NPC Issuance Wiki

NPC 19-1429: AMS v. CBB

Issued Decision

Decision Text

AMS

Complainant,

-versus-

CBB

Respondent.

x------------------------------------------------------x

NAGA, P.C.;

Before the Commission is an Affidavit of Complaint dated 03 October 20191 filed by Complainant AMS (Complainant) against Respondent CBB (Respondent) for violation of the Data Privacy Act of 20122 (DPA).

Facts

In her Affidavit of Complaint dated 03 October 2019, Complainant avers that on 01 September 2019, “upon arriving home at around 9pm,” she noticed a “white blinding light” coming from the Respondent’s residence where Complainant alleged that there was a CCTV [Closed Circuit Television] camera and directly pointing to their gate and front porch.3

The Complainant continued that “[t]he next morning, we noticed that the CCTV camera was already pointing towards our garage with the blinding white light still on. And upon close scrutiny, the CCTV turned out to be 360-degree PTZ (Pan/Tilt/Zoom) camera.”4

Complainant also alleged that “[i]n the next couple of days, we observed that the CCTV was pre-set to rotate from their front porch to their garage doing a 24-hour surveillance of their house from wall-to-wall deliberately and purposely intended to monitor all our activities and affairs within our private premises.”5

The Complainant prayed “to instruct the Respondent to remove the revolving CCTV camera that they have installed in front of their residence and transfer it back where our property will not be viewed from any angle.”6

In her Affidavit of Complaint were six photos taken during the daytime and nighttime, which show the residence of the Respondent and the installed CCTV camera.7

On 24 October 2019, the Commission, through its Complaints and Investigation Division (CID), issued an Order to Confer for Discovery requiring the parties to appear before the Commission on 27 November 2019.8

On 27 November 2019, the parties executed an Application for Mediation.9 An Order to Mediate was then issued by the CID suspending the proceedings for sixty (60) days for the conduct of mediation proceedings.10

On 05 December 2019, the Commission issued a Notice of Non-Settlement of Dispute stating that the parties are unable to reach a settlement.11

The Public Attorney’s Office entered their appearance as counsel for the Complainant on 15 June 2020.12

On 17 June 2020, the Complainant submitted a Petition (for Issuance of Temporary Ban and/or Preliminary Injunction Order) dated 15 June 2020, wherein the Complainant averred:

It would appear, however, that despite the pending case filed before this Honorable Office, respondent CBB continues to violate the law as the Closed Circuit Television (CCTV) remains to be deliberately fixed and installed and was pre-set to rotate from the [sic] herein petitioner’s porch to her garage, doing 24-hour surveillance of her house, from wall-to-wall, deliberately and purposely intended to monitor all her activities and affairs within her private premises.13

The Complainant continues that Respondent should be temporarily restrained from using the CCTV against the Complainant’s private premises since it is violative of Section 25 of the DPA on unauthorized processing of personal and sensitive personal information.14 She reiterated that the CCTV is a 360-degree PTZ camera directly overlooking their property, intended to do a 24-hour surveillance of the affairs, activities and other personal information of her and her family.15

Complainant persists that she is entitled to the issuance of a preliminary injunctive relief because the Respondent is doing an act in violation of her and her family’s rights, and that if the act of the Respondent would be allowed to continue, it would render any judgment of the Commission ineffectual.16

Complainant also stated that the Temporary Ban Order is urgent and pressing because the Respondent’s continuous surveillance on the persons and property of the Complainant would result in irreparable damage on her part.17 She submits that even if the relief prayed for would be granted, Respondent would not suffer any material damage, and prays further that she be exempted from the payment of the bond required under the Rules of Court.18 In support of her plea for exemption from the payment of bond, she manifested that she belongs to the indigent families of her community, who was merely protecting her rights and interest through the Public Attorney’s Office.19

The Complainant prays that an ex-parte Temporary Ban Order/Writ of Preliminary Injunction be issued prohibiting the Respondent from the continuous operation of the CCTV facing their private premises, and that after hearing, judgment be rendered making the temporary ban/injunctive relief permanent.20

The Complainant again attached nine photos taken during the daytime and nighttime, showing the Respondent’s residence with the subject CCTV camera from different angles.21

An Order for Resumption of Discovery Conference dated 27 January 2021 was issued by the CID requiring the parties to appear before the Commission on 18 March 2021.22 On 09 February 2021, Complainant executed her Consent to E-Hearing.23 On 18 March 2021, an order was issued cancelling and resetting the resumption of discovery conference to 06 April 2021.24

