Decision Text
ALS,
Complainant,
-versus-
Allied Bank (Now Philippine National Bank),
Respondent.
x----------------------------------------------------x
NAGA, P.C.;
Before the Commission is a Complaint dated 18 March 2022 filed by ALS (Complainant) against Allied Bank (now Philippine National Bank) (Respondent) for an alleged violation of the Data Privacy Act of 2012 or Republic Act No. 10173 (DPA).1
Facts
On 18 March 2022, the Commission, through its Complaints and Investigation Division (CID), received Complainant’s Complaints-Assisted Form (CAF).2
In his CAF, Complainant alleged that he was a former depositor of the Respondent Bank.3 He stated that on 11 August 2021, he requested a copy of his Statement of Account (SOA) covering the period from its opening to its closure.4 However, Complainant claimed that despite receiving the letter-request, Respondent Bank failed to provide him any SOA.5 Hence, according to him, “[he] referred this matter to [his] lawyer who subsequently sent a letter to the Data Protection Officer [(DPO)] of the bank.”6
Unfortunately, Complainant claimed that neither the DPO nor the Respondent Bank responded to this letter.7 This constrained the Complainant to bring this matter to the National Privacy Commission (NPC) because he asserted that, as a former depositor of the bank, he has the right to access information under the DPA.8
Complainant sought damages, alleging that Respondent Bank’s refusal to give him the requested SOA caused him humiliation, sleepless nights, and mental anguish for which the Respondent Bank should be ordered to pay him moral damages in the amount of one hundred thousand pesos (P100,000.00).9
On 25 March 2022, the CID issued an Order setting the preliminary conference for 13 July 2022 and 10 August 2022.10 Additionally, the Respondent Bank was ordered to file a Verified Comment.11
On 07 July 2022, Complainant submitted the email address by which he can be served with the Commission’s orders and issuances.12
On 12 July 2022, Complainant’s counsel filed his Entry of Appearance.13
On 13 July 2022, the CID issued an Order noting Complainant’s counsel’s Entry of Appearance.14
On an even date, the CID issued an Order noting that the first preliminary conference was held but only the Complainant appeared.15 Respondent Bank was reminded to submit its Verified Comment. Moreover, the CID ordered the parties to appear for the Second Preliminary Conference on 10 August 2022.16
On 13 August 2022, the CID issued an Order noting that the second preliminary conference was held on 10 August 2022, but only the Complainant was present.17 The Respondent Bank was again reminded to file its Verified Comment, and both parties were ordered to file their Memoranda.18
On 06 October 2022, Complainant filed his Manifestation with Motion dated 03 October 2022.19 In his Manifestation, Complainant stated that he will adopt his own complaint as his Memorandum.20
On 10 October 2022, the CID issued an Order noting Complainant’s Manifestation with Motion and granting the adoption of the complaint as his Memorandum.21
On 22 November 2022, Respondent Bank filed a Motion to Admit Verified Comment dated 18 November 2022, wherein it alleged that it only received the Commission’s Orders on 14 November 2022.22 In its Verified Comment, Respondent Bank posited:
- On 21 December 2017, Complainant dropped by the PNB San Fernando City-Sindalan Branch and requested for copies of his statements of account.
3.1 Complainant was assisted by the then-Branch Head, RMG (“RMG”) in his request for verification of the entries made in his passbook against the entries in the statements of account.
3.2 Notably, after verification, Complainant was able to confirm that all entries in his passbook from opening to closing dates were correct.
3.3 Thereafter, Complainant filled-out and signed the Bank’s Dispatch Control Card to signify that he already received the copies of his statements of account, a copy of which is hereto attached and made an integral part hereof as Annex “1.”
