NPC Issuance Wiki

NPC 19-1805: CBB v. AMS

Issued Decision

Decision Text

CBB,

Complainant,

-versus-

AMS,

Respondent.

x----------------------------------------------------x

NAGA, P.C.:

Before this Commission is a Complaint filed by CBB (Complainant) against AMS (Respondent) for an alleged violation of Sections 25, 28, and 31 of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

On 05 December 2019, Complainant filed her Complaints-Assisted Form (CAF) dated 17 December 2019 with the National Privacy Commission (NPC), through its Complaints and Investigation Division (CID).1

In her CAF, Complainant alleged that she is filing the complaint to “MAKE A COUNTER-COMPLAINT TO [Respondent’s] COMPLAINT OF INTRUSION OF PRIVACY.”2

Complainant alleged that Respondent has two closed-circuit television (CCTV) cameras installed on the opposite side of her firewall pointing toward Complainant’s gate, garage, garden, and front door.3 The CCTV cameras have been in place for three years.4 Complainant alleged that Respondent’s CCTV cameras filmed Complainant talking to Respondent’s mother, and then walking from the front of Respondent’s gate towards Complainant’s garage and front door on 23 December 2017 from 3:00-4:30 p.m.5 Complainant alleges that she discovered this during the mediation proceedings before the Office of the Lupong Tagapamayapa last April or May 2019 when Respondent brought out a laptop showing the footage to Complainant and the Lupon.6

This prompted the Complainant to file a complaint against Respondent for violating the DPA.7

Complainant seeks damages for Respondent “constantly annoying and harassing us by [Respondent’s] actions,” the imposition of a fine of Ten Thousand Pesos (P10,000.00), as well as an Order for a Temporary Ban on the Processing of Personal Data on the ground that “this is the proper time and venue to explain [Complainant’s] side.”8

In support of her complaint, Complainant submitted photographs showing Complainant’s CCTV cameras, photographs of Complainant’s residence, photographs of Respondent’s CCTV camera, and photographs showing the path of Respondent from the CCTV footage of the Complainant on 23 December 2017 at around 3:00-4:30 p.m.9

On 05 February 2021, the Commission issued an Order to Confer for Discovery ordering the parties to appear before the Commission on 18 March 2021 at 9:00 AM to, among others, discuss whether discovery of information and of electronically stored information will be sought.10

On 18 March 2021, an Order was issued cancelling the discovery conference set on even date and resetting the same to 06 April 2021 at 9:30 AM.11

On 05 April 2021, an Order to File Verified Comment was issued cancelling the discovery conference set on 06 April 2021, and, instead, ordering Respondent to file a verified comment within fifteen (15) calendar days from receipt of the said Order.12

On 12 May 2021, an Order to Appear for Preliminary Conference was issued setting the same on 26 May 2021 at 1:00 PM and 09 June 2021 at 1:00 PM via Microsoft Teams.13

On 26 May 2021, an Order was issued noting Complainant and her counsel’s appearance during the preliminary conference and Complainant’s manifestation of willingness to mediate.14 The Commission also noted that Respondent’s counsel entered her appearance for this case during the preliminary conference for NPC Case No. XXXXX.15 Respondent’s counsel manifested that Respondent did not receive the email or invitation link for the preliminary conference.16 The parties were ordered to virtually appear for the next setting on 09 June 2021 at 1:00 PM.17

On 10 June 2021, an Order was issued noting the parties’ appearance during the preliminary conference held on 09 June 2021.18 During the conference, the parties identified the following issues:

  1. Whether or not the use of [R]espondent’s CCTV is compliant with the requirements of the Commission.
  2. Whether or not [R]espondent performed processing for unauthorized [purposes] on the personal data of Complainant.
  3. Whether or not [R]espondent performed unauthorized processing or malicious disclosure of Complainant’s personal data.19

The parties likewise stipulated on the following facts:

  1. The identity of [R]espondent.
  2. Jurisdiction of the Commission over the subject matter of the complaint.
  3. The parties to this case are neighbors in Sun Valley, Paranaque City.
  4. Respondent has two installed CCTV cameras.20

