NPC Issuance Wiki

NPC 22-257: ARG v. AMP

Issued Decision

Decision Text

ARG,

Complainant,

-versus-

AMP,

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.:

Before this Commission is a Complaint filed by Dr. ARG against Dr. AMP for alleged violations of Sections 25 (Unauthorized Processing) and 28 (Processing for Unauthorized Purposes) of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

Dr. ARG and Dr. AMP are doctors at [the Hospital].1 Dr. ARG is the head of the Department of [ ]2 while Dr. AMP is one of the consultants.3 Dr. ARG alleged that Dr. AMP has been collecting and taking screenshots of the daily time records (DTRs) of the entire [department] consultant staff since 2020.4 Dr. ARG narrated that JHH, the department’s administrative assistant, warned her about Dr. AMP’s actions “such as requesting for previous letters and documents submitted to or by the department.”5 She added that JHH showed her the exchange of messages between him and Dr. AMP, which included screenshots of DTRs and letters with [the Hospital’s] logo.6

On 10 June 2022, in a department meeting, Dr. ARG informed the department’s staff about Dr. AMP’s actions and showed them the contents of JHH’s phone.7 After this, they decided to consult with [the Hospital’s] Data Protection Officer (DPO) who advised them to prepare a formal complaint against Dr. AMP.8 On 11 June 2022, in a special meeting with the Hospital’s Training Core and Ethic Liaison, JHH reported that it was Dr. AMP’s practice “to gain copies and information through insistence and intimidation.”9 He also reported that he asked the previous secretary, KDP, about Dr. AMP’s actions, and she told him “that was just the way it was, and to let it go.”10 Further, he stated that he saw Dr. AMP taking photos of the DTRs using his phone on several instances.11

On 13 June 2022, Dr. ARG submitted a complaint to the DPO.12 On 17 June 2022, after another meeting with the staff and the DPO, thirteen (13) consultants from the Department of [ ] prepared and signed a letter and submitted it to the Hospital’s Data Privacy Committee (DPC).13 On 20 June 2022, Dr. AMP responded to Dr. ARG’s complaint by categorically denying the allegations of a data privacy breach.14 On 22 June 2022, Dr. AMP likewise denied the allegations in the letter signed by the consultants.15 On 19 July 2022, Dr. AMP, upon receipt of the affidavits and evidence submitted to the DPC, responded through a letter that “he took copies of the DTRs under the advice of a civil service officer.”16

On 27 July 2022, the DPC initiated mediation proceedings.17 The mediation, however, failed because there was “no clear measure of accountability or recompense from the respondent.”18 As a result, Dr. ARG filed a Complaint with the National Privacy Commission (NPC) for violations of Sections 25 (Unauthorized Processing) and 28 (Processing for Unauthorized Purposes) of the DPA.19 Dr. ARG prayed for damages and the termination of Dr. AMP’s employment without benefits.20 She also prayed that a fine be imposed on Dr. AMP.21

On 13 December 2022, the NPC, through its Complaints and Investigation Division (CID), ordered Dr. AMP to submit his comment and directed the parties to appear for a preliminary conference after the lapse of the period to file their comment.22 On 26 January 2023, due to Dr. AMP’s non-appearance, the CID ordered the resetting of the preliminary conference and reminded Dr. AMP to submit his comment.23 On 27 January 2023, Dr. AMP submitted his Comment.24

Dr. AMP argued that for the past years he noticed that many consultants in the Department of [ ] at [the Hospital] were, on several occasions, not reporting to work despite the entries in their respective DTRs.25 He explained that during this time, the Hospital has already been using biometrics to record the time worked by its employees, including doctors.26 He added that he filed grievance reports with the Hospital but there was no change in work ethics.27

Because of this, Dr. AMP stated that he decided to bring the matter before the Civil Service Commission (CSC).28 He explained that the CSC advised him to support his complaint and allegations with evidence.29 Relying on the advice of the CSC, Dr. AMP requested JHH, the personnel in charge of collecting DTRs, to provide him with copies of the DTRs of the erring doctors.30 He denied the allegations that he used his authority and influence over the administrative assistants.31 As proof, he submitted screenshots showing when JHH, on several occasions, voluntarily and without being asked, sent him the DTRs.32