On 05 April 2021, an Order to File Verified Comment was issued by the CID ordering the cancellation of the resumption of discovery conference set on 06 April 2021 in view of the extension of the Enhanced Community Quarantine imposed in the National Capital Region and nearby provinces until 11 April 2021.25 In the same Order, the CID required Respondent to file her verified comment.26

An Order to Appear for Preliminary Conference dated 12 May 2021 was then issued by the CID ordering the parties to appear virtually before the Commission on 26 May 2021 and 09 June 2021.27 On 26 May 2021, both parties appeared with their respective counsel, submitted their respective issues, stipulated that they are neighbors in Barangay Sun Valley, Parañaque City, and were required to submit their respective position papers regarding the Complainant’s application for temporary ban on the use and operation of Respondent’s CCTV.28

The Complainant filed a Motion to Defer Submission of Position Paper (On the Petition for Temporary Ban in Case No. XXXXX) dated 11 June 2021, wherein she averred that the preliminary conference for NPC Case No. XXXXX ensued last 09 June 2021 and both parties manifested their intention for mediation proceedings.29 Complainant posited that it would be prudent and practical that no pleadings open for argumentation be filed pending the proceedings for alternative dispute resolution.30 Hence, she prays that the Commission defer the submission of position papers in this case pending mediation proceedings in Case No. XXXXX.31

On 20 August 2021, the CID issued an Order (Resuming the Submission of Position Paper) requiring the parties to submit position papers on whether the application for temporary ban on the processing of Complainant’s personal information against Respondent should be granted.32

A Motion for Extension of Time to File Position Paper (Re: Application for Temporary Ban on Processing of Personal Data) dated 21 September 2021 was then filed by the Respondent reasoning out that the operation of offices and mobility of persons in the country has been affected by the COVID-19 Pandemic including the parties, hence the motion.33 Said motion was partially granted by the CID in its Resolution on even date.34

In her Position Paper (Application for Temporary Ban on Processing of Personal Data) dated 08 October 2021, the Respondent alleged that sometime on 25 April 2019, while a separate case between the Complainant and the Respondent was being mediated at the Lupon ng Tagapamayapa, Brgy. Sun Valley, Parañaque City, the Complainant showed a copy of a CCTV footage containing a video of the Complainant’s mother and the Respondent having a discussion regarding the nuisance created by the incessant noise emanating from several dogs owned by the Complainant’s family.35 She further stated that the said CCTV footage was taken some time on 23 December 2017 between 3:00 to 4:30 in the afternoon by Complainant’s CCTV camera.36

Respondent alleged that she was shocked about Complainant’s act of prying into the former’s privacy and was capturing what was going on inside her property in violation of existing laws.37 She also averred that there had been several occasions of disagreement between the parties and the Respondent felt distressed and was worried that the Complainant might be up to something.38

Respondent continued that “[a]fraid [for] her and her family’s security, [R]espondent then inquired about how to protect herself including the installation of CCTV camera to protect her, her family and her home.”39 She stated that “[u]pon the recommendation of a supplier, a CCTV was installed at her house sometime in September 2019.”40 Respondent also added that “[d]uring the configuration, the CCTV was placed such that it can cover the whole front of [R]espondent’s property.”41

The Respondent was also told by the CCTV provider that if her intention is to monitor those inside her house, since technically her house’s configuration on the sides and the back are basically on the walls, cameras should also be installed on the said places.42 Considering that the intended purpose of installing the CCTV is to protect her, her family and their property from unscrupulous individuals, the Respondent elected to install just one camera.43

Respondent stated that she noticed a lot of establishments posted CCTV notices and opted to post one that notified affected individuals that a CCTV is installed in her house.44 Also, upon being informed of her responsibilities as an owner of a CCTV, the Respondent drafted her own CCTV Policy.45 She attached a photograph showing the front gate of their residence with the attached CCTV Notice.46 Likewise part of the submission was the CCTV Policy, which states the purpose, overview, scope, the policy and document control.47

The Respondent argues that the application for temporary ban on processing of personal data should be denied since the Complainant is not an indigent and fails to post the necessary bond in the guise of being an indigent litigant.48 Further, she counters that aside from the bare allegations and the photograph of the placement of the camera, the Complainant failed to provide substantial evidence to prove her claim that the CCTV camera of the Respondent is capturing images inside her property.49 As proof, she attached a still image of the focus of the CCTV footage.50

