Decision Text
MIP ,
Complainant,
-versus-
COLLIERS INTERNATIONAL PHILIPPINES represented by
RDR, EDS, JSA, and ALA .
Respondent.
x----------------------------------------------------x
AGUIRRE , D. P.C. ;
Before this Commission is a Complaint filed by MIP (Complainant)
against Colliers International Philippines (Colliers), represented by
RDR , EDS , JSA and ALA for alleged violations of Republic Act No.
10173 or the Data Privacy Act of 2012 (DPA).
Facts
MIP is a current and active paying member of Ultima Residences
Condominium Corporation (URCC). 1 Colliers International
Philippines (Colliers) has been the property manager of URCC since
January 2018. 2 According to Colliers, it does not manage URCC since
URCC is managed by its own Board of Directors (BOD) .3 Meanwhile,
respondents EDS, ALA, and JSA are former property managers of
Colliers. 4
Affidavit/Complaint, 19 September 2019, at 1, in MIP v. Colliers International Philippines, NPC 19-1411 (NPC 2019).
Id.
Verified Comment, 03 June 2022, at 1, in MIP v. Colliers International Philippines, NPC 19-1411
(NPC 20 22 ).
Email from ARV to NPC Complaints and Investigation Division (CID), 16 May 2022, in MIP v.
Colliers International Philippines, NPC 19-1411 (NPC 20 22 ).
Data Privacy Act of
2012 NPC 19-1411
On 19 September 2019, MIP filed his Affidavit/Complaint against
Colliers, EDS, ALA, and JSA for alleged violation of Sections 25, 31,
MIP alleged that Colliers does not have legal rights to manage URCC
because of a violation of Section 44 of Republic Act No. 11232 or the
Revised Corporation Code of the Philippines. 6 As such, MIP argues
that Colliers is not authorized to handle URCC’s owners’ and guests’
information. 7
MIP explained that Colliers collects information of the condominium
unit owners and their guests without their consent. 8 He recounted
that Colliers required “registration of contracts ” and the collection of
identification cards (ID) and passports of owners and their guests in
the lobby. 9 He also argues that Colliers had no “legitimate bases”
when it disclosed closed -circuit television ( CCTV ) recordings of him
during a URCC special meeting. 10
On 02 October 2018, URCC held a special meeting where it played
two (2) CCTV recordings showing MIP .11 The first video showed
MIP walking in the condominium premises while grabbing his own
suitcase. 12
MIP recalled that after the first video was shown, ALA and EDS
stated that MIP “trespassed into the condominium to take his bag.” 13
In a Memorandum dated 06 July 2018, however, the Property
Management Office (PMO) informed MIP that its security team
spotted MIP “twisting the CCTV units from its original position
facing [our] common hallways to a different angle opposite the
MIP v. Colliers International Philippines
aim.” 14 The PMO reported that MIP entered another homeowner’s
vacant unit and pulled out his black travel bag and small pail that he
left in the room .15
The second video showed MIP and another property owner walking
in the Property Management Office ( PMO ). 16
MIP claimed that Colliers violated the DPA during the meeting due
to its “malicious and unlawful disclosure of his personal information
and unauthorized processing of personal information and sensitive
personal information.” 17
MIP also claimed that EDS and ALA “conspired” to violate the
DPA. 18 MIP narrated that on 04 2018, SP, a member of the BOD,
emailed EDS and ALA stating:
A, can you please check our CCTV to see if we could catch these
culprits in action. Let’s print and post violators in the bulletin
and show the clip during the general assembly. 19
On 02 2022, the National Privacy Commission (NPC) , through
its Complaints and Investigation Division (CID) , issued an Order (To
File Verified Comment and Appear Virtually for Preliminary
Conference). 20 In the Order, the preliminary conference s were set for
07 June 2022 and 05 2022. 21
On 16 May 2022, Colliers sent a letter requesting a n extension of
fifteen (15) days to file its comment to give them “ample time to
review the documents and evidence [they have ] on file.” 22 Collier s
MIP v. Colliers International Philippines
also manifested that EDS , JSA , and ALA are no longer connected with
Colliers. 23
On 17 2022, Colliers filed a Motion for Extension of Time to File
a Verified Comment. 24 Colliers alleged that it has yet to engage the
services of a lawyer , and it still must go over pertinent documents
and files. 25 Colliers re iterated that EDS , JSA , and ALA are no longer
employees of the company. 26
On 20 May 2022, the CID issued an Order (Granting the Request for
Extension and the Motion for Extension of Time to File Verified
Comment). 27 Colliers was given until 03 June 2022 to file its verified
comment. 28
On 03 June 2022 , Colliers filed its Verified Comment. 29 At the outset,
Colliers emphasized that EDS , JSA , and ALA are no longer connected
with Colliers. 30
Colliers claimed that it did not violate the Corporation Code because
Colliers is the designated property manager of URCC .31 It explained
that URCC engaged Colliers’ property management services to
oversee the common areas of the condominium .32
Colliers added that questions on the engagement of Colliers is
beyond the NP C’s jurisdiction. 33 Further, Colliers stated that URCC
instructed the collection of personal data from people entering the
property to ensure the safety and security of its unit owners .34
According to Colliers, the condominium is not a public property so
access and entry to the premises is legally and validly regulated. 35
Colliers also attached a sample of a “ Move -In Form” , which is usually
accomplished by a registered owner or lessee to list a unit’s
occupants .36 Only those names written in the form will be allowed to
enter or have access to the unit , enter the common areas , and use the
common facilities of the condominium. 37 Further, guests of unit
owners were required to register and provide proof of their identities
“for the common security and safety” of the building’s occupants. 38
As for the disclosure of CCTV footage that depicted MIP , Colliers
clarified that the BOD’s investigation required the review of the
CCTV footage to “catch the culprits in action.” 39 Colliers emphasized
that the directive for the investigation was not aimed against any
specific individual but rather against those who may have violated
the URCC rules and regulations. 40
Colliers alleged that the administrative investigation through the
review of the CCTV footage was executed for a valid, legal, and
legitimate purpose, namely, an administrative investigation in
relation to accusations made by MIP against Colliers. 41 Colliers
reiterated that MIP ’s allegation that Colliers “conspired” to violate
Section s 31 and 32 of the DPA by “planning to authorize data
processing” is untenable. 42
According to Colliers the letter of URCC’s legal counsel dated 19
February 2019 to MIP shows the “root cause ” of the issu e.”43 In the
letter, URCC asserted that prior to the special meeting where the
CCTV footage was presented, MIP “fabricated a lie against the
Colliers’ PMO staff.” 44 URCC explained that MIP made
unsubstantiated claims against Colliers’ staff members that they
MIP v. Colliers International Philippines
“don’t show up for work on time” and that “they left the air
conditioners and lights turn on even after office hours.” 45 URCC also
insisted that MIP himself entered the PMO premises on a non -
working holiday, intentionally tried to turn around the CCTV camera
to an “off -direction”, turned on all the air conditioners and lights,
then proceeded to take a video of the empty office.“ 46 URCC stated
that MIP circulated these allegations to all URCC condominium unit
owners by sending a mass e -mail with an attached video depicting an
empty office. 47
URCC stated that the PMO informed MIP through a Memorandum
dated 06 July 2018 that its security team spotted him “twisting the
CCTV units from its original position facing [ their ] common hallways
to a different angle opposite the aim.” 48 The PMO reported that MIP
entered another homeowner’s vacant unit and pulled out his black
travel bag and small pail that he left in the room. 49
URCC argued that this was a plot crafted by MIP to support his
statement that Colliers is not fulfilling its responsibility. 50
In the letter, URCC also explained to MIP the reason it showed the
CCTV footage during the special meeting:
WHY WAS THE CCTV FOOTAGE OF YOU MAKING THE
VIDEO SHOWN AT THE SPECIAL MEETING?