Dr. AMP stressed that JHH voluntarily and willingly gave copies of the DTRs upon his request.33 He argued that he would not have continued his request for the copies if JHH informed him that there was a need to secure consent or observe protocols.34 Dr. AMP explained that “[his] only purpose in securing these DTRs is to provide proof and basis for the complaint before the CSC.”35 As a defense, he cited Sections 12(f) and 13(f) of the DPA as his basis for processing.36 He argued that there are “no other means to prove [his] claims against the erring doctors other than through their DTRs.”37

In addition, he stated that JHH, as the administrative assistant of the Department of [ ], is in charge of processing and keeping in his custody the employees’ DTRs.38 Thus, under the DPA, he is considered the Personal Information Controller (PIC).39 He added that “he did not think that DTRs were private or confidential because DTRs are always at the office for anyone to see and that the DTRs are just left in the respective pigeonholes of the consultants.”40

On 01 February 2023, the CID noted Dr. AMP’s Comment.41 On 23 February 2023, during the Preliminary Conference, the CID ordered Dr. AMP’s counsel to submit an enlarged copy of the DTRs and a formal entry of appearance.42 The CID also ordered Dr. ARG’s counsel to submit the affidavit of KDP and a formal entry of appearance.43 Further, the CID ordered the parties to submit their respective memoranda within fifteen (15) calendar days from receipt of the Order.44

On 03 March 2023, Dr. ARG’s counsel filed a Notice of Appearance with Compliance.45 On 08 March 2023, the CID noted the submission.46 On 09 March 2023, Dr. AMP’s counsel filed a Manifestation with Entry of Appearance.47 He manifested that the photos of the DTRs taken and sent by JHH to Dr. AMP’s messenger account was no longer accessible because the account was hacked last 31 December 2022.48 On 17 March 2023, the CID noted the submission.49

On 22 March 2023, Dr. ARG submitted her Memorandum.50 She narrated that as department head, she wanted to understand and know how long Dr. AMP has been getting copies of the DTRs.51 Because of this, she asked the former Administrative Assistant, KDP, if she previously provided any DTR to Dr. AMP.52 According to KDP, he took photos of the DTRs during her tenure.53 In her Memorandum, Dr. ARG argued that Dr. AMP committed multiple violations of the DPA, specifically Sections 25 and 28.54

First, Dr. AMP admitted, in his submissions, that on numerous occasions, he secured the DTRs of his colleagues in the department.55 In addition, she stated that JHH and KDP did not voluntarily give the DTRs to Dr. AMP because “there is a clear power imbalance in the relationship of the parties.”56 JHH and KDP are both Dr. AMP’s subordinates as medical doctor and consultant of the Department of [ ].57

Second, Dr. ARG argued that the DTRs contained sensitive personal information.58 She argued that the April 2021 DTR shows that she was on “quarantine leave.”59 She explained that during that time she was COVID-19 positive and had to undergo five (5) days of home quarantine.60 She posited that this information falls under “personal information about an individual’s health.”61 Further, the DTRs contained her signature.62 Citing the Minutes of the Meeting conducted with [the Hospital’s] DPC, she stated that the health information when put together with the name, signature, and position becomes SPI.63 Dr. ARG added that the fact that the DTRs are left in the doctors’ respective pigeonholes “does not make the personal information contained therein free for public consumption” but “show that they are meant only for the owners.”64

Third, she argued that good faith is not a defense in the DPA because a violation of such is mala prohibita.65 In his Comment, Dr. AMP stated that he was “of the belief that no law was being violated” and that the DTRs are “public documents open to scrutiny.”66 Dr. ARG stressed that whatever his intent or reason may be, he stands in violation of a special penal law, the DPA, which is mala prohibita.67

Fourth, Dr. ARG posited that there was no legitimate purpose or legal obligation on the part of Dr. AMP as a government employee to obtain the DTRs.68 She explained that:

[W]hile the processing of the complainant ARG’s personal and sensitive information was not strictly for the own interest of respondent AMP, to argue that it was for the interest of the [the Hospital] and/or the government may only be given credence if he was authorized by the [the Hospital] and/or the government. A simple advice to collect evidence by someone from the CSC is not the authority contemplated by law because for sure, the CSC employee did not instruct respondent AMP to collect evidence in violation of the DPA.69

Dr. ARG also argued that there are other lawful means for Dr. AMP to prove his claims against the erring doctors.70 In addition, she pointed out that despite being in possession of the DTRs as early as January 2021, Dr. AMP has not filed any complaint with the CSC.71