3.4 Thus, the Bank was surprised (to say the least) when it received letters from the Complainant and his lawyers asking for the release of his statements of account starting from the time the account was opened up to the time of its closing considering that Complainant has already received these statements of account in 2017. Copies of the letters are hereto attached and made integral parts hereof as Annexes “2”, “2-A”, 2-B.”
x x x
- Further, even though the Bank has already released Complainant’s statements of account in 2017, Complainant may visit the Branch within the banking hours to secure copies of the requested statements of account. Complainant only needed to visit the Branch to fully address his concerns, if any.23
On 24 November 2022, the CID issued an Order granting the Respondent Bank’s Motion to Admit Verified Comment and admitting the attached Verified Comment.24
On 01 December 2022, Respondent Bank filed its Memorandum (For the Respondent), reiterating the allegations in its Verified Comment dated 18 November 2022.25
On 16 December 2022, Respondent Bank filed a Motion to Refer the Case for Mediation with Manifestation dated 13 December 2022.26
On 19 December 2022, the CID issued an Order noting the Respondent Bank’s Motion to Refer the Case for Mediation with Manifestation and requiring the Complainant to signify if he is willing to refer the case for mediation.27
On 25 January 2023, Complainant manifested his willingness to refer the case for mediation.28
On 26 January 2023, the CID issued an Order referring the case for mediation and requiring the parties to submit an Application for Mediation.29
On 01 February 2023, an Order to Mediate was issued by the CID.30
On 11 May 2023, the mediation officer issued a Notice of Non-Settlement of Dispute.31
On 12 May 2023, the CID issued an Order lifting the issuance of the Notice of Non-Settlement of Dispute and ordering the parties to file their respective Memoranda.32
On 17 May 2023, Respondent Bank filed a Manifestation and Motion to Adopt Previously Filed Memorandum and Re-Apply for Mediation dated 15 May 2023.33 In the Manifestation, Respondent Bank claimed that they were willing to settle the instant case but some of the deliverables were not yet ready during the mediation period and thus requested for another opportunity to undergo mediation.34
On 19 May 2023, the CID issued an Order granting the Respondent Bank’s Motion to Adopt Previously Filed Memorandum and Re-Apply for Mediation and requiring the Complainant to signify his intent to re-apply for mediation.35
On 21 June 2023, Complainant manifested his willingness to re-apply for mediation.36
On 22 June 2023, the CID issued an Order noting the Complainant’s intention to re-apply for mediation.37
On 12 July 2023, an Order to Mediate was issued by the CID.38
On 04 September 2023, the CID issued a Notice of Non-Settlement of Dispute dated 31 August 2023.39
Following the issuance of the Notice of Non-Settlement of Dispute, on 05 September 2023, the CID issued an Order lifting the suspension of the complaints proceeding and ordering its resumption.40
On 11 September 2023, Respondent Bank filed a Manifestation, stating it will adopt the Memorandum it filed on 01 December 2022.41
On 14 September 2023, the CID issued an Order noting the Respondent Bank’s Manifestation.42
On 12 March 2024, the CID issued a Notice submitting the case for decision of the Commission.43
Issue
Whether Allied Bank (now Philippine National Bank) is liable for violation of Complainant’s right to access under Section 16(c) of the DPA.
Discussion
The Commission finds Respondent Bank not liable for violation of the Complainant’s right to access under Section 16(c) of the DPA.
In administrative proceedings, complainants carry the burden of proving their allegations with substantial evidence or “such relevant evidence as a reasonable mind will accept as adequate to support a conclusion.”44
Section 1, Rule 131 of the Rules of Court provides a distinction between burden of proof and burden of evidence:
Section 1. Burden of proof and burden of evidence. - Burden of proof is the duty of a party to present evidence on the facts in issue necessary to establish his or her claim or defense by the amount of evidence required by law. Burden of proof never shifts.
