NPC Issuance Wiki

NPC 22-201: JPV v. Souley MD Services, Inc.

Issued Decision

Decision Text

JPV,

Complainant,

-versus-

Souley MD Services, Inc.,

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before this Commission is a Complaint filed by JPV against Souley MD Services, Inc. (SMSI) for an alleged violation of Section 32 (Unauthorized Disclosure) of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

On 16 December 2021, JPV suffered injuries as a result of the impact of super typhoon “Odette” that hit Southern Leyte.1 JPV was then brought to the emergency room of Christ the Healer Hospital, an institution operated by SMSI, where Dr. JLT attended to her and sutured her shoulders.2

After the procedure, JPV claimed that she continuously experienced aggravated pains in her body and worsening fever, so she and her daughter CPV sought a “second opinion” from ACE Medical Center in Tacloban City.3 At the subsequent hospital, the health care personnel commented that JPV failed to receive anti-tetanus shots and sarcastically remarked, “mura man nagtahi og chorizo” (the stitching was conducted as if it was a local sausage).4

Meanwhile, Dr. JLT narrated that when JPV was admitted to the Christ the Healer Hospital, immediate medical attention and suturing were conducted on her.5 Dr. JLT recounted that the day after the medical procedure, JPV and her daughter requested to be discharged despite ongoing medication but were advised by the hospital staff to remain in the hospital for “health reasons.”6 Dr. JLT stated that JPV and CPV also offered a promissory note as a commitment to settle the outstanding hospital bills, as they are currently unable to make their payment.7 Dr. JLT and the personnel of Christ the Healer Hospital were unaware that JPV went to ACE Medical Center for further medication.8

On 24 December 2021, SMSI narrated that it came across a Facebook post authored by a person named “CPV” which said:

Hi kos ospital sa Sogod kung dis.a 1st na admit si mama after surviving the storm surge. Dia me karon sa tacloban nagpaadmit ug balik kay purya gaba inyo serbisyo sa amoa sanglit wala mi pambyad ato nga time. Naa mi pambayad oy pero gilamo2 ra ninyo tungod ky wala mi ikapakitang kwarta atong adlawa. Naa pay stiches ninyo nga murag dili professional ag nag-gama. Murag chorizo ag bukton sa ahong inahan sa iyang tahi! Ag Xray nga wa ninyo panumbalinga ang result. Nagkuha kos result ganiha, dec. 18 pami ngdischarge, unya hantod karon wa ninyo panumbalinga ag reading. Ingon ag attending nurse diri “basin nay development sa fracture sa tuhod sa inyo mama nga wala na-treat dayon”

Not to forget, on the night of December 16, gipahuwat2 pa ninuo amon h inahan sa gawas ug pila ka minute atong gabiuna wa ninyo gipahiluna dayon kay kuno “BAYARAN SA ANG ANTI-GEN” kadakong atay. Nihangyo pas mama “PAHIGDAA SAKO NINYO KAY GIKAPOY NAKO KAAYO” WA MO KAILAG EMERGENCY!!! WAMO KAILAG KALAMIDAD!!!

(Translated in English) Hi to the hospital at Sogod where my mother was first admitted after surviving the storm surge. We are here at Tacloban for medical re-admission since you provide us poor quality health care service, mainly because we don’t have enough money to pay during that time. We have money for payment for your information but you provided us poor quality us we have no shoun [sic] money on that time. Your stiches were like done by not professionals. The shoulder of my mother was like a chorizo because of your stiches. The result of the X-ray was neglected. I got the result a while ago, on December 18 we have been discharged, until now it was not responded/read. The attending nurse here said “maybe there was development as to the fracture of the knees of my mother that was not treated immediately”

Not to forget, on the night of December 16, you caused our mother to wait for few minutes outside the hospital, you didn’t make her comfortable immediately as you “waited for the payment of the Anti-gen” a big liver (bullshit). My mother asked for her to lie down as she was tired. You don’t know what is emergency!!! what is calamity!!!9

The Facebook post also received a series of comments from CPV’s friends implying that Dr. JLT was the doctor who attended to her mother.10

