NPC Issuance Wiki

NPC 20-287: HEB v. DA

Issued Decision

Decision Text

HEB,

Complainant,

-versus-

DA,

Respondent.

x----------------------------------------------------x

NAGA, P.C.;

Before this Commission is a Complaint filed by HEB (Complainant) against DA (Respondent) for an alleged violation of the Data Privacy Act of 2012 or Republic Act No. 10173 (DPA).1

Facts

In his Complaints-Assisted Form (CAF), Complainant alleged that on 14 September 2020, Respondent posted on the ‘BELOVED NUEVA VIZCAYA !!!’ Facebook page a call for people to report Complainant’s whereabouts to the police and for the public to conduct a citizen arrest on him.2 According to Complainant, the post made by the Respondent divulged sensitive details about the Complainant’s case filed against him by Respondent’s partner.3 The said post stated:

PTPA.

Whoever knows where is. HEB can be informed of the police or citizen arrest because he has a WARRANT OF ARREST in the case of STAFA CC -XXX s MTC Bayombong.. he is a former teacher NVGCHS.. Thank you very much [.]

PNPBAYOMBONG

On even date, Respondent posted another status on the same Facebook page which stated:

…cno man Po nkkaalam kinaroroonan ni HEB maari pong ipagbigay Alam s pulisya or citizen arrest dahil may WARRANT OF ARREST SYA s kasong STAFA CC-XXXX sa MTC bayombong,, sya Po ay dating teacher NVGCHS.. Maraming salamat Po[.] #PNPBAYOMBONG[.]

Complainant stated that based on Respondent’s post, the former was still at large, when in fact, he attended several arraignments and pre-trials on which Respondent was physically present.4 Complainant alleged that the reason for that post was due to his non-appearance before the court despite the issuance of a bench warrant of arrest.5 However, according to Complainant, the court “subsequently cancelled and withdrawn said bench warrant” contesting that he was not able to receive any notice of arraignment.6 Proof of the Order by the Municipal Trial Court of Bayombong, Nueva Vizcaya withdrawing the Bench Warrant of Arrest was attached by Complainant to his CAF.7

Moreover, Complainant added:

With or without knowledge of the foregoing facts, the [Respondent recklessly and negligently interpreted my non-appearance as being equal to absconding, hence his action.

His imprudence shows that he is taking matters into his own hands. His utter disregard to the court (which has jurisdiction to decide on the pending case) is obvious. On the first place, he is not even the plaintiff (and there is no mention of him whatsoever about his involvement in the case, except the fact that he is the husband/partner of the [C]omplainant [in the criminal case]).

As of this writing, the post earned (and is still earning) likes, comments, and shares (as shown in the attached file). It is easily accessible for all to view (by simply typing my name [on Facebook]. Any minute from now, my worst nightmare could happen. Even if he deletes his post he can no longer easily restore my reputation, for the damage has been done. Unquestionably, DA is putting my life in danger as he cultivates a culture of mob mentality, if not, prejudicial publicity.8

Complainant also averred that he did not contact Respondent because he “bears ill will and grudge” against the Complainant.9 Additionally, Complainant narrated:

Contacting him in person or even in writing will only aggravate the situation. He posted something negative about me in Facebook. If I call his attention by way of writing him, he will make his own interpretation about the reason why I am contacting him. I could not discount the possibility that he will further add insult to the injury by posting more derogatory posts about me. Definitely, I would not want that to happen. Besides, he has shown fits of anger in most instances when I have some conversations about the case with his wife/partner FJ. (note: He accompanies her during our conversations and hearings). He has the tendency to take matters into his hands, as what can be inferred from what he has been doing and what he just did (i.e. posting in Facebook page). The foregoing statements explain the reason why I decided not to contact the [R]espondent.10

Thus, Complainant prayed that he be awarded damages and that the Respondent be fined.11 Complainant alleged that he, his family, relatives, and friends “suffer from humiliation, indiscreet alienation, and verbal insults and threats, among others, from other people (because of their own interpretation and self-processing of the said Facebook post).”12 Lastly, Complainant hopes and prays that Respondent deletes his post and “do a sincere public apology as an act of remorse.”13

Accordingly, the National Privacy Commission (NPC), through the Complaints and Investigation Division (CID) issued the parties an Order to confer for discovery.14 On 23 December 2020, Complainant consented to e-hearing related to the complaint, committing his remote appearance via videoconference.15

