NPC Issuance Wiki

NPC 22-112: AQM v. PIT, NPT, and CNB

Issued Decision

Decision Text

AQM,

Complainant,

-versus-

PIT, NPT, and CNB.

Respondents.

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before this Commission are separate Complaints filed by AQM (Complainant) against PIT, NPT, and CNB (collectively, Respondents) for alleged violations of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

Complainant was setting up a business in Don Salvador, Negros Occidental, with IT, the father of PIT and husband of NPT.1 She narrated that the daughters of IT invited her to stay in their house in Brgy. Taculing, Bacolod City (family house) while the house she was planning to stay in was not yet available.2

On 08 December 2021, Complainant claimed that when she and IT went to Boracay to meet with a potential investor, PIT allowed his mother, NPT, back into the family house.3 Complainant explained that NPT “abandoned [her family] for several years.”4 She alleged that PIT and NPT took Complainant’s personal belongings, including her car and documents containing sensitive personal information which included her US Visa Application, Community Tax Certificate (CTC), and Deed of Sale for her car.5

Complainant further alleged that PIT gave the documents to NPT who, with assistance from Atty. CNB, used these as evidence to support the allegations in her pleadings for two cases:

  1. Reply with Opposition to the Motion to Lift/Recall Temporary Protection Order in a petition for issuance of permanent protection order against IT; and
  2. Complaint-Affidavit in criminal case for concubinage against Complainant.6

Complainant stated that the documents contained her (1) name; (2) age; (3) address; (4) email address; (5) phone number; (6) passport number; (7) social media identifiers; (8) passport number; (9) all information stated in her CTC; and (10) all information in her Safe, Swift & Smart Passage (S-PaSS).7

Due to the incident, Complainant filed Complaint-Affidavits dated 25 April 2022, against Respondents for violations of the DPA.8

Complainant alleged that the processing of the “sensitive information” contained in her documents was unfair, illegal, and purely malicious.9 She added that Atty. CNB should not have included the documents in any of her pleadings knowing that these were taken without the Complainant’s consent and knowledge.10

Complainant posited that the act of the Respondents constituted a “serious breach which should be immediately acted upon since their continuous use of this [sic] documents containing all [her] sensitive information is detrimental and harmful to [her].”11

Complainant prayed for the Commission to find Respondents guilty of violations of the DPA.12 She prayed that the penalty of imprisonment and fine be imposed on Respondents.13 She also claimed that she is entitled to damages.14

On 13 July 2022, the National Privacy Commission (NPC), through its Complaints and Investigation Division (CID), ordered Respondents to submit their respective comments and directed the parties to appear for a preliminary conference after the lapse of the period to file comments.15

On 20 July 2022, PIT submitted his Comment.16 He explained that he was the legitimate son of IT and NPT and that he personally knew Complainant who he alleged was the mistress of his father, IT.17

PIT stated that Complainant and his father have been living together in the family house since September 2020.18 He explained that the family house was his parents’ conjugal home.19 He added that his father forced his mother out of family house in the year 2015.20

PIT narrated that his mother wanted to return to the family house but was disallowed by his father.21 He added that when his mother learned that Complainant and his father were leaving for Boracay, she “reclaimed her rights over the conjugal house by entering the same.”22

Because of this, PIT alleged that upon his father’s return, he threatened to inflict harm on NPT which prompted her to file a civil case for the issuance of a permanent protection order.23

PIT argued that the case should be dismissed outright because Complainant had no valid cause of action against him and the other Respondents.24

PIT stressed that it was his mother, NPT, and not him, who recovered the documents from the family house.25 He explained that it was NPT who discovered that Complainant left documents where she admitted that she was living or staying at the family house with IT.26

He added that he did not take the documents from any government office:

That I did not take these documents from the US Embassy or the government offices concerned, neither I (sic) extracted or processed these documents from the offices concerned and in fact, I have nothing to do with these documents.27

He emphasized that the documents were left by Complainant in the family house.28

PIT further stated that the Complainant’s address does not qualify as sensitive personal information.29 Moreover, he argued that the information falls under the exception because the DPA does not cover the “title, business address, and office telephone number of the individual.”30

Finally, PIT concluded by stating that Complainant filed the complaint before the NPC to harass his mother and “to expunge the documents which she used in the criminal case for ‘concubinage’ she filed against [Complainant] and [PIT’s] father.”31