On 24 February 2022, SMSI and Dr. JLT filed a complaint-affidavit for cyber libel before the Office of Provincial Prosecutor, Sogod, Southern Leyte against “CPV,” the author of the Facebook post.11

According to SMSI, the Facebook post and comments “tarnished the image of Christ the Healer Hospital” as the malicious imputations in the post caused “dishonor and discredit” to the hospital not only in Southern Leyte but also in neighboring municipalities.12

On 07 September 2022, JPV filed a Complaint before the National Privacy Commission (NPC) against SMSI, Dr. JLT, and other corporate officers of SMSI for a violation of Section 32 (Unauthorized Disclosure) of the DPA.13 According to JPV, she was stunned that SMSI attached and disclosed her medical records in the complaint-affidavit.14

JPV also argued that SMSI and Dr. JLT filed a complaint-affidavit against a “digital person” and a Facebook user named “CPV,” whom they erroneously thought was her daughter.15 She also said that she personally confronted her daughter, who denied writing about the social media post in question.16

On 19 September 2022, the NPC, through its Complaints and Investigation Division (CID), issued an Order (To File Verified Comment and Appear Virtually for Preliminary Conference).17 In the Order, the preliminary conferences were set for 11 November 2022 and 09 December 2022.18

On 09 November 2022, SMSI filed its Verified Comment.19 SMSI argued that the Complaint lacks merit as there is no violation of the DPA.20 SMSI further argued that the medical records were attached in the Complaint filed in the National Prosecution Office to prove that JPV was “treated professionally and properly” at Christ the Healer Hospital contrary to what her daughter posted on Facebook.21 SMSI stated that JPV’s medical records served to refute the allegations about the medical treatment and the fact that she was not administered an anti-tetanus shot.22

It also stated that the medical records were necessary to prove whether the malicious Facebook post and comments really caused dishonor to the hospital.23 It explained that in order to prove such, it is necessary and inevitable to attach the medical records of JPV.24

SMSI also added it was not their fault that JPV became the “talk of the town” since the hospital did not divulge the matter on social media.25 SMSI claimed that it was JPV’s daughter who posted about her confinement in Christ the Healer Hospital and maliciously posted statements that caused dishonor to the hospital and Dr. JLT.26 SMSI also challenged JPV’s allegation that “CPV,” who posted on Facebook, is “virtually inexistent.”27 Lastly, SMSI argued that the medical records belonged to the hospital.28

On 14 November 2022, the CID issued an Order requiring the parties to submit their respective memoranda discussing and summarizing their respective causes of action.29

On 23 November 2022, JPV stated her Admissions and Denials to the annexes attached in the Verified Comment.30 JPV admitted Complaint-Affidavit (Annex 2), NPC Resolutions dated 23 April 200[sic] (Annex 4) and 30 June 2022 (Annex 5), and the RTC Order dated 27 April 2022 (Annex 6) as to its existence and due execution.31 Meanwhile, she denied the Board Resolution No. 6 (Annex 1) s. 2022, and the Facebook posts provided by SMSI (Annex 3).32

On 25 November 2022, the CID issued an Order noting Complainant’s Compliance and Reminding the Parties to Submit their Simultaneous Memoranda.33

On 20 December 2022, SMSI submitted its Memorandum.34

In its Memorandum, SMSI argued that the use of the medical records is allowed under Section 13 (f) of the DPA, which allows for the processing of sensitive personal information when necessary for the protection of lawful rights and interests of natural and legal persons in court proceedings or the establishment, exercise, or defense of legal claims, or when provided to government or public authority.35

SMSI also argued that a data subject’s rights are not applicable to the processing of personal data gathered for investigations in relation to criminal liabilities of a data subject under Section 37 of the Implementing Rules and Regulations of the DPA (IRR).36 Lastly, SMSI reasoned that the medical records were owned by Christ the Healer Hospital and that CPV’s posts caused dishonor and damage to it.37 SMSI prayed that JPV’s Complaint be dismissed.38

On 23 December 2022, JPV submitted her Memorandum.39 According to JPV, the complaint-affidavit for the cyber libel case attached twenty (20) medical records that pertain to her health status while being confined at the Christ the Healer Hospital.40

