NPC Issuance Wiki

NPC 21-082: MBA vs. GoFluent Philippines, Inc.

Issued Decision

Source

Source Tags

  • Section 25 Unauthorized Processing of Personal Information and Sensitive Personal Information, Section 28 Processing of Personal Information and Sensitive Personal Information for Unauthorized Purpose, Section 31 Malicious Disclosure, Section 32 Unauthorized Disclosure, Section 13, Principle of Proportionality, of Exhaustion of Remedies, Due Process, Forum Shopping, Privacy Violation, Cause of Action, Section 4(d), Nominal Damages

Decision Text

MBA, Complainant,

-versus-

GOFLUENT PHILIPPINES INC., Respondent.

NPC 21-082
For: Violation of the Data Privacy Act of 2012

DECISION

AGUIRRE, D.P.C.;

Before this Commission is a complaint filed by MBA against GoFluent Philippines Inc. (GoFluent) for an alleged violation of Sections 25 (Unauthorized Processing of Personal Information and Sensitive Personal Information), 28 (Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes), 31 (Malicious Disclosure) and 32 (Unauthorized Disclosure) of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

MBA was an employee of GoFluent.1 On 13 November 2020, MBA received a text message from his sister where she informed him that their mother was confirmed as COVID-19 positive.2 MBA reported this to his manager, RLL.3 RLL advised MBA to report to the HR office.4

MBA reported to the HR office and thereafter, went to Tulay Lingap ni Padre Pio Clinic to take a Reverse Transcription-Polymerase Chain Reaction (RT-PCR) Test.5 Since RT-PCR Testing was conducted on an appointment basis only, MBA took an Antigen Rapid Test instead where he tested positive.6 GoFluent advised MBA to undergo a fourteen (14)-day quarantine.7 On 18 November 2020, MBA was confirmed to be COVID-19 positive based on his RT-PCR Test results.8

MBA stated that while he was in quarantine, GoFluent employees from various departments messaged him on Facebook and asked about his health status.9 MBA asked his colleague how they found out about his situation and he found out that an email dated 18 November 2020 was sent out by GoFluent’s country manager, GLP (g*****@****.com) to the Management Team (GF_PH_management@gofluent.com) and the HR Team (hr@gofluent.com).10 In the email, GLP stated that “MBA has been tested positive with COVID-19.”11 The email was later forwarded by RLL to the Systems Application Testing (SAT) Team (sat@gofluent.com).12 VGC, a GoFluent employee, later forwarded the email to MBA.13 MBA alleged that due to the email, his personal data was leaked.14 MBA was later cleared of COVID-19 and he submitted his test results and clearance to GoFluent.15

On 23 November 2020, GoFluent’s HR Department issued a Notice to Explain to MBA which he later responded to on 27 November 2020.16

The administrative hearing was originally scheduled to take place on 13 December 2020 but it was rescheduled and then cancelled.17

GoFluent, thereafter, sent a termination letter to MBA.18 According to GoFluent, it exercised its management prerogative in opting not to regularize MBA since he failed “to meet the expectations of the management in complying with company policy and health standards.”19

On 25 May 2021, MBA filed his complaint with the Complaints and Investigation Division (CID) of the National Privacy Commission (NPC).20

On 14 October 2021, the CID directed GoFluent to file its Verified Comment.21 It also ordered the parties to appear virtually for a Preliminary Conference.22

On 08 November 2021, GoFluent’s counsel filed their Entry of Appearance and Verified Comment.23

In its Verified Comment, GoFluent argued that MBA’s complaint should be dismissed for his failure to make a timely complaint in writing against GoFluent to allow it for appropriate time for action pursuant to Section 2, Rule II of the 2021 Rules of Procedure of the NPC.24 GoFluent also stated that MBA’s complaint should be denied for his failure to disclose in the Complainant’s Verification and Certification of Non-Forum Shopping that he filed a Complaint with the National Labor Relations Commission (NLRC).25 GoFluent further argued that the complaint does not pertain to any violation of the DPA nor does it involve a privacy violation or personal data breach to which the NPC has no jurisdiction.26 GoFluent also added that the complaint does not state a cause of action and is frivolous, vexatious, and made in bad faith.27

According to GoFluent, MBA was “grossly negligent and inefficient” which was the reason for his non-regularization.28 GoFluent stated that MBA, through his actions, violated government health standard policy.29

