NPC Issuance Wiki

NPC 21-173: SLC v. Concentrix Philippines

Issued Decision

Decision Text

SLC,

Complainant,

-versus-

CONCENTRIX PHILS.,

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before this Commission is a Complaint filed by SLC against Concentrix Phils. (Concentrix) for alleged violation of Section 27 (Improper Disposal of Personal Information and Sensitive Personal Information) of the Data Privacy Act of 2012 or Republic Act No. 10173 (DPA).

Facts

According to her Complaints-Assisted Form (CAF), SLC was an employee of Concentrix at the [B] Ayala Land Technohub site (B site).1 In June 2021, she inquired with the Human Resources (HR) department about the Social Security System (SSS) Sickness Benefit that she could claim for her upcoming surgery.2 The HR department provided a list of requirements for the application, which SLC began to process.3 After her surgery, SLC returned to the office and submitted her application,4 together with a signed checklist of the documents she submitted.5 SLC also informed her manager of the submission through Facebook Messenger.6

On 10 July 2021, SLC sent an email to HR to follow up on the status of her application.7 STJ, an HR employee and the temporary person-in-charge for processing SSS applications,8 stated that she was lacking a document, an SSS Undertaking Form,9 and attached a copy for her signature.10 SLC complied and sent the signed form.11 She stated that she assumed “everything [was] okay after that”12 since STJ did not state otherwise and did not send any further emails.13

Thereafter, SLC sent another email to HR on 30 July 2021 to follow up on her application.14 On the same date, the person-in-charge of evaluating and processing all SSS applications, PDR, replied15 stating that “[HR] did not received [sic] the SSS [Sickness] Notification form [and] even the Reimbursement form is unsigned.”16 PDR asked SLC to submit a printout of her SSS contribution showing her name and SSS ID.17 SLC replied that she “gave [the required documents] to R from the reception completely,”18 that she even checked the documents in front of “R from the reception” before leaving the office, and that there was a checklist on the back of her submission.19 She asked why it took more than a month before she was informed that one of her documents was missing,20 since she was told that she only lacked the SSS Undertaking Form when she followed up the first time.21 Concentrix, however, did not respond.22

SLC sent an email to PDR, stating that STJ verified the submitted documents were complete before forwarding it to PDR.23 SLC also requested assistance from PDR in retrieving the missing SSS Notification Form so that she could process her SSS benefits application herself.24 PDR, however, did not respond.25

STJ sent an email to SLC, informing her that her submitted documents were left at the reception for claiming, and that she had to sign the attached “acknowledgement form.”26 She explained that she had resigned due to the stress caused by the situation.27

On 09 August 2021, SLC returned to the office to personally collect the documents she submitted.28 She alleged that her papers were returned incomplete.29

SLC filed her CAF dated 16 August 2021 with the National Privacy Commission (NPC).30 SLC prayed for damages and for the imposition of a fine against Concentrix.31

SLC alleged that she was made to wait for more than two (2) months before she found out what happened to her application.32 She also alleged that she could have already received her claims since, according to SSS procedures, the employer would reimburse her in advance.33 She stated that she had no reason not to submit the allegedly missing SSS Sickness Notification, since it was one of the “key” documents for the approval of her application.34 She also stated that Concentrix caused her “too much stress[s]” during her recovery, because she needed to go out to process her requirements only for Concentrix to end up losing the documents.35

To substantiate her allegations, SLC attached the following documents to her CAF: (1) a picture of the reception “logsheet” dated 24 June 2021 bearing the Concentrix logo and the header “Internal Routing Slip;”36 (Internal Routing Slip) (2) a checklist of documents required for SSS

24 Id. 25 Id. at 4. 26 Id. at 16. 27 Complaints -Assisted Form, 16 August 2021 ,at 4 ,in SLC v. Concentrix Philippines , NPC 21 -173 (NPC 2021 ). 28 Id. 29 Id. 30 Id. 31 Id. at 5. 32 Id. 33 Complaints -Assisted Form, 16 August 2021 ,at 5, in SLC v. Concentrix Philippines , NPC 21 -173 (NPC 2021 ). 34 Id. 35 Id. 36 Id. at 9.