Upon knowledge of SMSI’s disclosure, she sent a letter dated 16 March 2022 demanding SMSI to retract the medical records.41 Despite her demand, SMSI refused to retract it.42

JPV also argued that she is not a party to the preliminary investigation for cyber libel, so the disclosure of her medical records was done without her consent or without any prior court or government approval.43 Lastly, she reasoned that the introduction of her medical records was unnecessary, immaterial, and irrelevant to the crime of cyber libel because the disclosure of her medical records during preliminary investigation is premature,44 the veracity behind the “chorizo-style of stitching” allegedly conducted by SMSI is immaterial and not among the elements for prosecuting the crime of cyber libel,45 the medical records did not factually show that SMSI exercised extraordinary diligence in the manner of stitching and other medical procedures.46

JPV prayed for the following: (1) recommendation from the NPC for the filing of criminal case for twenty (20) counts of Unauthorized Disclosure and (2) indemnity in the form of moral damages of at least fifty thousand pesos (Php 50,000.00) and nominal damages of at least thirty thousand pesos (Php 30,000.00); (3) exemplary damages of at least thirty thousand pesos (Php 30,000.00).47

Issue

Whether SMSI’s use of JPV’s medical records in a complaint for cyber libel violates the DPA.

Discussion

The Commission dismisses the case for lack of merit. SMSI did not violate the DPA when it used JPV’s medical records in a complaint for cyber libel since the processing is with lawful basis under Section 13 (f) of the DPA.

In its cyber libel complaint, SMSI attached JPV’s Admission and Discharge Records containing details on her diagnosis and operation and procedures administered, doctor’s orders, nurse’s notes, medical administration records, blood test results, antigen test results, temperature, pulse, and respiration (TPR) chart, discharge summary, and emergency room intervention form.48

Section 3 (l) of the DPA defines sensitive personal information:

Section 3. Definition of Terms. Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

(l) Sensitive personal information refers to personal information:

  1. About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;
  2. About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;
  3. Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and
  4. Specifically established by an executive order or an act of Congress to be kept classified.49

Following this definition, since the medical records pertain to information about JPV’s health, these are considered sensitive personal information. Considering that these are sensitive personal information, the processing should have lawful basis.50

Section 13 (f) of the DPA provides:

Section 13. Sensitive Personal Information and Privileged Information. The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

…

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the exercise or defense of legal claims, or when provided to government or public authority.51

According to SMSI, it attached a copy of JPV’s medical records to its complaint-affidavit for cyber libel in order to prove that JPV was “treated professionally and properly” at Christ the Healer Hospital and to negate her daughter CPV’s alleged claims on Facebook.52

The purpose for attaching these medical records applies in both instances provided under Section 13 (f), namely: (1) they are necessary for the protection of lawful rights and interests in court proceedings, and (2) they are necessary for the establishment, exercise, or defense of legal claims.53

The qualifier “necessary” in the mentioned provision pertains to the general privacy principle of proportionality.

Section 11 of the DPA provides:

Section 11. General Data Privacy Principles. The processing of personal information shall be allowed, subject to compliance with the requirements of this Act and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.

Personal information must, be:

…

(c) Accurate, relevant and, where necessary for purposes for which it is to be used the processing of personal information, kept up to date; inaccurate or incomplete data must be rectified, supplemented, destroyed or their further processing restricted;

(d) Adequate and not excessive in relation to the purposes for which they are collected and processed.54

Section 18 of the IRR also elaborates on proportionality:

Section 18. Principles of Transparency, Legitimate Purpose and Proportionality. The processing of personal data shall be allowed subject to adherence to the principles of transparency, legitimate purpose, and proportionality.

…

c. Proportionality. The processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.55

In this case, the medical records of JPV were necessary and relevant for the protection of lawful rights and interests of natural and legal persons, namely Dr. JLT and SMSI, the persons who were mentioned in CPV’s social media post. The medical records were suitable and relevant to provide context and background information on the professional conduct of SMSI and their medical personnel while JPV was their patient. The records were also relevant to the cyber libel case filed by SMSI to refute the allegations made by CPV on social media.