GoFluent also stated that the email dated 18 November 2020, which MBA alleged to have been the source of the leaked information, was sent by GoFluent’s country manager, GLP, to official group emails referred to as “Management” and “HR.”30 GoFluent added that the email used the name “MBA” as a form of pseudonymized data in compliance with NPC Advisory 2020-03.31 According to GoFluent, the email was meant for Management and HR only and it did not disclose MBA’s identity as a confirmed COVID-19 case to its other employees.32

GoFluent further stated that the sole purpose of the email was for contact tracing measures to identify potential asymptomatic individuals in the workplace.33 GoFluent also stated that upon checking its records, it appeared that MBA failed to submit any contact tracing forms since 30 October 2020.34

Additionally, GoFluent argued that contact tracing is a form of research that falls under the exception in Section 4 (d) of the DPA.35 As such, GoFluent claimed that the NPC has no jurisdiction over the case.36

GoFluent further argued that it did not violate Section 25 of the DPA (Unauthorized Processing) since there was no processing on its part.37

GoFluent added that it did not violate Section 28 of the DPA (Processing for Unauthorized Purposes) since the email dated 18 November 2020 was for the sole purpose of containing the spread of COVID-19 and to isolate those who may have been exposed.38

According to GoFluent, this was “done within the ecosystem of [its] Management and HR[.]”39

Additionally, GoFluent argued that it did not violate Section 31 of the DPA (Malicious Disclosure) since the email “bears no malice, bad faith, or discloses unwarranted or false information relative to any personal information or sensitive personal information of the [MBA].”40

GoFluent also argued that it did not violate Section 32 of the DPA (Unauthorized Disclosure) since it did not disclose MBA’s test results to a third party or to anybody outside its organization, or outside LGU guidelines.41 GoFluent reiterated that the email was meant for the HR Team and Management Team to allow them to determine those who may have been exposed to MBA.42

According to GoFluent, it had lawful basis to process MBA’s personal information under Section 21 of the Implementing Rules and Regulations (IRR) of the DPA.43 GoFluent added that it had lawful basis to process MBA’s sensitive personal information under Section 22 of the IRR of the DPA.44

On 18 January 2022, the CID issued an Order resetting the Preliminary Conference to 15 February 2022 since MBA was not assisted by counsel.45 The CID also ordered MBA to inform it of the availability of his counsel at least two (2) working days before 15 February 2022.46

On 15 February 2022, the CID issued an Order resetting the Preliminary Conference to 23 March 2022 upon the inquiry of the Investigating Officer and with the conformity of the counsel of both parties.47 In the Order, the CID noted that MBA’s counsel has yet to enter his appearance because MBA had only recently engaged his services.48

On 18 February 2022, MBA’s counsel filed his Entry of Appearance.49

On 23 February 2022, the CID issued an Order noting the Entry of Appearance.50

On 23 March 2022, the CID issued an Order requiring the parties to fill out and submit their respective Application for Mediation Form in view of both parties’ willingness to undergo mediation proceedings.51

In the Order, the CID also noted that the parties agreed to stipulate the due execution and existence of GLP’s email dated 18 November 2020.52

On 29 March 202253 and 13 April 2022,54 GoFluent and MBA each filed their respective Applications for Mediation. On 13 April 2022, the CID issued an Order to Mediate requiring the parties to appear before the Mediation Officer on 19 April 2022.55

On 28 April 2022, the Mediation Officer issued a Notice of Non-Settlement of Dispute stating that the parties did not reach a settlement.56

On 28 April 2022, the CID issued an Order requiring GoFluent and MBA to submit their respective Pre-trial Briefs, Comments and Memoranda.57 Additionally, the CID required GoFluent to submit GLP’s email to Management and HR, and the resignation letters of certain GoFluent employees.58 During the 3rd Preliminary Conference, the parties agreed that GoFluent will submit the 18 November 2020 email that was addressed to Management and HR as well as the resignation letters of RLL, VGC and certain HR personnel who handled the 18 November 2020 email.59 In the Order dated 28 April 2022, the CID also reminded the parties that upon the expiration of the period provided, the case shall be submitted for resolution with or without the pleadings required.60

On 16 May 2022, GoFluent submitted its Compliance with the CID’s Order dated 28 April 2022.61 GoFluent attached a copy of GLP’s 18 November 2020 email.62

On 20 May 2022, the CID noted GoFluent’s Compliance.63

On 03 June 2020, GoFluent submitted its Pre-Trial Brief.64

On 06 June 2022, the CID noted GoFluent’s Pre-Trial Brief.65

On 17 June 2022, GoFluent filed a Manifestation.66 GoFluent stated that MBA failed to file his Pre-Trial Brief which shows MBA’s lack of concern to pursue the complaint.67

On 20 June 2022, the CID noted GoFluent’s Manifestation.68

On 04 July 2022, GoFluent filed a Memorandum reiterating its arguments in its Verified Comment.69

Issues

  • I. Whether the case should be dismissed on procedural grounds.

