NPC Issuance Wiki

NPC 19-1247: KDC v. Bank of the Philippine Islands

Issued Decision

Decision Text

KDC,

Complainant,

-versus-

BANK OF THE PHILIPPINE ISLANDS,

Respondent.

x----------------------------------------------------x

NAGA, P.C.;

Before this Commission is a Complaint filed by KDC (Complainant) against Bank of the Philippine Islands (Respondent) for an alleged violation of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).1

Facts

On 01 August 2019, the Commission, through its Complaints and Investigation Division (CID), received the Complaints-Assisted Form (CAF) filed by the Complainant against Respondent.2

In her CAF, she alleged:

THIS HAPPENED LAST MARCH 15, 2019 AROUND 2PM. AKO PO AY MAY PAYROLL ACCOUNT AT SAVINGS ACCOUNT SA BPI. ITO PONG MGA ACCOUNTS KO AY MAY ROONG ONLINE BANKING. NOONG ARAW NA ITO, MAY UNKNOWN AT UNAUTHORIZED PERSON NA GUMAMIT NG AKING ACCOUNTS AT I-KINONECT ANG KANYANG GCASH ACCOUNTS PARA MAKAPAG TRANSFER NG PERA. SIYA PO AY SUCCESSFUL NA NAKAPAGTRANSFER NG ₱100,000 SA MAGKAHIWALAY NA TRANSACTIONS. ₱50,000 EACH TRANSACTION AND 2 GCASH ACCOUNTS ANG KANYANG GINAMIT. ITO AY AGAD KONG NAI REPORT KAY BPI NGUNIT SI BPI AY TUMANGGI NA SILA ANG NAGING SOURCE KUNG PAANO NASIWALAT ANG AKING MGA IMPORMASYON. TUMANGGI DIN SILA NA IBALIK ANG NAWALANG PERA AT SINABING LAHAT NG IMPORMASYON NA NAGAMIT AY SA AKIN GALING, KAYA NAGING VALID ANG TRANSACTION.3

Along with the CAF, Complainant attached a Complaint-Affidavit dated 02 May 2019.4 In her Complaint-Affidavit, Complainant alleged that on 15 March 2019, an unknown number called her.5 The caller, who already knew Complainant’s name, introduced herself as a certain AM from Respondent’s main office in Makati.6 At the time, Complainant was expecting an update from Respondent regarding the unauthorized usage of her BPI credit card.7 AM informed Complainant that “[Respondent] said that BPI XXX which is the branch of [Complainant’s] BPI account [redacted BPI account number] forwarded my fraud case to her.”8

To further prove that AM was a representative of Respondent, she allegedly recited Complainant’s information, including her withdrawals, deposits, remaining balance, transaction dates, email, and home address.9

AM then informed Complainant that her bank information was changed because of fraud.10 Since Respondent changed her data, Complainant will not be able to receive notifications on potential unauthorized transactions.11 AM assured Complainant that Respondent already prevented the unauthorized transactions, and that her account is under the control of Respondent bank.12

Complainant stressed that she did not tell AM her username or password for her online banking account.13 AM allegedly did not ask for these.14

After the call with AM, Complainant immediately checked her account online.15 She saw that there were two transactions involving Complainant’s payroll account, transferring a total of One Hundred Thousand Pesos (PhP100,000.00) to two GCash accounts.16 She states that the fact that the registration of her BPI account to the GCash accounts happened prior to the phone call proves that she did not disclose her information to AM during the call with her.17

Thereafter, Complainant immediately went to her BPI branch in Aurora Blvd., which was located beside her office.18 There, Complainant was able to confirm with BPI that AM was not listed as an employee.19 After receiving a call from a person who the Complainant believed was the same person who called her previously, Complainant withdrew the remaining funds in her account over the counter, in the amount of Sixty-Two Thousand Pesos (PhP62,000.00).20 The bankers then told the Complainant to dial the number 89100 to report the incident.21