NPC 21 -173

Sickness Application dated 23 June 2021 and signed by SLC;37 (3) the email thread in which SLC followed up on her SSS benefits application with STJ and PDR;38 and (4) screenshots of her conversation on Facebook Messenger between SLC, her manager, and operations manager, in which she notified them of her sickness claim submission.39

On 14 October 2021, the NPC through its Complaints and Investigation Division (CID), issued an Order directing the parties to appear virtually for a preliminary conference on 26 January 2022.40 The CID directed Concentrix to file a Verified Comment within fifteen (15) calendar days from receipt of the Order.41

On 16 December 2021, Concentrix filed its Comment.42

In its Comment, Concentrix narrated that SLC inquired about the SSS sickness benefit she could claim.43 Concentrix provided her with the necessary information and forms.44 It was explained to her that she could claim the sickness benefits by submitting the requirements to Concentrix, which would then process the application.45

On 15 June 2021, SLC submitted the documents for her application at the [B] site.46 At that time, PDR was on emergency leave.47 Therefore, STJ conducted the preliminary evaluation of SLC’s application.48

Concentrix stated that prior to her leave, PDR had instructed STJ to verify that employees submitted the undertaking form.49 Concentrix explained that there had been numerous instances when employees failed to submit their undertaking form, which caused delay in the processing of their application for SSS benefits.50 Upon checking, STJ found that SLC’s undertaking form was missing and sent her an email

43 Id. at 2. 44 Id. 45 Id. 46 Id. 47 Id. 48 Comment, 16 December 2021, at 2 -3,in SLC v. Concentrix Philippines , NPC 21 -173 (NPC 2021 ). 49 Id. 50 Id .Annex 1.

NPC 21 -173

on 10 July 2021 asking her to submit it.51 SLC complied and submitted her undertaking form.52

On 12 July 2021, PDR returned from her leave and STJ turned over all SSS application documents, including SLC’s, to her.53 PDR noticed that SLC’s SSS Sickness Notification Form was missing and that her SSS Reimbursement Form was unsigned.54 On 28 July 2021, PDR sent an email to SLC’s immediate supervisor, with instructions to ask SLC to submit the missing form and to re-submit the screenshot of her SSS contributions.55

On 30 July 2021, SLC sent an email with a screenshot of her SSS contributions to PDR.56 SLC claimed that she had already submitted her SSS Sickness Notification Form, along with the other documents.57 PDR replied, reiterating that Concentrix did not receive the form.58 Concentrix added that according to STJ, “from his recollection, [STJ] did not see the [SSS Sickness Notification Form]” and that, as a matter of diligence, he even searched the filing cabinet where the SSS applications were stored but did not find it.59

On 03 August 2021, SLC resigned from Concentrix.60 On 12 August 2021, SLC retrieved and signed an Acknowledgement Receipt dated 12 August 2021 covering the documents she previously submitted.61 Concentrix added that PDR also instructed SLC how to process her SSS sickness benefits application even after her resignation.62

According to the Acknowledgement Receipt, SLC claimed the following documents from Concentrix:

This is to acknowledge that I received the original copy of the following SSS sickness documents for personal processing:

  1. Sickness Benefit Reimbursement Application Form – Unsigned by HR Partner
  2. Original Medical certificate Dated June 07 2021
  3. Original Discharge Instruction
  4. Original Clinical Record (Operation Sheet, Surgical Technique Sheet, Anesthesai [sic] Record, Discharge Summary, Patients Record, Pathology Consultation) Dated June 21 2021
  5. Normal-Cardio Pulmonary Findings
  6. Photocopy of Passport ID
  7. Photocopy of UMID
  8. Affidavit of Undertaking
  9. CNX Undertaking Form
  10. Checklist for SSS Sickness Application.63

Given the foregoing, Concentrix stated that it did not receive the SSS Sickness Notification Form from SLC.

