NPC Issuance Wiki

NPC 21-085: JAA v. RB

Issued Decision

Decision Text

JAA,

Complainant,

-versus-

RB,

Respondent.

x----------------------------------------------------x

NAGA, P.C.;

Before this Commission is a Complaint filed by JAA (Complainant) against RB (Respondent) for an alleged violation of Sections 31 and 32 of the Data Privacy Act of 2012 or Republic Act No. 10173 (DPA).

Facts

On 28 May 2021, the Commission, through its Complaints and Investigation Division (CID), received Complainant’s Complaints-Assisted Form (CAF) dated 27 May 2021.1

In Complainants’ CAF, he attached a Complaint Affidavit alleging that on 30 July 2020, one of his friends who is a member of the Facebook group BAA Today, forwarded to him a certain post by Respondent, BAA’s Barangay Captain, pertaining to his alleged violation of home quarantine rules and its corresponding penalty.2

The next day, on 31 July 2020, the Philippine National Police (PNP) and the BAA alternately parked in front of Complainant’s house, causing noise which resulted in his “tremendous humiliation.”3

On 07 August 2020, Complainant narrated that “while resting most of the day, about around 7:00pm, the door bell rang and the Muntinlupa Police team leader much more educated, has exchanged numbers again for an unfounded report.”4

On 08 August 2020, a doctor visited Complainant’s house to issue him a Medical Certificate with a COVID negative diagnosis and further informing him that he is “fit to work and travel.”5

On 09 August 2020, the PNP and BAA returned to Complainant’s house regarding the same issue.6 Complainant further declared that “on the same day, little that I know that a thread in BAA Today was initiated where my case has been publicly discussed by certain members.”7 Said Facebook post reads:

Disobedience to home quarantine:

Brgy is preparing a case against a covid patient who violated the quarante (sic) protocol of RA 11332, Section 9.

(e) Non-cooperation of the person or entities identified as having the notifiable disease or affected by the health event of public concern.

Section 10. Penalties. ---shall be penalized with a fine of not less than ₱20,000.00 but not more than ₱50,000.00 or imprisonment of not less than one (1) month but not more than six (6) months, or both such fine and imprisonment, at the discretion of the proper court.8

In addition, Complainant averred that Respondent led the discussion on the comment thread and thereafter disclosed his name and address with all false statements and accusations:

Hey A and G, we’re doing what we can. You want the name and address, I will give it to you; JA of XX Luzon. And lets all go to prison for violation of data privacy.9

The Complainant also mentioned that another member of BAA Today even posted a photo of his house with the barangay ambulance and police stationed therein, captioned as follows:

This is outside his house now. Just posting it here because seems like he is trying to let people know. I don’t know what protocols he is talking about nor the full story behind everything. Just posting to let everyone see.10

Complainant attached screenshots of the Facebook thread as annexes to prove that his privacy rights have been violated “by means of malicious and unauthorized disclosure.”11 He further claimed that this incident caused him congestive heart failure, lost business opportunities, friends and acquaintances that distanced themselves from him, and emotionally disturbed family members in the Philippines and abroad.12

On 25 June 2021, the CID issued an Order to Comment, requiring Respondent to file a verified comment within fifteen (15) calendar days from receipt of said Order.13

On 12 July 2021, the CID issued an Order for the parties to appear virtually before the Commission for the conduct of a preliminary conference on 24 August 2021 and 07 September 2021, via Microsoft Teams.14

On 26 July 2021, Respondent filed his Comment, denying the charges filed against him as it was intended to build an inexistent case against him and to harass and unlawfully coerce him.15

In Respondent’s Comment, he argued that the DPA does not apply to him because he is not involved in the processing of Complainant’s personal information, there is no data breach that occurred given that his authority as Barangay Chairman of BAA allowed him to access their COVID positive list, and he is only implementing the provisions of Section 9 (e) of Republic Act 11332 or the Mandatory Reporting of Notifiable Diseases and Health Events of Public Health Concern Act (RA 11332).16

Likewise, Respondent posited that Complainant did not even deny that he was COVID positive, which should have prompted him to follow minimum public health standards such as strict home quarantine and isolation.17 Lastly, the confirmation by the reports and footages from the closed-circuit television camera (CCTV) that Complainant regularly goes out of his house during his supposed isolation made him vulnerable to the BAA’s regulation, through the Barangay Health Emergency Response Team (BHERT) and the PNP.18

Respondent concluded that “had it not for the non-cooperation of the complainant, the complained incidents on July 30, 2020, July 31, 2020 and August 7, 2020 should have been avoided.”19 Thus, Respondent prayed for the summary dismissal of the proceedings because of the complaint’s lack of factual and legal basis, further alleging that “the barangay, being a government instrumentality, cannot be sued without its consent.”20