At the meeting, this supposed “misconduct” of Colliers staff that
you authored was scrutinized and brought up by some
homeowners, so the concerned Colliers staff rightfully
defended themselves by relating the whole incident of your
scheme.
One homeowner asked for the CCTV footage to be shown, in
order to clarify on who between the two of you was telling the
truth. It was only then that Colliers showed it, not to discredit
you personally, but to bring out the truth of the matter. 51
MIP v. Colliers International Philippines
In its Verified Comment, Colliers stated that an investigation was
conducted and the viewing of the CCTV became necessary on
account of the “false accusations” made by MIP .52 Since the CCTV
footage contradicts MIP ’s allegations, MIP “now cries foul and
[claims] a violation of his privacy.” 53 It also pointed out that MIP is a
“notorious violator” of the rules , regulations , and policies of URCC ,
and legal actions that had been brought against him in court. 54
Colliers argued that it did not violate the provisions of the DPA
because there was “no malicious and unlawful disclosure made on
[MIP ’s] personal information.” Collier argued further that the
viewing of the CCTV footage was for a legitimate purpose, and it was
necessary “as it was done on account of an administrative
investigation conducted by URCC[.]”
Given the foregoing, Colliers prayed that the complaint be dismissed
for utter lack of merit. 55
On 0 6 2022, Colliers filed an Urgent Motion for Resetting dated
03 June 2022 .56 Colliers alleged that its counsel was already scheduled
to appear in a prior case and, therefore, cannot attend the scheduled
Preliminary Conference on 07 June 2022. 57
On the same day , MIP filed a Reply to Defendants [sic] Verified
Comment and Objections to “Defendant’s Urgent Motion for
Resetting ” dated 06 June 2022 .58
In his Reply, MIP alleged that Colliers ’ Verified Comment was based
on hearsay and had no first -hand witness or verification document .59
MIP v. Colliers International Philippines
MIP also argued that the annexes submitted by Colliers show
“several unverified [and] false allegations [and] doesn’t have
witnesses to prove it[.]” 60 MIP concluded that this proves the
defendants are “mishandling private data of URCC owners” as he
had alleged in his Affidavit/Complaint. 61
MIP further argued that since neither he nor other URCC owners
gave authority to Colliers to manage URCC, Colliers “never gained
the legal authority to manage, process or gather private owner data
of URCC owners or their guests’ visiting condos.” 62
As for the Move -In Form, MIP argued that Colliers failed to show
any policy or contract that requires such document for private
guests. 63 According to MIP , Colliers admitted that they are only
managing common areas, so they do not have authority to log
visitors’ information for private condos. 64 MIP stated Colliers was
“overreaching” by asking for IDs and other details from guests. 65
As for the letter from URCC’s legal counsel, MIP argued that it was
hearsay and speculation and only proved that Colliers and its
employees “maliciously displayed” his “private data” during a
public meeting. 66
MIP also objected to Colliers’ Urgent Motion for Resetting dated 03 June 2022, arguing that it was intended to delay the proceedings. 67
On 07 June 2022, the CID issued an Order (Granting the
Respondent’s Urgent Motion for Resetting and Resetting the 1st
Preliminary Conference from 07 June 2022 to 05 2022) .68 The first
preliminary conference was reset to 05 2022. 69
MIP v. Colliers International Philippines
On 08 2022, the CID issued an Order (Noting the Complainant’s
Reply to Defendants Verified Comment & Objection to Defendant’s
“Urgent Motion for Resetting” ).70
On 05 2022, both parties attended the first Preliminary
Conference. 71 Colliers’ counsel manifested that pursuant to A.M. No.
20 -12 -01 -SC on the guidelines on the conduct of videoconferencing,
MIP should indicate his whereabouts. 72 The CID r equired Colliers to
file a written motion regarding its request for MIP to disclose his
location within ten (10) days from receipt .73 The Preliminary
Conference was reset to a third schedule on 23 August 2022 to give
Colliers time to file the motion .74
On 06 June 2022, Colliers filed an Omnibus Motion praying that MIP
be directed to disclose his location:
However, during the proceedings, Complainant refused to
disclose his specific location. Accordingly, Respondents
requested from the Honorable Hearing Officer to require at
least for the said Complainant to disclose whether he is in the
Philippines or outside the Philippines, citing that if indeed
Complainant is outside the Philippines, then for him to
participate in the videoconference hearing, he must be in the
Philippine Embassy or Consulate office of the country or State
wherever he is during the proceedings.
