NPC Issuance Wiki

NPC 22-237: MTS vs. Bank of the Philippine Islands

Issued Decision

Decision Text

MTS,

Complainant,

-versus-

BANK OF THE PHILIPPINE ISLANDS,

Respondent.

x-------------------------------------------------------x

DE JESUS, D.P.C.;

Before the Commission is MTS’ complaint against Respondent BPI – ZBC (BPI) for alleged violation of Section 25 (Unauthorized Processing) and Section 26 (Access Due to Negligence) of the Data Privacy Act or Republic Act No. 10173 (DPA).1

Facts

In her Complaints-Assisted Form (CAF) dated 26 October 2022, Complainant narrated that around 4:00 o’clock in the afternoon of 05 August 2022, she received a phone call from a person alleging to be a customer service representative of BPI Card Services.2

According to the Complainant, the caller claimed that she had earned a reward of Nine Thousand Pesos (P9,000.00) “to be put to [her] account as earned reward on [her] BPI Visa/Mastercard.”3 Complainant further narrated that the caller mentioned her card number which led her to believe the caller was a legitimate employee.”4

The Complainant later revealed that the caller managed to access her account, change the password, and withdraw PHP 50,000.00 from her savings account on six (6) separate occasions.5

According to the Complainant:

BPI was not able to help me return any amount of money knowing that this is a legitimate fraud. They said “VFishing”. Not sure what that is. I am a US/Citizen Dual [and] have been here for 2 years. Not familiar who the real people [and] employee of BPI. Not sure why my credit card/account was hacked by her. My Information was hacked and BPI stated to me that is not their problem at all since OTP was provided. The fraudster is really forceful [and] believable. Why [is] BPI not secure my information at all.6

Complainant believes that BPI should be held responsible in returning her money back.7 Complainant posited that “BPI should shoulder part of P300,000.00 regardless since “fraud” is committed although there [is] part negligence [and] ignorance on both parts.”8

To prove her allegations, Complainant attached the following to her CAF9:

  1. Cardholder Dispute Form from BPI;10
  2. Complainant’s handwritten statement dated 08 August 2022;11
  3. A printout of the Complainant’s transactions issued by BPI MH, CB, showing that on 05 August 2022, a total amount of Three Hundred Thousand Pesos (P300,000.00) was transferred from her account to ShopeePay Philippines;12
  4. An email from BPI showing that transactions with ShopeePay were made;13
  5. An email from Bangko Sentral ng Pilipinas (BSP) dated 15 August 2022 acknowledging receipt of a duly accomplished BSP Consumer/Inquiry/Request for Assistance (CIR) Form;14
  6. Complainant’s duly accomplished BSP CIR Form;15
  7. BSP Complaints/Inquiry/Follow-Up/Rejoinder Form;16
  8. Email from Shopee Philippines Email Support stating that it can no longer cancel or refund the transactions that were completed in real-time;17 and
  9. Email from BPI dated 18 August 2021 stating that access to Complainant’s banking account requires logging in using a username and password; that the fund transfers were authenticated using an OTP, which was an internationally accepted security standard that also passed BSP’s regulatory standards; and that it can no longer reverse the transaction since the transactions were authenticated from Complainant’s end.18

Finally, Complainant prayed in her CAF for BPI to reimburse her Three Hundred Thousand Pesos (P300,000.000), to wit:

My Information was hacked and BPI should reimburse my PhP 300,000.00 [that was] lost[.] and [BPI should] settle with me. Fraud is fraud[, it is] committed regardless if I have given OTP. BPI [was] not able to protect my information and was able to get used by Fraudster19

On 14 February 2023, the Complaints and Investigation Division (CID) of the National Privacy Commission (NPC) issued an Order20 directing BPI to file its Verified Comment within fifteen (15) calendar days from receipt thereof and for the parties to virtually appear for a Preliminary Conference on 16 March 2023 and 25 April 2023.21

On 01 March 2023, BPI, with the assistance of counsel,22 filed its Comment dated 27 February 2023.23

In its Comment dated 27 February 2023, BPI acknowledged that the Complainant was its client.24 BPI shared that on 11 August 2022, Complainant filed a case against Respondent before the BSP alleging six (6) unauthorized transactions in her account totaling Three Hundred Thousand Pesos (P300,000.00.)25