On 19 August 2021, Respondent, through Counsel, filed an Entry of Appearance and Manifestation with Preliminary Conference Brief.21 It was alleged therein that Respondent is willing to enter into an amicable settlement with the Complainant under just and equitable terms22 and that Respondent intends to avail of the different modes of discovery procedures for the expedient resolution of the case.23

Respondent attached a copy of the Complaint, dated 28 April 2021, filed by the Complainant through the 8888 Citizens’ Complaint Hotline:

“Isa akong recovered COVID patient. Last year around month of August pa ako nagka-covid. Mangyari kasi na itong si Kapitan RB ng BAA Muntinlupa ay pinakitaan ako ng hindi magandang pag-uugali. Ni-discriminate niya ako at pinandidirihan dahil nagka-COVID ako. Kaya pala iba rin ang turing ng mga kapitbahay ko sa akin dahil nag-create siya ng group chat para pag-usapan ako. Pinadirihan nila ako at kung ano-ano ang sinabi nila sa akin. Kaya ko nalaman na gumawa sila ng gc ay dahil member sa gc ang aking kaibigan at may mga ebidensya ako. Gusto ko lang na mapatawan siya ng parusa dahil sa ginawa niyang mapapahiya sakin. Naalala ko pa noon na pinapuntahan niya pa ako sa mga pulis, tinakot ako na huwag akong lalabas dahil dadamputin daw nila ako. May nag-report daw na pagala-gala ako kaya ikukulong daw nila ako kapag lumabas ako ng bahay. Sobra yung ginawa ng Kapitan ko sa akin at ng mga kapitbahay ko, kaya lumipat nalang ako ng ibang tirahan. Hindi dapat nila ako trinato ng ganoon lalo na at COVID patient ako that time. Bilang nakaupo sa gobyerno ay hindi dapat nagging ganoon ang pagtrato niya. Sana ay maaksyunan ito.”24

Also included is a copy of the Acting Punong Barangay’s reply, on behalf of Respondent, dated 04 May 2021, to the abovementioned Complaint to the 8888 Citizens’ Complaint Hotline:

In reply to the complaint of JA for alleged discrimination to a Covid patient. Please be informed that he was identified/listed in the Covid positive list of BAA. He should observe STRICT HOME quarantine/isolation and minimum public health standards at all times until his recovery.

Reports and CCTV footage confirmed that he frequently goes out of his house during the isolation period that poses significant risks to the health of the residents of AAV.

We seek the assistance of PNP and Barangay Health and Response Team (BHERT) to monitor the movement of the patient to prevent him from going out of his house.

We intend to file a complaint against him for violation of Section 9.e of Republic Act no. 11332, however the case was not filed because he moved-out of AAV when the lease contract of the house he was renting expired last February 16, 2021.25

On 23 August 2021, Respondent executed a Special Power of Attorney, naming, constituting, and appointing YSF, as his Attorney-in-Fact to act for and in his stead.26

On 24 August 2021, the CID issued an Order (after the 1st Preliminary Conference), wherein both parties manifested that they are willing to undergo mediation proceedings before the Commission.27

On 25 August 2021, Respondent submitted his Application for Mediation.28 On the other hand, Complainant presented his on 28 August 2021.29

On 31 August 2021, an Order to Mediate was issued, approving the parties’ Applications for Mediation, and suspending the complaint proceedings for sixty (60) days for the conduct of mediation proceedings.30 The parties are thereafter ordered to appear at the preliminary mediation conference on 09 September 2021, via Microsoft Teams.31

On 07 October 2021, the CID issued a Notice of Non-Settlement of Dispute for failure of Respondent to appear without prior notice and justifiable reason for two consecutive mediation conferences.32

On 14 October 2021, the CID issued an Order (for Resumption of Complaints Proceedings and Submission Memoranda), lifting the suspension of the complaints proceedings as the parties are unable to reach a settlement.33 The parties were also ordered to submit their respective memoranda within fifteen (15) calendar days from receipt of this Order.34

On 29 October 2021, Complainant submitted his Memorandum, arguing that Respondent headed the malicious publishing of his name and address on BAA’s Facebook group with over seven thousand (7,000) members.35 Complainant added that Respondent consequently “admitted to violating data privacy laws and willing to go to prison for it.”36

Complainant further claimed that the consequences of the event were inhumane, discriminatory, and dangerous to his health and safety.37 Also, what made things worse is the mental torture that Complainant allegedly had to withstand by reason of the incident.38

Appealing for a decision in his favor, Complainant concluded that his privacy rights have been violated by means of malicious and unauthorized disclosure.39

On 15 November 2021, Respondent, through Counsel, submitted his Memorandum, adopting the statements in his Comment and praying for the dismissal of the Complaint for utter lack of merit.40

On 20 August 2022, Complainant’s Counsel filed his Entry of Appearance.41

On 20 February 2023, Complainant, through Counsel, filed an Urgent Motion for Resolution, stating:

  1. The Complainant has sufficiently established that there was no consent to divulge, use nor even disseminate his personal information to the AAC through the group chat message and other means done by the respondent;

  2. The Respondent clearly exhibited malice, wanton, capricious and illegal actions and thus must be held to answer for his unwarranted actions to the damage and prejudice of the Complainant;

  3. The Respondent being an elected public official should have maintained and respected the privacy rights of the Complainant, when the same came to his possession by any and all means;

  4. He was not at liberty to disclose any and all personal information of the Complainant to the public and to the AAA by any and all means unless it is for a legitimate legal purpose or as provided for by law;

  5. There is nothing in Philippines laws, jurisprudence, procedures, circulars, memoranda, nor bulletins that authorize an elected barangay official to disclose any and all personal information to the public without the consent of the data subject;

  6. The COVID-19 pandemic did not suspend the operation and effectivity of Data Privacy Act of 2012 or Republic Act No. 10173;

  7. The unwarranted, prejudicial, disrespectful and illegal disclosure by the said public official, as shown by the evidence presented before this Honorable Tribunal, is a clear manifestation of his violation of the Privacy rights of the Complainant;

  8. This case is about to be three (3) years old, in May 2023, with the Respondent not yet being held to answer for his illegal acts;

  9. The Complainant has yet to attain the justice he rightfully deserves.42

Complainant therefore prays that the case be resolved and that the appropriate criminal and civil cases be filed in the proper court for the malicious, wanton, capricious and illegal actions of the Respondent in violating his rights under the DPA.43

On 22 March 2023, the CID issued a Notice that the case has been submitted for the decision of the Commission.44

Issue

Whether Respondent is liable for violation of Sections 31 and 32 of the DPA.

Discussion

Respondent is not liable for Malicious Disclosure under Section 31 of the DPA.

Malicious Disclosure, as penalized under Section 31 of the DPA, states:

SEC. 31. Malicious Disclosure. – Any personal information controller or personal information processor or any of its officials, employees or agents, who, with malice or in bad faith, discloses unwarranted or false information relative to any personal information or personal sensitive information obtained by him or her, shall be subject to imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).45

Malicious Disclosure is committed when the following elements concur:

  1. The perpetrator is a personal information controller or a personal information processor or any of its officials, employees or agents;

In Respondent’s Comment, he argued that the DPA does not apply to him because he is not involved in the processing of Complainant’s personal information.46

Section 3 (h) of the DPA defines a personal information controller (PIC) as “a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.”47

Following the abovementioned definition, Respondent is considered a PIC. As Barangay Captain, he is given access to the personal information of the COVID patients in BAA to effectively implement the provisions of Section 4 (f) of RA 11332, which states:

To ensure that public health authorities have the statutory and regulatory authority to ensure the following:

(1) Mandatory reporting of reportable diseases and health events of public health concern;

(2) Epidemic/outbreaks and/or epidemiologic investigation, case investigations, patient interviews, review of medical records, contact tracing, specimen collection and testing, risk assessments, laboratory investigation, population surveys, and environmental investigation;

(3) Quarantine and isolation; and

(4) Rapid containment and implementation of measures for disease prevention and control.48

This is further affirmed by the Department of Health-National Privacy Commission (DOH-NPC) Joint Memorandum Circular (JMC) No. 2020-0002 on Privacy Guidelines on the Processing and Disclosure of COVID-19 Related Data for Disease Surveillance and Response, which delineates the roles and responsibilities of public health authorities:

  1. Act as personal information controller.

  2. Comply with the DOH COVID-19 surveillance and response protocols and standards, including guidelines on privacy and data protection, and processing and disclosure of COVID-19 related data.49 (Emphasis supplied)

As also admitted by Respondent in his Comment, his authority as Barangay Chairman of BAA allowed him to access their COVID positive list.50 Thus, contrary to Respondent’s belief, he is a public health authority involved in the processing of Complainant’s personal information under the DPA.

  1. The perpetrator disclosed personal or sensitive personal information;

Complainant averred that Respondent disclosed his name and address with all false statements and accusations in a thread initiated by him through a Facebook post.51

Disclosing Complainant’s personal and sensitive personal information is an act of processing under the DPA. As defined, processing refers to “any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure, or destruction of data.”52

Sections 3 (g) and (l) of the DPA classify personal information and sensitive personal information, respectively as:

Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.53 (Emphasis supplied)

xxx

Sensitive personal information refers to personal information:

(1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;

(2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;

(3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and

(4) Specifically established by an executive order or an act of Congress to be kept classified.54 (Emphasis supplied)

The screenshots adduced by Complainant in his CAF clearly showed that Respondent disclosed his name, address, and health status as COVID positive to the BAA Facebook page.55 The comments in said page read:

Hey A and G, we’re doing what we can. You want the name and address, i will give it to you; JA of XX Luzon. And lets all go to prison for violation of data privacy.56 (Emphasis supplied)

xxx

J, he is a covid patient who violated the home quarantine protocol despite the repeated explanation of the brgy medical and pnp. If he’s implying that he does not know protocol, then all those visits and explanations did not go to his head. (Emphasis supplied)57

The foregoing statements evidently show that Respondent indeed disclosed the personal information of Complainant when he published his name and address, and his sensitive personal information which pertains to his COVID status as it concerns an individual’s health.