Since the CCTV camera was installed for the protection of vitally important interest including the security of her person, family and properties, the Respondent claimed that the processing has legitimate purpose and it is still necessary that a lawful purpose be determined considering that her CCTV is placed in front of her house and may capture footages outside the provided exception.51

Further, the Respondent counters that the collection of the CCTV footage abides with the proportionality principle since the images or footages captured in the camera does not undergo further processing and are also deleted once the purpose for the collection is accomplished.52 She also posted a notice in a very conspicuous and prominent area within the premises of her property and is readily visible providing information to the public that there is a CCTV camera in operation in a clear, plain, and concise language.53 She stated also having a CCTV Policy.54

Also, Respondent averred that the placement of the CCTV and its view were carefully considered as it was configured in a way that it shall only capture areas where there is less expectation of privacy such as the property itself of the Respondent, and due to technical and physical constraints, a portion of the public space, which is the road.55 The Respondent prays that the Petition for Issuance of Temporary Ban on Processing be denied.56

In her Position Paper (For the Petitioner) dated 13 October 2021, the Complainant reiterated her factual and legal arguments contained in her Petition (for Issuance of Temporary Ban and/or Preliminary Injunction Order) dated 15 June 2020.57 She insists that the Respondent’s CCTV is beyond her own private property, deliberately fixed, installed and pre-set to rotate from the Complainant’s private porch to her garage, doing a 24-hour surveillance of Complainant’s house, from wall-to-wall.58 As a personal information controller (PIC), the Respondent should have informed the Complainant that the personal property of the latter will be monitored and should have asked for Complainant’s consent before proceeding with the collection of personal data before placing the CCTV and started collecting Complainant’s personal data.59

The Complainant added that prayer for the order of temporary ban against the Respondent prohibiting her from the continuous operation of the CCTV is proper as hinged on her entitlement to privacy in her home since it is her private property and she is allowed to exclude others access therefrom, in any form.60 The failure of the Respondent to respect the privacy of the home of the Complainant entitles the latter to protection.61 Thus, Complainant prays that Temporary Ban Order be issued against Respondent regarding the operation of the CCTV, and thereafter, making the temporary ban permanent.62

On 18 October 2021, the Complainant filed an Ex-Parte Motion to Attach the Supposed Annexes to the Position Paper dated 07 October 2021 stating that she inadvertently failed to attach the supposed Annexes to the said Position Paper and asks for the indulgence of the Commission to allow her “to attach the Annexes inadvertently unclipped to the Position Paper.”63 The CID granted the Motion in its Resolution on 20 August 2021.64

In the Order (on the Application for Temporary Ban) dated 16 November 2021, the CID denied the Complainant’s Petition for Temporary Ban and/or Writ of Preliminary Injunction due to the Complainant’s failure to adduce any actual evidence that her personal information or sensitive personal information is being processed by the Respondent and that there was no actual evidence that would show the privacy breach the Complainant is claiming was present that could warrant the injunctive relief she prayed for.65 The dispositive portion of the Order also directed the parties to submit their respective memoranda, and ordered the Respondent to produce before the Commission the hard drive directly connected to the CCTV unit that was used to store the footages and recordings therefrom, among others.66

In her Memorandum (For the Petitioner) dated 29 November 2021, Complainant admitted that there is no CCTV coverage that she could legally obtain from the time of the installation of the high-technology Pan/Tilt/Zoom CCTV by the Respondent, which shows that she or any of her family was prying into Complainant’s residence.67 However, she stated that as can be gleaned from the very image submitted by the Respondent to the Commission, the CCTV installed is definitely not to safeguard Respondent’s property since the coverage thereof within her own premises is covered by a tree, hence, effectively preventing it from “safeguarding” her home.68

Complainant also alleged that pictures taken on different times and date would show that the camera is focused on her house.69 Pictures of Complainant’s residence would show that from the perspective of Respondent’s house alone, the camera set up by the latter could easily observe unto Complainant’s home.70

In addition, the Complainant alleged that for years, the Respondent has been harassing her and her family as proven by numerous witnesses and complaints filed before the proper bodies.71 To get back at the Complainant, the Respondent filed a case for abatement of nuisance pending before Branch 195, Regional Trial Court of Parañaque City.72

Complainant claims that prying into the privacy of another’s residence is an actionable act citing Section 12 of the DPA.73 She stated that none of the conditions under the said section is present in the case since neither the Complainant nor her family has given consent and no other lawful criteria for processing was present.74