Concentrix also argued that it is not liable for Improper Disposal under Section 27 of the DPA.64

First, Concentrix argued that it did not receive SLC’s missing SSS Sickness Notification Form. As such, “there is no personal information or sensitive personal information therein about [SLC] which [Concentrix] could have improperly disposed.”65

According to Concentrix, SLC failed to present substantial evidence that Concentrix received her SSS Sickness Notification Form66 and was only speculating that Concentrix lost it.67 The Internal Routing Slip68 submitted by SLC only indicates “SSS docs” as the items left by her at the reception, and does not show that part of the documents submitted is the missing SSS Sickness Notification Form.69 Further, while SSS Sickness Notification Form was ticked in the checklist submitted by SLC,70 it was ticked and signed by SLC herself.71 As for the email thread submitted by SLC, it only shows that there were discussions about her application and reminders to submit her missing SSS Sickness Notification Form.72 Finally, the email dated 10 July 2021 from STJ is not an acknowledgement that SLC submitted all of the required documents, including the SSS Sickness Notification Form, as nothing in the email thread stated Concentrix received it.73

Concentrix stated that it returned all of SLC’s documents on 12 August 2021, as shown by the Acknowledgement Receipt she signed.74 It stated that “[w]hat [Concentrix] received, it returned to [SLC] after she manifested that she will process the SSS sickness benefits application herself.”75

To substantiate its allegations, Concentrix submitted STJ’s Affidavit dated 10 December 202176 and PDR’s Affidavit dated 10 December 2021,77 in which they both attested that they did not see the missing SSS Sickness Notification Form.78 Concentrix also submitted several emails from the email thread between the HR employees and SLC regarding the documents missing from her application, which included the SSS Sickness Notification Form.79

Second, Concentrix argued there is no proof that it or any of its representatives disposed of, discarded, or abandoned the form in a publicly-accessible area.80 Even assuming that it received the form, “[the SSS Sickness Notification Form] was not disposed of, discarded, or abandoned in an area accessible to the public as all SSS applications, including that of [SLC], are stored in a filing cabinet inside the People Solutions room at the [B site].”81

Third, Concentrix argued that there is no allegation or evidence that Concentrix placed the form in its container for trash collection.82

Finally, Concentrix argued that SLC is not entitled to damages because it did not violate any of SLC’s rights as a data subject.83 It argued that

NPC 21 -173

it is also not liable for fines because “[it] did not engage in Improper Disposal.”84

Given the foregoing, Concentrix prayed that the complaint be dismissed for utter lack of merit.85

During the 26 January 2022 preliminary conference, both parties appeared.86 Due to technical difficulties on SLC’s end, however, the CID reset the schedule to 23 February 2022.87

During the 23 February 2022 preliminary conference, both parties appeared.88

SLC manifested that the first page of the form that was not returned to her “contains her personal information and the operation conducted by her doctor.”89 She also manifested that she would not be availing of mediation proceedings, because what she wanted was to ensure that “the same incident will not happen again to the other employees of [Concentrix]” and not the payment of damages.90

Concentrix’s counsel, on the other hand, reiterated that the form is not in their possession and that it had never been given to Concentrix.91

Given that SLC was not willing to undergo mediation proceedings, the CID issued an Order directing the parties to submit their respective memoranda within thirty (30) calendar days from receipt.92

On 25 March 2022, Concentrix submitted its Memorandum.93 It reiterated substantially the arguments in its Comment dated 17 December 2021.94 SLC did not submit her memorandum.

Issue

Whether there is substantial evidence to find Concentrix liable for a violation of Section 27 of the DPA (Improper Disposal).

Discussion

The Commission dismisses the case for lack of substantial evidence.

I. Concentrix is not liable under Section 27 of the DPA (Improper Disposal).

A person who knowingly or negligently disposes, discards, or abandons personal or sensitive personal information without securing it against further processing, unauthorized access, or disclosure, by placing it in a publicly accessible area or in a container for trash collection, is liable under Section 27 of the DPA.95 Section 27 of the DPA provides:

Section 27. Improper Disposal of Personal Information and Sensitive Personal Information. (a) The improper disposal of personal information shall be penalized by imprisonment ranging from six (6) months to two (2) years and a fine of not less than One hundred thousand pesos (Php100,000.00) but not more than Five hundred thousand pesos (Php500,000.00) shall be imposed on persons who knowingly or negligently dispose, discard or abandon the personal information of an individual in an area accessible to the public or has otherwise placed the personal information of an individual in its container for trash collection.