Complainant accuses Respondent of “making [Complainant’s] information known to other person and/or people that were unauthorized and [Respondent’s] engagement in unsafe and unsound banking practices of allowing a third party establishment (GCASH) to connect on [Complainant’s] accounts which led to compromise [Complainant’s] accounts and successfully transferred [Complainant’s] money to unknown accounts.”22

Along with her Complaint-Affidavit, Complainant also attached: (i) banking statements covering the period of 17 January to 17 March

2019 showing the two transfers from her payroll account to an allegedly unknown GCash account, (ii) printouts of the email communications between Complainant and Respondent wherein Complainant reported the incident to Respondent for resolution, (iii) a demand letter dated 16 April 2019 from Complainant to Respondent for the return of One Hundred Thousand Pesos (PhP100,000.00) charged to her payroll account, (iv) a screenshot of an SMS message indicating that a certain BPI Online Banking account has been successfully registered for GCash, and (v) a screenshot of a phone number.23

Complainant prays that the lost funds be returned due to the alleged unauthorized transactions, payment of damages, and the imposition of a fine against Respondent.24

On 30 September 2019, the investigating officer issued an Order to Confer for Discovery on even date.25 In the Order, the discovery conference was set for 30 October 2019.26

On 30 October 2019, only Complainant appeared for the discovery conference.27

On 27 November 2019, the parties signified their intention to submit to mediation by executing an Application for Mediation,28 and an Order to Mediate was served.29 On the same day, a mediation conference was held with both parties present.30 An Order of even date was issued stating that the parties were present and agreed to schedule another mediation conference.31

On 08 January 2020, a Notice of Non-Settlement of Dispute was issued by the mediation officer since the parties were unable to reach a settlement.32

The Discovery Conference was held on the same day.33 Complainant sought the following from Respondent:

(i) Recording of the conversation between the complainant and agent of respondent on 15 March 2019 involving the incident complained of;

(ii) Details of the transaction between respondent and GCash on 15 March 2019;

(iii) Respondent’s published guidelines on the validation of its online transactions; and

(iv) Guidelines of enrollment of the customers’ account between GCash and respondent.34

Respondent, on the other hand, sought the following from Complainant:

(i) Information provided to the caller on 15 March 2019;

(ii) Reply of the complainant to the email asking for her account details with respondent.35

After the discovery conference, an Order dated 08 January 2020 was issued requiring the parties to appear on 29 January 2020 for the continuance of the discovery conference.36

On 03 February 2020, the Commission issued an Order narrating that on 29 January 2020, the continuation of the discovery conference was held and the parties’ lawyers entered their appearances.37 The parties were given ten (10) days to submit the required documents enumerated in the Order dated 08 January 2020.38 Respondent was thereafter given ten (10) days from receipt of the required documents

to file a responsive comment.39 Complainant, on the other hand, was given ten (10) days from receipt of the comment to file her reply, to which Respondent may file a rejoinder within ten (10) days.40 The Order specified that upon expiration of the periods provided, the case shall be submitted for resolution with or without the pleadings required.41

Records show that the parties did not submit any further pleadings or compliance to the Order dated 08 January 2020. Thus, the case was submitted for Decision of the Commission on 15 January 2024.42

Issue

Whether Respondent Bank of the Philippine Islands is liable under the DPA.

Discussion

The Commission dismisses the complaint for lack of substantial evidence.

Respondent did not commit a violation of the DPA.

Preliminarily, it is observed that Complainant did not specify a particular provision of the DPA violated by the Respondent in her CAF43 or in the Complaint-Affidavit44 attached. However, regardless of the designation of the act allegedly committed by Respondent, the Commission deems it proper to dismiss the charge against Respondent considering that Complainant failed to provide sufficient evidence to prove any participation whatsoever on the part of Respondent in the alleged disclosure of her personal data.

In Avelina Sagun v. Sunace International Management Services, Inc.,45 the Supreme Court ruled that in proceedings before quasi-judicial bodies, the quantum of evidence necessary to establish one’s claim is substantial evidence:

In proceedings before administrative and quasi-judicial agencies, the quantum of evidence required to establish a fact is substantial evidence, or that level of relevant evidence which a reasonable mind might accept as adequate to justify a conclusion.46

Moreover, Section 1 of Rule 131 of the 2019 Amendments to the Revised Rules on Evidence provides for the definition of burden of proof:

Section 1. Burden of proof and burden of evidence. Burden of proof is the duty of a party to present evidence on the facts in issue necessary to establish his or her claim or defense by the amount of evidence required by law. Burden of proof never shifts.