Complainant also claimed that under NPC Advisory No. 2020-04, the scope of Respondent’s CCTV is beyond her own private property and reiterated that it is deliberately fixed, installed and is pre-set to rotate from Complainant’s private porch to her garage, doing a 24-hour surveillance of her house, from wall-to-wall.75 Respondent, as a PIC, before placing her CCTV and collecting Complainant’s personal data, should have informed the latter that their personal property will be monitored and should have asked for their consent before proceeding with the collection of personal data.76

The Complainant also claimed that the Respondent abused her right when she fixed the CCTV high-technology device in a manner that would monitor another person’s life and residence to the detriment of her rights.77 She rehashed her entitlement to the right to privacy and prays that the Commission render a judgment in her favor as follows:

  1. An order be issued prohibiting Respondent CBB and all persons claiming rights and authority under her from setting up Closed-Circuit Television towards complainant’s private premises.
  2. Find the Respondent liable for violation of the Data Privacy Act.
  3. Order the Respondent to pay the complainant damages amounting to one hundred thousand pesos and to pay the costs suit.

On 01 December 2021, the CID issued the Order (Granting the Request of the Complainant) for a copy of her complaint that she filed last 03 October 2019 for her reference.78

In her Memorandum (For the Respondent) dated 02 December 2021, the Respondent adopts and incorporates the statement of facts as stated in her Position Paper in the Petition for Temporary Ban and/or Issuance of Writ of Preliminary Injunction.79 Specifically, she highlighted that aside from bare allegations and numerous photographs of the placement of the camera, the Complainant failed to adduce actual evidence to prove her claim that the CCTV camera of the Respondent is capturing images inside her property and neither Complainant’s personal information nor sensitive personal information is being processed by the Respondent.80 She specified also that the right to privacy is not absolute and Complainant’s right has not been violated since the Respondent did not record nor intend to record any images within the premises of the Complainant’s property but only those images “that are allowed by laws and regulations.”81

Finally, the Respondent admits that her CCTV footages may extend beyond her property but only up to the road and considering that the area is public, the reasonableness of expectation of privacy of images captured by the CCTV camera is also limited.82 She added that her compliance to the minimum requirements of regulations provides basis and allows the lawful processing of images, if any.83 She therefore prays that the instant Complaint be dismissed for lack of merit and that the Complainant be ordered to pay the cost of suit.84

On the same date that her Memorandum was filed, the Respondent also filed the Compliance (To Order dated 16 November 2021) submitting the storage device directly connected to the CCTV Unit.85 Respondent averred that the storage device contained eight days of CCTV footage (from 25 November 2021 to 02 December 2021) showing the Respondent’s yard, including a tree, bush, gate, parts of a wall, garage, and the street in front of the house.86 The footage was recorded from a fixed-angle camera that did not pan, tilt, or zoom automatically.87 Upon perusal, the footage primarily covered household members and, incidentally, a small portion of the adjacent road, where some people and vehicles could be seen.88 The public road and those on it were not the CCTV camera’s focus.89

Issues

I. Whether the Complainant was able to substantiate her claim that Respondent’s CCTV Camera captured images or footages of the interior of Complainant’s property.

II. Whether Respondent is liable under Section 25 of the DPA.

Discussion

I. Complainant failed to substantiate her claim that Respondent’s CCTV Camera captured images or footages of the interior of Complainant’s property by substantial evidence.

At the onset, Complainant prayed for the removal of the 360-degree PTZ CCTV camera that the Respondent installed in front of their residence and to transfer it where their property will not be viewed from any angle.90 Thereafter, in her Petition (for Issuance of Temporary Ban and/or Preliminary Injunction Order), the Complainant averred that Respondent continued to violate the law as the CCTV remains to be deliberately fixed and installed and was pre-set to rotate from her porch to her garage doing 24-hour surveillance of their house, from wall-to-wall, deliberately and purposely intended to monitor all their activities and affairs within her private premises.91

The Revised Rules of Evidence, as amended, provides that “[i]n cases filed before administrative or quasi-judicial bodies, a fact may be deemed established if it is supported by substantial evidence, or that amount of relevant evidence which a reasonable mind might accept as adequate to justify a conclusion.”92

The Complainant must prove that Respondent has violated her data subject rights under the DPA and that the CCTV is doing 24-hour surveillance of their house. Mere allegation is not evidence, and he who alleges has the burden of proving his allegation with the requisite quantum of evidence.93