…
WHEREFORE, premises considered, it is respectfully prayed
that an Order be issued directing Complainant to disclose his
location and if he is outside the Philippines, comply with the
provisions under A.M. No. 20 -12 -01 SC, more particularly, on
the filing the required motion to conduct the videoconferencing
at his end at an embassy or consulate of the Philippines. 75
MIP v. Colliers International Philippines
On the same day, MIP filed an Objection to Respondents Omnibus
Motion. 76 MIP claimed that A.M. No. 20 -12 -01 -SC is discretionary and
does not apply to administrative hearings , and that Colliers filed the
motion in bad faith .77
On 19 2022, the CID issued a Resolution (of Respondent’s
Omnibus Motion dated 06 June 2022 ).78 The CID resolved that parties
are required to disclose their location pursuant to NPC Advisory
2020 -02. 79
On 05 August 2022, MIP filed for a Motion for Discovery of
Evidence. 80 MIP requested that Colliers produce all the evidence
relating to the BOD investigation, CCTV footage, meeting records,
and URCC policies on obtaining visitors’ information in its
possession. 81
On 23 August 2022, both parties attended the second preliminary
conference where MIP disclosed that he was in Cleveland, Ohio. 82
During the second Preliminary Conference, MIP admitted that:
-
Colliers is the property manager o f URCC ;
-
He filed a complaint against Colliers PMO Staff before the
Colliers Ethics Committee in the United States ;
- MIP accused Colliers PMO staff of malversation and
misconduct in the management of URCC ;
- MIP resorted to name -calling the Board of URCC by saying that
it was inefficient, incapable, and a “Board of Deflectors” ;
MIP v. Colliers International Philippines
- There was a brawl between MIP and another URCC
homeowner that resulted in the filing of cases against MIP ;
and
- MIP received a Memo randum for repositioning the CCTV
cameras without the consent of the PM O.83
Colliers on the other hand, admitted that :
- EDS , JSA , ALA were its employees at the time of the acts
complained of ;
- The counsel for URCC and Colliers is the same, and that Atty.
RP used to work for the law firm hired by URCC and Colliers ;
and
- MIP was also ordered to submit a motion specifying documents
requested from Colliers .84
On 06 June 2022, the CID issued an Order to Mediate dated 20 May 2022. 85 The CID also issued a n Order (On the Error in the
Caption of the Orders issued after the Preliminary Conference). 86
On 25 October 2022, the CID issued a Notice of Non -Settlement of
Disput e.87
On 17 November 2022, the CID issued a Resolution (Partially
Granting the Motion for Discovery of Evidence dated 05 August 2022,
Lifting the Suspension of Complaints Proceedings, and Requiring the
Parties to Submit their Simultaneous Memoranda). 88 In the
Resolution, the CID required Colliers to submit the following
documents :
Item No. 4: Minutes, meetings, records and CCTV clips of an
alleged plan to post data of other URCC owners including
complainant
MIP v. Colliers International Philippines
Item No. 5: Minutes of URCC meeting altering house rules to
allow Colliers to post videos and information of owners on
bulletin boards.
Item No. 7. 1 Minutes of the meeting and documents presented
during the URCC Annual Board of Directors meeting held on 02
October 2018
Item No. 10: URCC policies, minutes, and resolutions requiring
Colliers to stop private guests and obtain information from
them, including ID and a sign -up sheet that includes the guest’s
phone number and address; 11. Documents showing a change
of managers from ALA to JSA
Item No. 12: CCTV video of the break -in at complainant’s condo
on 03 January 2019 at 8:00 PM and 04 January 2019 between 8:00
AM to 2:00 PM. 89
On 1 6 2022, Colliers filed a Manifestation (on the Directive
of Producing Certain Files and Document Sought in MIP ‘s Motion for
Discovery of Evidence dated August 5, 2022). 90 Colliers claimed that
the documents requested do not belong to Colliers and , thus, cannot
be procured ; and that it has no copies of the CCTV footage .91
On 17 2022, Colliers filed its Respondent’s Memorandum
dated 16 May 2022. 92 Colliers reiterated the arguments raised in
the Verified Comment dated 03 June 2022. 93
On the same day , MIP also filed his Memorandum. 94 He claimed that
Colliers failed to obey the Commission’s subpoena , EDS and JSA
created false reports against and destroyed evidence, and Colliers’
defenses should be disregarded for lack of witnesses, lack of
evidence, and for being hearsay. 95
MIP v. Colliers International Philippines
On 20 May 2022, the CID issued an Order (Noting the
Respondent’s Memorandum and Manifestation (On the Directive of
the Producing Certain Files and Documents Sought in the Motion for
Discovery of Evidence dated August 5, 2022) and Complainants ’
Memorandum 96
On 13 January 2023, MIP submitted a “Mane sfestation [sic] of Privacy
Abuses.” 97
In the submission , MIP stated that he was “filing a statement” against
URCC , another URCC owner and member. 98 MIP manifested that
URCC , through Colliers asked his guest to pay a n entrance fee for a
Move -In Form before the guest could move in .99 The form required
the guest’s ID , email address, phone number, and the names of the
occupants of the property. 100
MIP argued that he does not agree with Collier’s policy and that he
did not give consent to collect their tenants’ information or for Collier
to use the forms to charge them money 101 or Colliers only “use [d]
these forms just to charge money.” 102 He also stated that “no consent
was given to out block guests from our condo units, and “no rights
regarding data privacy was given to us.” 103 Finally, MIP asserted that
“stopping guests from entering ou r personal [condos] to demand
info, ID [and ] payment” is in violation of the DPA. 104
MIP narrated that this caused him sleepless nights and extreme
anxiety. 105 MIP prays that Colliers be liable for Sections 21, 32, and 33
MIP v. Colliers International Philippines
of the DPA as well as “punitive damages, moral damages and as legal
fees or as the Commission sees fit. ”106
Issue
I. Whether Colliers has a legitimate interest in the processing of
the personal information of URCC unit owners and their
guests.