Moreover, while the Complainant failed to indicate in her CAF the alleged violation/s of the DPA committed by Respondent, the issues as to whether Respondent committed violations of Section 25 (Unauthorized Processing), 28 (Processing for Unauthorized Purposes), and 31 (Malicious Disclosure) under the DPA were raised during the preliminary conference held on 09 June 2021.21

Also, during the preliminary conference, Complainant sought the discovery and preservation of the copies of Respondent’s CCTV footage while Respondent sought clearer copies of the CCTV screenshots attached to the complaint. The parties likewise agreed to undergo mediation proceedings.22

On 11 June 2021, Respondent filed a Motion to Defer Submission of Position Paper (on the Petition for Temporary Ban in Case No.XXXXX) praying for the deferment of the submission of position papers pending the mediation proceedings in the instant case.23

On 16 June 2021 and 23 June 2021, Complainant and Respondent respectively filed their Application for Mediation.24

On 29 June 2021, an Order to Mediate was issued setting the preliminary mediation conference on 10 August 2021 at 10:30 AM and suspending the proceedings for sixty (60) days.25

On 10 August 2021, a Notice of Non-Settlement of Dispute was issued terminating the mediation proceedings on the ground that the parties were unable to reach a settlement.26

On 20 August 2021, an Order (For the Resumption of Complaints Proceedings and Submission of Memorandum) was issued lifting the suspension of the preliminary conference, requiring Respondent to submit clearer copies of her CCTV footage while requiring Complainant to submit clearer copies of the CCTV coverages/screenshots attached to the complaint within fifteen (15) calendar days from receipt of the Order.27 The parties were likewise ordered to submit their respective memoranda after seven calendar days from the first day of lifting of the Enhanced Community Quarantine (ECQ) or Modified ECQ in the National Capital Region, whichever is later.28

Respondent filed a Manifestation dated 07 September 2021 stating that she could not provide any CCTV footage as the laptop where the data was stored was damaged.29 According to Respondent, she brought the damaged laptop to Switch Studio84 Inc., a service provider, in order to have the laptop repaired, as evidenced by the Service Report attached therein.30 The report indicated that “Battery and main logic board needs to be replaced to resolve the issue.”31 As of the date of filing the Manifestation, Respondent alleged that “the data was not yet recovered.”32

On 21 September 2021, the Commission received a Motion for Extension of Time to File Memoranda from Complainant.33 The Commission thereafter issued a Resolution (on the Motion for Extension of Time to File Memoranda) granting Complainant’s Motion for Extension of Time to File Memoranda and giving the parties seven calendar days counted from the first day of shifting to a lower alert level of GCQ or lenient community quarantine, whichever is earlier.34

Complainant submitted a Memorandum dated 25 October 2021.35 Complainant, in her Memorandum, argued that (i) the CCTV footage involves personal data under the DPA, NPC Advisory Opinion No. 2018-080, and NPC Advisory No. 2020-04, (ii) Respondent’s act of capturing video footage beyond Respondent’s property violates the criteria for lawful processing of personal information and the legitimate interest test under NPC Advisory Opinion No. 2020-039 and does not fall under the exemptions provided under NPC Advisory No. 2020-04, (iii) the capturing of the video footage violates the principle of proportionality under NPC Advisory No. 2020-04, (iv) the placement of the CCTV camera focuses on an area where there is a heightened expectation of privacy, (v) Respondent, as a personal information controller (PIC), did not comply with the NPC requirements on preserving the quality and integrity of data under NPC Advisory No. 2020-04, and (vi) that Respondent committed unauthorized processing of personal information, and processing of personal information for unauthorized purposes.36

In alleging that the CCTV footage involves personal data under the DPA, Complainant cited the DPA and other NPC issuances as her bases in arguing that the CCTV footage is considered as personal information, to wit:

The Data Privacy Act of 2012 defines Personal Information, to wit:

xxx

(g) Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.

Based on the above definition, a personal information is any information, whether by itself or when combined with other information, will lead to the identity of a specific individual. Based on the video provided, it is clear that the identity of the Complainant is evident hence it is a personal information.

In NPC Advisory Opinion 2018-080, the Commission had the occasion to state that:

“If the camera surveillance footage is of sufficient quality, a person with the necessary knowledge will be able to reasonably ascertain the identity of an individual from the footage. Thus, the footage and images are considered personal information and the provisions of the DPA will apply.”