Complainant presented as evidence several photos showing the house of the Respondent that was taken during nighttime and during the day.94 From the perspective on which some nighttime photos were taken, a visible white light seems to emit where the subject CCTV camera is placed as if it was directed to the Complainant’s residence.95 This similar description was shown on the subsequent photos submitted by the Complainant as part of her Petition for Issuance of Temporary Ban and/or Preliminary Injunction Order96 as well as the photos attached as part of her Memorandum dated 29 November 2021.97

It is worthy to note that aside from the bare allegations and the photographs of the placement of the camera, the Complainant failed to provide substantial evidence to prove her claim that the CCTV camera of the Respondent is capturing images inside her property.98 In view of the basic rule that mere allegation is not evidence and is not equivalent to proof, the allegation is essentially self-serving and devoid of any evidentiary weight.99

On the other hand, Respondent submitted as proof a still image of the focus of her CCTV footage.100 She also produced the hard drive directly connected to the CCTV unit that was used to store the footages and recordings therefrom.101 As will be discussed later on, the Commission holds that the evidence presented by the Respondent is reasonable and adequate to support a conclusion in her favor.

Hence, the Complainant failed to substantiate her claim that Respondent’s CCTV Camera captured images or footages of the interior of Complainant’s property by substantial evidence. Her prayer for the removal of Respondent’s, therefore, is without substantial basis.

II. Respondent is not liable under Section 25 of the DPA

Complainant argued that Respondent should be temporarily restrained from using the CCTV against the Complainant’s private premises since it is violative of Section 25 of the DPA on unauthorized processing of personal and sensitive personal information.102

The Commission rules that Respondent cannot be held liable for unauthorized processing.

Section 25 of the DPA provides that:

SEC. 25. Unauthorized Processing of Personal Information and Sensitive Personal Information. – (a) The unauthorized processing of personal information shall be penalized by imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00) shall be imposed on persons who process personal information without the consent of the data subject, or without being authorized under this Act or any existing law.103

As laid down in the case of AQM v. PIT, NPT, and CNB, in determining whether Unauthorized Processing occurred, three elements must be established with substantial evidence, to wit:

  1. The perpetrator processed the information of the data subject;
  2. The information processed was personal information or sensitive personal information; and
  3. The processing was done without the consent of the data subject, or without being authorized under the DPA or any existing law.104

Anent the first element, Section 3 (j) of the DPA defines processing as “any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.”105 While Section 3 (c) of the DPA defines data subject as “an individual whose personal information is processed.”106

In this case, the Complainant presented photos that were taken during the daytime and nighttime, which show the Respondent’s house from different angles with the CCTV camera as the subject.107 Further, the Commission notes that Respondent submitted a storage device directly connected to her CCTV Unit.108 The storage device contained CCTV footages recorded by Respondent’s CCTV camera.109 The footage primarily covered household members and, incidentally, a small portion of the adjacent road, where some people and vehicles could be seen.110

From the images and footages presented, it may be concluded that Respondent is processing the data of the data subjects who happen to be recorded by Respondent’s operation of the CCTV unit. As such, the first element in this case is present.

As to the second element, Section 3 (g) of the DPA defines personal information as:

(g) Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.111

The images and footages captured with the use of the CCTV cameras are considered personal information if the same identity of the individual is apparent or can be reasonably and directly ascertained, or when put together with other information would directly and certainly identify an individual. Considering the contents of the CCTV footages as previously discussed, the Commission finds that the second element is also present.

However, the Commission rules that the last element for unauthorized processing is lacking because the Respondent had lawful basis to process under Sections 12 (f)112 of the DPA.

Section 12 (f) of the DPA allows for the processing of personal information when it is necessary for the purposes of the legitimate interests pursued by the PIC:

Section 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

x x x

(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.70

(Emphasis supplied.)

In the case of MAF vs Shopee Philippines, Inc., the Commission elaborated on the conditions of processing based on legitimate interest:

Processing based on legitimate interest requires the fulfillment of the following conditions: (1) the legitimate interest is established; (2) the processing is necessary to fulfill the legitimate interest that is established; and (3) the interest is legitimate or lawful and it does not override fundamental rights and freedoms of data subjects.113

Anent the first requisite, Respondent has shown a clear and defined interest on why she set up the CCTV camera. It must be recalled that Respondent’s interest in installing the CCTV is to protect her, her family, and their property from unscrupulous individuals.114 The legitimate interest is, therefore, established.