II. Whether Colliers is liable under Section 25 (Unauthorized
Processing of Personal Information), Section 32 (Unauthorized
Disclosure), and Section 33 (Combination or Series of Acts) of the DPA.
Discussion
I. Colliers’ processing of personal information had lawful basis
under Section 12 (f) of the DPA.
Colliers processed the personal information involved according to a
lawful criterion provided under Section 12 (f) of the DPA. Section 12 (f) of the DPA allows for the processing of personal information when
it is necessary for the legitimate interests pursued by the Personal
Information Controller (PIC):
Section 12. Criteria for Lawful Processing of Personal Information .
The processing of personal information shall be permitted only
if not otherwise prohibited by law, and when at least one of the
following conditions exists:
…
(f) The processing is necessary for the purposes of the
legitimate interests pursued by the personal information
controller or by a third party or parties to whom the data is
disclosed , except where such interests are overridden by
fundamental rights and freedoms of the data subject which
require protection under the Philippine Constitution. 107
MIP v. Colliers International Philippines
In MIP ’s Complaint, he argues that Colliers violated the DPA when
it: (1) collected the personal information of the condominium unit
owners and their guests and (2) disclosed the CCTV footage of him
during the URCC special meeting. 108
With regard to the collection of personal information of owners and
guests, MIP alleged that:
Colliers has been collecting information of Owners guests,
including my guest without my permission or consent.
Requiring registration of Contracts [sic], asking for sensitive
information such as ID’s and passports photocopying them in
the lobby.
…
The management policy demands guests photocopy of ID, with
no actions safeguards their privacy.
…
Consent was not ‘freely given ’ (SEC. 3(B) & there is no
legitimate purpose showed for collecting ID photocopies by
management when I emailed complaints & letter by LBC to the
Respondents. 109
According to Colliers, the guests of the registered owner are required
to register and provide proof of their identities for the security and
safety of the building’s occupants. 110 It explained that the registered
owner or lessee of the condominium is required to accomplish a
“Move -In Form” that contains a list of the occupants of a unit .111 It
stated that it collects their personal information because only those
named in the form will be allowed to enter or have access to the unit
and the common areas of the condominium. 112
Section 3 (g) of the DPA defines personal information:
MIP v. Colliers International Philippines
Section 3. Definition of Terms. Whenever used in this Act,
the following terms shall have the respective meanings
hereafter set forth:
…
(g) Personal information refers to any information whether
recorded in a material form or not, from which the identity
of an individual is apparent or can be reasonably and
directly ascertained by the entity holding the information,
or when put together with other information would
directly and certainly identify an individual. 113
In this case, Colliers collected information such as the names of
guests, condominium unit numbers, name of owner/lessor, contact
numbers, name of tenant/lessee, email address, signature, the names
of the occupants and the ir relationship to the owners or lessors .114
These are considered personal information under Section 3(g) of the DPA.
Further, CCTV footage that captures visual images used to identify or
ascertain the identity of a person, is also classified as personal
information under Section 3 (g) .
In this case, Colliers disclosed two CCTV recordings . One CCTV
recording captured footage of MIP walking in the condominium
premises while grabbing his suitcase , and the other captured him and
another owner walking into the PMO . These are both considered
personal .
Section 3 (j) of the DPA defines processing:
Section 3. Definition of Terms. Whenever used in this Act, the
following terms shall have the respective meanings hereafter set
forth:
…
(j) Processing refers to any operation or any set of operations
performed upon personal information including, but not
limited to, the collection, recording, organization, storage,
MIP v. Colliers International Philippines
updating or modification, retrieval, consultation, use,
consolidation, blocking, erasure or destruction of data. 115
Prior to occupying a condominium unit, Colliers stated that it collects
the necessary personal information from its owners and tenants as
outlined in the Move -In Forms. 116 It also regularly collects the ID s of
the owners or guests to verify the identities of individuals listed in
the Move -In Forms. 117 Under Section 3 (j) of the DPA, the act of
collecting and verifying the names of the condominium unit owners ,
their tenants, and their guests is considered processing. Likewise, the
acts of and their guests and the recording and disclosing of the CCTV
footage are considered processing. The CCTV footage was used by
Colliers to directly ascertain MIP ’s identity and to issue the
Memorandum dated 06 July 2018 .118
Processing based on legitimate interest requires the fulfillment of the
following conditions: (1) the legitimate interest is established; (2) the
means to fulfill the legitimate interest is both necessary and lawful;
and (3) the interest is legitimate and lawful, and it does not override
fundamental rights and freedoms of data subjects. 119
A. Colliers established its legitimate interest in processing the
personal information of MIP and of the condominium unit
owners and their guests .
The first requisite for processing based on Section 12(f) of the DPA
requires that legitimate interest is established. 120 This focuses on what
the PIC seeks to accomplish with the specific processing activity. 121
To determine whether the legitimate interest has been established,
the PIC must comply with the general privacy principles of (1)
legitimate purpose and (2) transparency. 122
Section 11 of the DPA discusses legitimate purpose as follows:
MIP v. Colliers International Philippines
Section 11. General Data Privacy Principles. The processing of
personal information shall be allowed, subject to compliance
with the requirements of this Act and other laws allowing
disclosure of information to the public and adherence to the
principles of transparency, legitimate purpose and
proportionality.
Personal information must be:
(a) Collected for specified and legitimate purposes
determined and declared before, or as soon as reasonably
practicable after collection, and later processed in a way
compatible with such declared, specified and legitimate
purposes only;
…
(e) Retained only for as long as necessary for the fulfillment
of the purposes for which the data was obtained or for the
establishment, exercise or defense of legal claims, or for
legitimate business purposes, or as provided by law [.] 123
Further, Section 18 of the Implementing Rules and Regulations of the
DPA (IRR) provides:
Section 18. Principles of Transparency, Legitimate Purpose and
Proportionality. The processing of personal data shall be allowed
subject to adherence to the principles of transparency,
legitimate purpose, and proportionality.