On 20 July 2022, NPT filed her Comment.32 She explained that she is legally married to IT and begot three (3) children.33

In addition to the arguments already raised by PIT in his Comment, NPT stated that Complainant left numerous documents at the family house, including her US Visa Application, CTC, car documents, and bank transactions showing that it was IT who was paying for the amortizations of her car, among other documents.34

NPT explained that after confirming that Complainant and IT were living together as husband and wife, she proceeded to file a criminal case for concubinage and violation of Republic Act No. 9262 or the Anti-Violence Against Women and their Children Act of 2004 against them.35

She added that Complainant filed several cases against her and PIT, including a criminal case for qualified theft, but all of these were dismissed by the respective investigating prosecutors for lack of probable cause.36 In the case for qualified theft, the investigating prosecutor stated that:

[T]he respondents did not unlawfully acquired (sic) the possession of the personal properties of the complainant. The evidence suggests that the personal properties of the complainant, which were contained in boxes as stated in the copy of the delivery receipt attached by the complainant, were left at the [family’s] house.37

She reiterated PIT’s argument that they did not obtain the documents from the US Embassy or any government office.38 She pointed out that Complainant left the documents at the family house.39

Finally, NPT argued that the documents were not the only evidence to establish the commission of the crime of concubinage.40

On 20 July 2022, Atty. CNB filed her Comment.41 She explained that NPT engaged her services sometime in December 2020 when she filed a petition for issuance of permanent protection order against IT.42

She argued that since the documents were found in the family house, her client, NPT, submitted them as documentary evidence for the criminal case for concubinage and the petition for issuance of permanent protection order.43 She prayed for the dismissal of the complaint against her and the other Respondents.44

On 25 July 2022, the CID noted the comments and annexes of the Respondents.45

On 30 August 2022, Complainant submitted her Reply to Comment.46 Complainant explained that PIT and NPT have already been separated for seven (7) years.47 She added that it was NPT who left the family house as stated in an affidavit that she executed in another case.48

She further argued that the documents were not just lying around in the family house.49 She explained that the living quarters of IT, where the documents were kept, is a different and separate structure from the house that NPT occupied.50

She posited that the documents were illegally obtained.51 She stressed that Respondents had no authority to go into IT’s living quarters as it was locked and not part of the main house.52 Thus, she contended that Respondents should be held liable for a violation of Section 29 (Unauthorized Access or Intentional Breach) under the DPA.53

She further contended that Respondents are liable for violating Sections 31 (Malicious Disclosure) and 32 (Unauthorized Disclosure) of the DPA because their use of her personal and sensitive personal information in the criminal case for concubinage was “purely malicious and unauthorized” because the case has not been heard.54

On 31 August 2022, the CID issued an Order noting the Reply to Comment submitted by the Complainant.55

On 01 September 2022, Complainant’s counsel filed his Entry of Appearance.56

On 02 September 2022, during the Preliminary Conference, Complainant’s counsel manifested that he is requesting the return of the original copies of all the documents, as well as Complainant’s laptop and tablet.57 Atty. CNB manifested that the NPC is not the proper forum to allow the return of Complainant’s devices because there is a case pending before the court where the proper motion could be filed.58 Further, Respondents denied having the documents in their possession.59

On 05 September 2022, the CID noted the Entry of Appearance filed by Complainant’s counsel and ordered the parties to submit their respective memoranda within thirty (30) calendar days from receipt of the Order.60

On 04 October 2022, Complainant submitted her Memorandum.61 Aside from the allegations in her Complaint, she explained that the family house had two (2) structures.62 The first structure was the old house where Complainant was temporarily residing, while the second structure was IT’s living quarters.63

She explained that before leaving for Boracay, she asked IT if she could leave her valuables, including her documents, in IT’s living quarters.64 She stated that IT’s living quarters can only be opened through a digital lock and that only IT and PIT knew of the passcode.65 She posited that PIT and NPT “intentionally breached” IT’s living quarters and took her personal belongings.66

On 06 October 2022, Respondents submitted their Memorandum.67

On 12 October 2022, Complainant filed a Manifestation with Motion to Quash Memoranda of Respondents, stating that Respondents filed their Memorandum out of time.68 The Motion, however, was denied by the CID in the interest of substantial justice.69

Issue

Whether Respondents violated Section 25 of the DPA when they processed Complainant’s documents.