Burden of evidence is the duty of a party to present evidence sufficient to establish or rebut a fact in issue to establish a prima facie case. Burden of evidence may shift from one party to the other in the course of the proceedings, depending on the exigencies of the case.47 (Emphasis supplied.)

Further, in Gatmaytan v. Dolor,48 the well-established principle regarding the burden of the party alleging a fact is concisely restated:

As basic as the previously-discussed principles on appeal as a statutory privilege, finality of judgments, and service of papers, is the principle that “a party who alleges a fact has the burden of proving it.” A mere allegation will never suffice: “a mere allegation is not evidence, and he who alleges has the burden of proving the allegation with the requisite quantum of evidence.” Logically, a party who fails to discharge his or her burden of proof will not be entitled to the relief prayed for.49

Thus, it is Complainant who has the burden of proving her claim against Respondent by substantial evidence.

In this case, what appears to have transpired was a phishing incident. Phishing is defined as the fraudulent process of attempting to acquire private or confidential information by masquerading as a trustworthy entity in an electronic communication.50 The responsibility for the avoidance of falling victim to phishing falls both on the personal information controller (PIC) and the data subject.51

In Complainant’s narration, however, it appears that her personal data has already been obtained by the threat actor prior to communicating with Complainant, and was in fact relayed by the threat actor to her to make her believe that the fraudster was an authorized representative. Nothing in Complainant’s submissions prove the fact that it was Respondent who was the cause of the disclosure of Complainant’s information to the threat actor. The mere fact that a threat actor knows Complainant’s personal data is not proof that the Respondent disclosed her information.

Aside from Complainant’s allegations in her CAF52 and Complaint-Affidavit53 that Respondent disclosed her data to a third person, the only other evidence submitted by Complainant serves to prove the fact that transactions involving her banking account occurred, and that Complainant communicated the matter to Respondent for the purpose of requesting assistance.54 Taken together, the evidence submitted by Complainant do not prove, by substantial evidence, participation by Respondent in the disclosure of Complainant’s data, which led to the allegedly fraudulent transactions.

Considering the Complainant’s failure to discharge her burden to prove by substantial evidence, any form of participation on the part

of Respondent in the alleged privacy violation, the Commission cannot find Respondent liable for violating the DPA.

As to the Complainant’s prayer for the reversal of the allegedly unauthorized transactions,55 such is beyond the jurisdiction of the Commission.

Notwithstanding the foregoing, the Commission takes this opportunity to impress upon the banking sector the weight of their responsibility as keepers of their depositor’s personal data. As PICs controlling the processing of information pertinent to financial transactions, banks process personal data which, if mishandled, may result in their depositor’s economic ruin, among others.

While the holding of information campaigns may be an effective means to spread awareness among depositors regarding the prevalence of phishing and other similar scams, the holding of the same should not be deemed a license allowing banks to evade liability borne from their failure to satisfactorily fulfill their solemn duty to safeguard their depositors’ personal data.

The Commission stresses that the holding of these campaigns should not have the effect of passing the banking sector’s burden onto their depositors. To adequately address the rise of online financial scams, banks must take a more direct and active role in helping prevent the occurrence of these scams. As such, banks are strongly encouraged to innovate technical and proactive solutions to reduce the likelihood of depositors being victimized.

WHEREFORE, premises considered, this Commission hereby resolves that the instant complaint filed by KDC against the Bank of the Philippine Islands is DISMISSED for lack of substantial evidence.

This is without prejudice to the filing of appropriate civil, criminal or administrative cases against the Respondent Bank of the Philippine Islands before any other forum or tribunal, if any.

SO ORDERED.