…
b. Legitimate purpose. The processing of information shall
be compatible with a declared and specified purpose which
must not be contrary to law, morals, or public policy. 124
Hence, the legitimate purpose principle requires that: (1) the purpose
of processing must be specified; and (2) that purpose must not be
contrary to law, morals, or public policy. 125
MIP v. Colliers International Philippines
The first element of legitimate purpose requires that there should be
a specific purpose, such that the purpose of processing is clearly
defined and not vague or overbroad. 126 While this does not require an
exhaustive enumeration of each and every purpose that may possibly
apply to that processing activity, it must be specific enough for the
data subject to understand what is sought to be achieved by that
processing. 127
The second element of legitimate purpose requires the purpose to be
within the limitations of the law, which should be understood to
include the entire body of laws, rules, and regulations. 128
Additionally, the purpose of processing should not go against
prevailing morals or run counter to public policy. 129
In this case, Colliers specified that its purpose for processing the
information of the owners, and their guests was to update its records
and to maintain the security of its premises.
The Move -In Form attached by Colliers states that the purpose of
collecting information was to update the records of the members :
This is for member update purposes only . The information
contained herein is considered confidential and will not be
divulged to a third party without your prior consent. Please
have this form returned to the Administration Office after being
filled -up. 130
Further, Colliers stated that the names of the owners and the ir guest s
were collected to verify the identity of people who enter the premises
of the condominium property. 131 The Commission previously held
that maintaining the security of the premises and tenants of a
building is a legitimate interest. 132 Maintaining logbooks that contain
MIP v. Colliers International Philippines
the name of the guest, the date of visit, and the name of the tenant is
considered a common security practice in public and private
buildings. Such acts of r ecording personal information of guests may
be considered necessary for the purposes of monitoring all
individuals who enter URCC’s condominium property .
Hence, the collection of personal information by Colliers through the
Move -In Form was for a specified purpos e and it was not contrary to
law, moral s, or public policy.
With regard to the CCTV footage, Colliers specified that its purpose
for processing MIP ’s personal information was to facilitate the
investigation conducted on the basis of his allegations :
[T] he view of the CCTV footage was for a legitimate purpose
and the same was necessary as it was done on account of an
investigation conducted by URCC to determine whether the
accusation of the Complainant against herein Respondent was
true or not. 133
To recall, Colliers stated that MIP was responsible for sending a mass
email accusing Colliers employees and staff members of “not doing
their job.” 134 In his email, MIP accused Colliers’ staff members’ of
“poor management and performance.” 135 Thus, a special meeting was
held with the URCC property owners and Colliers staff to address
MIP ’s allegation of “misconduct” of Colliers staff members. 136
Colliers explained that there was an investigation conducted by a
member of URCC’s BOD concerning violators of the rules of URCC
and that the investigation required the review of the CCTV to “catch
these culprits in action.” 137
He nce , the processing through disclosure of the CCTV footage is for a
specified purpose , and it was not contrary to law, morals, or public
policy .
MIP v. Colliers International Philippines
The general privacy principle of transparency requires that th e PIC’s
interest is communicated to the data subject. 138 This principle requires
that a PIC should inform the data subject of the nature, purpose, and
extent of the processing, using clear and plain language that is easy to
understand. 139
Section 18 of the Implementing Rules and Regulations of the DPA
(IRR) elaborates on transparency :
Section 18. Principles of Transparency, Legitimate Purpose and
Proportionality . The processing of personal data shall be
allowed subject to adherence to the principles of transparency,
legitimate purpose, and proportionality.
a. Transparency. The data subject must be aware of the
nature, purpose, and extent of the processing of his or her
personal data, including the risks and safeguards involved,
the identity of personal information controller, his or her
rights as a data subject, and how these can be exercised. Any
information and communication relating to the processing
of personal data should be easy to access and understand,
using clear and plain language. 140
As previously discussed, Colliers clearly and adequately
communicated to the homeowners its claimed interest in processing
the homeowner’ s personal information when it declared that the
Move -In D orm was for “member update purposes only.” 141 This
includes the registration of lessees and visitors, and their respective
contact details.
As for the disclosure of the CCTV footage showing MIP , Colliers
explained in its Verified Comment that it informed MIP and the other
homeowners that the special meeting was specifically called to
address the allegations of misconduct and poor work performance in
MIP ’s email. 142
MIP v. Colliers International Philippines
Since Colliers communicated its specific purpose for processing the
personal information to MIP and to the URCC unit owners and their
guests, and such purpose is not contrary to law, morals, or public
policy, it established its legitimate interest.
Therefore, Colliers established its legitimate interest and satisfied the
first requisite based on Section 12(f) of the DPA.
B. The means that Colliers used to fulfill the legitimate interest
were both necessary and lawful.
The second requisite of processing based on Section 12 (f) of the DPA
is that the means to fulfill the legitimate interest is both necessary and
lawful. 143 For this requisite, the PIC must show that the means or the
specific processing activity undertaken is (1) necessary and (2)
lawful. 144 The PIC must evaluate how it intends to accomplish the
legitimate interest it has previously established.
The Commission previously held that the qualifier “necessary” refer
to the general privacy principle of proportionality. 145 Following this
principle, the processing must be adequate, relevant, suitable, and
necessary, such that it is not excessive in relation to the declared and
specified purpose. 146
Section 11 of the DPA provides:
Section 11. General Data Privacy Principles. The processing of
personal information shall be allowed, subject to compliance
with the requirements of this Act and other laws allowing
disclosure of information to the public and adherence to the
principles of transparency, legitimate purpose and
proportionality.
Personal information must, be:
MIP v. Colliers International Philippines
…
(c) Accurate, relevant and, where necessary for purposes for
which it is to be used the processing of personal information ,
kept up to date; inaccurate or incomplete data must be rectified,
supplemented, destroyed or their further processing restricted;
(d) Adequate and not excessive in relation to the purposes for
which they are collected and processed [.] 147
Section 18 of the Implementing Rules and Regulations of the DPA
(IRR) elaborates on proportionality:
Section 18. Principles of Transparency, Legitimate Purpose and
Proportionality. The processing of personal data shall be
allowed subject to adherence to the principles of transparency,
legitimate purpose, and proportionality .