As to the second requisite, the Commission finds that the same is present. In order to accomplish the purpose of securing one’s family’s security without processing beyond the limitations of the law, the location and placement of the CCTV must be taken into consideration. Notable is NPC Advisory No. 2020-04, which provides guidelines on the location and placement of the CCTV system, viz:

SECTION 4. Guidelines. — The processing of personal data in CCTV systems shall be subject to the following guidelines:

x x x

E. Location and placement. To ensure that CCTV systems capture footages in a manner consistent with the DPA, the location and angles of the cameras must be carefully considered. CCTVs shall only be used to monitor the intended spaces, taking into consideration the purpose for monitoring the same.

The use of CCTVs in areas where individuals have a heightened expectation of privacy (i.e. fitting rooms, rest rooms, toilets, lactation or breastfeeding rooms, and other similar places) is prohibited.115

Respondent stated that the location and placement of the CCTV were carefully considered as they were configured in such a way that the CCTV shall only capture areas where there is less expectation of privacy such as the property of the Respondent, and due to technical and physical constraints, a portion of the public road.116 As proof, Respondent attached a still image of the focus of the CCTV footage.117 Respondent also submitted a storage device directly connected to the CCTV Unit containing footages of such unit.118 Based on the Commission’s observation of the video clips, Respondent’s CCTV camera captures only a part of the white fence of their residence, a small tree, a portion of their front yard/garden, and a slight portion of their road.119

Contrary to the allegations of the Complainant, Respondent’s CCTV camera did not tilt or reposition towards the direction of Complainant’s house. Neither did the CCTV camera pan, tilt nor zoom in the direction of other houses in the vicinity thereof. The manner of positioning of Respondent’s CCTV camera and the purpose of monitoring the slight portion of the road are consistent with the provisions of the DPA and Respondent’s intended purpose of security and protection of her person, her family, and their property.

Finally, as to the third requisite, the interest of Respondent to protect her, her family, and their property from unscrupulous individuals is lawful and does not override the fundamental rights and freedoms of data subjects. There is no substantial evidence presented to show that the fundamental rights and freedom of Complainant has been violated by Respondent’s use of her CCTV camera.

In sum, the operation by the Respondent of CCTV camera has all the requisites for processing based on legitimate interest. Hence, Respondent cannot be held liable under Section 25 of the DPA on unauthorized processing.

From the discussions above, it is established that the Respondent has a legitimate interest for the provision of a CCTV camera. The acts of installation and positioning of the CCTV camera, as well as the monitoring of the portion of the road are justified by Respondent’s need for security and personal safety. Having legitimate interest in processing, Respondent’s use of her CCTV camera is authorized under the DPA. Considering that not all the requisites of a violation of Section 25 are present, Respondent Serrano cannot be held liable for Unauthorized Processing.

WHEREFORE, premises considered, the Commission resolves that the complaint filed by AMS against CBB for violation of Section 25 of Data Privacy Act of 2012 is hereby DISMISSED for lack of merit.

This is without prejudice to the filing of the appropriate civil, criminal, or administrative cases against the Respondent before any other forum or tribunal, if any.

SO ORDERED.

City of Pasay, Philippines. 04 September 2024.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

AMS Complainant

CBB Respondent

MC Counsel for the Complainant

KB Counsel for the Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Affidavit of Complaint dated 03 October 2019 of AMS. ↩

  2. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173. ↩

  3. Affidavit of Complaint dated 03 October 2019 of AMS, ¶ 1. ↩

  4. Id. ↩

  5. Id., ¶ 3. ↩

  6. Id., ¶ 5. ↩

  7. Affidavit of Complaint dated 03 October 2019 of AMS, at p. 2. ↩

  8. AMS v. CBB, NPC 19-1429, Order to Confer for Discovery dated 24 October 2019. ↩

  9. Application for Mediation dated 27 November 2019 of AMS and CBB. ↩

  10. AMS v. CBB, NPC 19-1429, Order to Mediate dated 27 November 2019. ↩

  11. AMS v. CBB, NPC 19-1429, Notice of Non-Settlement of Dispute dated 05 December 2019. ↩

  12. Entry of Appearance dated 15 June 2020 of AMS. ↩

  13. Petition (for Issuance of Temporary Ban and/or Preliminary Injunction Order) dated 15 June 2020 of AMS, ¶ 6. ↩

  14. Id., ¶ 7. ↩

  15. Id., ¶ 8. ↩

  16. Id., ¶ 10. ↩

  17. Petition (for Issuance of Temporary Ban and/or Preliminary Injunction Order) dated 15 June 2020 of AMS, ¶ 12. ↩

  18. Id., ¶ 13. ↩

  19. Id., ¶ 14. ↩

  20. Id., at p. 5. ↩

  21. Petition (for Issuance of Temporary Ban and/or Preliminary Injunction Order) dated 15 June 2020 of AMS, Annex B, at p. 8. ↩