Burden of evidence is the duty of a party to present evidence sufficient to establish or rebut a fact in issue to establish a prima facie case. Burden of evidence may shift from one party to the other in the course of the proceedings, depending on the exigencies of the case.45
Initially, Complainant alleged that Respondent Bank refused to provide him with his requested SOAs, thereby violating his right to access.46 To support his claim, the Complainant attached letter requests as evidence of his efforts to obtain his SOAs.47
Guided by the aforecited provision, once the Complainant has established his case by discharging the burden of proof, the burden of evidence shifts to Respondent who has the burden to establish his defense. Thus, in this jurisdiction, it is recognized that a party who alleges a fact has the burden of proving it.48
In response to Complainant’s allegations, the Respondent Bank, in its Verified Comment, refuted this claim by attaching a Dispatch Control Card as evidence, signifying that Complainant had already received copies of his SOAs.49 Respondent Bank claimed that in 2017, Complainant visited the Respondent Bank and requested copies of his SOA.50 Respondent Bank alleged that after verifying the accuracy of the entries stated in his SOA, Complainant filled out and signed the said Dispatch Control Card.51 Respondent Bank further clarified that, despite having already provided the Complainant with his SOAs in 2017, Complainant could still secure copies by personally visiting the branch during banking hours.52
Under Section 16(c) of the DPA, data subjects can request access to their personal data under the custody of a personal information controller (PIC):
Section 16. Rights of the Data Subject. - The data subject is entitled to:
x x x
(c) Reasonable access to, upon demand, the following:
(1) Contents of his or her personal information that were processed; (2) Sources from which personal information were obtained; (3) Names and addresses of recipients of the personal information; (4) Manner by which such data were processed; (5) Reasons for the disclosure of the personal information to recipients; (6) Information on automated processes where the data will or likely to be made as the sole basis for any decision significantly affecting or will affect the data subject; (7) Date when his or her personal information concerning the data subject were last accessed and modified; and (8) The designation, or name or identity and address of the personal information controller;53
While the Respondent Bank argued that it had already provided the Complainant with copies of SOAs in 2017,54 the Commission clarifies that having previously provided a copy does not mean data subjects can no longer request a new one. Nothing in the DPA and its Implementing Rules and Regulations (IRR) state that the right to access can only be exercised once. Thus, Complainant was not precluded from making a subsequent request in 2021.
Nonetheless, while the Complainant has the right to access his SOAs under the DPA,55 the Commission emphasizes that this right is not absolute. It must be exercised in accordance with the laws governing the confidentiality of bank records and the reasonable verification measures established by the Respondent Bank which, as stated in its Verified Comment, suggested that the Complainant may visit the branch during banking hours.56
Given the sensitive nature of bank records, financial institutions are duty bound to ensure that only authorized individuals are given access. This duty aligns with Section 5(b) of NPC Advisory No. 2021-01 (Data Subject Rights), which mandates that PICs shall use reasonable measures to verify the identity of the requesting data subject.57
Furthermore, bank records contain sensitive personal information and are protected under the DPA to prevent unauthorized access.58 As stated in Section 2 of the Bank Secrecy Law or Republic Act No. 1405:
Section 2. All deposits of whatever nature with banks or banking institutions in the Philippines including investments in bonds issued by the Government of the Philippines, its political subdivisions and its instrumentalities, are hereby considered as of an absolutely confidential nature and may not be examined, inquired or looked into by any person, government official, bureau or office, except upon written permission of the depositor, or in cases of impeachment, or upon order of a competent court in cases of bribery or dereliction of duty of public officials, or in cases where the money deposited or invested is the subject matter of the litigation.59
Additionally, Simex International (Manila), Inc. v. Court of Appeals highlighted a bank’s fiduciary duty to treat depositors’ accounts with meticulous care and confidentiality:
In every case, the depositor expects the bank to treat his account with the utmost fidelity, whether such account consists only of a few hundred pesos or of millions… .
The point is that as a business affected with public interest and because of the nature of its functions, the bank is under obligation to treat the accounts of its depositors with meticulous care, always having in mind the fiduciary nature of their relationship.60 (Emphasis supplied)
Thus, the Respondent Bank must balance the Complainant’s right to access with its duty to safeguard the confidentiality of financial records. Releasing SOAs without verifying the requester’s identity could expose both the Respondent Bank and the Complainant to fraud, identity theft, or other security threats.