On 27 March 2023, Dr. AMP submitted his Memorandum.72 First, Dr. AMP posited that he is not a PIC or Personal Information Processor (PIP).73 He argued that he is not covered by the DPA and cannot be made liable for the offenses charged against him.74 He stated:

In the instant case, it must be noted that Dr. AMP is a consultant and a government employee at [the Hospital] belonging in the same Department with Dr. ARG, and all other fellow [doctors] and staff. As a consultant, he does not control the collection, holding, processing, or use of the Daily Time Record of employees in the hospital. Neither is he a person whom the personal information controller has outsourced the processing of personal information. Therefore, he is not a person within the coverage of the law for which the alleged violations complained are punished. Thus, Dr. AMP, cannot be made liable for the offenses charged by Dr. ARG.75

Second, he argued that he “did not do any of the acts considered as processing under the law.”76 He stressed that his receipt of the DTRs is not considered as processing under the DPA.77 He narrated that:

The collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data were made by the [the Hospital] through Mr. JHH’s performance of his official function, and not by Dr. AMP. He received the information from the administrative staff with his consent, voluntarily, with no signs of duress, or intimidation.78

Third, assuming receiving a copy of the DTRs was processing, Dr. AMP contended that the information contained in the DTRs are not sensitive personal information.79 Thus, he argued that its processing falls within the exceptions for processing information without the consent of the data subject.80 The DTRs contained only the employee’s name and time of ingress and egress.81

Finally, Dr. AMP stressed that he acted under a legal obligation as a government employee.82 He explained that the processing was necessary for the fulfillment of a legal obligation and necessary to pursue legitimate interests.83 He stated:

Dr. AMP, being a public official, has the duty to uphold public interest, by gathering information that would expose erring co-public officials from causing undue injury to the government by falsifying their daily time records, and still paid with full and complete salary while the actual hours worked is less. It must be emphasized that public officials and employees shall always uphold the public interest over and above personal interest. All government resources and powers of their respective offices must be employed and used efficiently, effectively, honestly, and economically, particularly to avoid wastage in public funds and revenues.84

On legitimate interest, Dr. AMP posited that all requisites for processing based on legitimate interest are present.85 He argued that his letters to [the Hospital] show that he intends to save government resources from being misused due to erring employees.86 In addition, Dr. AMP stated that the receipt of the DTRs was necessary “to support his planned administrative complaint against erring employees before the CSC, more so that his grievance letters were not acted upon.”87 He explained that there were no other means to prove his claims about the misdeclarations of the doctors.88

Finally, Dr. AMP contended that the government’s interest does not override fundamental rights and freedoms of the data subjects.89 He explained that “the government’s interest to be protected from employees trying to use its resources dishonestly” should not override Dr. ARG’s right to protect her name and conceal her actual hours worked.90

Issue

Whether Dr. AMP violated Section 25 of the DPA (Unauthorized Processing) when he processed Dr. ARG’s documents.

Discussion

The Commission dismisses the case for lack of merit.

I. Dr. AMP is not liable under Section 25 of the DPA (Unauthorized Processing)

Section 25 of the DPA provides:

Section 25. Unauthorized Processing of Personal Information and Sensitive Personal Information. (a) The unauthorized processing of personal information shall be penalized by imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00) shall be imposed on persons who process personal information without the consent of the data subject, or without being authorized under this Act or any existing law.91

In determining whether Unauthorized Processing occurred, three (3) elements must be established with substantial evidence:

  1. The perpetrator processed the information of the data subject;
  2. The information processed was personal information or sensitive personal information; and
  3. The processing was done without the consent of the data subject, or without being authorized under the DPA or any existing law.92
A. Dr. AMP processed the information of Dr. ARG.

The first requisite for Unauthorized Processing is that the perpetrator processed information of the data subject. Dr. ARG stated that Dr. AMP processed her information when he secured the DTRs.93 On the other hand, Dr. AMP argued that he is not the PIC or PIP.94

Under Section 3(h) the DPA, a PIC is defined as, “a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.”95

A PIP is “any natural or juridical person qualified to act as such under [the DPA] to whom a [PIC] may outsource the processing of personal data pertaining to a data subject.”96 The Implementing Rules and Regulations of the DPA (IRR) defines control as deciding on the information is collected, or the purpose or extent of its processing.97

In this case, Dr. AMP had control over the personal information in the DTRs. He decided on the information that was collected from Dr. ARG, specifically her DTRs. Further, he determined the purpose for collection, which was to file a complaint with the CSC. Thus, Dr. AMP is the PIC.