  22. AMS v. CBB, NPC 19-1429, Order for Resumption of Discovery Conference dated 27 January 2021. ↩

  23. Consent to E-Hearing dated 09 February 2021 of AMS. ↩

  24. AMS v. CBB, NPC 19-1429, Order dated 18 March 2021. ↩

  25. AMS v. CBB, NPC 19-1429, Order to File Verified Comment dated 05 April 2021. ↩

  26. Id. ↩

  27. AMS v. CBB, NPC 19-1429, Order to Appear for Preliminary Conference dated 12 May 2021. ↩

  28. AMS v. CBB, NPC 19-1429, Order (to Submit Position Paper) dated 26 May 2021. ↩

  29. Motion to Defer Submission of Position Paper (On the Petition for Temporary Ban in Case No. 19-1429) dated 11 June 2021 of Arabella M. Serrano, ¶ 2. ↩

  30. Id., ¶ 3. ↩

  31. Id., at p. 2. ↩

  32. AMS v. CBB, NPC 19-1429, Order (Resuming the Submission of Position Paper) dated 20 August 2021. ↩

  33. Motion for Extension of Time to File Position Paper (Re: Application for Temporary Ban on Processing of Personal Data) dated 21 September 2021 of CBB, ¶ 4. ↩

  34. AMS v. CBB, NPC 19-1429, Resolution (on the Motion for Extension of Time to File Position Paper) dated 21 September 2021. ↩

  35. Position Paper (Application for Temporary Ban on Processing of Personal Data) dated 08 October 2021 of CBB, ¶ 21. ↩

  36. Id., ¶ 22. ↩

  37. Id., ¶ 26. ↩

  38. Id., ¶ 21. ↩

  39. Position Paper (Application for Temporary Ban on Processing of Personal Data) dated 08 October 2021 of CBB, ¶ 30. ↩

  40. Id., ¶ 31. ↩

  41. Id., ¶ 32. ↩

  42. Id., ¶ 33. ↩

  43. Position Paper (Application for Temporary Ban on Processing of Personal Data) dated 08 October 2021 of CBB, ¶ 34. ↩

  44. Id., ¶ 41. ↩

  45. Id., ¶ 43. ↩

  46. Id., Annex B, at p. 18. ↩

  47. Position Paper (Application for Temporary Ban on Processing of Personal Data) dated 08 October 2021 of CBB, at pp. 19-22. ↩

  48. Id., at p. 9. ↩

  49. Id., at p. 10. ↩

  50. Id., at p. 11. ↩

  51. Position Paper (Application for Temporary Ban on Processing of Personal Data) dated 08 October 2021 of CBB. ↩

  52. Id., at p. 12. ↩

  53. Id. ↩

  54. Id. ↩

  55. Position Paper (Application for Temporary Ban on Processing of Personal Data) dated 08 October 2021 of CBB, at pp. 12-13. ↩

  56. Id., at p. 14. ↩

  57. Position Paper (For the Petitioner) dated 08 October 2021 of AMS. ↩

  58. Id., ¶ 3.6. ↩

  59. Id., ¶ 3.8. ↩

  60. Id., ¶ 3.18. ↩

  61. Position Paper (For the Petitioner) dated 08 October 2021 of AMS, ¶ 3.18. ↩

  62. Id., at pp. 10-11. ↩

  63. Ex-Parte Motion to Attach the Supposed Annexes to the Position Paper dated 07 October 2021 dated 18 October 2021 of CBB, ¶¶ 2-3. ↩

  64. AMS v. CBB, NPC 19-1429, Resolution (On the Ex-Parte Motion to Attach the Supposed Annexes to the Position Paper dated 07 October 2021) dated 20 August 2021. ↩