…
c. Proportionality. The processing of information shall be
adequate, relevant, suitable, necessary, and not excessive in
relation to a declared and specified purpose. Personal data
shall be processed only if the purpose of the processing could
not reasonably be fulfilled by other means. 148
Given this, the processing is proportional when the (1) processing is
adequate, relevant, and necessary to the declared and specified
purpose; and (2) means by which processing is performed is the least
intrusive means available. 149
In this case , the collection of the personal information of the owners
and their guests was relevant and necessary to fulfill URCC’s
directive to maintain safety on the premises of the property managed
by Colliers .
As previously established, the BOD of URCC required and instructed
Colliers to collect the personal information of persons entering the
MIP v. Colliers International Philippines
condominium to “ensure the safety and security of all the unit
owners.” 150 Colliers argued that the condominium is not a public
property, and the common areas of the property remain to be
privately owned. 151
The processing was also not excessive since Colliers limited the
collected information to names, the condominium unit number
concerned, contact numbers, email address, signature, and
relationship to the owners or lessors . Individuals entering the
premises were requested to show proof of their identity to ensure
that only those named in the Move -In Form would be able to access
the facilities and common areas. After being filled up, the Move -In
Form was then returned to the Administration Office. 152 Colliers
emphasized that this was also to ensure the safety of the unit owners
in the condominium, and that it was not disclosed to other parties.
Further, MIP did not establish or even allege that Colliers process ed
the owners’ and guests’ personal information further in order to
confirm it matches the name provided in the Move -In documents
submitted by the unit owners. Therefore, Colliers adopted the least
intrusive means possible to accomplish its legitimate interest .
As for the disclosure of the CCTV footage showing MIP , Colliers
disclosed the CCTV footage during the special meeting held for the
purpose of addressing the concerns of the homeowners and the staff
members of Colliers. 153
In the letter to MIP , Colliers stated that the CCTV footage was shown
upon the persuasion of a homeowner who wanted to “bring out the
truth of the matter” :
One homeowner asked for the CCTV footage to be shown, in
order to clarify on who between the two of you was telling the
truth. It was only then that Colliers showed it, not to discredit
you personally, but to bring out the truth of the matter. 154
In that instance, Colliers disclose d the footage to all those present at
the special meeting because it was necessary and relevant to the
purpose of verifying the CCTV footage . During that time, Colliers’
act of verifying the CCTV footage during the special meeting was
necessary to determine the accuracy of the claims made by MIP in his
email. 155 Further, the showing of the CCTV footage was the least
intrusive, and most suitable and prompt thing to do to belie the
accusations made by MIP himself.
The second element of legitimate purpose requires the purpose to be
within the limitations of the law, which should be understood to
include the entire body of laws, rules, and regulations. 156
Additionally, the purpose of processing should not go against
prevailing morals or run counter to public policy. 157
Section 11 of the DPA provides:
Section 11. General Data Privacy Principles. The processing of
personal information shall be allowed, subject to compliance
with the requirements of this Act and other laws allowing
disclosure of information to the public and adherence to the
principles of transparency, legitimate purpose and
proportionality.
Personal information must, be:
…
(b) Processed fairly and lawfully [.] 158
Here, as previously established the collection of the personal
information of the unit owners, tenants, and guests through the
Move -In Form and upon entering the premises, was conducted
lawfully and without any coercion or pressure from Collier s. Colliers’
act of monitoring access and entry to the property following the
instructions of the URCC BOD falls within its duty as property
manager.
MIP v. Colliers International Philippines
As for Colliers’ disclosure of the CCTV footage, it was intended to
validate the truthfulness of MIP ’s claims involved showing the CCTV
footage . This objective of determining truthfulness did not violate
any existing law or regulation, company policy, or contractual
agreem ent between URCC as the company and MIP as a property
owner .
Therefore, the means used by Colliers to fulfil its legitimate interest
were necessary and lawful.
C. Colliers’ interest is legitimate and lawful, and it does not
override fundamental rights and freedoms of the data
subject.
The third requisite for processing based on legitimate interest under
Section 12 (f) of the DPA is that the interest is legitimate and lawful,
and it does not override fundamental rights and freedoms of data
subjects. 159 This requisite focuses on the effect or impact of
accomplishing the legitimate interest such that it does not override
the fundamental rights and freedoms of the data subjects .160
A determination of the effect of accomplishing legitimate interest
requires an analysis of the totality of the three (3) requisites. 161 Given
that the legitimate interest of the PIC has been established, and the
PIC’s means to fulfill that legitimate interest is both necessary and
lawful, it must now be determined whether the processing
undertaken does not override Complainants’ fundamental rights and
freedoms. 162
In determining the impact of the PIC’s processing based on legitimate
interest, aside from the categories of personal information that are
processed, the Commission considers the general privacy principle of
MIP v. Colliers International Philippines
fairness and the reasonable expectation of the data subjects regarding
the processing of their personal information. 163
Section 11 (b) of the DPA states that the personal information must be
processed fairly :
Section 11. General Data Privacy Principles. The processing of
personal information shall be allowed, subject to compliance
with the requirements of this Act and other laws allowing
disclosure of information to the public and adherence to the
principles of transparency, legitimate purpose and
proportionality.
Personal information must, be:
…
(b) Processed fairly and lawfully[.] 164
Section 19 of the Implementing Rules and Regulations of the DPA
(IRR) elaborates on fairness:
Section 19. General principles in collection, processing and retention.
The processing of personal data shall adhere to the following
general principles in the collection, processing, and retention of
personal data:
…
b. Personal data shall be processed fairly and lawfully.
- Processing shall uphold the rights of the data subject,
including the right to refuse, withdraw consent, or object.
It shall likewise be transparent, and allow the data subject
sufficient information to know the nature and extent of
processing.
- Information provided to a data subject must always be in
clear and plain language to ensure that they are easy to
understand and access.
- Processing must be in a manner compatible with
declared, specified, and legitimate purpose.