Further, Dr. AMP argued that he only received the DTRs from JHH and such does not constitute processing under the DPA.98 Section 3 of the DPA defines processing as follows:

Section 3. Definition of Terms. Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

(j) Processing refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.99

In this case, Dr. AMP processed the personal data of Dr. ARG in two instances: (1) when he requested the DTRs; and (2) when he took photos of the DTRs. These two acts are considered processing of personal data. Thus, Dr. AMP processed Dr. ARG’s personal data, satisfying the first requisite for Unauthorized Processing.

B. Dr. AMP processed Dr. ARG’s personal information.

The second requisite for Unauthorized Processing is that the information processed is personal information or sensitive personal information.100 Dr. ARG stated that the DTRs contained her name, position, signature, and that she was on “quarantine leave.”101 She argued that the information, when put together, becomes sensitive personal information.102

Section 4(a) and (b) of the DPA states:

Section 4. Scope.

…

This Act does not apply to the following:

(a) Information about any individual who is or was an officer or employee of a government institution that relates to the position or functions of the individual, including:

(1) The fact that the individual is or was an officer or employee of the government institution; (2) The title, business address and office telephone number of the individual; (3) The classification, salary range and responsibilities of the position held by the individual; and (4) The name of the individual on a document prepared by the individual in the course of employment with the government;

(b) Information about an individual who is or was performing service under contract for a government institution that relates to the services performed, including the terms of the contract, and the name of the individual given in the course of the performance of those services.103

Since [the Hospital] is a government hospital, the information contained in the DTRs fall under either Section 4(a) or 4(b) of the DPA. These pieces of information relate to Dr. ARG’s position or functions to identify if she is a plantilla personnel, or the service she performed if she is under contract with [the Hospital]. The information covered by Section 4(a) is not limited to those enumerated in the provision. The use of the word “including” shows that Section 4(a) covers information that relates to how government officials performed their functions. Thus, since the pieces of information relate to the “position or functions of an individual,” the information contained in the DTRs are excluded from the scope of the DPA.

Further, if Dr. ARG was performing services under a contract with [the Hospital], the information on her DTR directly relates to how she performed her services as consultant in [the Hospital’s] Department of [ ]. These pieces of information, especially her time of ingress and egress, fall squarely under Section 4(b) of the DPA and are likewise excluded from the scope of the DPA.

Assuming the information contained in the DTRs are not excluded, the Commission has previously held that the name, signature, and designation of the data subject cannot be considered as sensitive personal information.104 Sensitive personal information refers to:

Section 3. Definition of Terms. Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

(l) Sensitive personal information refers to personal information:

(1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; (2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and (4) Specifically established by an executive order or an act of Congress to be kept classified.105

Dr. ARG’s name, position, and signature clearly do not fall within the definition of sensitive personal information. These, however, are considered personal information, which refers to:

Section 3. Definition of Terms. Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

(g) Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.106

Further, while the DPA considers information about an individual’s health as sensitive personal information, the Commission emphasizes that not all information related to health should automatically be considered sensitive personal information. The enumeration provided in Section 3(l) of the DPA includes information from which an individual can be personally identified, and can be used to build a more comprehensive profile of an individual for targeted phishing attacks, scams, or other malicious activities, and even lead to discrimination, or stigmatization.107 Thus, these must be taken into consideration when determining whether the information about health falls within the definition of sensitive personal information.

In this case, one of Dr. ARG’s DTRs contained a notation that she was on “quarantine leave.”108 This information, by itself, does not give enough information about the specific health condition of Dr. ARG that may lead to profiling or discrimination. Thus, in the given circumstances, such information cannot be considered sensitive personal information.

Given these, the second requisite of Unauthorized Processing is present. Dr. AMP processed Dr. ARG’s personal information.

C. Dr. AMP processed Dr. ARG’s personal information pursuant to Section 13(f) in relation Section 12(f) of the DPA.

The third requisite is that the processing was done without the consent of the data subject, or without being authorized under the DPA or any existing law.109 Dr. AMP argued that his only purpose in securing the DTRs was to provide proof and basis for his complaint against Dr. ARG and the other department staff before the CSC.110 He stated that he had lawful basis to process Dr. ARG’s personal data under Sections 12(f) and 13(f) of the DPA.111

Section 13(f) of the DPA allows for the processing of sensitive personal information when it is necessary for the exercise or defense of legal claims:

Section 13. Sensitive Personal Information and Privileged Information. The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

…

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.112

This lawful basis for processing can be applied to personal information and treated as processing necessary for the purpose of legitimate interest under Section 12(f) of the DPA.113 In this case, Dr. AMP will use the DTRs to build a case against Dr. ARG and the other department staff before the CSC. The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural persons in court proceedings and the establishment of legal claims. Thus, even if some of the information in the DTRs can be considered sensitive personal information, as argued by Dr. ARG, there would still have been lawful basis under Section 13(f) to process such information.