Discussion

The Commission dismisses the case for lack of merit.

Section 25 of the DPA provides:

Section 25. Unauthorized Processing of Personal Information and Sensitive Personal Information. (a) The unauthorized processing of personal information shall be penalized by imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00) shall be imposed on persons who process personal information without the consent of the data subject, or without being authorized under this Act or any existing law.70

In determining whether Unauthorized Processing occurred, three (3) elements must be established with substantial evidence:

  1. The perpetrator processed the information of the data subject;
  2. The information processed was personal information or sensitive personal information; and
  3. The processing was done without the consent of the data subject, or without being authorized under the DPA or any existing law.71

Respondents processed the information of Complainant.

The first requisite for Unauthorized Processing is that the perpetrator processed information of the data subject.

Complainant stated that Respondents processed her information when they used her documents in a petition for issuance of permanent protection order and in a criminal case for concubinage.72

Section 3 of the DPA defines processing as follows:

Section 3. Definition of Terms. Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

(j) Processing refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.73

In this case, Respondents processed the personal data of Complainant in two instances: (1) when Respondents PIT and NPT obtained the documents from the family house; and (2) when Respondents subsequently used these documents as evidence to support their allegations in the petition for issuance of permanent protection order and criminal case for concubinage. These two acts are considered processing of personal data. Thus, Respondents processed Complainant’s personal data, satisfying the first requisite for Unauthorized Processing.

Respondents processed Complainant’s personal and sensitive information.

The second requisite for Unauthorized Processing is that the information processed was personal information or sensitive personal information.74

Complainant stated that the documents obtained and used by the Respondents contained her (1) name; (2) age; (3) address; (4) email address; (5) phone number; (6) passport number; (7) social media identifiers; (8) passport number; (9) all information stated in her CTC; and (10) all information in her S Pass.75

Section 3 of the DPA defines personal and sensitive personal information as:

Section 3. Definition of Terms. Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

(g) Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.

…

(l) Sensitive personal information refers to personal information:

(1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; (2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and (4) Specifically established by an executive order or an act of Congress to be kept classified.76

In this case, Respondents processed Complainant’s personal information including her name, address, and contact details.77 Respondents likewise processed Complainant’s sensitive personal information in her US Visa Application including her age, marital status, and passport number.78 Thus, the second requisite of Unauthorized Processing is likewise present.

Respondents processed Complainant’s personal and sensitive information pursuant to Section 12(f) and Section 13(f) of the DPA.

The third requisite is that the processing was done without the consent of the data subject, or without being authorized under the DPA or any existing law.79

Complainant alleged that the processing of the “sensitive information” contained in her documents was unfair, illegal, and purely malicious.80

As discussed earlier, Respondents processed Complainant’s personal data in two instances. First, when Respondents PIT and NPT obtained the documents from the family house. Second, when Respondents subsequently used these documents as evidence to support their allegations in the petition for issuance of permanent protection order and criminal case for concubinage.

In relation to the first act of processing or to Respondents obtaining the documents, there is no substantial evidence to conclude that the acquisition of the documents was unauthorized. As determined by the investigating prosecutor in resolving Complainant’s criminal complaint for qualified theft against Respondents, Respondents did not unlawfully acquire Complainant’s personal properties, including the documents, because the evidence showed that these “were left at the [family’s] house.”81

In addition, the evidence on record is inadequate to show that Respondents NPT and PIT did not have access to IT’s living quarters. In fact, Complainant herself stated that PIT knew the passcode and had access to IT’s living quarters.82 Given this, PIT’s entry to IT’s living quarters was not illegal. Thus, Complainant failed to prove with substantial evidence that the acquisition of the documents was unauthorized.

On the second act of processing, Respondents argued that they submitted the documents as evidence for a petition for issuance of permanent protection order and a criminal case for concubinage.83

Section 13 of the DPA allows for the processing of sensitive personal information when it is necessary for the exercise or defense of legal claims:

Section 13. Sensitive Personal Information and Privileged Information. The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

…

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.84

In this case, Respondents used the documents to build a case for concubinage against the Complainant.85 Further, Respondents processed the documents to oppose the motion to lift temporary protection order in a petition for issuance of a permanent protection order.86 This demonstrates that the processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural persons in court proceedings and the establishment of legal claims.