  1. The disclosed information relates to unwarranted or false information; and

The disclosed information in this case pertains to Complainant’s name, address, and health status. As to his name and address, there can be no question because Complainant never disputed the same. Rather, he filed the instant case because aside from his health status, it was his name and address that were published.

Regarding Complainant’s health status, in his Complaint filed through the 8888 Citizens’ Complaint Hotline, he admitted contracting COVID at the time of the incident:

“Isa akong recovered COVID patient. Last year around month of August pa ako nagka-covid. Mangyari kasi na itong si Kapitan RB ng BAA Muntinlupa ay pinakitaan ako ng hindi magandang pag-uugali. Ni-discriminate niya ako at pinandidirihan dahil nagka-COVID ako. Kaya pala iba rin ang turing ng mga kapitbahay ko sa akin dahil nag-create siya ng group chat para pag-usapan ako. Pinadirihan nila ako at kung ano-ano ang sinabi nila sa akin. Kaya ko nalaman na gumawa sila ng gc ay dahil member sa gc ang aking kaibigan at may mga ebidensya ako. Gusto ko lang na mapatawan siya ng parusa dahil sa ginawa niyang mapapahiya sakin. Naalala ko pa noon na pinapuntahan niya pa ako sa mga pulis, tinakot ako na huwag akong lalabas dahil dadamputin daw nila ako. May nag-report daw na pagala-gala ako kaya ikukulong daw nila ako kapag lumabas ako ng bahay. Sobra yung ginawa ng Kapitan ko sa akin at ng mga kapitbahay ko, kaya lumipat nalang ako ng ibang tirahan. Hindi dapat nila ako trinato ng ganoon lalo na at COVID patient ako that time. Bilang nakaupo sa gobyerno ay hindi dapat nagging ganoon ang pagtrato niya. Sana ay maaksyunan ito.”58

Although these statements from the Complainant himself indicate that the disclosed information was not false, nonetheless, it was still unwarranted.

DOH-NPC JMC No. 2020-0002 states that “aggregate, pseudonymized, or anonymized data may still be made available which may include details on a patient’s sex, age, barangay, travel history, etc., taking caution that a COVID-19 suspected, probable, or confirmed case should not be capable of being identified.”59

While the abovementioned JMC does not prohibit disclosure per se, the disclosure made by Respondent was still unjustified because Complainant was specifically identified as a confirmed case on the BAA Facebook page, necessarily compromising a COVID patient’s privacy rights, as will be discussed in the succeeding paragraphs.

  1. The disclosure was made with malice or in bad faith.

In Complainant’s Urgent Motion for Resolution, he claimed that “the Respondent clearly exhibited malice, wanton, capricious and illegal actions.”60

In administrative proceedings such as this case, the burden of proof required is substantial evidence, or “that amount of relevant evidence which a reasonable mind might accept as adequate to justify a conclusion.”61 The Supreme Court has explained that:

[T]he complainant has the burden of proving by substantial evidence the allegations in his complaint. The basic rule is that mere allegation is not evidence and is not equivalent to proof. Charges based on mere suspicion and speculation likewise cannot be given credence.62

In this case, however, Complainant failed to discharge the onus probandi that Respondent acted with bad faith or malice in disclosing his personal information. Aside from bare assertions that his privacy rights have been violated “by means of malicious and unauthorized disclosure”63 and that “Respondent clearly exhibited malice, wanton, capricious and illegal actions,”64 there is nothing on record that would support said claims.

In line with this, it is well to note that “good faith is always presumed unless convincing evidence to the contrary is adduced. It is incumbent upon the party alleging bad faith to sufficiently prove such allegation. Absent enough proof thereof, the presumption of good faith prevails.”65

In this regard, the Supreme Court defined malice as one which “connotes ill will or spite and speaks not in response to duty but merely to injure the reputation of the person defamed and implies an intention to do ulterior and unjustifiable harm.”66 Meanwhile, as to bad faith, it “implies a conscious and intentional design to do a wrongful act for a dishonest purpose or some moral obliquity.”67

Here, the Complainant did not sufficiently prove bad faith on the part of Respondent. In JCB vs. FRL, the Commission held that:

The disclosure, however, was done without malice or bad faith. The existence of malice or bad faith cannot be presumed. In this case, JCB alleged that FRL acted with malice or in bad faith in disclosing the incidents that were already amicably settled. Further, he attempted to demonstrate the existence of malice or bad faith by claiming that the information disclosed were confidential and were obtained by FRL in her official position. He, however, failed to substantially provide evidence to support this claim. It is fundamental that he who alleges has the burden to prove his allegation with the quantum of evidence prescribed by law.68

In this case, Respondent’s post on BAA’s Facebook page only identified a covid patient who violated quarantine protocols:

Disobedience to home quarantine:

Brgy is preparing a case against a covid patient who violated the quarante (sic) protocol of RA 11332, Section 9.