  • II. Whether GoFluent is liable for violating Section 25 (Unauthorized Processing), Section 28 (Processing for Unauthorized Purposes), Section 31 (Malicious Disclosure) and Section 32 (Unauthorized Disclosure) of the DPA.

  • III. Whether GoFluent violated the general privacy principle of proportionality.

Discussion

The Commission dismisses the case for lack of information on record that clearly shows GoFluent violated relevant health protocols. GoFluent had lawful basis to process MBA’s sensitive personal information under Section 13 (b) of the DPA. GoFluent, however, violated the general privacy principle of proportionality.

I. The case should not be dismissed based on procedural grounds.

A. MBA informed GoFluent in writing of the alleged privacy violation.

GoFluent alleged that MBA’s complaint should not have been given due course due to MBA’s failure to make a timely complaint in writing against GoFluent.70 According to GoFluent, this was necessary to allow GoFluent appropriate time for action under Section 2, Rule II of NPC Circular 21-01 (2021 NPC Rules of Procedure).71

Section 2, Rule II of the 2021 NPC Rules of Procedure provides:

Section 2. Exhaustion of remedies. No complaint shall be given due course unless it has been sufficiently established and proven that:

  1. the complainant has informed in writing, the personal information controller (PIC), personal information processor (PIP), or concerned entity of the privacy violation or personal data breach to allow for appropriate action on the same; and

  2. the PIC, PIP, concerned entity did not take timely or appropriate action on the claimed privacy violation or personal data breach, or there is no response from the PIC, PIP, or concerned entity within fifteen (15) calendar days from receipt of written information from the complaint.

The NPC may waive any or all of the requirements of this Section at its discretion upon (a) good cause shown, properly alleged and proved by the complainant; or (b) if the allegations in the complaint involve a serious violation or breach of the Data Privacy Act of 2012, taking into account the risk of harm to the affected data subject, including but not limited to:

  • i. when there is grave and irreparable damage which can only be prevented or mitigated by action of the NPC;

  • ii. when the respondent cannot provide any plain, speedy, or adequate remedy to the alleged violation; or

  • iii. the action of the resident is patently illegal.72

In his complaint, MBA stated that he did not contact GoFluent but instead submitted an incident report to GoFluent’s HR Department and that GoFluent did not act on the matter.73 The Commission finds, however, that MBA did not attach a copy of this incident report to his Complaint. As a result, the incident report cannot be used as a basis for MBA’s compliance with the requirements under Section 2, Rule II of the 2021 NPC Rules of Procedure.

It appears, however, that MBA had informed GoFluent in writing of the privacy violation in his Memorandum dated 27 November 2020 addressed to GoFluent’s HR Department.74 Here, MBA stated that GoFluent had disclosed the circumstances surrounding his COVID-19 positive status as well as that of his mother’s COVID-19 positive status to “several management teams” in violation of the DPA.75 GoFluent, thereafter, did not act on the claimed privacy violation and instead, terminated MBA’s employment.76

In any case, the NPC may waive the requirements under Section 2, Rule II of the 2021 NPC Rules of Procedure in any of the therein enumerated cases. Here, MBA’s submissions show that the complaint involves a serious violation of the DPA as he alleged that GoFluent violated Sections 25, 28, 31, and 32 of the DPA.77

In GJJ v. Creditable Lending Corporation (Easy Peso), the Commission gave due course to a similar complaint that involved a serious violation or breach of the DPA and taking into account the risk of harm to the affected data subject.78 Here, MBA’s allegations, assuming these are true, could directly contravene specific provisions of the DPA.

Further, GoFluent’s acts could have directly exposed MBA to a real risk of serious harm. Thus, MBA’s allegations serve as sufficient basis to give due course to the Complaint.