(b) The improper disposal of sensitive personal information shall be penalized by imprisonment ranging from one (1) year to three (3) years and a fine of not less than One hundred thousand pesos (Php100,000.00) but not more than One million pesos (Php1,000,000.00) shall be imposed on persons who knowingly or negligently dispose, discard or abandon the personal information of an individual in an area accessible to the public or has otherwise placed the personal information of an individual in its container for trash collection.96

To be held liable under Section 27 of the DPA, the following elements must be present:

  1. There is personal or sensitive personal information;
  2. The personal or sensitive personal information was disposed, discarded, or abandoned;
  3. The manner of disposal, discarding, or abandonment was not in a secure manner that would prevent further processing, unauthorized access, or disclosure; and
  4. The place of disposal is an area accessible to the public or the personal or sensitive personal information was placed in a container for trash collection.97

In this case, Concentrix cannot be held liable for a violation of Section 27 of the DPA based on the allegations and evidence submitted by SLC.

In her CAF, SLC claimed that she submitted her SSS Sickness Notification Form together with her other documents.98 She alleged that after STJ emailed her to ask for the SSS Undertaking Form, she assumed “everything [was] okay after that” since he did not state that any other documents were missing and did not send further emails.99 In her email to PDR, SLC also explained that she gave the documents to “R from the reception,”100 and that SLC even checked them in front of her before leaving the office.101

To substantiate her allegations, SLC submitted a picture of the Internal Routing Slip102 and the checklist of documents required for SSS Sickness Application with her signature.103 SLC also submitted a copy of the email thread in which she followed up on her SSS benefits application with STJ and PDR.104

In this case, SLC, as the complainant, had the burden of proof in alleging a violation of the DPA. She, however, did not discharge this burden as she failed to support her allegations with substantial evidence.

NPC 21 -173

Section 1 of Rule 131 of the 2019 Amendments to the Revised Rules on Evidence provides:

Section 1. Burden of proof and burden of evidence. Burden of proof is the duty of a party to present evidence on the facts in issue necessary to establish his or her claim or defense by the amount of evidence required by law. Burden of proof never shifts.

Burden of evidence is the duty of a party to present evidence sufficient to establish or rebut a fact in issue to establish a prima facie case. Burden of evidence may shift from one party to the other in the course of the proceedings, depending on the exigencies of the case.105

Section 6 of Rule 133 of the 2019 Amendments to the Revised Rules on Evidence provides:

Section 6. Substantial Evidence. In cases filed before administrative or quasi-judicial bodies, a fact may be deemed established if it is supported by substantial evidence, or that amount of relevant evidence which a reasonable mind might accept as adequate to justify a conclusion.106

In BSA Tower Condominium Corporation v. Reyes,107 the Supreme Court held that:

The basic rule is that mere allegation is not evidence and is not equivalent to proof. Likewise, charges based on mere suspicion and speculation cannot be given credence.108

In this case, the documents attached to SLC’s complaint do not prove her allegations that Concentrix received and improperly disposed of her SSS Sickness Notification Form.

SLC submitted the Internal Routing Slip which showed her name and “SSS docs” in the description.109 According to SLC, this was the “reception logsheet.”110 SLC also included a signed checklist of documents required for SSS Sickness Application in her submission.111

Neither the Internal Routing Slip nor the checklist of documents, however, establish that the SSS Sickness Notification Form was included in SLC’s submission.

The Internal Routing Slip merely shows the date “6-24-21,” SLC’s name, and the description “SSS docs.”112 The description “SSS docs” does not specify what documents were received, and whether those documents included the missing SSS Sickness Notification Form. Similarly, the signed checklist does not specify what documents were submitted by SLC. Although SLC alleged in her CAF that she gave the documents to a certain “R from the reception”113 and that she even checked them in front of her before leaving the office,114 the signed checklist did not contain any form of acknowledgement by Concentrix regarding its receipt of the documents. Further, all the items under the header “Checklist for SSS Sickness Application” were ticked, except for the item “SSS Sickness e-Notification form.”115 While this does not prove that SLC failed to submit the missing form, it also does not prove that Concentrix received it.

Aside from the failing to prove that Concentrix actually received the missing form, these documents submitted by SLC do not show, much less prove, the second, third, or fourth element of Section 27.