On 10 February 2021, the CID issued an Order requiring the parties to confer for discovery via modified-in-person hearing on 18 March 2021.16 Subsequently, the CID issued an Order canceling and resetting the mentioned discovery conference on 06 April 2021 due to self-quarantine measures.17

However, on 05 April 2021, the CID cancelled the rest discovery conference in view of the extension of the Enhanced Community Quarantine.18 Accordingly, the CID ordered Respondent to file a verified comment.19

On 12 May 2021, CID required the parties to appear for preliminary conferences on 26 May 2021 and 09 June 2021, via Microsoft Teams.20

During the first preliminary conference dated 26 May 2021, only Complainant appeared.21 Complainant manifested therein that the email address of Respondent may be available through his Facebook account, but such email address was not provided therein.22 Accordingly, the parties were ordered to appear virtually for the next preliminary conference on 09 June 2021.23

During the second preliminary conference, only the Complainant appeared.24 In the Order (After the Second Preliminary Conference held on 09 June 2021), the CID stated that the “second failure to appear of a party shall be deemed a waiver of her rights to the benefits of the Preliminary Conference, including but not limited to mediation, discovery, and/or stipulation of facts,” citing Section 2, Rule V if the 2021 Rules of Procedure of the NPC.25

Accordingly, CID required the parties to submit their respective memoranda discussing and summarizing their respective causes of action, claims, and defenses.26

On 25 June 2021, Complainant submitted his Memorandum alleging that based on the screenshots, the Facebook post made by Respondent contained personal information such as Complainant’s name, previous employment, “and other sensitive details.”27 Complainant stated that he “suffered and continue to suffer insomnia, paranoia, humiliation, indiscreet alienation, verbal insult, and threats[.]”28 Complainant added that even though the Facebook post was already deleted, Respondent can no longer restore the good image of Complainant to the public.29

Due to lack of Respondent’s participation in the proceedings of the case before the NPC, the CID sought the assistance of the punong barangay of the place where Respondent’s last known address was identified. In a letter sent by CID, it requested the punong barangay to confirm the residence of Respondent through an official certification.30

Subsequently, the punong barangay submitted a certification confirming that Respondent “is not already a resident of Bonfal Proper, Bayombong, Nueva Vizcaya.” xxxxxxxx.31

Thus, with the available evidence presented by the Complainant, the Commission hereby resolves the merits of the case.

Issue

I. Whether the complaint should be dismissed for failure to exhaust remedies under the 2016 NPC Rules of Procedure.

II. Whether Respondent is liable under the DPA.

Discussion

The Commission finds Respondent liable for violating Sections 25 and 32 of the DPA.

I. The instant case should not be dismissed outright despite Complainant’s failure to exhaust remedies.

The Complainant filed his complaint prior to the effectivity of NPC Circular No. 2021-01 (2021 NPC Rules of Procedure), thus, the applicable procedural rules at the time of its filing, which was on 01 October 2020, is the NPC Circular 16-04 or the 2016 NPC Rules of Procedure.

Rule II, Section 4 of NPC Circular No. 16-04 (2016 NPC Rules of Procedure) provides:

SECTION 4. Exhaustion of remedies. – No complaint shall be entertained unless:

a. the complainant has informed, in writing, the personal information controller or concerned entity of the privacy violation or personal data breach to allow for appropriate action on the same;

b. the personal information controller or concerned entity did not take timely or appropriate action on the claimed privacy violation or personal data breach, or there is no response from the personal information controller within fifteen (15) days from receipt of information from the complaint; and

c. the complaint is filed within six (6) months from the occurrence of the claimed privacy violation or personal data breach, or thirty (30) days from the last communiqué with the personal information controller or concerned entity, whichever is earlier.

The failure to comply with the requirements of this Section shall cause the matter to be evaluated as a request to the National Privacy Commission for an advisory opinion, and for the National Privacy Commission to take such further action, as necessary.

The National Privacy Commission may waive any or all of the requirements of this Section, at its discretion, upon good cause shown, or if the complaint involves a serious violation or breach of the Data Privacy Act, taking into account the risk of harm to the affected data subject.32 (Emphasis supplied)

Complainant stated that he did not contact Respondent because doing so will only aggravate the situation.33 Complainant alleged that by informing Respondent, he will make his own interpretation and “will further add insult to the injury.”34

In this case, regardless of whether Respondent has acted upon the allegations provided herein, the latter has no longer any opportunity to “provide any plain, speedy or adequate remedy to the alleged violation.”35 Thus, the Commission, at its discretion, finds that it is but proper to waive the requirement under Section 4 of NPC Circular No. 16-04 considering that the instant complaint involves serious violation of the DPA.