(e) Non-cooperation of the person or entities identified as having the notifiable disease or affected by the health event of public concern.

Section 10. Penalties. ---shall be penalized with a fine of not less than ₱20,000.00 but not more than ₱50,000.00 or imprisonment of not less than one (1) month but not more than six (6) months, or both such fine and imprisonment, at the discretion of the proper court.69 (Emphasis supplied)

However, said post triggered a slew of comments from the terrified and frustrated residents of BAA:

“Is he from our village?”70

xxx

“A person such as this is a danger to our community and therefore, we all need to be warned regarding his identity and the barangay take all necessary action to contain him from doing further damage!”71

xxx

“O no! Hoping he has not contaminated the community…is there a way to advise his neighbors to minimize transmission.”72

xxx

“It would surely help to know where he went and when.”73

xxx

“Since a case will be filed, I take it that the complaint stems from the barangay. Hence it is already public record. His name and address should be put out to warn the community. It will also help enforcement if his picture is put on line.”74

xxx

“I think it’s only fair to tell us his street so we are all aware about staying away.”75

xxx

“That’s unfair to someone who was exposed as positive patient if the Barangay doesnt identify this 2nd violator! It’s also for everybody’s safety if we know who he/she is. We can even pray for him”76

xxx

“May I know which street does the guy live?”77

xxx

“Just post his name and address so this menace can be neutralized. If he can’t be considerate to others why should the rest of us tiptoe around his rights?”78

From these statements, it can be gleaned that they prompted Respondent to disclose Complainant’s personal and sensitive personal information, ensuring that the residents of BAA are well informed about health-related events and conditions in their Barangay.

In Respondent’s Comment, he posited that “reports and CCTV footage confirmed that Complainant frequently goes out of his house during his supposed isolation period”79 when he should have “observed strict home quarantine/isolation and minimum public health standards as provided by various quarantine policies of the government during this time of the pandemic.”80

As Barangay Chairman, Respondent believed that he was merely implementing Section 9 (e) of RA 11332,81 which prohibits the non-cooperation of persons identified as having the notifiable disease or those affected by the health event of public concern, such as Complainant in this case.82

To reiterate, the screenshots presented as evidence show that it was only after Respondent was prodded by the concerned citizens of BAA, who wanted to protect themselves from the spread of the virus, that he revealed Complainant’s personal information by commenting in the thread.

The abovementioned circumstances establish that Respondent was seemingly motivated by the need to appease the sentiments of his constituents, especially given that the Facebook post complained of was dated 09 August 2020, a time when the COVID pandemic was at its peak. As such, this negates any indication that the disclosure was done for a dishonest purpose or some moral obliquity.

Despite Respondent’s overenthusiasm in upholding his responsibility as a public health authority duly tasked with the implementation of quarantine protocols that he disregarded Complainant’s rights, as will be discussed in the succeeding paragraphs, the Commission still maintains that Respondent was not influenced by malice or bad faith when he disclosed Complainant’s personal and sensitive personal information. Thus, Respondent is not liable for Malicious Disclosure under Section 31 of the DPA.

Respondent is liable for Unauthorized Disclosure under Section 32 of the DPA.

Unauthorized Disclosure under Section 32 of the DPA provides:

Section 32. Unauthorized Disclosure. – (a) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).83

To determine whether there is Unauthorized Disclosure, the following requisites must concur:

  1. The perpetrator is a personal information controller or personal information processor;
  2. The perpetrator disclosed information;
  3. The information relates to personal or sensitive personal information;
  4. The perpetrator disclosed the personal or sensitive personal information to a third party;
  5. The disclosure was without any of the lawful basis for processing, consent or otherwise, under Sections 12 and 13 of the DPA; and
  6. The disclosure is neither malicious nor done in bad faith and the information disclosed is not unwarranted or false information.84

Given that in the preceding discussion, the first, second, third, and sixth elements were adequately deliberated upon, emphasis will now be on the fourth and fifth elements to underscore Respondent’s liability for Unauthorized Disclosure under Section 32 of the DPA.

Anent the fourth element, that the perpetrator disclosed the personal or sensitive personal information to a third party, the Commission finds that the members of the BAA Facebook group are third parties to the PIC-data subject relationship of the Respondent and Complainant.