According to BPI, on 18 August 2022, it replied to the said complaint via email and informed the Complainant of the results of its investigation on the disputed transactions.26 The pertinent portion of this email reads:

As you are aware of [sic] access to your BPI Online banking account requires logging in using your nominated Username and Password. Financial transactions also require further authentication by a One-Time PIN (OTP), sent through a text message to your registered mobile number, or Mobile Key. Your mobile number ending in XXXX-XXX-0321 was duly registered in the Bank’s records in June 2021. The text message provides the description of the transaction. These are the internationally accepted industry standards for secure and safe online banking transactions that has passed even the rigid regulatory standards set by the Bangko Sentral ng Pilipinas (BSP). Under the terms of use of our Online Banking facility, your Username and Password should be always under your control. Any transaction that is done by using your username and password and duly validated either through your One Time Pin (OTP) or your Mobile Key is presumed to be done by you.

Given that the Bank has discharged its obligation in providing a safe and secure online banking platform, and it is apparent that the personal banking information was compromised at your end, we regret that we are unable to grant your request for reversal of the disputed transactions. These are all considered valid as these were properly authenticated from your end.27

BPI, in its Comment, further denied the allegation of the Complainant that it violated Section 25 (Unauthorized Processing) of the DPA.28 BPI argued that “during account opening, the Complainant expressly agreed to be bound by the provisions of the Terms and Conditions of BPI Products, Services, Facilities and Channels.”29

BPI added that “aside from the Complainant’s consent, the processing of her personal data was necessary for her continued use of the Respondent’s services, facilities and channels. Hence, contrary to the Complainant’s allegations, the foregoing discussion categorically proves that she expressly authorized the Respondent to process her data.”30

As to the allegation of violation of Section 26 (Access Due to Negligence) of the DPA, BPI claims that “the Complainant miserably failed to present even a shred of competent evidence establishing that the Respondent was negligent in processing her data, and the same was the proximate cause of the fraudulent transactions. Verily, the burden of proof necessarily lies with the party making the allegation.”31

To establish its diligence, BPI narrated in its Comment that it “implements a multi-factor authentication method to verify transactions made through BPI Online. This requires the concurrence of the following personal data conclusively presumed to be known only to the depositor:32

a. BPI Online username; b. BPI Online password; and c. one-time-password (“OTP,” for brevity) sent to the depositor’s registered mobile number, or Mobile Key.”33

BPI added that the “disputed transactions would not have been made without the concurrence of the foregoing personal data. Therefore, the transactions are conclusively presumed to be made by the Complainant herself. She has the burden to present competent evidence to prove otherwise. Bare self-serving allegations do not equate to proof.”34

BPI, in its Comment also claimed that assuming arguendo that there were indeed unauthorized transactions, the reasonable presumption is that the Complainant was guilty of gross negligence and should solely bear the loss, to wit:

The Complainant, as a data subject, has the obligation to safeguard her personal data. Sharing them with an unknown third person is tantamount to gross and inexcusable negligence. Hence, the Complainant must solely bear the consequences. She simply cannot shift the loss to the Respondent through an unfounded and farfetched accusation that her rights as data subject were violated.35

BPI also shared its policy not to inquire into its client’s OTP and regularly reminds its clients to safeguard their personal data,36 which reads:

To protect its clients and raise awareness on personal data security, the Respondent frequently reminds its clients that it will never require them to verify or divulge their personal data such as bank account number, log-in credentials, credit card details, and OTP via email link, text message or phone call. These advisories are regularly sent to its clients’ registered email addresses and mobile numbers. They are also posted on Respondent’s official website, and its various social media accounts.37

Finally, BPI prays for the dismissal of the Complaint as it is “bereft of any sufficient information to establish a cause of action against the Respondent under Sections 25 and 26 of the Data Privacy Act.”38

On 07 March 2023, the CID issued an Order39 noting the submissions made by BPI on 01 March 2023.