In CPV’s social media post, she mentioned that Christ the Healer Hospital provided them with poor quality healthcare service because she and her mother did not have enough money to pay for the bills during that time.56 She claimed that the stitches on her mother’s shoulders appeared to have been performed by nonprofessionals, her mother’s x-ray results were neglected, and the hospital displayed a lack of urgency in attending to her mother amidst the calamity.57

For an imputation to be considered libelous, it must be proven that the statements were defamatory and malicious.58 Here, the medical records attached in the complaint-affidavit for cyber libel were relevant and necessary to prove that the medical personnel of the hospital attended to JPV immediately, professionally and properly, and that CPV’s allegations made in the Facebook post were defamatory and malicious. The attached hospital records and test results served as SMSI’s proof of how it treated JPV when she was admitted to the hospital, contrary to the statements made online.

SMSI used JPV’s medical records to establish a case for cyber libel against JPV’s daughter, the alleged author of the social media post. This falls directly under “processing is necessary for the establishment, exercise, or defense of legal claims.”59 The purpose of the disclosure of JPV’s medical records was to build the case for cyber libel against the person who published the malicious imputations about the hospital and its personnel. Whether JPV was a party to the cyber libel case filed by SMSI is immaterial.

Given the foregoing, the use of JPV’s medical records in the cyber libel case finds a lawful basis under Section 13(f) of the DPA.

In her Complaint, JPV charged SMSI and Dr. JLT of Unauthorized Disclosure as defined and penalized under Section 32 of the DPA:

Section 32. Unauthorized Disclosure. (a) Any personal information controller or personal information processor or any of its

officials, employees or agents, who discloses to a third party personal information not covered by the immediately preceding section without the consent of the data subject, shall he subject to imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).

(b) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party sensitive personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from three (3) years to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00).60

To determine whether there is Unauthorized Disclosure, the following requisites must concur:

  1. The perpetrator is a personal information controller or personal information processor;
  2. The perpetrator disclosed information;
  3. The information relates to personal or sensitive personal information;
  4. The perpetrator disclosed the personal or sensitive personal information to a third party;
  5. The disclosure was without any of the lawful basis for processing, consent or otherwise, under Sections 12 and 13 of the DPA; and
  6. The disclosure is neither malicious nor done in bad faith and the information disclosed is not unwarranted or false information.61

As discussed, there is lawful processing under Section 13 (f) of the DPA when SMSI attached JPV’s medical records for the establishment of the case on cyber libel. Thus, the fifth element is lacking in this case.

Considering that the requisites for Section 32 of the DPA (Unauthorized Disclosure) are not fully met, SMSI cannot be held liable.

The Commission takes this opportunity to address SMSI’s claim that they take ownership of the medical records.62 Ownership of the physical or digital copies of the medical records does not result in the ownership of the personal data within those records such that they can use it in whatever way they want. The Commission emphasizes that any processing of personal data must not only comply with the general privacy principles but also have a lawful basis for the processing and be undertaken in a manner that is mindful of the rights of data subjects.

WHEREFORE, premises considered, the Commission resolves that the Complaint filed by JPV against Souley MD Services, Inc., is hereby DISMISSED for lack of merit.

This is without prejudice to the filing of appropriate civil, criminal, or administrative cases before any other forum or tribunal, if any.

SO ORDERED.

City of Pasay, Philippines. 05 June 2024.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

I CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

JPV Complainant

HCA Counsel for Complainant

SOULEY MD SERVICES, INC., Respondent

MAM and GAP Counsels for Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Complaint, 04 September 2022, at 1, in JPV v. Souley MD Services, Inc., NPC 22-201 (NPC 2022). ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. Complaint-Affidavit (of Dr. JLT), 24 December 2022, at 1, in JPV v. Souley MD Services, Inc., NPC 22-201 (NPC 2022). ↩