It must be stressed that the DPA provides that the processing of sensitive personal information is prohibited unless such processing falls under the lawful criteria enshrined under Section 13 of the DPA.36 In this case, the Commission perceives of possible violations under the DPA considering the alleged unauthorized processing of Complainant’s personal and sensitive personal information, as well as the disclosure thereof through a Facebook post which was made by Respondent.

Lastly, the alleged unauthorized processing and disclosure of the criminal information for estafa may pose a risk of harm to Complainant when the same may be used in a manner that could expose him to harassment, discrimination, or even suffer from “insomnia, paranoia, humiliation, indiscreet alienation, verbal insult, and threats” as experienced by Complainant and his family as a result of the incident.37

As such, the Commission finds it appropriate to exercise its authority to resolve the case on the merits.

II. Respondent violated Section 25 of the DPA or Unauthorized Processing of Personal and Sensitive Personal Information.

Chapter VIII, Section 25 of the DPA or Unauthorized Processing of Personal and Sensitive Personal Information provides that the Respondent shall be liable if he or she processes personal and sensitive personal information of the data subject without his or her consent, or without the authority of DPA or any existing laws.38 Section 25 states:

SEC. 25. Unauthorized Processing of Personal Information and Sensitive Personal Information. – (a) The unauthorized processing of personal information shall be penalized by imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00) shall be imposed on persons who process personal information without the consent of the data subject, or without being authorized under this Act or any existing law.

(b) The unauthorized processing of personal sensitive information shall be penalized by imprisonment ranging from three (3) years to six (6) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Four million pesos (Php4,000,000.00) shall be imposed on persons who process personal information without the consent of the data subject, or without being authorized under this Act or any existing law.39

To be held liable under Section 25 of the DPA, the following requisites must concur:

  1. The perpetrator processed the information of the data subject;
  2. The information processed was personal information or sensitive personal information;
  3. The processing was done without the consent of the data subject, or without being authorized under the DPA or any existing law.40

As to the first requisite, Section 3(j) of the DPA defines processing as “any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.”41

In this case, Complainant stated in his CAF that Respondent is not involved in the criminal case for estafa filed against the former, except the fact that Respondent is the partner of the plaintiff therein.42 Thus, it can be inferred that Respondent acquired such information from his partner who is the plaintiff therein, as evidenced by the tagged Facebook account in the name of FA on the subject Facebook post.43 Considering that fact, Respondent was able to use the name of the Complainant and the existence of a bench warrant of arrest for estafa case in the post on the provincial Facebook page of Nueva Vizcaya.44 As defined above, the ‘use’ of personal data of the Complainant constitutes processing under the DPA.

Moreover, not only the Respondent used the personal data of Complainant but also posted the same on the Nueva Vizcaya provincial Facebook page.45 Such posting of personal data on the Facebook page constitutes processing of personal data of Complainant. Disclosing Complainant’s personal and sensitive personal information, such as posting on a Facebook page, is a form of processing as defined under the DPA. Thus, the first requisite is present.

As to the second requisite, the DPA defined personal information as “any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.”46

On the other hand, sensitive personal information is defined as any personal information:

(h) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;

(2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;

(3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and

(4) Specifically established by an executive order or an act of Congress to be kept classified.47 (Emphasis supplies)

In this case, Respondent posted on Facebook the full name of Complainant, HEB,48 coupled with his previous employment as former teacher at XXXXXXXX.49 These information can be used to reasonably and directly ascertain his identity.50

Moreover, other than the Complainant’s name, the Facebook post also stated that he has warrant of arrest for an estafa case before the Municipal Trial Court of Bayombong.51 A bench warrant of arrest is defined as a “writ issued directly by a judge to a law-enforcement officer, especially for the arrest of a person who has been held in contempt, has disobeyed a subpoena, or has to appear for a hearing or trial.”52 The bench warrant of arrest issued by the Municipal Trial Court of Bayombong for the case of estafa is within the ambit of the definition of sensitive personal information. Thus, the second requisite is present.

Lastly, Complainant’s personal and sensitive personal information on the Nueva Vizcaya provincial Facebook page was clearly processed by Respondent without Complainant’s consent, or without authority under the DPA or any existing law.