On 16 March 2023, the first scheduled Preliminary Conference for this case was held.40 Both parties were present.41 The respondent BPI was represented by Gxx and Jx.42

During the said preliminary conference, Complainant manifested that she already provided all the documents needed to prove her case and that she will not be requiring any document and/or evidence from the respondent, thus, discovery shall not be sought.43 On the other hand, BPI requested from the Complainant the screenshots of the short message service (SMS) message containing the OTPs and screenshots of the call logs when the fraudster called her.44

The parties also expressed willingness to explore settlement.45 As such, the parties were required to file their Application for Mediation, and the mediation conference was set for 19 April 2023 at 2:00 in the afternoon.46

In Compliance with the Order dated 16 March 2023,47 Complainant and Respondent submitted their Application for Mediation dated 17 March 202348 and 21 March 2023,49 respectively. As such, in an Order dated 23 March 2023, CID ordered the parties to appear for mediation proceedings on 19 April 2023.50

During the scheduled mediation, the parties were unable to reach a settlement.51 As such, the assigned mediation officer issued a Notice of Non-Settlement of Dispute dated 19 April 2023.52

On 25 April 2023, the CID issued an Order53 lifting the suspension of the complaints proceedings,54 requiring the Complainant to submit screenshots of the SMS messages containing the OTPs received and screenshots of the log of the call of the fraudster within fifteen (15) calendar days from 26 April 2023, or until 11 May 202355 and further requiring both parties to submit their respective memoranda within fifteen (15) calendar days from 11 May 2023 or until 26 May 2023.56

On 27 April 2023, the Complainant submitted her Memoranda.57 Complainant narrated that:

Representative knew my name, address, [date of birth] and my card number. She stated she is legitimate so I was able to provide all the information needed. She also she[sic] has an ID number (employee number) and a name. So I believe she is telling the truth.58

As to BPI’s negligence, Complainant argued in her Memoranda the following:

  1. My account was compromised and able to access the information and my phone and profile.
  2. No advice that BPI does not have a customer service and they do not [sic] the depositor.
  3. OTP was provided but notice on OTP does not state that once given money will be deducted.
  4. Not enough protection BPI provided to my account knowing that we have a scammer/fraudster here in the Philippines and it is getting wild.
  5. BPI did not provide enough notice not to entertain such a call.
  6. BPI is stating not liable at all. My money deposited. I trust them they will take care of it my privacy was compromised.
  7. They just use my money deposited to their bank and not protected at all.
  8. No notice at all that BPI customer representative does not call at all.
  9. Don’t let BPI decide on this case. It will be in court and go media.59

Complainant attached to her Memoranda several screenshots of multiple text messages from “BPI-OTP”60 containing the following:

NEVER SHARE YOUR OTP. You are about to access Manage My Accounts Page. Use OTP x x x only if you initiated this request. x x x BPIcybersecuriTips: Keep your personal information confidential at all times. NEVER share your OTP and password with anyone. Cybersecurity is a shared responsibility.

…

You are about to register to BPI Online. Use OTP x x x if you initiated this request. BPIcybersecuriTips: Keep your personal information confidential at all times. NEVER share your OTP and password with anyone. Cybersecurity is a shared responsibility.

…

WARNING: NEVER SHARE YOUR OTP. You are about to activate Mobile Key on your iPhone 6s Plus. Use One-Time PIN OTP x x x only if you initiated this request.

…

WARNING: NEVER SHARE YOUR OTP. You are about to activate Mobile Key on your iPhone XR. Use One-Time PIN OTP x x x only if you initiated this request.

…

NEVER SHARE YOUR OTP. You are about to topup or pay PHP 50,000.00 for SHOPEEPAY with Ref no. x x x. Use OTP x x x only if you initiated this transaction.61 (Emphasis supplied)

Meanwhile, BPI filed a Manifestation with Motion for Extension of Time to File Memorandum on 29 May 2023.62 BPI manifested that Complainant has not yet submitted the screenshots of the SMS messages containing the OTPs received and screenshots of the call logs on the call of the fraudster, as directed by the Order dated 25 April 2023.63 BPI emphasized that “that these documents are all in the exclusive possession of the Complainant. More importantly, these documents may be crucial and relevant in establishing the facts and circumstances attending the present case.”64

On 01 June 2023, the CID issued an Order65 stating that based on CID’s records, the Complainant has filed her memorandum and attached therein the screenshots required by the BPI.66 Thus, the CID directed that the Respondent be furnished a copy of the memorandum of the Complainant via email address, and gave the Respondent a fresh period of fifteen (15) calendar days from receipt of said order to file its memorandum.67

On 05 June 2023, BPI filed its Memorandum68 dated 04 June 2023.

