basis constitutes unauthorized processing under Section 25 of the DPA.60

WHEREFORE, premises considered, this Commission hereby:

  1. HOLDS Respondent Spouses CP and CC liable for violating Section 25 of the Data Privacy Act of 2012; and
  2. FORWARDS this Decision and a copy of the pertinent case records to the Secretary of Justice and recommends the prosecution of Spouses CP and CC for Unauthorized Processing of Personal Information and Sensitive Personal Information under Section 25 of the DPA.

SO ORDERED.

City of Pasay, Philippines.

13 November 2023.

JOHN HENRY D. NAGA

Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

NERISSA N. DE JESUS

Deputy Privacy Commissioner

Copy furnished:

JG and AG

Complainants

CP and CC

Respondents

CRC

Counsel for Complainants

BMV and JO

Counsel for Respondents

COMPLIANCE AND MONITORING DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Complaints-Assisted Form dated 14 March 2023 of Spouses JG and AG. ↩

  2. Id., at p. 7. ↩

  3. Id., at p. 7. ↩

  4. Id., at p. 7. ↩

  5. Complaints-Assisted Form dated 14 March 2023 of Spouses JG and AG, at p. 2. ↩

  6. Id., at p. 7. ↩

  7. Id., at p. 7 and Annex 1 “Joint and Consolidated Reply Affidavit” at p. 28. ↩

  8. Id., at p. 7 and Annex 1 “Joint and Consolidated Reply Affidavit” at p. 28. ↩

  9. Complaints-Assisted Form dated 14 March 2023 of Spouses JG and AG, at p. 8. ↩

  10. Id., at p. 8. ↩

  11. Id., at p. 9. ↩

  12. Spouses JG and AG vs. Spouses CP and CC, NPC 23-036, Order (To File Verified Comment and Appear Virtually for Preliminary Conference) dated 11 April 2023. ↩

  13. Id., at p. 2. ↩

  14. Verified Comment dated 02 May 2023 of Spouses CP and CC. ↩

  15. Id., at p. 9. ↩

  16. Id., at p. 9. ↩

  17. Id., at p. 11. ↩

  18. Verified Comment dated 02 May 2023 of Spouses CP and CC, at p. 11. ↩

  19. Id., at p. 12. ↩

  20. Id., at p. 14. ↩

  21. Id., at p. 16. ↩

  22. Verified Comment dated 02 May 2023 of Spouses CP and CC, at p. 16. ↩

  23. Id., at p. 20. ↩

  24. Id., at p. 20. ↩

  25. Id., at p. 20. ↩

  26. Verified Comment dated 02 May 2023 of Spouses CP and CC, at p. 21. ↩

  27. Spouses JG and AG vs. Spouses CP and CC, NPC 23-036, Order (Noting the Complainants Working Email Addresses and Respondents Comment and Reminding the Parties to Appear Virtually for the Preliminary Conferences) dated 08 May 2023. ↩

  28. Id. ↩

  29. Manifestation dated 26 May 2023 of Spouses CP and CC. ↩

  30. Special Power of Attorney dated 27 April 2023 of Spouses JG and AG. ↩

  31. Spouses JG and AG vs. Spouses CP and CC, NPC 23-036, Order (Noting the Respondents Manifestation, Noting the Complainants Special Power of Attorney, and Requiring the Parties to Submit Simultaneous Memoranda) dated 29 May 2023. ↩

  32. Id., at p. 2. ↩

  33. Memorandum dated 12 June 2023 of Spouses CP and CC. ↩

  34. Id. ↩

  35. Id., at p. 4-17. ↩

  36. Id., at p. 17. ↩

  37. Memorandum dated 21 June 2023 of Spouses JG and AG, at p. 19. ↩

  38. Id., at p. 22. ↩

  39. Spouses JG and AG vs. Spouses CP and CC, NPC 23-036, Notice (that the Case is Submitted for Decision of the Commission) dated 06 September 2023. ↩

  40. National Privacy Commission, 2021 Rules of Procedure of the National Privacy Commission, NPC Circular No. 2021-01, rule II, § 2 (28 January 2021) (2021 NPC Rules of Procedure). ↩

  41. Complaints-Assisted Form dated 14 March 2023 of Spouses JG and AG, at p. 7 and Annex 1 “Joint and Consolidated Reply Affidavit” at p. 28. ↩

  42. National Privacy Commission, 2021 Rules of Procedure of the National Privacy Commission, NPC Circular No. 2021-01, rule II, § 2 (28 January 2021) (2021 NPC Rules of Procedure). ↩

  43. Complaints-Assisted Form dated 14 March 2023 of Spouses JG and AG, at p. 7. ↩

  44. Heirs of Amada Zaulda v. Zaulda, G.R. No. 201234, 17 March 2014. ↩

  45. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter VIII, § 25 (2012). ↩

  46. Id. ↩

  47. Id., chapter I, § 3(j) (2012). ↩

  48. Complaints-Assisted Form dated 14 March 2023 of Spouses JG and AG, at p. 7 and Annex 1 “Joint and Consolidated Reply Affidavit” at p. 28. ↩

  49. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter I, § 3 (g) (2012). ↩

  50. Id., chapter I, § 3 (l) (2012). ↩

  51. Complaints-Assisted Form dated 14 March 2023 of Spouses JG and AG, at p. 7. ↩

  52. Id., at p. 7 and Annex 1 “Joint and Consolidated Reply Affidavit” at p. 28. ↩

  53. Verified Comment dated 02 May 2023 of Spouses CP and CC, at p. 16. ↩

  54. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter III, § 13(f) (2012). ↩

  55. Id., chapter III, § 11(a) (2012). ↩

  56. JBD v. JI and VVV, NPC 18-D-012, Decision dated 21 January 2021, at p. 13. ↩

  57. Id. ↩

  58. Complaints-Assisted Form dated 14 March 2023 of Spouses JG and AG, at p. 7 and Annex 1 “Joint and Consolidated Reply Affidavit” at p. 28. ↩

  59. National Privacy Commission, Implementing Rules and Regulations of the Data Privacy Act of 2012, rule IV, § 18(b) (2016). ↩

  60. Complaints-Assisted Form dated 14 March 2023 of Spouses JG and AG, at p. 7. ↩

Backlinks

  • No backlinks found