Additionally, MBA stated that his employment had already been terminated by GoFluent79 and that he was seeking damages, the imposition of a fine on GoFluent and other reliefs.80 Based on the foregoing circumstances, GoFluent can no longer provide any plain, speedy, or adequate remedy to the alleged violation. Thus, it is proper for the Commission to give due course to MBA’s Complaint.

B. GoFluent was not denied its right to due process.

GoFluent also stated that MBA did not provide Annex “D” of his complaint which resulted in a denial of due process.81

In Vivo v. Philippine Amusement and Game Corporation (PAGCOR) v. Court of Appeals, the Supreme Court held:

Due process, as a constitutional precept, does not always and in all situations require a trial-type proceeding. Due process is satisfied when a person is notified of the charge against him and given an opportunity to explain or defend himself. In administrative proceedings, the filing of charges and giving reasonable opportunity for the person so charged to answer the accusations against him constitute the minimum requirements of due process. The essence of due process is simply to be heard, or as applied to administrative proceedings, an opportunity to explain one’s side, or an opportunity to seek a reconsideration of the action or ruling complained of.82

In this case, GoFluent was given the opportunity to be heard. In fact, GoFluent submitted its Verified Comment83 precisely to address the allegations in MBA’s Complaint. The fact that MBA did not attach Annex “D” or the Termination Letter Due to Covid to his Complaint does not equate to a denial of due process on the part of GoFluent. In his Complaint, MBA referenced Annex “D” to support his claim that GoFluent sent him a termination letter.84 GoFluent had the opportunity to address this allegation in its Verified Comment where it stated that “on 14 December 2020, MBA was informed of his non-regularization effective 16 December 2020 for his failure to meet the expectations of management in complying with company policy and health standards.”85 Additionally, the Termination Letter Due to Covid came from GoFluent itself so it could have ascertained whether MBA’s allegations are correct based on the contents of the termination letter.86 As such, GoFluent had ample opportunity to defend itself against MBA’s allegations despite MBA’s failure to attach Annex “D” of his complaint.

C. MBA did not commit forum shopping.

GoFluent stated that MBA failed to disclose in his Verification and Certification of Non-Forum Shopping that he filed a Complaint now pending before the NLRC.87

Section 3, Rule II of the 2021 NPC Rules of Procedure provide:

Section 3. Form and contents of the complaint. The complaint should be in the proper form, as follows:

…

  1. A certification against forum shopping must accompany the complaint. The complainant shall certify under oath in the complaint, or in a sworn certification annexed and simultaneously filed with the pleading: (a) that he or she has not commenced any action or filed any claim involving the same issues in any court, tribunal or quasi-judicial agency and, to the best of his or her knowledge, no such other action or claim is pending with such court, tribunal or quasi-judicial agency; (b) if there is such other pending action or claim, a complete statement of its present status; and (c) if he or she should thereafter learn that the same or similar action or claim has been filed or is pending, he or she shall report that fact within five (5) calendar days therefrom to the NPC.

Failure to comply with the proper form and contents of the complaint may be cause for outright dismissal under Section 1 (1), Rule IV: Provided, an application that does not comply with the foregoing requirements may be acted upon if it merits appropriate consideration on its face, or is of such notoriety that it necessarily contains sufficient leads or particulars to enable the taking of further action.88

In San Juan, et al. v. Arambulo, Sr., the Court held:

There is forum shopping when the following elements are present: ‘(a) identity of parties, or at least such parties as represent the same interests in both actions; (b) identity of rights asserted and relief prayed for, the relief being founded on the same facts; and (c) the identity of the two preceding particulars, is such that any judgment rendered in the other action will, regardless of which party is successful, amount to res judicata in the action under consideration; said requisites [are] also constitutive of the requisites for auter action pendant or lis pendens.’89

Here, the second and third elements of forum shopping are not present. The labor case filed by MBA against GoFluent involves a question of whether he was illegally dismissed whereas this case pending before the Commission involves a question of whether GoFluent violated Sections 25, 28, 31, and 32 of the DPA. Additionally, a judgment rendered in either the labor case or the NPC case will not be a bar to a judgment in the other case. Thus, MBA did not commit forum shopping.

In any case, the Commission may still act upon MBA’s complaint despite the perceived failure to comply with the requirements under Section 3, Rule II of the 2021 NPC Rules of Procedure if the complaint merits appropriate consideration on its face.

