NPC Issuance Wiki

NPC 19-1234: FCG v. Unipeso Lending Company Inc. (Handy Loan)

Issued Decision

Decision Text

FCG,

Complainant,

-versus-

UNIPESO LENDING COMPANY INC. (HANDY LOAN),

Respondent.

x----------------------------------------------------x

BELARMINO, D.P.C.;

Without personal information being processed, there can be no violations of Sections 25, 28, 29, and 33 of the DPA, as the processing of a data subject’s personal information is a necessary element for establishing these violations.

Before this Commission is a Complaint filed by FCG (Complainant) against Unipeso Lending Company Inc. (Respondent), for alleged violations of Sections 25, 28, 29 and 33 of Republic Act 10173 or the Data Privacy Act of 2012 (DPA).

Facts

Complainant serves as the Technical and Institutional Capacity Building Officer for the Foundation.1 In his Complaints-Assisted Form (Complaint), Complainant identified himself as the Data Protection Officer of the Foundation.2 The Respondent in this case is Unipeso Lending Company Inc., operating under the trade name “Handy Loan”.3

On 11 September 2019, Complainant filed his Complaint against Respondent for alleged violations of Sections 25, 28, 29 and 33 of the DPA.4 Attached to the Complaint were (i) various screenshots of messages from online lending companies and (ii) exchanges of emails and messages between Complainant and representatives of said lending companies, including Respondent.5

Complainant alleged that a former employee of the Foundation, ACM, utilized various online lending applications on her mobile device, which included one operated by Respondent.6 When the former employee defaulted on her loan obligations, the lending applications, including Respondent, allegedly initiated phone calls and sent text messages to Complainant, other employees, board members, affiliates, and partners of the organization, allegedly through their mobile numbers on her smart phone.7

Complainant claimed that these communications were made without their consent and that Respondent obtained their mobile numbers through the application on the former employee’s mobile phone.8

He further alleged that the messages sent by Respondent contained deceptive or false statements, as they stated that the recipients were emergency contacts or personal references of the former employee, despite the fact that many of those contacted held no such designation.9 Moreover, Complainant explained that they made attempts to contact the Respondent and the companies related to the lending applications.10 According to him, some responded while others did not.11 The response was sometimes to download their application.12 At other times, when they were asked to remove a number, they would instead call and still ask them to contact the former employee who had taken out the loan.13

Complainant contended that Respondent has their names and mobile phone numbers.14 He also stated that they may have additional information that he is not aware of, depending on the information they were able to access on the former employee’s phone.15 He said that the privacy statements of some of the companies state that they are able to access contact lists, call logs, SMS logs, and contact lists from other social media accounts.16 However, it must be noted that the screenshots Complainant attached to the Complaint to support these allegations only show Respondent’s alleged messages to them regarding their former employee’s loan and not their alleged personal data.

On 21 September 2020, an Order to Confer for Discovery was issued.17 The parties were recommended to appear via videoconferencing, as well as advised of their respective rights to the assistance of counsel.18

On 27 July 2022, an Order To File Verified Comment and Appear Virtually for Preliminary Conference of even date was served.19 In the Order, the preliminary conference was set for 07 September 2022 and 05 October 2022.20

On 07 September 2022, the first preliminary conference was held.21 Only Complainant was present.22

On 12 September 2022, an Order After the 1st Preliminary Conference held on 07 September 2022, Reminding the Respondent to Comply with the Order to Submit Verified Comment, and Requiring the Parties to Appear Virtually for the 2nd Preliminary Conference dated 07 September 2022 was served.23

On 05 October 2022, the second Preliminary Conference was held.24 Only the Complainant was present.25

On 10 October 2022, an Order dated 05 October 202226 was issued pursuant to the second Preliminary Conference conducted on the same date and was duly served upon the parties. The Order reiterated the directive for the Respondent to submit a Verified Comment and required both parties to file their respective memoranda.27

On 31 May 2024, a Notice informing the parties that the case has been submitted for the Commission’s decision was served via email and registered mail.28

Issues

I. Whether the mobile numbers alleged in the Complaint constitute personal information under the DPA.

II. Whether Respondent is liable under Section 25 (Unauthorized Processing), Section 28 (Processing for Unauthorized Purposes), Section 29 (Unauthorized Access or Intentional Breach), and Section 33 (Combination or a Series of Acts) under the DPA.