Finally, the email threads between SLC, STJ, and PDR do not establish that Concentrix received the SSS Sickness Notification Form nor do they establish that there was any act of improper disposal on the part of Concentrix. It only shows that STJ informed SLC of the missing SSS Undertaking Form, and that PDR requested SLC to submit missing documents, which included the SSS Undertaking Form,116 the missing SSS Sickness Notification Form,117 a Reimbursement form with SLC’s signature,118 and a printout of her SSS contribution showing her name and SSS ID.119

Based on SLC’s assertions and submitted evidence, it cannot be said that Concentrix committed Improper Disposal under Section 27 of the DPA. The Internal Routing Slip, the checklist with SLC’s signature, and the email threads, do not sufficiently establish that Concentrix received the missing SSS Sickness Notification Form. Further, SLC did not submit evidence to prove that Concentrix improperly disposed, discarded, or abandoned the missing form in an area accessible to the public or in a container for trash collection.120

Given the foregoing, the Commission cannot find Concentrix liable for violating Section 27 of the DPA (Improper Disposal).

II. Concentrix is liable for nominal damages for its failure to fulfill its obligations as a PIC under Section 20 of the DPA.

While SLC failed to establish by substantial evidence that Concentrix violated Section 27 (Improper Disposal), Concentrix also failed to comply with its obligation as a PIC under Section 20 of the DPA.

There is a disputable presumption that SLC, in the ordinary course of managing her affairs, would exercise due care to ensure her requirements were complete. Rule 131, Section 3 of the 2019 Amendments to the Revised Rules on Evidence provides:

Section 3. Disputable presumptions. The following presumptions are satisfactory if uncontradicted, but may be contradicted and overcome by other evidence:

…

(d) That a person takes ordinary care of his or her concerns.121

SLC stated that she checked her documents before leaving them with “R from the reception.”122 Further, based on the evidence submitted by both parties, SLC sent two (2) follow-up emails regarding the status of her application.123 These actions show that SLC believed she submitted all of the required documents, including the SSS Sickness Notification Form, and was waiting for Concentrix to process her application.

NPC 21 -173

Further, while STJ and PDR stated in their respective Affidavits that they did not see the SSS Sickness Notification Form with SLC’s other documents,124 their allegations are self-serving.

In the email to SLC dated 10 July 2021, STJ requested SLC to submit the signed SSS Undertaking Form that was missing from her submission.125 STJ, however, did not mention any other missing documents. He stated in his email:

Hi SLC,

Please fill out and sign the lacking document of your SSS Sickness Benefit Application

• SSS Undertaking Form126

Further, in his Affidavit dated 11 December 2021, STJ stated that he evaluated SLC’s application and found that the SSS Undertaking Form was missing:

  1. Prior to going on leave, Ms. PDR reminded me to check the supporting documents of the SSS applications of employees and to ensure that they submitted the undertaking form.

  2. In line with Ms. PDR’s reminder, I checked the documents of Ms. SLC and noticed that she failed to submit the accomplished undertaking form. Thus, I e-mailed the SSS undertaking form to Ms. SLC on 10 July 2021. Ms. PDR was able to submit the same.

At that point in time, however, STJ did not inform SLC that her SSS Sickness Notification Form was also missing, despite his claim that he did not see it when SLC submitted her documents:

  1. On July 12, 2021, I turned over all SSS application documents, including the application of Ms. SLC, to Ms. PDR upon her return from her leave for processing. No document was left with me.

  2. I was informed that Ms. SLC claimed that she submitted her SSS Sickness Notification Form together with the other supporting documents on 15 June 2021. However, based on my

NPC 21 -173

recollection, I did not see the same. Further, and as matter of diligence, I searched the filing cabinet where the SSS applications are stored and did not see the alleged SSS Sickness Notification Form of Ms. SLC.127

STJ’s assertion that he did not see the missing SSS Sickness Notification Form, and that he even searched the relevant filing cabinet, is not conclusive evidence that SLC failed to submit it. This is especially true considering that STJ did not inform SLC of the missing SSS Sickness Notification Form when he emailed her about the missing SSS Undertaking Form on 10 July 2021. If the SSS Sickness Notification Form was indeed missing because SLC failed to submit it, STJ should have pointed it out to SLC after that initial evaluation.