In NPC Advisory No. 2020-04, the Commission further stated that:

xxx

C. The capture, use, retention, and destruction of video and/or audio footages obtained from CCTVs are considered as processing of personal data under the Data Privacy Act of 2012 (DPA). Those who process personal data through CCTV systems, whether as PICs or PIPs shall comply with the Data Privacy Act of 2012, its Implementing Rules and Regulations (IRR) and relevant issuances of the National Privacy Commission (NPC).37

Respondent submitted a Memorandum dated 21 October 2021, arguing that (i) the Commission lacks jurisdiction over the case, citing Sections 4 and 12 of NPC Circular No. 16-04, (ii) that the processing of data is allowed under Section 12 (f) and 13 (f) since the CCTV footage was used in mediation proceedings before the Barangay Lupon of Sun Valley, Paranaque, and (iii) that Respondent is not a PIC under Section 3 (G) of NPC Advisory No. 2020-04 which excludes an individual who collects, holds, processes or uses personal information in connection with the individual’s personal, family or household affairs.38

On 20 July 2022, Complainant submitted additional evidence in the form of videos, which, as explained in the email accompanying the videos, allegedly were CCTV footages captured by Respondent wherein the interior of Complainant’s property is captured.39

Complainant stated that these footages were obtained by her due to the fact that Respondent was ordered to submit the same in another proceeding for Abatement of Nuisance.40

Issues

I. Whether the case should be outrightly dismissed for failure of the Complainant to exhaust administrative remedies; and

II. Whether Respondent is liable for violating Sections 25 (Unauthorized Processing), Section 28 (Processing for Unauthorized Purposes), and/or Section 31 (Malicious Disclosure) of the DPA.

Discussion

The Commission dismisses the complaint on the ground of lack of merit.

I. The instant case should not be dismissed outright despite Complainant’s failure to exhaust administrative remedies.

The Complainant filed his complaint prior to the effectivity of NPC Circular No. 2021-01 (2021 NPC Rules of Procedure), thus, the applicable procedural rules at the time of its filing, which was on 05 December 2019, is NPC Circular 16-04 or the 2016 NPC Rules of Procedure.41

Section 4, Rule II of NPC Circular No. 16-04 (2016 NPC Rules of Procedure) provides:

SECTION 4. Exhaustion of remedies. – No complaint shall be entertained unless:

a. the complainant has informed, in writing, the personal information controller or concerned entity of the privacy violation or personal data breach to allow for appropriate action on the same;

b. the personal information controller or concerned entity did not take timely or appropriate action on the claimed privacy violation or personal data breach, or there is no response from the personal information controller within fifteen (15) days from receipt of information from the complaint; and

c. the complaint is filed within six (6) months from the occurrence of the claimed privacy violation or personal data breach, or thirty (30) days from the last communiqué with the personal information controller or concerned entity, whichever is earlier.

The failure to comply with the requirements of this Section shall cause the matter to be evaluated as a request to the National Privacy Commission for an advisory opinion, and for the National Privacy Commission to take such further action, as necessary.

The National Privacy Commission may waive any or all of the requirements of this Section, at its discretion, upon good cause shown, or if the complaint involves a serious violation or breach of the Data Privacy Act, taking into account the risk of harm to the affected data subject.42

Respondent, in her Memorandum dated 21 October 2021 argued that Complainant failed to exhaust administrative remedies as the complaint was filed beyond the reglementary period “as alleged in the complaint, that the last time the parties met before the barangay lupon of Barangay Sun Valley was on May 2019 while the complaint was only filed on 5 December 2019.”43

Moreover, Respondent argues that Complainant did not show a “written complaint/demand/information to the [R]espondent which evidently proves that there is no exhaustion of remedies on the part of the complainant.”44 Indeed, as may be seen in Complainant’s CAF, she admitted that she did not contact Respondent relative to her complaint.45 She, however, justified this failure by indicating “BUT SHE HAS AN EXISTING COMPLAINT AGAINST ME.”46

As this Commission has ruled in VVC v. CJB, the Commission has the discretion to waive any of the conditions precedent enumerated in Section 4 of NPC Circular No. 16-04 “upon good cause shown, or if the complaint involves a serious violation or breach of the DPA, taking into account the risk of harm to the affected data subject.”47