In this regard, since Respondent Bank has countered Complainant’s allegation by attaching a Dispatch Control Card as evidence that he had already received copies of his SOAs in 2017 and clarified that he could still secure copies by personally visiting the branch during banking hours,61 the burden of evidence shifted back to the Complainant to refute Respondent Bank’s allegation and evidence by proving that he did not receive copies of his SOAs in 2017 or that he visited Respondent Bank’s branch in 2021 to request another copy but was denied access.62
However, instead of presenting countervailing evidence, Complainant merely filed a Manifestation with Motion, stating that “he is adopting his own Complaint as his memorandum.”63
Section 2, Rule VII of NPC Circular No. 2021-01 (2021 NPC Rules of Procedure) provides for the effect of a party’s non-submission of Memorandum, viz:
SECTION 2. Submission of simultaneous memoranda. – The investigating officer shall require the parties to submit simultaneous memoranda discussing and summarizing their respective causes of action, claims, and defenses within fifteen (15) calendar days from written notice. The memoranda must also include, in simple tabular form, a list of all the evidence presented by the party and purpose to his/her claim or defense. Failure to submit the memorandum within the period provided shall be considered a waiver of such opportunity.64
Since the Complainant did not submit his Memorandum and merely adopted his complaint in lieu thereof,65 he waived the opportunity to present countervailing evidence against the Respondent Bank.
Without evidence to refute Respondent Bank’s arguments, Complainant failed to substantiate his claim that Respondent Bank violated his right to access his SOAs as he did not deny signing the Dispatch Control Card, nor did he provide evidence suggesting that the SOAs provided in 2017 were incomplete or inaccurate. Also, Complainant failed to establish that he personally visited Respondent Bank in 2021 and was unlawfully denied access to his SOAs.
In view of the foregoing, the Commission stresses that mere allegation of non-receipt of the requested SOAs, unsupported by substantial evidence, is insufficient to establish a violation of the DPA. Hence, the Complainant failed to discharge the burden of proof required to establish a violation of his right to access under the DPA.
WHEREFORE, premises considered, this Commission hereby resolves that the instant complaint filed by ALS against Allied Bank (now Philippine National Bank) is hereby DISMISSED for lack of substantial evidence.
This is without prejudice to the filing of the appropriate civil, criminal, or administrative cases against the Respondent before any other forum or tribunal, if any.
SO ORDERED.
City of Pasay, Philippines. 12 December 2024.
JOHN HENRY D. NAGA Privacy Commissioner
WE CONCUR:
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
NERISSA N. DE JESUS Deputy Privacy Commissioner
Copy furnished:
ALS Complainant
RCM Counsel for the Complainant
MCB AME MDA Counsels for the Respondent
PHILIPPINE NATIONAL BANK
COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission
Footnotes
-
National Privacy Commission, Data Privacy Act of 2012, Republic Act No. 10173. ↩
-
Complaints-Assisted Form dated 18 March 2022 of ALS. ↩
-
Id. ↩
-
Id. ↩
-
Id. ↩
-
Id. ↩
-
Id. ↩
-
Id. ↩
-
Id. ↩
-
Order to File Verified Comment and Appear Virtually for Preliminary Conference dated 25 March 2022. ↩
-
Id. ↩
-
Electronic mail dated 07 July 2022 from ALS. ↩
-
Entry of Appearance of RCM dated 12 July 2022. ↩
-
Order noting Complainant’s Counsel Entry of Appearance. ↩
-
Order (After 1st Preliminary Conference held on 13 July 2022, Requiring the Parties to Submit their Simultaneous Memoranda) dated 13 July 2022. ↩
-
Id. ↩
-
Order (After 2nd Preliminary Conference held on 10 August 2022, Requiring the Parties to Submit their Simultaneous Memoranda) dated 10 August 2022. ↩
-
Id. ↩
-