PDR, in her Affidavit, explained that she found the SSS Sickness Notification Form was missing while evaluating SLC’s application.128 This shows that the absence of the SSS Sickness Notification Form was noted by Concentrix only after STJ had turned over the documents to PDR. PDR stated:

  1. Upon evaluation of SLC’s application, I noticed that while she was able to submit the accomplished undertaking form, as requested by Mr. STJ, she failed to submit her SSS Sickness Notification Form and sign the SSS Reimbursement Form.

  2. Thus, on 28 July 2021, I advised SLC’s immediate supervisor to ask her to submit the accomplished SSS Sickness Notification Form as well as to resubmit a screenshot of her SSS contributions showing her SSS number and name.

  3. On 30 July 2021, SLC sent an e-mail and submitted a screenshot of her SSS contributions. SLC also claimed that she already submitted her SSS Sickness Notification Form together with the other documents on 15 June 2021. I responded to her e-mail and reiterated that we did not receive her SSS Sickness Notification Form.129

The foregoing circumstances, which include SLC’s submission to “R from the reception,”130 STJ’s failure to inform SLC after initial evaluation, and PDR’s discovery that the form was missing after STJ

NPC 21 -173

turned over the documents to her, show that Concentrix failed to properly track and handle SLC’s documents.

As such, despite STJ’s and PDR’s claims that the SSS Sickness Notification Form is missing, their statements, in the absence of any other corroborating evidence, are insufficient to overturn the disputable presumption that SLC exercised due care in ensuring the completeness of her submission.131

Between SLC and Concentrix, Concentrix, as the PIC, is in a better position to prove its claim that there was no receipt if it had the proper processes in place. While SLC was not able to prove with substantial evidence that Concentrix violated Section 27, Concentrix was also not able to prove that it never received the missing form since it failed to show it had clear internal procedures for handling SLC’s documents or any process to confirm or dispute its receipt of the missing form.

The Commission sternly reminds Personal Information Controllers (PICs) of their continuing obligation to ensure that the personal data they process, whether offline or online, are properly protected. The Commission has explained that PICs must implement, monitor, evaluate, and update their security measures considering the risks that data subjects are exposed to.132

Section 20 (a) and (c) of the DPA provide the PIC’s obligation to implement measures for the protection of personal information:

Section 20. Security of Personal Information.

(a) The personal information controller must implement reasonable and appropriate organizational, physical and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.

…

(c) The determination of the appropriate level of security under this section must take into account the nature of the personal information to be protected, the risks represented by the processing, the size of the organization and complexity of its operations, current data privacy best practices and the cost of security implementation. Subject to guidelines as the Commission may issue from time to time, the measures implemented must include:

(1) Safeguards to protect its computer network against accidental, unlawful or unauthorized usage or interference with or hindering of their functioning or availability;

(2) A security policy with respect to the processing of personal information;

(3) A process for identifying and accessing reasonably foreseeable vulnerabilities in its computer networks, and for taking preventive, corrective and mitigating action against security incidents that can lead to a security breach; and

(4) Regular monitoring for security breaches and a process for taking preventive, corrective and mitigating action against security incidents that can lead to a security breach.133

In this case, Concentrix failed to show how it handled SLC’s submitted documents. Concentrix also failed to show that its process for handling documents had sufficient safeguards to protect the personal data involved. The documents submitted by Concentrix’s employees, particularly those related to medical benefits and procedures like SLC’s, contain both personal and sensitive personal information. Since there is no secure process for handling these documents, however, Concentrix’s data subjects are exposed to higher levels of risk. Concentrix should have ensured that a reliable system with appropriate security measures and secure processes for tracking the receipt, processing, and storage of documents received from its employees was in place.