In this case, however, since the DTRs only contained personal information, the processing falls within the scope of legitimate interest under Section 12(f) of the DPA. Section 12(f) of the DPA allows for the lawful processing of personal information when it is necessary for legitimate interest, provided that these interests are not overridden by the fundamental rights and freedoms of the data subject.114 To constitute lawful processing of personal information based on legitimate interest, the following requisites must be complied with:

  1. The legitimate interest is established
  2. The means to fulfill the legitimate interest is both necessary and lawful; and
  3. The interest is legitimate and lawful, and it does not override fundamental rights and freedoms of data subjects.115

The requisites for processing personal information based on legitimate interest are established in this case.

First, Dr. ARG’s legitimate interest was established. He processed the DTRs in preparation for filing a complaint with the CSC. Second, the processing of the personal information contained in the DTRs was both necessary and lawful. The DTRs were necessary to prove and support Dr. AMP’s claims in his complaint with the CSC that the doctors were falsifying the entries in their DTRs.116 Third, the processing did not override Dr. ARG’s fundamental rights and freedoms, as it is directly relevant to the legal claims that Dr. AMP had to make.

The Commission emphasizes that the general privacy principles continue to apply regardless of the applicable lawful basis for processing.117

In her submissions, Dr. ARG argued that Dr. AMP had no legitimate purpose or legal obligation as a government employee to secure the DTRs.118 Further, there are other lawful means for Dr. AMP to prove his claims against the erring doctors.119

The legitimate purpose principle requires that the processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy.120 This means that the processing done for the establishment of a legal claim should not be outside the limitations provided by law.121

In this case, the processing of the DTRs was in view of complaint to be filed by Dr. AMP against Dr. ARG. The purpose for processing of the DTRs cannot be considered as wrongful or illegal. The DPA is neither a tool to prevent the discovery of a crime nor a means to hinder legitimate proceedings.122

As stated by Dr. AMP, he, as a public official, has the duty to uphold public interest, by exposing erring co-public officials from causing undue injury to the government.123 This is provided under Section 4 of Republic Act No. 6713 or the Code of Conduct and Ethical Standards for Public Officials and Employees, which states:

Section 4. Norms of Conduct of Public Officials and Employees. (A) Every public official and employee shall observe the following as standards of personal conduct in the discharge and execution of official duties:

(a) Commitment to public interest. Public officials and employees shall always uphold the public interest over and above personal interest. All government resources and powers of their respective offices must be employed and used efficiently, effectively, honestly and economically, particularly to avoid wastage in public funds and revenues.124

Further, he is under oath to expose any anomaly that would come to his knowledge through the proper channels:

Panunumpa ng Lingkod Bayan (2021)

Ako ay isang lingkod bayan.

Pangangalagaan ko ang tiwalang ipinagkaloob ng mamamayan. Maglilingkod ako nang may malasakit, katapatan, at kahusayan na walang kinikilingan. Magiging mabuting halimbawa ako, at magbibigay ng pag-asa at inspirasyon sa aking kapwa lingkod bayan.

Lilinangin ko ang aking sariling kakayahan upang sa lahat ng panahon ay mapaglingkuran ko nang buong kahusayan ang sambayanan.

Hindi ako makikibahagi sa mga katiwalian sa pamahalaan. Pipigilan at isisiwalat ko ito sa pamamagitan ng tama at angkop na pamamaraan.

Isasabuhay ko ang isang lingkod bayang maka-Diyos, maka-tao, makakalikasan at makabansa.

Tutugon ako sa mga hamon ng makabagong panahon tungo sa adhikain ng matatag, maginhawa, at panatag na buhay. Sa mga tungkulin at hangaring ito, kasihan nawa ako ng Maykapal.125

Further, the proportionality principle requires that processing must be adequate, relevant, suitable, and necessary, such that it is not excessive in relation to the declared and specified purpose.126

In this case, the DTRs show Dr. ARG’s time of ingress and egress, which is relevant to the complaint to be filed with the CSC. The use of the DTRs was necessary to establish and support Dr. AMP’s allegations that Dr. ARG and the other department staff were not reporting to work despite the entries in their respective DTRs.127

Therefore, Dr. AMP had lawful basis to process Dr. ARG’s personal information under Section 13(f) in relation to 12(f) of the DPA.