The DOH Updated Guidelines on Contact Tracing provides that disclosure of patient identifiers or patient data shall be limited to authorized entities, officers, personnel and concerned individuals only.85 The said disclosure is allowed if the same will serve a public purpose or function during the COVID-19 pandemic.86

Here, the members of the BAA Facebook group are in no way privy to the information that Respondent was able to access in his capacity as a PIC. The name, address, and health status of the Complainant, as a data subject, should have remained between him and the Respondent, absent any of the lawful basis for processing.

As to the fifth element, the Commission holds that the disclosure was without any of the lawful basis for processing, consent or otherwise, under Sections 12 and 13 of the DPA.

In line with this, it was previously held that a literal reading of Section 32 of the DPA will result in absurdity as a PIC or a personal information processor (PIP) may commit Unauthorized Disclosure if such disclosure was done without the consent of the data subject even if it is justified by another lawful criterion for processing.87

Section 32 of the DPA should be read together with Sections 12 and 13 on the criteria for lawful processing of personal and sensitive personal information.88 The presence of any of the criteria listed in Sections 12 and 13 is sufficient to justify the processing of personal or sensitive personal information, including its disclosure.89

However, the disclosure made by the Respondent does not fall under any of the lawful bases for processing under Sections 12 and 13 of the DPA. Although as earlier discussed that the Respondent’s disclosure was not motivated by malice or bad faith, it still does not find justification under the DPA or the NPC’s other issuances.

Nonetheless, NPC Advisory Opinion No. 2020-022 clarifies that the DPA has never been a hindrance to contact tracing activities of the government as the law does not prevent government institutions from processing personal data when necessary to fulfill their mandates.90

In relation to this, DOH-NPC JMC 2020-0002 states that aggregate health information, or pseudonymized or anonymized detailed health information may be disclosed for a legitimate purpose, consistent with the DOH Updated Guidelines on Contact Tracing provisions on Protecting Data Privacy of COVID-19 Cases and Close Contacts.91

Said policy is further reinforced in Section 10 (C) (5) of NPC Circular 2021-02, or the Guidelines on the Processing of Personal Data During Public Health Emergencies for Public Health Measures, which prohibits the disclosure of personal data to the public, the media, or any other public-facing platforms without the consent of the patient or vaccinee or his/her authorized representative or next of kin.92

Unfortunately, these issuances are what Respondent precisely failed to abide by when he specifically named the Complainant as a COVID patient in the BAA Facebook group with over seven thousand (7,000) members.

The Commission underscores that the rules on patient privacy and data subjects’ rights remain in effect even in times of public health emergencies. Those involved in the processing of personal health information of COVID-19 cases and identified close contacts shall adhere to the DPA, the NPC’s other issuances, and the general privacy principles, implement safeguards to protect personal data, and uphold data subjects’ rights at all times.93

As opposed to Respondent’s obligation “to protect and preserve identities of COVID-19 cases and identified close contacts, and their families to the extent that this does not result in undue discrimination, or physical or emotional harm or distress,”94 his unlawful disclosure of Complainant’s name, address, and health status, caused the latter with a “congestive heart failure, lost business opportunities, friends and acquaintances that distanced themselves from him, and emotionally disturbed family members in the Philippines and abroad.”95

A public health emergency such as the COVID-19 pandemic does not render our laws inoperable. Quite the contrary, these crises toughen our laws in safeguarding our rights and freedoms, specifically the right to data privacy, to ensure that such occurrence do not become excuses for these rights to be trampled upon.

At the time of the incident, proper procedures, as enunciated above, were already in place to balance the demands of the pandemic and protecting every individual’s data privacy rights. As a PIC and a public health authority, Respondent should have strictly observed the requirements of the law and employed strategies that are least intrusive to the rights and freedoms of the data subjects.

It bears stressing that the right to privacy of health information shall be protected at all times. Regrettably, the facts and the evidence laid down in this case established that the rights of the Complainant have been infringed upon, therefore resulting in Unauthorized Disclosure under Section 32 of the DPA.

Complainant is entitled to nominal damages under Section 16 (f) of the DPA.

Section 16 (f) of the DPA entitles data subjects to be indemnified for any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information.96

Article 2221 of the New Civil Code, which governs the restitution of any party aggrieved in relation to the DPA, states:

Art. 2221. Nominal damages are adjudicated in order that a right of the plaintiff, which has been violated or invaded by the defendant, may be vindicated or recognized, and not for the purpose of indemnifying the plaintiff for any loss suffered by him.97

In view of the foregoing, Respondent’s violation under Section 32 of the DPA, when he disclosed Complainant’s personal and sensitive personal information without any of the lawful basis for processing, is sufficient to warrant an award of nominal damages in favor of the Complainant.