In its Memorandum, BPI reiterated its arguments in its Comment and added that:

  1. … in order to protect its clients and raise awareness on personal information security, it consistently warns its clients about online scams, and reminds them that BPI’s employees or agents will never ask for their personal information such as bank account number, log-in credentials, credit card details, and OTP via email link, text message or phone call. These advisories are regularly sent to its clients’ registered email addresses and mobile numbers. They are also posted on BPI’s official website, and its accounts in various social media platforms, such as Facebook, Twitter, and Instagram.

  2. As a final measure to protect its clients from online scams, the text message sent by BPI containing the OTP also provides the transaction details, including the amount to be transferred or paid. It is also accompanied by an explicit warning, either in English, Tagalog, or both, not to share the OTP to anyone, and to report the transaction to BPI if it is unrecognized.69

To substantiate these claims, BPI attached copies of the “Bank of the Philippine Islands, Outsmart Fraudster Today”70, “Bank of the Philippine Islands, BPI Encourages its Clients to be More Cybersafe with Digital Security Features”71, and the screenshot of OTP messages previously attached to the Complainant’s Memorandum.72

Finally, BPI explained its preventive measures after one of its clients became victim of a scam and further claimed that it followed the same with regard to the present case, saying:

  1. However, in case a client falls victim to an online scam, BPI immediately deactivates their BPI Online account or compromised credit card, as the case may be, in order to prevent further unauthorized transactions. If the attack pertains to an unauthorized fund transfer to a digital wallet partner, a report is submitted to the concerned partner for their appropriate action. Afterwards, BPI conducts an exhaustive investigation on the unauthorized transaction. The result of this investigation is then provided to the client in order to assist them in the event that they decide to refer the matter to law enforcement agencies for investigation.

  2. In the present case, the foregoing security measures were in place when the disputed transactions were made. The transactions were all verified through BPI’s multi-factor authentication method. Further, the OTP messages sent to the Complainant’s registered mobile number contain the complete transaction details, with explicit warnings not to share her OTPs. After she reported the attack, BPI immediately deactivated her BPI Online account, and reported the same to Shopee for their appropriate action. Finally, the result of BPI’s exhaustive investigation was provided to the Complainant.73

To substantiate these claims and “to prove that it conducted an investigation pertaining to the disputed transactions, and the result thereof was provided to the Complainant,”74 BPI attached a BPI Online Feedback Letter75 issued by its BPI Open Banking Fraud Monitoring and Risk Management Officer dated 18 August 2022, which reads:

Based on our review of your account as detailed in the table below, on August 5, 2022, at 3:32pm, your account was accessed via BPI Online and its password was reset thru proper One Time Pin authentication. Thereafter the account had five (5) ensuing transactions with Shopeepay Cash-In amounting to P250,000.

We note that the password change and subsequent transactions to Shopee were all confirmed by One-Time PIN (OTP) sent to your registered mobile number ending in XXXX-XXX-0321. This means that only you can access your registered phone in your possession to have knowledge of these transactions that need authentication.

As you are aware of access to your BPI Online banking account requires logging in using your nominated Username and Password. Financial transactions also require further authentication by a One-Time PIN (OTP), sent through a text message to your registered mobile number, or Mobile Key. Your mobile number ending in XXXX-XXX-0321 was duly registered in the Bank’s records in June 2021. The text message provides the description of the transaction. These are the internationally accepted industry standards for secure and safe online banking transactions that has passed even the rigid regulatory standards set by the Bangko Sentral Ng Pilipinas (BSP). Under the terms of use of our Online Banking facility, your Username and Password should be always under your control. Any transaction that is done by using your username and password and duly validated either through your One Time Pin (OTP) or your Mobile Key is presumed to be done by you.