Discussion

The mobile numbers alleged in the Complaint do not meet the statutory definition of personal information under Section 3(g) of the DPA. Without personal information being processed, there can be no violations of Sections 25, 28, 29, and 33 of the DPA as the processing of a data subject’s personal information is an important element of these violations.

I. Prepaid mobile numbers are not personal information before the effectivity of the Sim Registration Act.

The Complainant alleged that Respondent obtained his mobile number as well as the mobile numbers of other employees, board members, affiliates, and partners of their organization and contacted them about their former employee’s loan without their consent.29 However, the Complainant presented no corroborating evidence such as subscriber records, account registration details, or entries in publicly accessible directories establishing that these numbers belong to them.30 The Complainant likewise failed to substantiate that these numbers are postpaid or prepaid numbers. Prior to the effectivity of the Sim Registration Act on 27 December 2022,31 a prepaid mobile number does not automatically qualify as a personal information.

Section 3(g) of the DPA32 provides that ‘personal information’ refers to:

…any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.33

This is because the absence of proof linking the number to the Complainant means that the identity of the Complainant is neither “apparent” nor “reasonably and directly ascertainable” to the entity holding the information.34

NPC Advisory Opinion No. 2018-002 provides that the identifiability of a person must be determined on a case-by-case basis, considering the context, the purpose of processing, and the availability of additional information that can link the data to a specific individual.35 In the absence of this demonstrable linkage, the protection afforded by the DPA to personal information does not attach.36

Prior to the effectivity of the SIM Registration Act, the Commission released NPC Advisory Opinion No. 2017-68 which provides guidance on the treatment of mobile numbers, distinguishing between postpaid and prepaid numbers. Specifically:

A postpaid number is certainly considered as personal information given that the telecommunications companies assign a specific number to an individual subscriber in such a manner that no two individuals will have the same postpaid number at the same time.

On the other hand, a prepaid number standing alone may not yet be considered as personal information. However, once the said prepaid number is activated and associated/linked to an individual subscriber, i.e. through the use of the mobile number for various registrations, availment of products or services, etc., then the same is already considered as personal information.37

However, Complainant herein failed to demonstrate that the mobile numbers in question were postpaid numbers or that they had otherwise been linked to their identities in a manner that would qualify them as personal information under the DPA. No documentary evidence, such as billing statements, registration records, or account confirmations, was submitted to substantiate this claim.

It must be noted that Complainants in administrative proceedings carry the burden of proving their allegations with substantial evidence.38 The basic rule is that mere allegation is not evidence and is not equivalent to proof.39 Likewise, charges based on mere suspicion and speculation cannot be given credence.40

The Commission takes judicial notice of Republic Act No. 11934, or the Subscriber Identity Module (SIM) Registration Act, which now mandates the registration of SIM cards and the disclosure of personal information such as the end user’s full name, date of birth, sex, and address, along with the submission of a government-issued ID.41 Under this law, a mobile number registered in compliance with these requirements could constitute personal information.42

However, it must be noted that the instant Complaint was filed on 11 September 2019, prior to the enactment and effectivity of the SIM Registration Act in 27 December 2022. This means that at the time of the filing of the Complaint, there was no legal presumption that a prepaid number was linked to an identifiable individual. It was, therefore, incumbent upon the Complainant to prove that the mobile numbers were either postpaid or otherwise registered and associated with their identities. Unfortunately, he failed to present any such evidence.

In this case, the Commission finds that the Complainant failed to establish that the mobile numbers alleged in the Complaint constitute personal information under the DPA. Although the Complainant alleged that these mobile numbers were personal information unlawfully processed by the Respondent, such an assertion must be substantiated by substantial evidence.

Given the failure to submit any evidence that the numbers are postpaid mobile numbers and the fact that the commission of alleged violation and the complaint was filed before the effectivity of the SIM Registration Act, the Commission finds that the mobile numbers alleged in the Complaint, as presented in this case, do not meet the statutory definition of personal information under Section 3(g) of the DPA.

II. There is no violation of the DPA.

Without personal information being processed, there can be no violations of Sections 25, 28, 29, and 33 of the DPA as the processing of a data subject’s personal information is an essential element of establishing these violations.