  65. AMS v. CBB, NPC 19-1429, Order (On the Application for Temporary Ban) dated 16 November 2021, at p. 6. ↩

  66. Id. ↩

  67. Memorandum (For the Petitioner) dated 29 November 2021 of CBB, ¶ 13. ↩

  68. Id., ¶ 14. ↩

  69. Id., ¶ 15. ↩

  70. Id., ¶ 16. ↩ ↩2

  71. Memorandum (For the Petitioner) dated 29 November 2021 of CBB, ¶ 17. ↩

  72. Id., ¶ 18. ↩

  73. Id., ¶ 20. ↩

  74. Id., ¶ 21. ↩

  75. Memorandum (For the Petitioner) dated 29 November 2021 of CBB, ¶ 25. ↩

  76. Id., ¶ 27. ↩

  77. Id., ¶ 28. ↩

  78. AMS v. CBB, NPC 19-1429, Order (Granting the Request of the Complainant) dated 01 December 2021. ↩

  79. Memorandum (For the Respondent) dated 02 December 2021 of CBB, ¶ 21. ↩

  80. Id., at p. 8. ↩

  81. Id., at pp. 10-11. ↩

  82. Id., at p. 14. ↩

  83. Memorandum (For the Respondent) dated 02 December 2021 of CBB, at p. 14. ↩

  84. Id., at p. 17. ↩

  85. Compliance (To Order dated 16 November 2021) dated 02 December 2021 of CBB, ¶ 3. ↩

  86. Id. ↩

  87. Id. ↩

  88. Id. ↩

  89. Compliance (To Order dated 16 November 2021) dated 02 December 2021 of CBB. ↩

  90. Affidavit of Complaint dated 03 October 2019 of AMS, ¶ 5. ↩

  91. Petition (for Issuance of Temporary Ban and/or Preliminary Injunction Order) dated 15 June 2020 of AMS, ¶ 6. ↩

  92. Proposed Amendments to the Revised Rules on Evidence, A.M. No. 19-08-15-SC, rule 133, § 6 (2019). ↩

  93. Spouses Nilo Ramos and Eliadora Ramos v. Raul Obispo and Far East Bank and Trust Company, G.R. No. 193804, February 27, 2013. ↩

  94. Affidavit of Complaint dated 03 October 2019 of AMS, at p. 2. ↩

  95. Id. ↩

  96. Petition (for Issuance of Temporary Ban and/or Preliminary Injunction Order) dated 15 June 2020 of AMS, Annex B. ↩

  97. Memorandum (For the Petitioner) dated 29 November 2021 of CBB, Annexes A and series. ↩

  98. Position Paper (Application for Temporary Ban on Processing of Personal Data) dated 08 October 2021 of CBB, at p. 10. ↩

  99. Amalia S. Menez v. Status Maritime Corporation, G.R. No. 227523, August 29, 2018. ↩

  100. Position Paper (Application for Temporary Ban on Processing of Personal Data) dated 08 October 2021 of CBB, at p. 11. ↩

  101. Compliance (To Order dated 16 November 2021) dated 02 December 2021 of CBB. ↩

  102. Petition (for Issuance of Temporary Ban and/or Preliminary Injunction Order) dated 15 June 2020 of AMS, ¶ 7. ↩

  103. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter viii, § 25 (2012). ↩

  104. AQM v. PIT, NPT, and CNB, NPC 22-112, Decision dated 18 April 2024, at p. 9. ↩

  105. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter I, § 3 (j) (2012). ↩

  106. Id., chapter I, § 3 (c). ↩

  107. Petition (for Issuance of Temporary Ban and/or Preliminary Injunction Order) dated 15 June 2020 of AMS, Annex B. ↩

  108. Compliance (To Order dated 16 November 2021) dated 02 December 2021 of CBB, ¶ 3. ↩

  109. Id. ↩

  110. Compliance (To Order dated 16 November 2021) dated 02 December 2021 of CBB. ↩

  111. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter I, § 3 (g) (2012). ↩

  112. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter III, § 12 (f). ↩

  113. MAF v. Shopee Philippines, NPC 21-167, Decision dated 22 September 2022. ↩

  114. Position Paper (Application for Temporary Ban on Processing of Personal Data) dated 08 October 2021 of CBB, ¶ 34. ↩

  115. National Privacy Commission, Guidelines on the Use of Closed-Circuit Television (CCTV) Systems, NPC Advisory No. 2020-04, § 4 (E), 16 November 2020. ↩

  116. Position Paper (Application for Temporary Ban on Processing of Personal Data) dated 08 October 2021 of CBB, at p. 12. ↩

  117. Id., at p. 11. ↩

  118. Compliance (To Order dated 16 November 2021) dated 02 December 2021 of CBB, ¶ 3. ↩

  119. Id. ↩

Backlinks

  • No backlinks found