Section 3(b) of the DPA defines consent as follows:

Section 3. Definition of Terms. – Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

(b) Consent of the data subject refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so.53 (Emphasis supplied)

Based on the foregoing definition, consent has five (5) requisites for it to become valid – freely given, specific, informed indication of will, and it shall be evidenced by written, electronic or recorded means.54

Clearly, Complainant has not given his consent to the collection and posting of his personal data by Respondent. In this case, Respondent, as personal information controller (PIC), has the burden of proof to show any lawful basis for processing Complainant’s personal and sensitive personal information. However, Respondent has failed to show that Complainant has given his consent to the processing of his personal and sensitive personal information and that he “was extremely shocked to discover” that Respondent posted on Nueva Vizcaya provincial Facebook page that he has warrant of arrest for an estafa case, as alleged by the Complainant in his Memorandum.55

Moreover, Respondent has no lawful basis in processing Complainant’s personal data as there was no showing that the posting of personal and sensitive personal information on Facebook is “necessary for the establishment, exercise or defense of legal claims.”56

Lastly, the records show that none of the criteria for lawful processing of personal57 and sensitive personal58 information are applicable in this case. Thus, Respondent’s collection of Complainant’s personal and sensitive personal information and his processing of the same through a Facebook post was without authority, therefore the privacy violation for Unauthorized Processing of Personal Information and Sensitive Personal Information.

Given that all requisites are present in this case, the Commission finds that the Respondent should be held liable for Section 25 of the DPA.

III. Respondent violated Section 32 of the DPA or Unauthorized Disclosure.

Unauthorized Disclosure under Section 32 of the DPA provides:

Section 32. Unauthorized Disclosure. – (a) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).59

In determining the liability of the Respondent for Unauthorized Disclosure under Section 32, the following requisites must be present:

  1. The perpetrator is a personal information controller or personal information processor or any of its officials, employees or agents;
  2. The information relates to personal or sensitive personal information;
  3. The perpetrator disclosed personal or sensitive personal information;
  4. The disclosure was made to a third party;
  5. The personal or sensitive personal information disclosed is neither unwarranted nor false information;
  6. The disclosure was not malicious nor done in bad faith; and
  7. The disclosure was without any of the lawful bases for processing under Sections 12 and 13 of the DPA.60

As to the first requisite, a personal information controller (PIC) is defined as:

(h) [A] person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.61

In this case, the mere fact that Respondent gained access of the Complainant’s information, being the partner of the plaintiff to the criminal case, specifically that of a warrant of arrest issued by the Municipal Trial Court, Respondent is considered as PIC. Moreover, upon gaining access, he already holds such personal and sensitive personal information. Since Respondent is considered as PIC as defined under the DPA, the first requisite is present.

The second requisite is also present as it was already established above that the information involved in this case relates to personal and sensitive personal information.

On the other hand, the personal and sensitive personal information of Complainant were posted on the Facebook page of Nueva Vizcaya, and posting of which is considered as disclosure on made by Respondent. Thus, the third requisite is also present.

For the fourth requisite, as can be seen in the screenshot of the subject Facebook post submitted by Complainant, it already earned likes, comments, and shares from third persons.62 According to Complainant, the post was easily accessible by simply typing his name on Facebook.63 Thus, it can be deduced that the personal and sensitive personal information of Complainant were disclosed to third parties. The fourth requisite is therefore present in this case.

As to the fifth requisite, the disclosed personal and sensitive personal information of Complainant was false since the bench warrant of arrest issued against Complainant has been withdrawn by the Municipal Trial Court of Bayombong on 15 August 2020,64 a month before Respondent posted the subject Facebook post. Complainant attached in his CAF the Order by the Municipal Trial Court of Bayombong cancelling and withdrawing the bench warrant of arrest, stating that the Complainant, the accused therein, “was not duly notified of the notice of arraignment, hence, his non-appearance.”65 Thus, the fifth requisite is present in this case.

As to the sixth requisite, the disclosure made by Respondent was neither malicious nor done in bad faith.66

The Supreme Court in numerous cases has pronounced that “good faith is always presumed unless convincing evidence to the contrary is adduced. It is incumbent upon the party alleging bad faith to sufficiently prove such allegation. Absent enough proof thereof, the presumption of good faith prevails.”67

In this case, the evidence provided by Complainant was not sufficient to prove that Respondent acted in bad faith when he posted the former’s personal and sensitive personal information on the Nueva Vizcaya provincial Facebook page. Although Complainant stated that she “suffered and continue to suffer insomnia, paranoia, humiliation, indiscreet alienation, verbal insults, and threats,”68 this does not prove that Respondent acted maliciously or in bad faith.