The Commission also takes this opportunity to address Dr. ARG’s argument that despite Dr. AMP’s possession of the DTRs since January 2021, he has not filed any complaint with the CSC.128 The absence of a complaint does not remove Dr. AMP’s acts from processing under Section 13(f) of the DPA. The processing of personal data on the basis of Section 13(f) may be conducted during stages preparatory to a case.129 It does not require that there be an existing proceeding before an administrative agency, court, or other tribunal.130

The Commission does not rule on the admissibility of evidence, its materiality, relevance, or probative value to a particular case outside its jurisdiction, or the propriety of the legal strategy employed by parties in legal proceedings.131 While the filing of a case is not required, there must still be a reasonable connection between the processing activity and the legal claim sought to be established or defended.132 Further, there must likewise be an element of reasonableness to when the complaint will be filed.133 If no complaint is eventually filed, the PIC should properly dispose of the personal data gathered, as it will no longer be used for the purpose for which it was originally processed.134

As the Commission previously held, the qualifier “necessary” to the second instance in Section 13(f) serves to limit the potentially broad concept of “establishment of legal claims” consistent with the general privacy principles of legitimate purpose and proportionality.135

In sum, because Dr. AMP had lawful basis to process Dr. ARG’s personal information, the third requisite for Unauthorized Processing is absent.

Given the absence of the third requisite, Dr. AMP did not commit Unauthorized Processing under Section 25 of the DPA.

Notwithstanding the foregoing, the Commission takes this opportunity to admonish its Legal and Enforcement Office (LEO) and CID for failing to dismiss the second complaint filed by Dr. ARG involving the same parties, facts, and issues. Dr. ARG filed two (2) Complaints-Assisted Forms on 26 October 2022 and 24 November 2022.136 On 10 October 2023, LEO dismissed Dr. ARG’s Complaint in NPC Case 22-238 entitled ARG v. AMP because the Complaint does not pertain to a violation of the DPA and there was insufficient information to substantiate the allegations in the Complaint.137 The present Complaint, however, was given due course despite involving the same parties, facts, and issues.

WHEREFORE, premises considered, the Commission resolves that the Complaint filed by ARG against AMP is hereby DISMISSED for lack of merit. This is without prejudice to the filing of appropriate civil, criminal, or administrative cases before any other forum or tribunal, if any.

SO ORDERED.

City of Pasay, Philippines. 04 September 2024.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

I CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

CABATO AND TAYABAN LAW OFFICE Counsel for Complainant

IBARRA-SAGAY, CUARTEROS, AND ASSOCIATES Counsel for Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Complaint-Affidavit, 24 November 2022, at 1, in ARG v. AMP, NPC 22-112 (NPC 2022). ↩

  2. Id. ↩

  3. Memorandum for the Complainant, 22 March 2023, at 1, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  4. Complaints-Assisted Form, 24 November 2022, Annex C, in ARG v. AMP, NPC 22-112 (NPC 2022). ↩

  5. Complaint-Affidavit, 24 November 2022, at 1, in ARG v. AMP, NPC 22-112 (NPC 2022). ↩

  6. Id. ↩

  7. Id. at 2. ↩

  8. Id. ↩

  9. Id. at 2 & Annex C. ↩

  10. Id. ↩

  11. Complaint-Affidavit, 24 November 2022, Annex D, in ARG v. AMP, NPC 22-112 (NPC 2022). ↩

  12. Id. at 2. ↩

  13. Id. ↩

  14. Id. ↩

  15. Id. ↩

  16. Id. ↩

  17. Complaint-Affidavit, 24 November 2022, at 2, in ARG v. AMP, NPC 22-112 (NPC 2022). ↩

  18. Id. ↩

  19. Complaints-Assisted Form, 24 November 2022, in ARG v. AMP, NPC 22-112 (NPC 2022). ↩

  20. Id. at 6. ↩

  21. Id. ↩

  22. Order to File Verified Comment and Appear Virtually for Preliminary Conference, 13 December 2022, in ARG v. AMP, NPC 22-112 (NPC 2022). ↩