The Commission previously held that applying the qualifier “necessary” to the second instance in Section 13(f) serves to limit the potentially broad concept of “establishment of legal claims” consistent with the general privacy principles of legitimate purpose and proportionality.87

The legitimate purpose principle requires that the processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy.88 This means that the processing done for the establishment of a legal claim should not be outside the limitations provided by law.89

In this case, the submission of the documents was in view of a criminal complaint for concubinage filed by Respondents against the Complainant and a petition for the issuance of a permanent protection order filed by Respondents against IT. The processing of the documents cannot be considered as wrongful or illegal. The DPA is neither a tool to prevent the discovery of a crime nor a means to hinder legitimate proceedings.90

Further, the proportionality principle requires that processing must be adequate, relevant, suitable, and necessary, such that it is not excessive in relation to the declared and specified purpose.91

In this case, the documents were used to establish and support their allegations that Complainant was living or staying at the family house with IT for both the criminal case for concubinage and petition for issuance of permanent protection order.92

Therefore, Respondents had lawful basis to process Complainant’s sensitive personal information under Section 13(f) of the DPA.

Complainant’s personal information was also processed pursuant to a lawful basis, specifically Section 12(f) of the DPA.

While Section 13(f) applies to sensitive personal information, the protection of lawful rights and interests under Section 13(f) is considered as legitimate interest pursuant to Section 12(f) of the DPA.93 This can be understood to include the establishment of legal claims as a legitimate interest. Thus, Respondents had lawful basis under the DPA to process Complainant’s personal information.

In sum, because Respondents had lawful basis to process Complainant’s personal and sensitive personal information, the third requisite for Unauthorized Processing is absent. Thus, Respondents did not commit Unauthorized Processing under Section 25 of the DPA.

WHEREFORE, premises considered, the Commission resolves that the Complaint filed by AQM against PIT, NPT, and CNB is hereby DISMISSED for lack of merit.

This is without prejudice to the filing of appropriate civil, criminal, or administrative cases before any other forum or tribunal, if any.

SO ORDERED.

City of Pasay, Philippines.

18 April 2024.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

AQM Complainant

JDL Counsel for Complainant

PIT Respondent

NPT Respondent

CNB Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Complaint-Affidavit of AQM against PIT, 25 April 2022, at 3, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. at 4. ↩

  5. Id. at 3-4. ↩

  6. Id. at 4. ↩

  7. Complaint-Affidavit of AQM against PIT, 25 April 2022, at 2, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  8. Complaint-Affidavit of AQM against PIT, 25 April 2022, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022); Complaint-Affidavit of AQM against NPT, 25 April 2022, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022); Complaint-Affidavit of AQM against CNB, 25 April 2022, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  9. Complaint-Affidavit of AQM against PIT, 25 April 2022, at 4, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  10. Complaint-Affidavit of AQM against CNB, 25 April 2022, at 4, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  11. Complaint-Affidavit of AQM against PIT, 25 April 2022, at 4, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  12. Id. at 5. ↩

  13. Id. ↩

  14. Id. ↩

  15. Order to File Verified Comment and Appear Virtually for Preliminary Conference, 13 July 2022, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  16. Comment of PIT, 20 July 2022, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  17. Id. at 1. ↩

  18. Id. ↩

  19. Id. ↩

  20. Id. ↩

  21. Id. at 2. ↩

  22. Comment of PIT, 20 July 2022, at 3, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  23. Id. ↩

  24. Id. at 5. ↩

  25. Id. at 6. ↩

  26. Id. at 4. ↩

  27. Id. at 6. ↩

  28. Comment of PIT, 20 July 2022, at 7, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  29. Id. ↩

  30. Id. ↩

  31. Id. ↩

  32. Comment of NPT, 20 July 2022, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  33. Id. at 1. ↩

  34. Id. at 4. ↩

  35. Id. ↩

  36. Id. at 5, Annexes C and E. ↩

  37. Id. Annex E. ↩

  38. Comment of NPT, 20 July 2022, at 7, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  39. Id. ↩

  40. Id. at 8. ↩

  41. Id. at 7. ↩

  42. Id. at 2. ↩

  43. Id. ↩

  44. Comment of CNB, 20 July 2022, at 5, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  45. Order Noting Respondents Verified Comments and Annexes, 25 July 2022, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  46. Reply to Comment, 23 August 2022, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  47. Id. at 1. ↩