Given that the Bank has discharged its obligation in providing a safe and secure online banking platform, and it is apparent that the personal banking information was compromised at your end, we regret that we are unable to grant your request for reversal of the disputed transactions. These are all considered valid as these were properly authenticated from your end.

We referred this matter to Shopee for blocking the recipients and possible reclamation of funds. According to Shopee, they already banned the account linked to the reported transaction. There was an Instapay transfer after the top-up.

Such transfers are immediate and once made, merchant can no longer cancel or recall the transfer. Hence, refund is not possible.

Should you decide to pursue further investigation with the proper government agency (e.g., NBI or PNP Cyber Crime Office), we can assist you in the filing process. Rest assured that we will abide by the legal processes and provide the material information needed in their own investigation.76 (Emphasis supplied)

Finally, BPI argued that “the totality of the surrounding facts and circumstances patently establishes that the Complainant was guilty of gross and inexcusable negligence in safeguarding her personal information”77 and “any resulting loss must be solely borne by her as a direct consequence of her own negligence.”78 Thus, BPI prayed that the Complaint be dismissed for utter lack of merit.79

On 09 November 2023, the Commission issued a Notice80 to the parties that this case has been submitted for decision of the Commission.81

Issue

Whether BPI violated Section 25 (Unauthorized Processing) and Section 26 (Access Due to Negligence) of the DPA.

Discussion

The Commission resolves to dismiss the instant Complaint for lack of substantial evidence. BPI cannot be held liable for a DPA violation given the allegations and evidence provided by Complainant.

Section 6 of Rule 133 of the 2019 Amendments to the Revised Rules on Evidence provides:

Section 6. Substantial Evidence. In cases filed before administrative or quasi-judicial bodies, a fact may be deemed established if it is supported by substantial evidence, or that amount of relevant evidence which a reasonable mind might accept as adequate to justify a conclusion.82

In NIC v. Guanzon,83 the Court elaborated on the standard of proof required before administrative or quasi-judicial bodies, defining substantial evidence as:

[T]he quantum of evidence required to establish a fact in cases before administrative or quasi-judicial bodies. It has been defined as “such amount of relevant evidence [that] a reasonable mind might accept as adequate to justify a conclusion.” This quantum of evidence “is satisfied where there is reasonable ground to believe that [a person] is guilty of the act or omission complained of, even if the evidence might not be overwhelming.84

While Section 1 of Rule 131 of the 2019 Amendments to the Revised Rules on Evidence provides for the definition of burden of proof:

Section 1. Burden of proof and burden of evidence. Burden of proof is the duty of a party to present evidence on the facts in issue necessary to establish his or her claim or defense by the amount of evidence required by law. Burden of proof never shifts.

Burden of evidence is the duty of a party to present evidence sufficient to establish or rebut a fact in issue to establish a prima facie case. Burden of evidence may shift from one party to the other in the course of the proceedings, depending on the exigencies of the case.85

This principle that the duty to present evidence sufficient to support one’s claim remains with the party making the allegation is well-established in jurisprudence. The Supreme Court has consistently held that “whoever alleges a fact has the burden of proving it because a mere allegation is not evidence.”86

In Government Service Insurance System v. Prudential Guarantee87 the Supreme Court affirmed that “it is basic in the rule of evidence that bare allegations, unsubstantiated by evidence, are not equivalent to proof. In short, mere allegations are not evidence.”88

Thus, the Complainant in this case bears the burden of proof to substantiate her claims. However, she failed to show, by substantial evidence, that BPI committed a violation of the DPA.

Respondent is not liable under Section 25 of the DPA due to lack of substantial evidence.