In this case, it is alleged that Respondent has a recording of Complainant talking with Respondent’s mother, and then walking from the front of Respondent’s gate towards Complainant’s garage and front door on 23 December 2017 from 3:00-4:30 p.m.48 Moreover, this video was allegedly discovered during mediation proceedings between Complainant and Respondent before the Office of the Lupong Tagapamayapa last April or May 2019 involving a different incident.49

Considering that the subject video has allegedly already been shown by Respondent to the Lupong Tagapamayapa, that the Complainant and Respondent are already at odds with one another as both parties escalated their issues involving CCTVs they have respectively installed on their property, and that the complaint involves serious violations of the DPA, the Commission finds it appropriate to exercise its authority to resolve the case on the merits.

II. Respondent did not commit Unauthorized Processing of Complainant’s Personal Information as defined under Section 25 (a) of the DPA.

To reiterate, Complainant stated in her CAF that Respondent’s CCTV cameras filmed her talking to Respondent’s mother, and then walking from the front of Respondent’s gate towards Complainant’s garage and front door on 23 December 2017 from 3:00-4:30 p.m.50 Moreover, this footage was allegedly shown before the Office of the Lupong Tagapamayapa last April or May 2019.51

Further, in her Memorandum dated 25 October 2021, Complainant elaborates on her allegation that Respondent violated Section 25 of the DPA:

The act of the respondent of capturing video footages beyond that which is allowed by the law is a clear violation of Section 25. When the respondent focused her CCTV camera well outside her property into the public road up to the property of the Complainant without her consent, her actions went beyond what is allowed by law and has violated the right to privacy of the Complainant including Section 25 of the DPA. As discussed in the previous paragraphs, the respondent cannot now lean on legitimate interest as her basis for processing personal data.52 (Emphasis supplied)

Section 25 (a) of the DPA, on Unauthorized Processing of Personal Information, provides:53

SEC. 25. Unauthorized Processing of Personal Information and Sensitive Personal Information. – (a) The unauthorized processing of personal information shall be penalized by imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00) shall be imposed on persons who process personal information without the consent of the data subject, or without being authorized under this Act or any existing law.54

To be held liable under Section 25 (a) of the DPA, the following requisites must concur:

  1. The accused processed the information of the data subject.
  2. That the information processed was personal information.
  3. That the processing was done without the consent of the data subject, or without authority under this Act or any existing law.55

As to the first requisite, Section 3 (j) of the DPA defines processing as “any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.”56

A data subject is defined under Section 3 (c) of the DPA as “an individual whose personal information is processed.”57

In this case, in order to prove that Complainant’s personal information was processed, she submitted photographs showing Complainant’s CCTV cameras, photographs of Complainant’s residence, Respondent’s CCTV camera, a photograph showing the path of the Respondent from the CCTV footage of the Complainant on 23 December 2017 at around 3:00-4:30 p.m.58 She also attached letters addressed to the Barangay Chairman and the Katarungang Barangay regarding her complaints against Respondent.59

Apart from these, Complainant also submitted videos on 20 July 2022, which were alleged to be CCTV footages captured by Respondent’s CCTVs.60 In the email accompanying the CCTV footages, Complainant stated that these footages were obtained by her because Respondent was ordered to submit the same in another proceeding for Abatement of Nuisance.61 She stated:

I was shocked to see that most if not all of her videos have footages capturing the inside of my property-my car, my garden, my frontage.

So it is true that the respondent is merely afraid that the surveillance she makes on my family’s affairs is also being done to her that is why she filed [a separate case] against me.62

As may be clearly seen in the videos submitted by Complainant on 20 July 2022, persons inside Complainant’s residence are captured in Respondent’s CCTV. Thus, Complainant may be said to be processing the information of several data subjects who were caught in the footages, including Complainant and the other members of her household. Thus, the first element, is present.

As to the second requisite, personal information is defined under Section 3 (g) of the DPA, thus:

(g) Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.63

Thus, footages and images captured using CCTV cameras are considered personal information if the footage or image allows for the identification of a specific individual pursuant to the phrase in Section 3 (g) of the DPA that states: “from which the identity of an individual is apparent or can be reasonably and directly ascertained.”64

As previously discussed, Complainant submitted videos on 20 July 2022 showing persons inside the residence of the Complainant.65 The footages are such that the identities of the individuals captured therein may be identified by one who views the same. Hence, the second element is also present.