WHEREFORE, premises considered, this Commission hereby:

  1. HOLDS Respondent RB liable for Unauthorized Disclosure, violating Section 32 of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA);

  2. AWARDS the Complainant JAA with nominal damages in the amount of ₱20,000.00 for Respondent’s unauthorized disclosure of his personal information and sensitive personal information, pursuant to Section 16 (f) of the DPA; and

  3. FORWARDS this Decision and a copy of the pertinent case records to the Secretary of Justice, recommending the prosecution of RB for Unauthorized Disclosure under Section 32 of the DPA.

SO ORDERED.

City of Pasay, Philippines.

08 February 2024.

JOHN HENRY D. NAGA

Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

NERISSA N. DE JESUS

Deputy Privacy Commissioner

Copy furnished:

JAA

Complainant

RB

Respondent

RBS

Counsel for Complainant

YSF

Counsel for Respondent

COMPLIANCE AND MONITORING DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

National Privacy Commission

Footnotes

  1. Complaints-Assisted Form dated 27 May 2021 of JAA. ↩

  2. Complaint Affidavit dated 25 May 2021 of JAA, at p. 1. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. ↩

  6. Complaint Affidavit dated 25 May 2021 of JAA, at p. 1. ↩

  7. Id. ↩

  8. Attached Screenshots from the Complaints-Assisted Form dated 27 May 2021 of JAA, at p. 13. ↩

  9. Id, at p. 8. ↩

  10. Id, at p. 16. ↩

  11. Complaint Affidavit dated 25 May 2021 of JAA, at p. 1. ↩

  12. Id. ↩

  13. JAA vs. RBS, NPC 21-085, Order to Comment dated 25 June 2021. ↩

  14. JAA vs. RB, NPC 21-085, Order to Appear for Preliminary Conference dated 12 July 2021. ↩

  15. Comment dated 26 July 2021 of RB, at p. 1. ↩

  16. Id. ↩

  17. Id. ↩

  18. Id. ↩

  19. Comment dated 26 July 2021 of RB, at p. 2. ↩

  20. Id. ↩

  21. Entry of Appearance and Manifestation with Preliminary Conference Brief for Respondent RB dated 19 August 2021. ↩

  22. Id, at p. 2. ↩

  23. Id, at p. 4. ↩

  24. 8888 Citizens’ Complaint dated 28 April 2021 of JAA. ↩

  25. Reply dated 04 May 2021 of MR Sto 8888 Citizens’ Complaint of JAA. ↩

  26. Special Power of Attorney dated 23 August 2021 of RB. ↩

  27. JAA vs. RB, NPC 21-085, Order after the 1st Preliminary Conference on 24 August 2021 dated 24 August 2021. ↩

  28. Application for Mediation dated 25 August 2021 of RB. ↩

  29. Application for Mediation dated 28 August 2021 of JAA. ↩

  30. JAA vs. RB, NPC 21-085, Order to Mediate dated 31 August 2021. ↩

  31. Id. ↩

  32. JAA vs. RB, NPC 21-085, Notice of Non-Settlement of Dispute dated 07 October 2021. ↩

  33. JAA vs. RB, NPC 21-085, Order for Resumption of Complaints Proceedings and Submission Memoranda dated 14 October 2021. ↩

  34. Id. ↩

  35. Complaint Memorandum dated 29 October 2021 of JAA. ↩

  36. Id. ↩

  37. Id. ↩

  38. Id. ↩

  39. Complaint Memorandum dated 29 October 2021 of JAA. ↩

  40. Memorandum dated 15 November 2021 of RB. ↩

  41. Entry of Appearance for JAA, dated 20 August 2022. ↩

  42. Urgent Motion for Resolution dated 20 February 2023 of JAA, at pp. 5-6. ↩

  43. Id, at p. 6. ↩

  44. JAA vs. RB, NPC 21-085, Notice that the Case is Submitted for the Decision of the Commission dated 22 March 2023. ↩

  45. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, chapter VIII, § 31 (2012). ↩

  46. Comment dated 26 July 2021 of RB, at p. 2. ↩

  47. Data Privacy Act of 2012, chapter I, § 3 (h). ↩

  48. An Act Providing Policies and Prescribing Procedures on Surveillance and Response to Notifiable Diseases, Epidemics, and Health Events of Public Health Concern, and Appropriating Funds Therefor, Repealing for the Purpose Act No. 3573, Otherwise Known as the “Law on Reporting of Communicable Diseases” [Mandatory Reporting of Notifiable Diseases and Health Events of Public Health Concern Act], Republic Act No. 11332, § 9 (e) (2019). ↩

  49. Privacy Guidelines on the Processing and Disclosure of COVID-19 Related Data for Disease Surveillance and Response, Joint Memorandum Circular No. 2020-0002, VII (E) (2020). ↩