The DPA provides that restitution for any aggrieved party shall be governed by the provisions of the New Civil Code.134 Article 2221 of the New Civil Code provides:

Article 2221. Nominal damages are adjudicated in order that a right of the plaintiff, which has been violated or invaded by the defendant, may be vindicated or recognized, and not for the purpose of indemnifying the plaintiff for any loss suffered by him.135

133 Data Privacy Act of 2012, § §20 (a), (c)(4). 134 Id. §37. 135 An Act to Ordain and Institute the Civil Code of the Philippines [C IVIL CODE ], Republic Act No. 386, art. 2221 (1950). NPC 21 -173

As stated, the PIC has an obligation to implement processes intended for the protection of personal information.136 An obligation implies not just a duty on the part of one party, but also denotes a correlative right on the other.137 Since there is an obligation on the part of a PIC to implement measures to protect the personal information that it processes, there is also a correlative right on the part of data subjects to expect that their personal information is being protected.138

Thus, as a recognition and vindication of SLC’s right as a data subject, the Commission awards nominal damages in the total amount of Ten Thousand Pesos (Php 10,000.00).

WHEREFORE, premises considered, the Commission DISMISSES the complaint filed by SLC against Concentrix Phils. (Concentrix).

The Commission AWARDS nominal damages in the amount of Ten Thousand Pesos (Php 10,000.00) to SLC to vindicate her right arising from Concentrix’s noncompliance with Section 20 (a) and (c) of Republic Act No. 10173 or the Data Privacy Act of 2012.

This is without prejudice to the filing of appropriate civil, criminal, or administrative cases before any other forum or tribunal, if any.

SO ORDERED.

City of Pasay, Philippines.
12 August 2024.

Sgd.

LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner

WE CONCUR:

Sgd.

JOHN HENRY D. NAGA
Privacy Commissioner

Sgd.

NERISSA N. DE JESUS
Deputy Privacy Commissioner

Copy furnished:

SLC
Complainant

BVL
Counsel for Respondent

CONCENTRIX PHILS.
Respondent

COMPLAINTS AND INVESTIGATION DIVISION
ENFORCEMENT DIVISION
GENERAL RECORDS UNIT

Footnotes

  1. Complaints-Assisted Form, 16 August 2021, at 3, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. at 10-11. ↩

  6. Id. at 3. ↩

  7. Complaints-Assisted Form, 16 August 2021, at 3, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  8. Comment, 16 December 2021, at 2-3, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  9. Complaints-Assisted Form, 16 August 2021, at 12, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  10. Id. at 3-4. ↩

  11. Id. at 4. ↩

  12. Id. ↩

  13. Id. ↩

  14. Id. ↩

  15. Complaints-Assisted Form, 16 August 2021, at 14, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  16. Id. ↩

  17. Id. ↩

  18. Id. at 15. ↩

  19. Id. ↩

  20. Id. ↩

  21. Complaints-Assisted Form, 16 August 2021, at 15, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  22. Id. at 4. ↩

  23. Id. at 16. ↩

  24. Id. ↩

  25. Id. at 4. ↩

  26. Id. at 16. ↩

  27. Complaints-Assisted Form, 16 August 2021, at 4, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  28. Id. ↩

  29. Id. ↩

  30. Id. ↩

  31. Id. at 5. ↩

  32. Id. ↩

  33. Complaints-Assisted Form, 16 August 2021, at 5, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  34. Id. ↩

  35. Id. ↩

  36. Id. at 9. ↩

  37. Id. at 10-11. ↩

  38. Id. at 12-16. ↩

  39. Complaints-Assisted Form, 16 August 2021, at 17-20, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  40. Order To File Verified Comment and Appear Virtually for Preliminary Conference, 14 October 2021, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  41. Id. at 1. ↩

  42. Comment, 16 December 2021, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  43. Id. at 2. ↩

  44. Id. ↩

  45. Id. ↩

  46. Id. ↩

  47. Id. ↩

  48. Comment, 16 December 2021, at 2-3, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  49. Id. ↩

  50. Id. Annex 1. ↩

  51. Id. at 3. ↩

  52. Id. ↩

  53. Id. ↩

  54. Comment, 16 December 2021, at 3, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  55. Id. ↩

  56. Id. ↩

  57. Id. at 3-4. ↩

  58. Id. at 3. ↩

  59. Id. ↩

  60. Comment, 16 December 2021, at 3, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  61. Id. Annex D. ↩

  62. Id. at 6. ↩

  63. Id. Annex D. ↩

  64. Id. at 12. ↩

  65. Id. at 12-13. ↩

  66. Comment, 16 December 2021, at 9, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  67. Id. at 6. ↩

  68. Id. at 9. ↩

  69. Id. at 8. ↩

  70. Complaints-Assisted Form, 16 August 2021, at 10-11, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  71. Comment, 16 December 2021, at 8, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  72. Id. ↩