- Processed personal data should be adequate, relevant,
and limited to what is necessary in relation to the
purposes for which they are processed.
- Processing shall be undertaken in a manner that ensures
appropriate privacy and security safeguards .165
To reiterate, Colliers’s act of collecting the names of the owners and
guests was made for the purpose of verifying whether persons
entering and staying at the condominium property are occupants,
tenants, or guests. This stems from its duty as property manager to
implement the instructions of the BOD to monitor access and entry
for the safety and security of the unit owners. Since it is a standard
security practice when individuals enter private buildings and
property, the processing does not exceed the data subjects’
reasonable expectation of privacy. Moreover, the collected
information enables Colliers to identify unauthorized individuals
and enforce rules and regulations effectively. Maintaining a record of
who enters the property is necessary to maintain security and sa fety,
and for proper management of the condominium and its facilities .
Further, the dis closure of the CCTV footage during the meeting was
done to aid the ongoing administrative investigation being
conducted by URCC , which stemmed from the accusations made by
MIP himself against the staff members of Colliers. It was aligned with
the legitimate business objective sought by both Colliers staff and
property owners, which was to verify the accuracy of MIP ‘s claims
against them.
As such, the disclosure did not contravene the principle of fairness
because it was shown to the homeowners to whom the mass email
was sent and who themselves requested for it to be shown.
The interest of Colliers in protecting its managed property and in
addressing the accusations made by MIP about its employees is
legitimate and does not override the fundamental freedoms of the
data subjects, including MIP . This legitimate interest does not, in any
way, disregard MIP ’s fundamental rights and freedoms of as a data
subject.
Given the foregoing , Colliers was able to clearly establish its
legitimate interest in processing by collecting the personal
information of tenants and visitors, and by disclosing the CCTV
footage showing MIP . Both acts of processing were lawfully
conducted and necessary , and neither overrode the fundamental
rights and freedoms of the data subjects .
In sum, for processing based on Section 12 (f) of the DPA to apply,
the PIC must comply with three (3) requisites. The first requisite
focuses on what the PIC is accomplishing and the legitimate purpose
that has been communicated to the data subject. The second requisite
refers to how the PIC is accomplishing the legitimate interest, such as
the means chosen or the specific processing activity undertaken,
which should be necessary and lawful. Finally, the third requisite
considers the effect of accomplishing the legitimate interest, such that
it does not override the fundamental rights and freedoms of the data
subjects.
In this case, Colliers complied with all three requisites for processing
based on legitimate interest. It clearly established the legitimate
interest in collecting personal information through the Move -In
Forms and in disclosing the CCTV footage showing MIP . The
processing was lawfully conducted and were necessary to maintain
security of the building and to address the claims made by MIP .
Further, its acts did not go beyond what could be reasonably
expected by the data subjects, including MIP , when they entered and
utilized the premises of the URCC condominium.
Given that all three requisites for processing based on legitimate
interest under Section 12 (f) are present, Colliers processed personal
information with lawful basis.
II. Colliers did not violate Section s 25 and 32 of the DPA
Colliers is n either liable for Section 25 of the DPA on Unauthorized
Processing of Personal and Sensitive Personal Information nor
Section 32 of the DPA on Unauthorized Disclosure.
A. Colliers is not liable under Section 25 of the DPA
(Unauthorized Processing ).
Section 25 of the DPA on Unauthorized Processing of Personal and
Sensitive Personal Information provides: NPC 19-1411
MIP v. Colliers International Philippines
Section 25. Unauthorized Processing of Personal Information and
Sensitive Personal Information. (a) The unauthorized processing
of personal information shall be penalized by imprisonment
ranging from one (1) year to three (3) years and a fine of not less
than Five hundred thousand pesos (Php500,000.00) but not
more than Two million pesos (Php2,000,000.00) shall be
imposed on persons who process personal information without
the consent of the data subject, or without being authorized
under this Act or any existing law.
(b) The unauthorized processing of personal sensitive
information shall be penalized by imprisonment ranging from
three (3) years to six (6) years and a fine of not less than Five
hundred thousand pesos (Php500,000.00) but not more than
Four million pesos (Php4,000,000.00) shall be imposed on
persons who process personal information without the consent
of the data subject, or without being authorized under this Act
or any existing law. 166
Under Section 25, a PIC or PIP may be held liable for Unauthorized
Processing of Personal Information and Sensitive Personal
Information if it processes personal data without consent or lawful
basis under the DPA or any applicable law. The elements for
Unauthorized Processing are :
-
The perpetrator processed the information of the data subject;
-
The information processed was personal information or
sensitive personal information;
- The processing was done without the consent of the data
subject, or without being authorized under the DPA or any
existing law. 167
In this case, Colliers processed the personal information of the
owners and guests of the condominium property when it asked for
proof of their identity. Colliers also processed MIP ’s personal
information when it recorded and disclosed the CCTV footage of him
during the special meeting. Thus, the first and second elements are
present.
MIP v. Colliers International Philippines
As previously established , however, the processing was authorized
under the DPA. Collier s’ act of process ing the personal information
of its owners , including MIP , and their guests was made pursuant to
a legitimate interest under Section 12 (f) . As such, the third requisite
of Section 25 of the DPA is absent .
B. Colliers is not liable under Section 32 of the DPA
(Unauthorized Disclosure ).
Section 32 of the DPA on Unauthorized Disclosure provides:
Section. 32. Unauthorized Disclosure. (a) Any personal
information controller or personal information processor or any
of its officials, employees or agents, who discloses to a third
party personal information not covered by the immediately
preceding section without the consent of the data subject, shall
be subject to imprisonment ranging from one (1) year to three
(3) years and a fine of not less than Five hundred thousand
pesos (Php500,000.00) but not more than One million pesos
(Php1,000,000.00).