For the last requisite, Section 32 of the DPA should be read together with Sections 1269 and 1370 on the criteria for lawful processing of personal and sensitive personal information.71 In order for the processing of personal and sensitive personal information to be considered lawful, including its disclosure, any of the criteria outlined in Sections 12 and 13 must be met.72

However, as discussed above, Complainant clearly did not consent to the processing of his personal and sensitive personal information when Respondent posted the former’s name, as well as the fact of the bench warrant of arrest issued by Municipal Trial Court of Bayombong against Complainant.73

Aside from consent not being obtained by Respondent when he made the said Facebook post, the disclosure likewise does not fall within the criteria for lawful processing of personal and sensitive personal information as provided under Sections 12 and 13 of the DPA. Hence, the seventh requisite is present in this case.

Considering all the requisites above are present, Respondent should be held liable for violating Section 32 of the DPA.

IV. For its violation of Sections 25 and 32 of the DPA, the Respondent should be held liable for Section 33 thereof.

Section 33 of the DPA provides:

SEC. 33. Combination or Series of Acts. – Any combination or series of acts as defined in Sections 25 to 32 shall make the person subject to imprisonment ranging from three (3) years to six (6) years and a fine of not less than One million pesos (Php1,000,000.00) but not more than Five million pesos (Php5,000,000.00).74

Given that all the requisites for Sections 25 and 32 of the DPA are present in this case, the combination of these privacy violations shall make the Respondent liable for Section 33 of the DPA.

V. Complainant shall be awarded with nominal damages under Section 16(f) of the DPA.

Section 16(f) of the DPA entitles data subjects to be indemnified for any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information.75

In relation with the above provision, Article 2221 of the New Civil Code provides:

Art. 2221. Nominal damages are adjudicated in order that a right of the plaintiff, which has been violated or invaded by the defendant, may be vindicated or recognized, and not for the purpose of indemnifying the plaintiff for any loss suffered by him.76

Nominal damages are also awarded “where a legal right a legal right is technically violated and must be vindicated against an invasion that has produced no actual present loss of any kind or where there has been a breach of contract and no substantial injury, or actual damages whatsoever have been or can be shown.”77

Given the foregoing, Respondent’s violation of Sections 25 (Unauthorized Processing), 32 (Unauthorized Disclosure) and 33 (Combination or Series of Acts), the Commission deems it proper to award nominal damages in favor of the Complainant in order to vindicate the privacy violations committed by Respondent against the former.

WHEREFORE, premises considered, this Commission hereby:

  1. FINDS DA (Respondent) liable for violating Sections 25 (Unauthorized Processing of Personal Information and Sensitive Personal Information), 32 (Unauthorized Disclosure) and 33 (Combination or Series of Acts) of the Data Privacy Act of 2012 (DPA);

  2. FORWARDS this Decision and a copy of the pertinent case records to the Secretary of Justice and RECOMMENDS the PROSECUTION of Respondent for violating Sections 25, 32, and 33 of the DPA; and

  3. AWARDS the Complainant HEB with nominal damages in the amount of ₱50,000.00 pursuant to Section 16(f) for Respondent’s violation of Sections 25, 32, and 33 of the DPA.

SO ORDERED.

City of Pasay, Philippines. 21 March 2024.

SGD

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

SGD

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

SGD

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

HEB Complainant

DA Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Complaint-Assisted Form dated 01 October 2020 of HEB. ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. Complaint-Assisted Form dated 01 October 2020 of HEB. ↩

  6. Id. ↩

  7. Id. ↩

  8. Id. ↩

  9. Id. ↩

  10. Id. ↩

  11. Complaint-Assisted Form dated 01 October 2020 of HEB. ↩

  12. Id. ↩

  13. Id. ↩

  14. HEB v. DA, NPC 20-287, Order to Confer for Discovery of Complaints and Investigation Division dated 7 December 2020. ↩

  15. Consent to E-hearing dated 23 December 2020 of HEB. ↩

  16. HEB v. DA, NPC 20-287, Order to Confer for Discovery of Complaints and Investigation Division dated 10 February 2021. ↩