To be held liable under Section 25 of the DPA, the following requisites must concur:

  1. The perpetrator processed the information of the data subject;
  2. The information processed was personal information or sensitive personal information;
  3. The processing was done without the consent of the data subject, or without being authorized under the DPA or any existing law.89

As to the first requisite, under the DPA, processing is defined as “any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.”90

According to Complainant, the alleged fraudster knew her name, address, date of birth, and her card number.91 The Complainant claims the alleged fraudster accessed her account, changed the password, and withdrew PHP 50,000.00 from her savings account on six separate occasions, transferring the amount to ShopeePay Philippines.92 The Complainant equates the fraudster’s knowledge of her personal details and entry of this information into ShopeePay Philippines to “retrieval” and “use” of personal information, which she argues constitutes “processing” as defined above.93

To support her claims of unauthorized processing of her name, date of birth, and her card number against BPI, the Complainant presented several pieces of evidence: a screenshot of the OTP text messages, correspondences with BPI and Shopee PH email support, and a printout of transactions from BPI Maharlika Highway, Cabanatuan Branch.94 The printout shows a transfer of PHP 300,000.00 from her account to ShopeePay Philippines on 05 August 2022.95

However, aside from these documents, the Complainant did not demonstrate that BPI was responsible for processing her personal data (i.e., authenticating, retrieving, and using it) in connection with the alleged unauthorized transactions. It is important to emphasize that mere allegations do not constitute proof.96 In other words, there was no sufficient proof to substantiate Complainant’s claim of unauthorized processing by BPI of said personal data.

The Commission finds that Complainant’s submissions fail to establish a connection between the alleged processing and BPI’s involvement. Although there was processing of personal data involved, the Complainant failed to prove by substantial evidence that BPI processed her personal information, specifically her name, date of birth, and her BPI Visa/Mastercard card number97, and due to or through this processing, the fraudulent caller obtained the same.98

As such, since the Complainant failed to substantiate that BPI processed her personal data in connection with the alleged unauthorized transactions, which is the first requisite for a violation of Section 25 of the DPA. As a result, the Respondent cannot be held liable for unauthorized processing.

Respondent is not liable under Section 26 of the DPA due to lack of substantial evidence.

As to the alleged violation of Section 26 (Access Due to Negligence), Complainant also failed to sufficiently prove that the unauthorized access to her information was brought about by the negligence on the part of BPI.

Anent this claimed negligence by BPI, Complainant asserts BPI’s negligence on account that there was “[n]ot enough protection BPI provided to [my] account knowing that we have a scammer/fraudster here in the Philippines and it is getting wild, and that BPI “did not provide enough notice not to entertain such a call.”99 However, these claims are unsupported by concrete evidence. The Complainant has failed to substantiate her allegations with proof of a violation of Section 26 of the DPA.

In contrast, BPI has demonstrated its measures in place in safeguarding customer information. One of which is thru its multi-factor authentication method for transactions conducted through BPI Online, which requires personal data presumed to be known only to the account holder.100 Additionally, BPI has issued communications instructing its customers not to share their OTPs, as evidenced by the attached documents: “Bank of the Philippine Islands, Outsmart Fraudster Today”101, “Bank of the Philippine Islands, BPI Encourages its Clients to be More Cybersafe with Digital Security Features,”102 and notably, the screenshots of OTP messages included in the Complainant’s Memorandum,103 which explicitly advise customers to “NEVER share [their] OTP and password with anyone.”104

Moreover, as correctly pointed out by BPI, BSP itself warns the public of vishing attacks through its primer entitled Protect Yourself from Fraud and Scam105, to wit:

In its primer entitled Protect Yourself from Fraud and Scam, the Bangko Sentral ng Pilipinas (“BSP,” for brevity) defined voice phishing or vishing as “voice calls, automated voice recording, or Voice over Internet Protocol (VoIP) from someone pretending to be an employee of a bank or popular company, and asking for account details.” The BSP warns the public not to provide their personal information, account details, or passwords to anyone, even if they claim to be representatives of banks or financial institutions. This is because banks or financial institutions will never ask for the said information.

It must be stressed, however, that vishing attacks related to online banking accounts in the country are usually not targeted attacks. Generally, they are random calls looking for clients of a particular financial institution. In this day and age, it is easy for cybercriminals to obtain mobile numbers, email addresses, or other personal information since people regularly share them with personal and business contacts, establishments, social media platforms, and various websites. In fact, government issued identification cards, email addresses, credit card information, online accounts, and other personal information are being traded by cybercriminals in the dark web market.106

Consequently, the lack of substantial evidence to support the Complainant’s allegations precludes any conclusion that the access to the Complainant’s information, which resulted in the disputed transactions, was due to BPI’s negligence. Therefore, BPI cannot be held liable under Section 26 of the DPA.