However, as to the third element, the Commission finds that the same is absent as Respondent had lawful basis to process under Sections 12 (f)66 and 13 (f)67 of the DPA.

Section 12 (f) of the DPA allows for the processing of personal information when it is necessary for the purposes of the legitimate interests pursued by the PIC:

Section 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

x x x

(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.68

(Emphasis supplied.)

In this case, the alleged recording of CCTV footage is considered as processing necessary for the legitimate interests of the PIC. In particular, the CCTV cameras are used as security measures to protect one’s home.

In connection with Respondent’s use of the CCTV footage is Complainant’s allegation of Respondent’s violation of the proportionality principle. Under the Implementing Rules and Regulations of the DPA, “the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.”69

In this case, Complainant argues in her Memorandum dated 25 October 2021 that “the act of the [R]espondent in capturing video footages well beyond the boundaries of her property constitutes a violation of the proportionality principle.”70 Complainant claimed that the CCTV cameras were pointed at her gate, garage, garden, and front door.

However, based on the submissions made by the Complainant, it can be clearly seen that the CCTV cameras were directed mainly towards the public road, and a portion of Complainant’s gate and garage.

Given the angle of the CCTV cameras, it appears that the extent of recording by Respondent was truly for the security of her home. As such, Respondent’s recording is authorized by her legitimate interest in securing her home and does not violate the proportionality principle.

Considering that not all the elements of Section 25 are present since the processing of personal information has lawful basis under the DPA, and that it is in accordance with the principle of proportionality, Respondent should not be held liable for Unauthorized Processing under the Section 25 of the DPA nor for non-adherence to the principle of proportionality.

III. Respondent did not commit Processing of Complainant’s Personal Information for Unauthorized Purposes as defined under Section 28 (a) of the DPA.

In her Memorandum, Complainant argues that Respondent violated Section 28,71 thus:

The act of the respondent in using the video captured by her CCTV Camera and showing it at the Lupon to advance her claim is a violation of Section 28. Here, the elements are present, i.e., there is personal information, it was used or processed by the respondent, and lastly, the processing was for an unauthorized purpose under the categories allowed by law.72 (Emphasis supplied)

Section 28 (a) of the DPA, on Processing of Personal Information for Unauthorized Purposes, provides:

SEC. 28. Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes. – (a) The processing of personal information for unauthorized purposes shall be penalized by imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00) shall be imposed on persons processing personal information for purposes not authorized by the data subject, or otherwise authorized under this Act or under existing laws.73

To be held liable under Section 28 (a) of the DPA, the following requisites must concur:

  1. A person processed information of the data subject;
  2. The information processed is classified as personal or sensitive personal information;
  3. The person processing the information obtained consent of the data subject or is granted authority under the DPA or existing laws; and
  4. The processing of personal or sensitive personal information is for a purpose that is neither covered by the authority given by the data subject and could not have been reasonably foreseen by the data subject nor otherwise authorized by the DPA or existing laws.74

As previously discussed, the first and second requisites are present in this case.

To reiterate, the third requisite is present. As also discussed above, the processing by Respondent through the act of recording through the CCTV is authorized by Respondent’s legitimate interest of securing her property.

Moreover, Section 13 (f) of the DPA allows the processing of sensitive personal information in cases where the processing is necessary for the establishment, exercise, and defense of legal claims, thus:

Section 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

x x x

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.75

Further, in the case of BGM v. IPP,76 the Commission has ruled that Section 13 (f) of the DPA may be considered as legitimate interest pursuant to Section 12 (f), thus:

Although Section 13(f) applies to sensitive personal information while the information involved in this case is just personal information, the protection of lawful rights and interests under Section 13(f) by the Respondent is considered as legitimate interest pursuant to Section 12(f) of the DPA. This section provides that it is lawful to process personal information if it is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.77

In this case, the presentation of the CCTV footage before the Lupon is necessary for Respondent to establish her claims against Complainant in relation to the barangay dispute. In fact, Complainant herself suggested in her Memorandum that the purpose of “[t]he act of the [R]espondent in using the video captured by her CCTV Camera and showing it at the Lupon” is “to advance [Respondent’s] claim.”78 Thus, the processing of the CCTV footage has lawful basis under Section 13 (f)79 in relation to Section 12 (f)80 of the DPA.