Manifestation with Motion of ALS dated 03 October 2022. ↩
-
Id. ↩
-
Order (Noting Complainant’s Manifestation with Motion and Granting the Adoption of the Complaint as Complainant’s Memorandum) dated 10 October 2022. ↩
-
Motion to Admit Verified Comment of Allied Bank (now Philippine National Bank) dated 18 November 2022. ↩
-
Verified Comment of Allied Bank (now Philippine National Bank) dated 18 November 2022. ↩
-
Order (Granting the Respondent’s Motion to Admit Verified Comment, Admitting the Verified Comment, and Reminding the Respondent to Submit its Memorandum). ↩
-
Memorandum of Allied Bank (now Philippine National Bank) dated 01 December 2022. ↩
-
Motion to Refer the Case for Mediation with Manifestation dated 13 December 2022. ↩
-
Order (Noting the Respondent’s Motion to Refer the Case for Mediation with Manifestation and Requiring the Complainant to Signify if He is Willing to Refer the Case for Mediation) dated 19 December 2022. ↩
-
Electronic mail dated 16 December 2022 from ALS. ↩
-
Order (to Refer the Case for Mediation and Requiring the Parties to Submit Signed Application for Mediation Forms) dated 26 January 2023. ↩
-
Order to Mediate dated 01 February 2023. ↩
-
Notice of Non-Settlement of Dispute dated 11 May 2023. ↩
-
Order (for Resumption of Complaints Proceedings and Requiring the Parties to Submit their Simultaneous Memoranda) dated 12 May 2023. ↩
-
Manifestation and Motion to Adopt Previously Filed Memorandum and Re-Apply for Mediation dated 15 May 2023. ↩
-
Id. ↩
-
Order (Granting the Respondent’s Manifestation and Motion to Adopt Previously Filed Memorandum, Noting the Respondent’s Motion to Re-Apply for Mediation, and Requiring the Complainant to Signify Intent to Re-Apply for Mediation) dated 19 May 2023. ↩
-
Complainant’s Manifestation dated 21 June 2023. ↩
-
Order (Noting the Complainant’s Intention to Re-Apply for Mediation) dated 22 June 2023. ↩
-
Order to Mediate dated 12 July 2023. ↩
-
Notice of Non-Settlement of Dispute dated 31 August 2023. ↩
-
Order (for Resumption of Complaints Proceedings) dated 05 September 2023. ↩
-
Manifestation of Allied Bank (now Philippine National Bank) dated 11 September 2023. ↩
-
Order (on Respondents Manifestation) dated 13 September 2023. ↩
-
Notice (that the Case is Submitted for Decision of the Commission) dated 12 March 2024. ↩
-
De Jesus v. Guerrero III, G.R. No. 171491 dated 04 September 2009. ↩
-
2019 Amendments to the 1989 Revised Rules on Evidence, Rule 131 §1. ↩
-
Complaints-Assisted Form dated 18 March 2022 of ALS. ↩
-
Id. ↩
-
Office of the Ombudsman v. Espina, G.R. No. 213500, dated 15 March 2017. ↩
-
Verified Comment of Allied Bank (now Philippine National Bank), at Annex “1” dated 18 November 2022. ↩
-
Id. ↩
-
Id. ↩
-
Id. ↩
-
National Privacy Commission, Data Privacy Act of 2012, Republic Act No. 10173, §16(c). ↩
-
Verified Comment of Allied Bank (now Philippine National Bank) dated 18 November 2022. ↩
-
National Privacy Commission, Data Privacy Act of 2012, Republic Act No. 10173, §16(c). ↩
-
Verified Comment of Allied Bank (now Philippine National Bank) dated 18 November 2022. ↩
-
National Privacy Commission, NPC Advisory No. 2021-01, §5(b) dated 29 January 2021. ↩
-
National Privacy Commission, Data Privacy Act of 2012, Republic Act No. 10173. ↩
-
An Act Prohibiting Disclosure of or Inquiry into, Deposits with any Banking Institution and Providing Penalty therefor, R.A. No. 1405, §2. ↩
-
Simex International (Manila), Incorporated v. The Honorable Court of Appeals and Traders Royal Bank, G.R. No. 88013 dated March 19, 1990. ↩
-
Verified Comment of Allied Bank (now Philippine National Bank), at Annex “1” dated 18 November 2022. ↩
-
Verified Comment of Allied Bank (now Philippine National Bank) dated 18 November 2022. ↩
-
Manifestation with Motion of Allan Earl L. Santos dated 03 October 2022. ↩
-
National Privacy Commission, NPC Circular No. 2021-01, Rule VII, §2. ↩
-
Manifestation with Motion of Allan Earl L. Santos dated 03 October 2022. ↩