Given the foregoing, the Commission finds that BPI cannot be held liable for violating Section 25 (Unauthorized Processing) and Section 26 (Accessing Due to Negligence) of the DPA.

Although this case is being dismissed due to insufficient substantial evidence implicating BPI in the alleged DPA violations, this decision should not be construed as a conclusion to the broader imperative of advancing data protection practices. Rather, it serves as a reminder of the ongoing necessity for continual improvement in security and efficiency within the banking sector.

In light of this, financial institutions, who are imbued with public interest and are required to exercise the highest degree of diligence, are strongly encouraged to move beyond the mere issuance of reminders about the risks associated with fraudulent calls and other security threats. While such notifications play a role in raising awareness, they are insufficient on their own to effectively combat the rising prevalence of financial fraud.

To adequately address and mitigate evolving threats, it is crucial that banks should explore other measures to protect their clients. Proactive measures and innovative strategies are essential for safeguarding personal data, thereby fulfilling the enduring obligation to protect both operational integrity and customer information against sophisticated and emerging risks.

WHEREFORE, premises considered, the Complaint of MTS against BPI – ZBC is hereby DISMISSED for lack of substantial evidence

This is without prejudice to the filing of appropriate civil, criminal or administrative cases against Respondent BPI before any other forum or tribunal, if any.

SO ORDERED.

City of Pasay, Philippines. 01 August 2024.

NERISSA N. DE JESUS Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

Copy furnished:

MTS Complainant

BANK OF THE PHILIPPINE ISLANDS BPI LEGAL DIVISION Attn: CDC and GAB Counsel for the Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Complaints-Assisted Form dated 26 October 2022 of MTS. ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. ↩

  6. Id. ↩

  7. Id. ↩

  8. Id. ↩

  9. Id. ↩

  10. Id., at p. 9 to 10. ↩

  11. Id., at p. 11. ↩

  12. Id., at p. 12. ↩

  13. Id., at p. 13 to 14. ↩

  14. Id., at p. 15. ↩

  15. Id., at p. 16 to 18. ↩

  16. Id., at p. 19 to 21. ↩

  17. Id., at p. 22. ↩

  18. Id., at p. 23 to 25. ↩

  19. Id., at p. 5 to 6. ↩

  20. Order (To File Verified Comment and Appear Virtually for Preliminary Conference) dated 14 February 2023. ↩

  21. Id. ↩

  22. Special Power of Attorney executed by CDC dated 27 February 2023. (See also BPI’s Secretary Certificate dated 17 November 2022). ↩

  23. Respondent’s Comment dated 27 February 2023. ↩

  24. Id., at p. 1. ↩

  25. Id., at p. 1. ↩

  26. Id., at p. 2. ↩

  27. See email dated 18 August 2022 – Disputed Transaction Case 04061047, attached to the Respondent’s Comment dated 27 February 2023, Annex “1”. ↩

  28. Id., at p. 4. ↩

  29. Id., at p. 4. ↩

  30. Id., at p. 5. ↩

  31. Id., at p. 5. ↩

  32. Id., at p. 6. ↩

  33. Id., at p. 6. ↩

  34. Id., at p. 6. ↩

  35. Id., at p. 7 to 8. ↩

  36. Id., at p. 8. ↩

  37. Id., at p. 8. ↩

  38. Id., at p. 6. See also page 8. ↩

  39. Order (Noting the Respondent’s Comment, Verification, Corporate Secretary’s Certificate, Entry of Appearance, and Special Power of Attorney) dated 07 March 2023. ↩

  40. Order (After the 1st Preliminary Conference held on 16 March 2023, Cancelling the 2nd Setting of the Preliminary Conference on 25 April 2023, Requiring the Parties to Submit Signed Application for Mediation Form, and Requiring the Parties to Appear for Mediation Conference on 19 April 2023) dated 16 March 2023. ↩