WHEREFORE, premises considered, this Commission resolves that the instant Complaint filed by Complainant FCG, against Respondent Unipeso Lending Company, Inc. (Handy Loan), is DISMISSED for lack of merit.

This is without prejudice to the filing of appropriate civil, criminal or administrative cases against Handy Loan before any other forum or tribunal, if any.

SO ORDERED.

Quezon City, Philippines. 03 July 2025.

JOSE AMELITO SUTTON BELARMINO II Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

FCG Complainant

UNIPESO LENDING COMPANY, INC. (HANDY LOAN) Respondent

CID, END, GRU National Privacy Commission

Footnotes

  1. Complaints-Assisted Form, 11 September 2019, in FCG v. Unipeso Lending Company Inc. (Handy Loan), NPC 19-1234 (NPC 2019). ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. ↩

  6. Id. ↩

  7. Complaints-Assisted Form, 11 September 2019, in FCG v. Unipeso Lending Company Inc. (Handy Loan), NPC 19-1234 (NPC 2019). ↩

  8. Id. ↩

  9. Id. ↩

  10. Id. ↩

  11. Id. ↩

  12. Id. ↩

  13. Complaints-Assisted Form, 11 September 2019, in FCG v. Unipeso Lending Company Inc. (Handy Loan), NPC 19-1234 (NPC 2019). ↩

  14. Id. ↩

  15. Id. ↩

  16. Id. ↩

  17. Order to Confer for Discovery, 21 September 2020, in FCG v. Unipeso Lending Company, NPC Case no. 19-1234 (NPC 2019). ↩

  18. Id. ↩

  19. Order (To file Verified Comment and Appear Virtually for Preliminary Conference), 27 July 2022, in FCG v. Unipeso Lending Company, NPC Case no. 19-1234 (NPC 2019). ↩

  20. Id. ↩

  21. Order (After the 1st Preliminary Conference held on 07 September 2022, Reminding the Respondent to Comply with the Order to Submit Verified Comment, and Requiring the Parties to Appear Virtually for the 2nd Preliminary Conference), 07 September 2022, in FCG v. Unipeso Lending Company, NPC Case no. 19-1234 (NPC 2019). ↩

  22. Id. ↩

  23. Email screenshot, 12 September 2022, in FCG v. Unipeso Lending Company, NPC Case no. 19-1234 (NPC 2019). ↩

  24. Order (After the 2nd Preliminary Conference held on 05 October 2022, Reminding the Respondent to Submit Verified Comment, and Requiring the Parties to Submit their Simultaneous Memoranda), 05 October 2022, in FCG v. Unipeso Lending Company, NPC Case no. 19-1234 (NPC 2019). ↩

  25. Id. ↩

  26. Id. ↩

  27. Id. ↩

  28. Notice (that the Case is Submitted for Decision of the Commission), 31 May 2024, in FCG v. Unipeso Lending Company, NPC Case no. 19-1234 (NPC 2019). ↩

  29. Complaints-Assisted Form, 11 September 2019, in FCG v. Unipeso Lending Company Inc. (Handy Loan), NPC 19-1234 (NPC 2019). ↩

  30. Id. ↩

  31. Implementing Rules and Regulations (IRR) of the SIM Registration Act (2022). ↩

  32. An Act Protecting Individual Personal Information in Information and Communication Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act no. 10173, §3(g) (2012). ↩

  33. Id. ↩

  34. Id. ↩

  35. NPC Advisory Opinion No. 2018-002, dated 15 January 2018, Re: Commission on Audit (COA) Request for Access to Bangko Sentral ng Pilipinas (BSP) Employees’ Directory. ↩

  36. Id. ↩

  37. NPC Advisory Opinion No. 2017-68, dated 22 November 2017, Re: Data Privacy Act And Its Implementing Rules And Regulations. ↩

  38. Office of the Ombudsman v. Fetalvero, G.R. No. 211450 (July 23, 2018). ↩

  39. Morales v. Ombudsman Conchita Carpio-Morales, et. al., G.R. No. 208086 (July 27, 2016). ↩

  40. Id. ↩

  41. An Act Requiring the Registration of Subscriber Identity Module, Republic Act No. 11934, October 10, 2022. ↩

  42. Id. ↩

Backlinks

  • No backlinks found