  23. Order, 26 January 2023, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  24. Comment to the Complaint, 27 January 2023, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  25. Id. at 2. ↩

  26. Id. ↩

  27. Id. ↩

  28. Id. at 3. ↩

  29. Id. ↩

  30. Comment to the Complaint, 27 January 2023, at 3, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  31. Id. ↩

  32. Id. ↩

  33. Id. ↩

  34. Id. ↩

  35. Id. at 4. ↩

  36. Comment to the Complaint, 27 January 2023, at 4-6, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  37. Id. at 6. ↩

  38. Id. at 4. ↩

  39. Id. at 4. ↩

  40. Id. ↩

  41. Order, 01 February 2023, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  42. Order, 23 February 2023, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  43. Id. ↩

  44. Id. ↩

  45. Notice of Appearance with Compliance dated 01 March 2023, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  46. Order, 08 March 2023, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  47. Manifestation with Entry of Appearance dated 09 March 2023, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  48. Id. ↩

  49. Order, 17 March 2023, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  50. Memorandum for the Complainant, 22 March 2023, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  51. Id. at 4. ↩

  52. Id. ↩

  53. Id. ↩

  54. Id. at 10. ↩

  55. Id. at 12. ↩

  56. Memorandum for the Complainant, 22 March 2023, at 12, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  57. Id. ↩

  58. Id. ↩

  59. Id. at 14. ↩

  60. Id. ↩

  61. Id. ↩

  62. Memorandum for the Complainant, 22 March 2023, at 15, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  63. Id. ↩

  64. Id. at 16. ↩

  65. Id. ↩

  66. Id. at 17. ↩

  67. Id. ↩

  68. Memorandum for the Complainant, 22 March 2023, at 18, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  69. Id. at 19. ↩

  70. Id. at 20. ↩

  71. Id. ↩

  72. Memorandum for the Respondent, 27 March 2023, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  73. Id. at 10. ↩

  74. Id. ↩

  75. Id. ↩

  76. Id. at 11. ↩

  77. Id. at 12. ↩

  78. Memorandum for the Respondent, 27 March 2023, at 11, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  79. Id. ↩

  80. Id. ↩

  81. Id. at 13. ↩

  82. Id. ↩

  83. Id. at 13-14. ↩

  84. Memorandum for the Respondent, 27 March 2023, at 14, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  85. Id. at 15. ↩

  86. Id. ↩

  87. Id. at 16. ↩

  88. Id. ↩

  89. Id. at 15. ↩

  90. Memorandum for the Respondent, 27 March 2023, at 15, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  91. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 § 25 (2012). ↩

  92. In re: Wefund Lending Corporation (JuanHand) and its Responsible Officers, NPC SS 21-006, 16 May 2022, at 31, available at https://privacy.gov.ph/wp-content/uploads/2024/05/NPC-SS-21-006-2022.05.16-In-re-Wefund-Lending-Corporation-Decision-FinalP.pdf (last accessed 30 September 2024). ↩

  93. Memorandum for the Complainant, 22 March 2023, at 12, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  94. Memorandum for the Respondent, 27 March 2023, at 10, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  95. Data Privacy Act of 2012, § 3 (h). ↩

  96. Id. § 3 (i). ↩

  97. National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, rule I, § 3 (m) (2015). ↩

  98. Memorandum for the Respondent, 27 March 2023, at 12, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  99. Data Privacy Act of 2012, § 3 (j). ↩

  100. In re: Wefund Lending Corporation (JuanHand) and its Responsible Officers, NPC SS 21-006, at 31. ↩

  101. Memorandum for the Complainant, 22 March 2023, at 14-15, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  102. Id. at 15. ↩

  103. Data Privacy Act of 2012, § 4 (a) & (b). ↩

  104. In re: Commission on Elections, Smartmatic Group of Companies, RVA, WS, and Other John Does and Jane Does, NPC SS 22-001 and NPC SS 22-008, 22 September 2022, at 20, available at https://privacy.gov.ph/wp-content/uploads/2024/05/NPC-SS-22-001-and-NPC-SS-22-008-2022.09.22-In-re-COMELEC-Decision-FinalP.pdf (last accessed 30 September 2024). ↩

  105. Data Privacy Act of 2012, § 3 (l). ↩

  106. Id. § 3 (g). ↩

  107. RJC v. DL, NPC 22-012, 10 November 2022, at 7, available at https://privacy.gov.ph/wp-content/uploads/2023/08/NPC-22-012-2022.11.10-RJC-v.-DL-Decision.pdf (last accessed 30 September 2024); NPC BN 18-158, at 13 (unreported). ↩