The fourth requisite, however, is absent in this case as the processing has lawful basis under the DPA. As previously discussed, Respondent’s processing had lawful basis under Sections 12 (f)81 and 13 (f)82 of the DPA. No other evidence presented proves that Respondent deviated from the purposes of securing her home and advancing her claim against Respondent. As such, it cannot be said that Respondent processed data for purposes which were unauthorized.

IV. Complainant failed to substantiate the allegation that Respondent committed Malicious Disclosure.

Complainant raised the issue of whether Respondent committed Malicious Disclosure as regards Complainant’s personal information for the first time during the Preliminary Conference held on 09 June 2021.83 After which, Complainant has not, in her Memorandum or in any of her submissions after the Preliminary Conference, substantiated the alleged commission of Malicious Disclosure by the Respondent.

As to the quantum of evidence necessary to prove one’s claim, in Avelina Sagun v. Sunace International Management Services, Inc.,84 the Supreme Court ruled that in proceedings before quasi-judicial bodies, the quantum of evidence necessary to establish one’s claim is substantial evidence:

In proceedings before administrative and quasi-judicial agencies, the quantum of evidence required to establish a fact is substantial evidence, or that level of relevant evidence which a reasonable mind might accept as adequate to justify a conclusion.85

It appears, therefore, that Complainant failed to discharge her burden to support her allegations with substantial evidence considering that she failed to make any substantiation whatsoever to support her claim. Thus, in view of the lack of substantiation, the Commission deems it proper not to address this allegation.

Considering the foregoing, this Commission finds that Respondent cannot be found to have committed a violation of the DPA due to lack of merit.

WHEREFORE, premises considered, this Commission hereby resolves that the instant complaint filed by CBB against AMS is DISMISSED for lack of merit.

This is without prejudice to the filing of appropriate civil, criminal or administrative cases against the Respondent before any other forum or tribunal, if any.

SO ORDERED.

City of Pasay, Philippines.

04 September 2024.

JOHN HENRY D. NAGA

Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

NERISSA N. DE JESUS

Deputy Privacy Commissioner

Copy furnished:

CBB

Complainant

KB

Counsel for Complainant

AMS

Respondent

MC

Counsel for Respondent

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

National Privacy Commission

Footnotes

  1. Complaints-Assisted Form dated 05 December 2019 of CBB. ↩

  2. Id., at p. 3. ↩

  3. Id., at p. 5. ↩

  4. Id., at p. 5. ↩

  5. Complaints-Assisted Form dated 05 December 2019 of CBB., at p. 5. ↩

  6. Id., at p. 5. ↩

  7. Id., at p. 3. ↩

  8. Id., at p. 6-7. ↩

  9. Attachments to the Complaints-Assisted Form dated 05 December 2019 of CBB. ↩

  10. CBB v. AMS, NPC Case 19-1805, Order to Confer for Discovery dated 05 February 2021. ↩

  11. CBB v. AMS, NPC Case 19-1805, Order Resetting Discovery Conference dated 18 March 2021. ↩

  12. CBB v. AMS, NPC Case 19-1805, Order to File Verified Comment dated 05 April 2021. ↩

  13. CBB v. AMS, NPC Case 19-1805, Order to Appear for Preliminary Conference dated 12 May 2021. ↩

  14. CBB v. AMS, NPC Case 19-1805, Order to Virtually Appear for the Next Preliminary Conference Setting dated 26 May 2021. ↩

  15. Id. ↩

  16. Id. ↩

  17. Id. ↩

  18. CBB v. AMS, NPC Case 19-1805, Preliminary Conference Order dated 10 June 2021. ↩

  19. Id. ↩

  20. Id. ↩

  21. Id. ↩

  22. CBB v. AMS, NPC Case 19-1805, Preliminary Conference Order dated 10 June 2021. ↩

  23. Motion to Defer Submission of Position Paper dated 11 June 2021 of AMS. ↩

  24. Application for Mediation dated 16 June 2021 of AMS; and Application for Mediation dated 23 June 2021 of CBB. ↩

  25. CBB v. AMS, NPC Case 19-1805, Order to Mediate dated 29 June 2021. ↩

  26. CBB v. AMS, NPC Case 19-1805, Notice of Non-Settlement of Dispute dated 10 August 2021. ↩

  27. CBB v. AMS, NPC Case 19-1805, Order for the Resumption of Complaints Proceedings and Submission of Memorandum dated 20 August 2021. ↩