City of Pasay, Philippines. 17 September 2024.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

NERISSA N. DEJESUS Deputy Privacy Commissioner

Copy furnished:

KDC Complainant

BANK OF THE PHILIPPINE ISLANDS BPI LEGAL DIVISION Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Complaints-Assisted Form dated 02 May 2019 of KDC. ↩

  2. Id. ↩

  3. Id., p. 3-4. ↩

  4. Complaint-Affidavit dated 02 May 2019 of KDC. ↩

  5. Id., ¶ 3. ↩

  6. Id., ¶ 3. ↩

  7. Id., ¶ 3. ↩

  8. Complaint-Affidavit dated 02 May 2019 of KDC, ¶ 3. ↩

  9. Id., ¶ 4. ↩

  10. Id., ¶ 5. ↩

  11. Id., ¶ 5. ↩

  12. Complaint-Affidavit dated 02 May 2019 of KDC, ¶ 5. ↩

  13. Complaint-Affidavit dated 02 May 2019 of KDC, ¶ 6. ↩

  14. Id., ¶ 6. ↩

  15. Id., ¶ 7. ↩

  16. Id., ¶ 7. ↩

  17. Complaint-Affidavit dated 02 May 2019 of KDC, ¶ 9. ↩

  18. Id., ¶ 6. ↩

  19. Id., ¶ 7. ↩

  20. Id., ¶ 7. ↩

  21. Complaint-Affidavit dated 02 May 2019 of KDC, ¶ 7. ↩

  22. Id., ¶ 13. ↩

  23. Attachments to the Complaint-Affidavit dated 02 May 2019 of KDC. ↩

  24. Complaints-Assisted Form dated 02 May 2019 of KDC, p. 6. ↩

  25. KDC v. Bank of the Philippine Islands, NPC Case 19-1247, Order to Confer for Discovery dated 30 September 2019. ↩

  26. Id. ↩

  27. KDC v. Bank of the Philippine Islands, NPC Case 19-1247, Attendance Sheet for Discovery Conference dated 30 October 2019. ↩

  28. KDC v. Bank of the Philippine Islands, NPC Case 19-1247, Application for Mediation dated 27 November 2019. ↩

  29. KDC v. Bank of the Philippine Islands, NPC Case 19-1247, Order to Mediate dated 27 November 2019. ↩

  30. KDC v. Bank of the Philippine Islands, NPC Case 19-1247, Order dated 27 November 2019. ↩

  31. Id. ↩

  32. KDC v. Bank of the Philippine Islands, NPC Case 19-1247, Notice of Non-Settlement of Dispute dated 08 January 2020. ↩

  33. KDC v. Bank of the Philippine Islands, NPC Case 19-1247, Order dated 08 January 2020. ↩

  34. Id. ↩

  35. Id. ↩

  36. Id. ↩

  37. KDC v. Bank of the Philippine Islands, NPC Case 19-1247, Order dated 03 February 2020. ↩

  38. Id. ↩

  39. Id. ↩

  40. Id. ↩

  41. KDC v. Bank of the Philippine Islands, NPC Case 19-1247, Order dated 03 February 2020. ↩

  42. Id. ↩

  43. Complaints-Assisted Form dated 02 May 2019 of KDC. ↩

  44. Complaint-Affidavit dated 02 May 2019 of KDC. ↩

  45. Sagun v. Sunace International Management Services, Inc., G.R. 179242, 23 February 2011. ↩

  46. Id. ↩

  47. 2019 Amendment to the 1989 Revised Rules on Evidence, A.M. No. 19-08-15-SC, Rule 131, § 1 (1 May 2020). ↩

  48. Gatmaytan v. Dolor, G.R. 198120, 20 February 2017. ↩

  49. Id. ↩

  50. IBC v. PBI, CID No. 17-K-004, undated. ↩

  51. Id. ↩

  52. Complaints-Assisted Form dated 02 May 2019 of KDC. ↩

  53. Complaint-Affidavit dated 02 May 2019 of KDC. ↩

  54. Attachments to the Complaints-Assisted Form dated 01 August 2019 of KDC. ↩

  55. Complaints-Assisted Form dated 02 May 2019 of KDC. ↩

Backlinks

  • No backlinks found