  108. Memorandum for the Complainant, 22 March 2023, at 14-15, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  109. In re: Wefund Lending Corporation (JuanHand) and its Responsible Officers, NPC SS 21-006, at 31. ↩

  110. Comment to the Complaint, 27 January 2023, at 4, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  111. Id. ↩

  112. Data Privacy Act of 2012, § 13 (f) (l). Emphasis supplied. ↩

  113. KRL v. Trinity University of Asia, AA, MC, NCB, RG, GV, GCT, RR, MR, PB, CID 17-K-003, 19 November 2019, at 6, available at https://privacy.gov.ph/wp-content/uploads/2023/05/CID-17-K-003-KRL-v-Trinity-Decision-PSD-10Aug2020.pdf (last accessed 27 September 2024); See National Privacy Commission, Guidelines on Personal Data Processing Based on Section 13(f) of the Data Privacy Act, Advisory No. 02, Series of 2024 [NPC Adv. No. 24-02], § 3 (12 August 2024). ↩

  114. Data Privacy Act of 2012, § 12(f); See NPC Adv. No. 24-02, § 3. ↩

  115. Sps. MCD and [JD v. Victorias Milling Company et al, NPC 19-758 and NPC 19-1846, 30 June 2023, at 122, available at https://privacy.gov.ph/wp-content/uploads/2024/05/NPC-19-758-to-NPC-19-1846-2023.06.30-MCD-_-JD-v-Victorias-Milling-Company-et-al-Decision-FinalP.pdf (last accessed 11 October 2024). ↩

  116. See Memorandum for the Respondent, 27 March 2023, at 14, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  117. See Data Privacy Act of 2012, § 11. ↩

  118. Memorandum for the Complainant, 22 March 2023, at 18, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  119. Id. at 20. ↩

  120. National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18 (b) (2016). ↩

  121. EA and TA v. EJ, EE and HC, NPC 17-018, 15 July 2019, at 9, available at https://privacy.gov.ph/wp-content/uploads/2024/06/NPC-17-018-2019.07.15-EA-and-TA-v-EJ-Decision-FinalP.pdf (last accessed 28 September 2024). ↩

  122. Id. ↩

  123. Memorandum for the Respondent, 27 March 2023, at 14, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  124. An Act Establishing a Code of Conduct and Ethical Standards for Public Officials and Employees, to Uphold the Time-Honored Principle of Public Office being a Public Trust, Granting Incentives and Rewards for Exemplary Service, Enumerating Prohibited Acts and Transactions and Providing Penalties for Violations thereof and For Other Purposes. [Code of Conduct and Ethical Standards for Public Officials and Employees], Republic Act No. 6713 § 4 (A)(a) (1989). ↩

  125. Civil Service Commission, Adoption of the Revised 2021 Panunumpa ng Lingkod Bayan, Memorandum Circular No. 15, Series of 2021 [CSC M.C. No. 15-21] (12 November 2021). Emphasis supplied. ↩

  126. Data Privacy Act of 2012, § 11 (c) & (d). ↩

  127. Comment to the Complaint, 27 January 2023, at 2, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  128. Memorandum for the Complainant, 22 March 2023, at 20, in ARG v. AMP, NPC 22-112 (NPC 2023). ↩

  129. NPC Adv. No. 24-02, § 5 (A). ↩

  130. Id. § 5 (B). ↩

  131. RJC v. DL, NPC 22-012, 26 January 2023, at 11, available at https://privacy.gov.ph/wp-content/uploads/2023/07/NPC-22-012-2023.01.26-RJC-v.-DL-Resolution-w-Sgd-Final.pdf (last accessed 11 October 2024); See NPC Adv. No. 24-02, § 7. ↩

  132. See NPC Adv. No. 24-02, § 4. ↩

  133. See Id. ↩

  134. See Data Privacy Act of 2012, § 11 (e). ↩

  135. EA and TA v. EJ, NPC 17-018, at 8. ↩

  136. Complaint-Affidavit, 24 November 2022, at 1, in ARG v. AMP, NPC 22-112 (NPC 2022). ↩

  137. Decision (on the Recommendation for the Dismissal of the Above-Entitled Case), 10 October 2023, in ARG v. AMP, NPC 22-238 (NPC 2023). ↩

Backlinks