  28. Id. ↩

  29. Manifestation dated 07 September 2021 of AMS. ↩

  30. Attachments to the Manifestation dated 07 September 2021 of AMS. ↩

  31. Id. ↩

  32. Manifestation dated 07 September 2021 of AMS. ↩

  33. Motion for Extension of Time to File Memoranda dated 21 June 2021 of CBB. ↩

  34. CBB v. AMS, NPC Case 19-1805, Resolution on the Motion for Extension of Time to File Memoranda. ↩

  35. Memorandum dated 25 October 2021 of CBB. ↩

  36. Id. ↩

  37. Id. ↩

  38. Memorandum dated 21 October 2021 of AMS. ↩

  39. Attachments to the Electronic mail dated 20 July 2022 from CBB. ↩

  40. Electronic mail dated 20 July 2022 from CBB. ↩

  41. National Privacy Commission, Rules of Procedure of the National Privacy Commission, NPC Circular 16-04, (15 December 2016) (NPC Circular 16-04). ↩

  42. Id. ↩

  43. Memorandum dated 21 October 2021 of AMS. ↩

  44. Complaints-Assisted Form dated 05 December 2019 of CBB, at p. 3. ↩

  45. Id., at p. 3. ↩

  46. Id., at p. 3. ↩

  47. VVC v. CJB, NPC 19-134, Decision dated 10 December 2021, at p. 6. ↩

  48. Complaints-Assisted Form dated 05 December 2019 of CBB, at p. 5. ↩

  49. Id., at p. 5. ↩

  50. Id., at p. 5. ↩

  51. Id., at p. 5. ↩

  52. Memorandum dated 25 October 2021 of CBB. ↩

  53. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, chapter VIII, § 25 (2012). ↩

  54. Id., chapter VIII, § 25. ↩

  55. In Re: FLI Operating ABC Online Lending Application, NPC 19-910, Decision dated 17 December 2020 at p. 17. ↩

  56. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, chapter I, § 3(j) (2012). ↩

  57. Id., chapter I, § 3 (c). ↩

  58. Attachments to the Complaints-Assisted Form dated 05 December 2019 of CBB. ↩

  59. Attachments to the Memorandum dated 25 October 2021 of CBB. ↩

  60. Attachments to the Electronic mail dated 20 July 2022 from CBB. ↩

  61. Electronic mail dated 20 July 2022 from CBB. ↩

  62. Id. ↩

  63. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, chapter I, § 3 (g) (2012). ↩

  64. Id. ↩

  65. Electronic mail dated 20 July 2022 from CBB. ↩

  66. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 ,chapter III, § 12 (f) (2012). ↩

  67. Id., chapter III, § 13 (f). ↩

  68. Id., chapter III, § 12 (f). ↩

  69. National Privacy Commission, Implementing Rules and Regulations of the Data Privacy Act of 2012, Rule IV, § 18 (c) (2016). ↩

  70. Memorandum dated 25 October 2021 of CBB. ↩

  71. Id. ↩

  72. Id. ↩

  73. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, chapter VIII, § 28 (2012). ↩

  74. RLA v. PLDT, NPC 18-010, Resolution dated 10 December 2021. ↩

  75. Id., chapter III, § 13 (f). ↩

  76. BGM v. IPP, NPC 19-653, Decision dated 17 December 2020, at p. 7-8. ↩

  77. Id. ↩

  78. Memorandum dated 25 October 2021 of CBB. ↩

  79. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, chapter III, § 13 (f) (2012). ↩

  80. Id., chapter III, § 12 (f). ↩

  81. Id. ↩

  82. Id., chapter III, § 13 (f). ↩

  83. CBB v. AMS, NPC Case 19-1805, Preliminary Conference Order dated 10 June 2021. ↩

  84. Sagun v. Sunace International Management Services, Inc., G.R. 179242, 23 February 2011. ↩

  85. Id. ↩

Backlinks

  • No backlinks found