  6. Complaint, 04 September 2022, at 2, in JPV v. Souley MD Services, Inc., NPC 22-201 (NPC 2022). ↩

  7. Id. ↩

  8. Id. ↩

  9. Id. Annex A. ↩

  10. Id. ↩

  11. Verified Comment, 09 November 2022, at 1, in JPV v. Souley MD Services, Inc., NPC 22-201 (NPC 2022). ↩

  12. Id. at 2. ↩

  13. Complaints-Assisted Form, 07 September 2022, at 1, in JPV v. Souley MD Services, Inc., NPC 22-201 (NPC 2022). ↩

  14. Complaint, 04 September 2022, at 2, in JPV v. Souley MD Services, Inc., NPC 22-201 (NPC 2022). ↩

  15. Id. at 1. ↩

  16. Id. ↩

  17. Order (To File Verified Comment and Appear Virtually for Preliminary Conference), 19 September 2022, at 1, in JPV v. Souley MD Services, Inc., NPC 22-201 (NPC 2022). ↩

  18. Id. ↩

  19. Verified Comment, 09 November 2022, at 1, in JPV v. Souley MD Services, Inc., NPC 22-201 (NPC 2022). ↩

  20. Id. ↩

  21. Id. ↩

  22. Id. at 2. ↩

  23. Id. ↩

  24. Id. ↩

  25. Verified Comment, 09 November 2022, at 3, in JPV v. Souley MD Services, Inc., NPC 22-201 (NPC 2022). ↩

  26. Id. ↩

  27. Id. ↩

  28. Id. at 2. ↩

  29. Order, 14 November 2022, at 1, in JPV v. Souley MD Services, Inc., NPC 22-201 (NPC 2022). ↩

  30. Compliance, 23 November 2023, at 1, in JPV v. Souley MD Services, Inc., NPC 22-201 (NPC 2023). ↩

  31. Id. at 1-2. ↩

  32. Id. ↩

  33. Order (Noting the Complainant’s Compliance and Reminding the Parties to Submit their Simultaneous Memoranda), 25 November 2022, at 1, in JPV v. Souley MD Services, Inc., NPC 22-201 (NPC 2022). ↩

  34. Memorandum for Respondent, 20 December 2022, at 1, in JPV v. Souley MD Services, Inc., NPC 22-201 (NPC 2022). ↩

  35. Id. at 4. ↩

  36. Id. at 5. ↩

  37. Id. at 8. ↩

  38. Id. at 10. ↩

  39. Memorandum for Complainant, 23 December 2022, at 1, in JPV v. Souley MD Services, Inc., NPC 22-201 (NPC 2022). ↩

  40. Id. at 3. ↩

  41. Id. ↩

  42. Id. ↩

  43. Id. at 12. ↩

  44. Id. at 13. ↩

  45. Memorandum for Complainant, 23 December 2022, at 12, in JPV v. Souley MD Services, Inc., NPC 22-201 (NPC 2022). ↩

  46. Id. at 13. ↩

  47. Id. at 12. ↩

  48. Verified Comment, 09 November 2022, at 2, in JPV v. Souley MD Services, Inc., NPC 22-201 (NPC 2022). ↩

  49. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 § 3 (l) (2012). ↩

  50. Id. § 13. ↩

  51. Id. § 13 (f). ↩

  52. Verified Comment, 09 November 2022, at 2, in JPV v. Souley MD Services, Inc., NPC 22-201 (NPC 2022). ↩

  53. Data Privacy Act of 2012, § 13 (f). ↩

  54. Id. § 11 (c)(d). Emphasis supplied. ↩

  55. National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, rule IV, § 18 (c). Emphasis supplied. ↩

  56. Complaint, 04 September 2022, Annex A, in JPV v. Souley MD Services, Inc., NPC 22-201 (NPC 2022). ↩

  57. Id. at 2. ↩

  58. Diaz v. People, G.R. No. 159787 (2007). ↩

  59. Data Privacy Act of 2012, § 13 (f). ↩

  60. Id. § 32. ↩

  61. JCB v. FRL, NPC 21-031, 03 March 2022, at 15, available at https://privacy.gov.ph/wp-content/uploads/2024/05/NPC-21-031-2022.03.03-JCB-v.-FRL-Decision-FinalP.pdf. ↩

  62. Memorandum for Respondent, 20 December 2022, at 10, in JPV v. Souley MD Services, Inc., NPC 22-201 (NPC 2022). ↩

Backlinks