  50. Comment dated 26 July 2021 of RB, at p. 2. ↩

  51. Complaint Affidavit dated 25 May 2021 of JAA, at p. 1. ↩

  52. Data Privacy Act of 2012, chapter I, § 3 (j). ↩

  53. Data Privacy Act of 2012, chapter I, § 3 (g). ↩

  54. Data Privacy Act of 2012, chapter I, § 3 (l). ↩

  55. Attached Screenshots from the Complaints-Assisted Form dated 27 May 2021 of JAA. ↩

  56. Id, at p. 8. ↩

  57. Id, at p. 13. ↩

  58. 8888 Citizens’ Complaint dated 28 April 2021 of JAA. ↩

  59. Public Disclosure of Identities of COVID Patients for Contact Tracing, NPC Advisory Opinion No. 2020-022, 08 June 2020, at p. 3. ↩

  60. Urgent Motion for Resolution dated 20 February 2023 of JAA, at p. 6. ↩

  61. 2019 Amendments to the 1989 Revised Rules on Evidence, Administrative Matter No. 19-08-15-SC, Rule 133, § 6 (2019). ↩

  62. Pastor Abaracoso Macaventa v. Atty. Anthony C. Nuyda, A.C. No. 11087, 12 October 2020. ↩

  63. Complaint Memorandum dated 29 October 2021 of JAA. ↩

  64. Urgent Motion for Resolution dated 20 February 2023 of JAA, at pp. 5-6. ↩

  65. Heirs of Severa P. Gregorio v. Court of Appeals, G.R. No. 117609, 29 December 1998. ↩

  66. Mary Elizabeth Ty-Delgado v. House of Representatives Electoral Tribunal, G.R. No. 219603, 26 January 2016. ↩

  67. Nancy S. Montinola v. Philippine Airlines, G.R. No. 198656, 08 September 2014. ↩

  68. JCB vs. FRL, NPC 21-031, Decision dated 03 March 2022, at p. 12. ↩

  69. Attached Screenshots from the Complaints-Assisted Form dated 27 May 2021 of JAA, at p. 13. ↩

  70. Id, at p. 8. ↩

  71. Id, at p. 10. ↩

  72. Id, at p. 11. ↩

  73. Attached Screenshots from the Complaints-Assisted Form dated 27 May 2021 of JAA, at p. 31. ↩

  74. Id, at p. 35. ↩

  75. Id, at p. 36. ↩

  76. Id, at p. 36. ↩

  77. Attached Screenshots from the Complaints-Assisted Form dated 27 May 2021 of JAA, at p. 38. ↩

  78. Id, at p. 38. ↩

  79. Comment dated 26 July 2021 of RB, at p. 3. ↩

  80. Id, at p. 3. ↩

  81. Id, at pp. 2-3. ↩

  82. Mandatory Reporting of Notifiable Diseases and Health Events of Public Health Concern Act, § 9 (e). ↩

  83. Data Privacy Act of 2012, chapter VIII, § 32. ↩

  84. EG v. JI, RO, and RR, NPC 21-111, Decision dated 22 September 2022, at pp. 11-12. ↩

  85. Department of Health, Updated Guidelines on Contact Tracing of Close Contacts of Confirmed Coronavirus Disease Cases, Department Memorandum 2020-0189 (2020). ↩

  86. Department of Health Department Memorandum 2020-0189. ↩

  87. MVC, et al. v. DSL, NPC 21-010 to NPC 21-015, Decision dated 03 February 2022, at p. 11. ↩

  88. Id, at p. 12. ↩

  89. Id, at p. 11. ↩

  90. Public Disclosure of Identities of COVID Patients for Contact Tracing, NPC Advisory Opinion No. 2020-022, 08 June 2020, at p. 3. ↩

  91. Department of Health and National Privacy Commission, Privacy Guidelines on the Processing and Disclosure of COVID-19 Related Data for Disease Surveillance and Response, Joint Memorandum Circular No. 2020-0002, VI (F) (2020). ↩

  92. National Privacy Commission, Guidelines on the Processing of Personal Data During Public Health Emergencies for Public Health Measures, NPC Circular 2021-02, § 10 (C) (5), (08 November 2021) (NPC Circular 2021-02). ↩

  93. Public Disclosure of Identities of COVID Patients for Contact Tracing, NPC Advisory Opinion No. 2020-022, 08 June 2020, at p. 3. ↩

  94. Department of Health and National Privacy Commission Joint Memorandum Circular No. 2020-0002, VII (F)(2). ↩

  95. Complaint Affidavit dated 25 May 2021 of JAA, at p. 1. ↩

  96. Data Privacy Act of 2012, chapter IV, § 16 (f). ↩

  97. An Act to Ordain and Institute the Civil Code of the Philippines [Civil Code of the Philippines], Republic Act No. 386, book IV, chapter 3, § 3, Art. 2221 (1949). ↩

Backlinks

  • No backlinks found