  73. Id. ↩

  74. Id. Annex D. ↩

  75. Id. at 11. ↩

  76. Id. Annex 2. ↩

  77. Comment, 16 December 2021, Annex 1, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  78. Id. ↩

  79. Id. Annex A-C. ↩

  80. Id. at 13. ↩

  81. Id. ↩

  82. Id. ↩

  83. Comment, 16 December 2021, at 14, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  84. Id. ↩

  85. Id. ↩

  86. Order After the 1st Preliminary Conference held on 26 January 2022, 26 January 2022, at 1, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  87. Id. ↩

  88. Order After the 2nd Preliminary Conference held on 23 February 2022, 23 February 2022, at 1, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  89. Id. ↩

  90. Id. ↩

  91. Id. ↩

  92. Id. at 1-2. ↩

  93. Memorandum, 25 March 2022, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  94. Comment, 16 December 2021, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  95. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 § 27 (2012). ↩

  96. Id. ↩

  97. Id. ↩

  98. Comment, 16 December 2021, at 3-4, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  99. Complaints-Assisted Form, 16 August 2021, at 4, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  100. Id. at 15. ↩

  101. Id. ↩

  102. Complaints-Assisted Form, 16 August 2021, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  103. Id. ↩

  104. Id. ↩

  105. 2019 AMENDMENTS TO THE 1989 REVISED RULES ON EVIDENCE [2019 REVISED RULES ON EVIDENCE], A.M. No. 19-08-15-SC, rule 131, § 1 (1 May 2020). Emphasis supplied. ↩

  106. Id. rule 133, § 6. ↩

  107. BSA Tower Condominium Corp. v. Reyes II, A.C. No. 11944 (2018). ↩

  108. Id. ↩

  109. Complaints-Assisted Form, 16 August 2021, at 9, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  110. Id. at 4. ↩

  111. Id. at 10-11. ↩

  112. Id. at 9. ↩

  113. Id. at 15. ↩

  114. Id. ↩

  115. Complaints-Assisted Form, 16 August 2021, at 10, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  116. Id. at 12. ↩

  117. Id. at 14. ↩

  118. Id. ↩

  119. Id. ↩

  120. Data Privacy Act of 2012, § 27. ↩

  121. 2019 REVISED RULES ON EVIDENCE, rule 131, § 1. ↩

  122. Complaints-Assisted Form, 16 August 2021, at 15, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  123. Id. at 9-20; Comment, 16 December 2021, Annex A-C, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  124. Comment, 16 December 2021, Annex 1-2, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  125. Complaints-Assisted Form, 16 August 2021, at 12, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  126. Id. ↩

  127. Comment, 16 December 2021, Annex 2, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). Emphasis supplied. ↩

  128. Id. Annex 1. ↩

  129. Id. Emphasis supplied. ↩

  130. Complaints-Assisted Form, 16 August 2021, at 15, in SLC v. Concentrix Philippines, NPC 21-173 (NPC 2021). ↩

  131. St. Martin Polyclinic, Inc. v. LWV Construction Corporation, G.R. No. 217426 (2017). ↩

  132. NMF v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273, 19 January 2023, at 12, available at https://privacy.gov.ph/wp-content/uploads/2023/09/NPC-19-1273-NFM-v.-BPI-Decision.pdf. ↩

  133. Data Privacy Act of 2012, §§ 20 (a), (c)(4). ↩

  134. Id. § 37. ↩

  135. An Act to Ordain and Institute the Civil Code of the Philippines [CIVIL CODE], Republic Act No. 386, art. 2221 (1950). ↩

  136. Data Privacy Act of 2012, § 20 (c)(4). ↩

  137. Serrano v. Court of Appeals, 363 SCRA 223, 231 (2001). ↩

  138. NMF v. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273, at 13. ↩

Backlinks

  • No backlinks found