(b) Any personal information controller or personal
information processor or any of its officials, employees or
agents, who discloses to a third party sensitive personal
information not covered by the immediately preceding section
without the consent of the data subject, shall be subject to
imprisonment ranging from three (3) years to five (5) years and
a fine of not less than Five hundred thousand pesos
(Php500,000.00) but not more than Two million pesos
(Php2,000,000.00). 168
Section 32 makes a reference to the “immediately preceding section”
or Section 31 on Malicious Disclosure, which reads:
Section 31. Malicious Disclosure. – Any personal information
controller or personal information processor or any of its
officials, employees or agents, who, with malice or in bad faith,
discloses unwarranted or false information relative to any
personal information or personal sensitive information obtained
by him or her, shall be subject to imprisonment ranging from
one (1) year and six (6) months to five (5) years and a fine of not
less than Five hundred thousand pesos (Php500,000.00) but not
more than One million pesos (Php1,000,000.00) .169
MIP v. Colliers International Philippines
The following requisites must concur for there to be a finding of
malicious disclosure:
- The perpetrator is a personal information controller or
personal information processor or any of its officials,
employees, or agents;
- The perpetrator disclosed personal or sensitive personal
information;
-
The disclosure was with malice or in bad faith; and
-
The disclosed information relates to unwarranted or false
information. 170
A PIC or PIP may be held liable under Section 31 for Malicious
Disclosure if it discloses unwarranted or false personal information or
sensitive personal information with malice or in bad faith. 171 The
absence of either the third or fourth requisite, or both requisites
distinguishes Malicious Disclosure and Unauthorized Disclosure.
In this case, the disclosure does not fall under Malicious Disclosure
since the third and fourth requisites are absent. Since both requisites
are absent , the disclosure falls under Section 32 on Unauthorized
Disclosure. 172
There was no showing that the collection of personal information of
owners and tenants through the Move -In Form and the disclosure of
the CCTV footage was malicious or done in bad faith. As previously
discussed, the collection of personal information was to maintain
security of the premises. The disclosure was made during a special
meeting in response to allegations raised by MIP himself, and the
footage was directly relevant to clarifying the facts of the matter.
Moreover, the information was not unwarranted or false as the CCTV
footage recorded events that took place without fabrication. Thus, t he
disclosure was not malicious nor done in bad faith and the
information disclosed is not unwarranted or false information.
Given that the disclosure was not malicious nor done in bad faith and
the information disclosed is not unwarranted or false information , the
disclosure does not fall under Section 31 on Malicious Disclosure.
C. Processing without a lawful basis is a common requisite of
Section 25 and Section 32 of the DPA.
As previously established, there was a lawful basis for processing the
CCTV footage under Section 12 (f) of the DPA.
Processing personal information without a lawful basis is a common
requisite of Unauthorized Processing under Section 25 and
Unauthorized Disclosure under Section 32 of the DPA.
In determining whether Unauthorized Processing occurred, the
following requisites should be present:
-
The perpetrator processed the information of the data subject;
-
The information processed was personal information or
sensitive personal information; and
- The processing was done without the consent of the data
subject, or without being authorized under the DPA or any
existing law. 173
Since the processing had lawful basis under Section 12 (f) of the DPA
and was thus authorized under the DPA , Colliers is not liable under
Section 25 of the DPA on Unauthorized Processing of Personal or
Sensitive Personal Information for failure to fulfill the third requisite
In determining whether Unauthorized Disclosure occurred, the
following requisites should be present:
- The perpetrator is a personal information controller or
personal information processor;
-
The perpetrator disclosed information;
-
The information relates to personal or sensitive personal
information;
- The perpetrator disclosed the personal or sensitive personal
information to a third party;
- The disclosure was without any of the lawful basis for
processing, consent or otherwise, under Sections 12 and 13
of the DPA; and
- The disclosure is neither malicious nor done in bad faith or
the information disclosed is not unwarranted or false
information. 174
Since there is lawful basis for Colliers’ act of disclosure, as previous ly
established, the fifth requisite is absent. Hence, Colliers is not liable
under Section 32 of the DPA on Unauthorized Disclosure.
To summarize, the third requisite of Section 25 of the DPA
(Unauthorized Processing) requires that the processing be without
the consent of the data subject or without authority under the DPA or
any existing law. 175 Meanwhile, the fifth requisite of Section 32 of the DPA (Unauthorized Disclosure) provides that the processing of the
information was without any of the lawful basis for processing,
consent or otherwise, under Sections 12 (f) of the DPA. 176 Since there
is lawful basis for processing, then the third requisite of Section 25 of the DPA and the fifth requisite of Section 32 of the DPA are not
present.
In this case, Colliers complied with all three requisites for processing
based on legitimate interest. It clearly established the legitimate
interest in processing the personal information of the owners and
their guests and the disclosure of the CCTV footage during the
special meeting . Collecting the personal information of both owners
and guests pursuant to its objective of maintaining security on its
premises is a legitimate interest. Meanwhile, t he disclosure of the
footage was lawfully conducted and was necessary to verify the
accuracy of the claims made by MIP .
Given the foregoing, the Commission cannot find Colliers, RDR , EDS ,
JSA , and ALA liable for violating Section 25 (Unauthorized
Processing) and Section 32 (Unauthorized Disclosure) of the DPA.
Consequently, they are also not liable under Section 33 (Combination or Series of Acts) of the DPA.
WHEREFORE, premises considered, this Commission resolves that
the instant Complaint filed by MIP against Colliers International
Philippines (Colliers) represented by RDR, EDS, JSA, and ALA is
hereby DISMISSED for lack of merit.
This is without prejudice to the filing of appropriate civil, criminal or
administrative cases against Colliers, before any other forum or
tribunal, if any.
SO ORDERED.
City of Pasay, Philippines.
12 March 202 4.
Sgd.
LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner
WE CONCUR:
Sgd.
JOHN HENRY D. NAGA
Privacy Commissioner
Sgd.
NERISSA N. DE JESUS
Deputy Privacy Commissioner
Copy furnished:
MIP
Complainant NPC 19-1411
MIP v. Colliers International Philippines
SIU RINEN LATRAS LAW FIRM
Counsel for Respondent
COMPLAINTS AND INVESTIGATION DIVISION
ENFORCEMENT DIVISION
GENERAL RECORDS UNIT