  48. Id. ↩

  49. Id. ↩

  50. Id. ↩

  51. Id. at 6. ↩

  52. Reply to Comment, 23 August 2022, at 6, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  53. Id. at 5. ↩

  54. Id. at 7. ↩

  55. Order Noting the Complainant’s Reply to Comment, 31 August 2022, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  56. Entry of Appearance, 01 September 2022, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  57. Order After the 1st Preliminary Conference held on 02 September 2022, Requiring the Parties to Submit their Respective Memoranda, and Cancelling the 2nd Preliminary Conference on 23 September 2022, 05 September 2022, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  58. Id. ↩

  59. Id. at 2. ↩

  60. Order (After the 1st Preliminary Conference held on 02 September 2022, Requiring the Parties to Submit their Respective Memoranda, and Cancelling the 2nd Preliminary Conference on 23 September 2022) 05 September 2022, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  61. Memorandum for the Complainant, 04 October 2022, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  62. Id. at 2. ↩

  63. Id. ↩

  64. Id. ↩

  65. Id. ↩

  66. Id. ↩

  67. Memorandum for the Respondent, 05 October 2022, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  68. Order Denying the Complainant’s Manifestation with Motion to Quash Memoranda of Respondents, 19 October 2022, at 3, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  69. Id. ↩

  70. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 § 25 (2012). ↩

  71. In re: Wefund Lending Corporation (JuanHand) and its Responsible Officers, NPC SS 21-006, 16 May 2022, available at https://privacy.gov.ph/wp-content/uploads/2023/05/NPC-21-006-2022.05.16-Wefund-Lending-Corporation-Decision-on-the-Main-Case-Final.pdf (last accessed 06 May 2024). ↩

  72. Complaint-Affidavit of AQM against PIT, 25 April 2022, at 4, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  73. Data Privacy Act of 2012, § 3(j). ↩

  74. In re: Wefund Lending Corporation (JuanHand) and its Responsible Officers, NPC SS 21-006, at 31. ↩

  75. Complaint-Affidavit of AQM against PIT, 25 April 2022, at 2, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  76. Data Privacy Act of 2012, § 3(g) (l). Emphasis supplied. ↩

  77. Complaint-Affidavit of AQM against PIT, 25 April 2022, at 2, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  78. Id. ↩

  79. In re: Wefund Lending Corporation (JuanHand) and its Responsible Officers, NPC SS 21-006, at 31. ↩

  80. Complaint-Affidavit of AQM against PIT, 25 April 2022, at 4, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  81. Comment of NPT, 20 July 2022, Annex E, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  82. Memorandum for the Complainant, 04 October 2022, at 2, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  83. Comment of CNB, 20 July 2022, at 2, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  84. Data Privacy Act of 2012, § 13(f) (l). Emphasis supplied. ↩

  85. Complaint-Affidavit of AQM against PIT, 25 April 2022, at 4, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  86. Id. ↩

  87. EA and TA v. EJ, EE and HC, NPC 17-018, 15 July 2019, at 8, available at https://privacy.gov.ph/wp-content/uploads/2023/05/NPC-17-018-EA-and-TA-v-EJ-Decision-2019.07.15-.pdf (last accessed 07 May 2024). ↩

  88. National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18(b) (2016). ↩

  89. EA and TA v. EJ, EE and HC, NPC 17-018, 15 July 2019, at 9. ↩

  90. Id. ↩

  91. Data Privacy Act of 2012, § 11(c) & (d). ↩

  92. Comment of PIT, 20 July 2022, at 4, in AQM v. PIT, NPT, and CNB, NPC 22-112 (NPC 2022). ↩

  93. KRL v. Trinity University of Asia, AA, MC, NCB, RG, GV, GCT, RR, MR, PB, CID 17-K-003, 19 November 2019, available at https://privacy.gov.ph/wp-content/uploads/2023/05/CID-17-K-003-KRL-v-Trinity-Decision-PSD-10Aug2020.pdf (last accessed 09 May 2024). ↩

Backlinks