  17. HEB v. DA, NPC 20-287, Order of Complaints and Investigation Division dated 18 March 2021. ↩

  18. HEB v. DA, NPC 20-287, Order to File Verified Comment of Complaints and Investigation Division dated 05 April 2021. ↩

  19. Id. ↩

  20. HEB v. DA, NPC 20-287, Order to File Verified Comment of Complaints and Investigation Division dated 12 May 2021. ↩

  21. HEB v. DA, NPC 20-287, Order of Complaints and Investigation Division dated 26 May 2021. ↩

  22. Id. ↩

  23. HEB v. DA, NPC 20-287, Order of Complaints and Investigation Division dated 09 June 2021. ↩

  24. Id. ↩

  25. HEB v. DA, NPC 20-287, Order After the Second Preliminary Conference held on 09 June 2021) of Complaints and Investigation Division dated 10 June 2021. ↩

  26. Id. ↩

  27. Memorandum dated 25 June 2021 of HEB. ↩

  28. Id. ↩

  29. Id. ↩

  30. Letter dated 24 August 2023 of Complaints and Investigation Division to the Punong Barangay of Barangay Bonfal Proper, Bayombong, Nueva Vizcaya. ↩

  31. Certification dated 19 September 2023 of the Office of Punong Barangay of Barangay Bonfal Proper, Bayombong, Nueva Vizcaya. ↩

  32. National Privacy Commission, 2016 Rules of Procedure of the National Privacy Commission, NPC Circular No. 2016-04, rule II, § 4 (15 December 2016) (2016 NPC Rules of Procedure). ↩

  33. Complaint-Assisted Form dated 01 October 2020 of HEB. ↩

  34. Id. ↩

  35. 2021 NPC Rules of Procedure, rule II, § 2. ↩

  36. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, chapter III, § 13 (2012). ↩

  37. Id. ↩

  38. Data Privacy Act of 2012, chapter VIII, § 25. ↩

  39. Id. ↩

  40. Id. ↩

  41. Data Privacy Act of 2012, chapter I, §3(j). ↩

  42. Complaint-Assisted Form dated 01 October 2020 of HEB. ↩

  43. Id., see attached Notice of Arraignment and Pre-Trial Conference. ↩

  44. Complaint-Assisted Form dated 01 October 2020 of HEB. ↩

  45. Id. ↩

  46. Data Privacy Act of 2012, chapter I, §3(g). ↩

  47. Id., chapter I, §3(l). ↩

  48. Complaint-Assisted Form dated 01 October 2020 of HEB. ↩

  49. Id. ↩

  50. Id. ↩

  51. Id. ↩

  52. JBD v. JI and VVV, CID Case No. 18-D-012 dated 21 January 2021. ↩

  53. Complaint-Assisted Form dated 01 October 2020 of HEB. ↩

  54. Id. ↩

  55. Id. ↩

  56. Data Privacy Act of 2012, chapter III, § 13(f). ↩

  57. Data Privacy Act of 2012, chapter III, § 12. ↩

  58. Id., § 13. ↩

  59. Id., § 32. ↩

  60. NPC 22-006 (unreported) dated 19 January 2023, at p. 17. ↩

  61. Data Privacy Act of 2012, chapter III, § 3(h). ↩

  62. Complaint-Assisted Form dated 01 October 2020 of HEB. ↩

  63. Id. ↩

  64. Id. ↩

  65. Id. ↩

  66. Id. ↩

  67. Heirs of Severa P. Gregorio v. Court of Appeals, G.R. No. 117609 dated 29 December 1998. ↩

  68. Memorandum dated 25 June 2021 of HEB. ↩

  69. Data Privacy Act of 2012, chapter III, § 12. ↩

  70. Id., § 13. ↩

  71. Id. ↩

  72. Id. ↩

  73. MVC, et al. v. DSL, NPC 21-010 to NPC 21-015, Decision dated 03 February 2022, at p. 12. ↩

  74. Id., at p. 11. ↩

  75. Complaint-Assisted Form dated 01 October 2020 of HEB. ↩

  76. An Act to Ordain and Institute the Civil Code of the Philippines [Civil Code of the Philippines], Republic Act No. 386, book IV, chapter 3, § 3, Art. 2221 (1949). ↩

  77. Seven Brothers Shipping Corporation v. DMC-Construction Resources, Inc., G.R. No. 193914 dated 26 November 2014. ↩

Backlinks

  • No backlinks found