  41. Id. ↩

  42. Id. ↩

  43. Id. ↩

  44. Id. ↩

  45. Id. ↩

  46. Id. ↩

  47. Id. ↩

  48. Complainant’s Application for Mediation Form dated 17 March 2023. ↩

  49. Respondent’s Application for Mediation Form dated 21 March 2023. ↩

  50. Order to Mediate dated 23 March 2023. ↩

  51. Notice of Non-Settlement of Dispute dated 19 April 2023. ↩

  52. Id. ↩

  53. Order (for Resumption of Complaints Proceedings, Requiring the Complainant to Submit Documents Subject of Discovery, and Requiring the Parties to Submit their Simultaneous Memoranda) dated 25 April 2023. ↩

  54. Id. ↩

  55. Id. ↩

  56. Id. ↩

  57. Complainant’s Memoranda dated 27 April 2023. ↩

  58. Id., at p. 1. ↩

  59. Id. ↩

  60. Id. ↩

  61. Id., at p. 6 to 9. ↩

  62. Respondent’s Manifestation with Motion for Extension of Time to File Memorandum dated 29 May 2023. ↩

  63. Order (for Resumption of Complaints Proceedings, Requiring the Complainant to Submit Documents Subject of Discovery, and Requiring the Parties to Submit their Simultaneous Memoranda) dated 25 April 2023. ↩

  64. Respondent’s Manifestation with Motion for Extension of Time to File Memorandum dated 29 May 2023. ↩

  65. Order (Noting Respondent’s Manifestation with Motion for Extension of Time to File Memorandum, Furnishing Respondent with a Copy of the Complainant’s Memorandum, and Requiring the Respondent to File its Memorandum) dated 01 June 2023. ↩

  66. Id. ↩

  67. Id. ↩

  68. Respondent’s Memorandum dated 04 June 2023. ↩

  69. Id. ↩

  70. Id., Annex 4. ↩

  71. Id., Annex 5. ↩

  72. Id., at p. 8. ↩

  73. Id., at p. 9. ↩

  74. Id. ↩

  75. Id., Annex 1. ↩

  76. Id. ↩

  77. Id. ↩

  78. Id. ↩

  79. Id. ↩

  80. Notice (that the Case is Submitted for Decision of the Commission) dated 09 November 2023. ↩

  81. Id. ↩

  82. 2019 Amendment to the 1989 Revised Rules on Evidence, A.M. No. 19-08-15-SC. ↩

  83. G.R. No. 230931, 15 November 2021. ↩

  84. Id., citing Castillon v. Marine, Inc., G.R. No. 234711, 02 March 2020 and Office of the Ombudsman v. Agustino, 758 Phil. 191, 201 (2015). ↩

  85. 2019 Amendment to the 1989 Revised Rules on Evidence, A.M. No. 19-08-15-SC. Emphasis supplied. ↩

  86. Luxuria Homes, Inc. v. Court of Appeals, G.R. No. 125986, January 28, 1999, 302 SCRA 315, 325; Coronel v. Court of Appeals, G.R. No. 103577, October 7, 1996, 263 SCRA 15, 35. ↩

  87. G.R. No. 165585, 20 November 2013. ↩

  88. Id., citing Real v. Belo, 542 Phil. 109 (2007). ↩

  89. In Re: FLI Operating ABC Online Lending Application, NPC 19-910, Decision dated 17 December 2020 at p. 17. ↩

  90. National Privacy Commission, Data Privacy Act of 2012, Chapter I § 3(j) (2012). Emphasis supplied. ↩

  91. Complaints-Assisted Form dated 26 October 2022 of MTS. ↩

  92. Id. ↩

  93. Id. ↩

  94. Id. ↩

  95. Id. ↩

  96. G.R. No. 165585, 20 November 2013, citing Real v. Belo, 542 Phil. 109 (2007). ↩

  97. Complaints-Assisted Form dated 26 October 2022 of MTS. ↩

  98. Id. ↩

  99. Id. ↩

  100. Respondent’s Memorandum dated 04 June 2023. ↩

  101. Id., Annex 4. ↩

  102. Id., Annex 5. ↩

  103. Id., at p. 8. ↩

  104. Id. ↩

  105. Id., Annex 2. ↩

  106. Id., at p. 7 to 8. See also Annexes 2 and 3. ↩

Backlinks

  • No backlinks found