In his Complaint, MBA alleged that GoFluent violated Section 25, 28, 31, and 32 of the DPA when it sent out an email containing his health information to its Management Team and HR Team.90 A cursory review of the Complaint and its attachments, including the copy of the email dated 18 November 2020, shows that GoFluent had apparently processed MBA’s sensitive personal information when it sent out the email. Thus, the Commission may act upon MBA’s Complaint as it merits appropriate consideration on its face.

D. MBA’s Complaint sufficiently alleged a privacy violation.

GoFluent further stated that the Commission has no jurisdiction over the case because the Complaint and its annexes do not pertain to any violation of the DPA, nor does it involve a privacy violation or personal data breach.91

A privacy violation is defined as follows:

A privacy violation pertains to the processing of personal information in violation of a person’s reasonable expectation of confidentiality or privacy or in violation of any law, rules, or regulation relating to the protection of personal data, such as the DPA. It includes but is not limited to a violation of the general principles of privacy, a violation of the rights of the data subjects, unauthorized processing, improper disposal of personal data, processing for an unauthorized purpose, concealment of security breaches, and unauthorized or malicious disclosure.92

Here, MBA alleged that GoFluent sent out an email containing his health information to GoFluent’s Management Team and HR Team without his consent.93 Based on the email thread that MBA attached to his complaint, GLP sent the 18 November 2020 email to the Management Team and HR Team, which RLL subsequently forwarded to the SAT Team.94 A reading of the Complaint95 and the 18 November 2020 email96 shows that GoFluent may have committed a privacy violation when it processed MBA’s personal data without lawful basis.

Section 3 of the DPA provides:

Section 3. Definition of Terms. Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

  • (j) Processing refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use,consolidation, blocking, erasure or destruction of data.97

In MVC v. DSL, the Commission held that “matters concerning the processing of personal information is within the scope of the DPA and under the jurisdiction of the Commission.”98 Given the foregoing, this case falls within the jurisdiction of the Commission since the allegations in MBA’s complaint constitute a privacy violation.

E. MBA’s Complaint states a cause of action.

GoFluent also stated that the allegations state no cause of action and is frivolous, vexatious and made in bad faith.99

In Apostolic Vicar of Tabuk, Inc. v. Spouses Ernesto and Elizabeth Sison and Venancio Wadas, the Supreme Court held:

Failure to state a cause of action refers to an insufficiency of the allegations in the petition/complaint. It is a ground for dismissal under Rule 16 of the Rules of Court before the defendant or respondent files a responsive pleading. Notably, the dismissal is without prejudice to the re-filing of an amended complaint.100

Here, the Complaint states a cause of action which is that GoFluent processed his personal data without basis and in violation of the DPA.101

In Roa v. Spouses Sy, the Supreme Court held:

The test to determine whether a complaint states a cause of action against the defendants is this: admitting hypothetically the truth of the allegations of fact made in the complaint, may a judge validly grant the relief demanded in the complaint?102

If the Commission hypothetically admits MBA’s allegations in his Complaint that GoFluent had committed the previously discussed privacy violations, then MBA would be entitled to the reliefs sought. The allegations in MBA’s complaint are sufficient to warrant the reliefs prayed for if proved to be true. Thus, MBA’s complaint states a cause of action.

F. The research exception under Section 4 (d) of the DPA does not apply.

GoFluent argued that the email dated 18 November 2020, sent out by its country manager, GLP, was “for the sole purpose of contact tracing measures by the HR and Management[.]”103 GoFluent added that the DPA does not apply here since contact tracing is a form of research that falls outside the scope of the DPA.104

Section 4 of the DPA provides:

Section 4. Scope. This Act applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing including those personal information controllers and processors who, although not found or established in the Philippines, use equipment that are located in the Philippines, or those who maintain an office, branch or agency in the Philippines subject to the immediately succeeding paragraph: Provided, That the requirements of Section 5 are complied with.

This Act does not apply to the following:

…

  • (d) Personal information processed for journalistic, artistic, literary or research purposes;105

Here, the research exception under Section 4 of the DPA does not apply. According to GoFluent, the email was sent out “for the sole purpose of contact tracing measures by the HR and Management of [GoFluent] to look for potential asymptomatic individuals in the workplace.”106 Clearly, GoFluent did not process MBA’s sensitive personal information for research but precisely to comply with the prevailing health protocols at that time including contact tracing.107

Given this, the exception under Section 4(d) of the DPA does not apply to this case.

Based on the foregoing discussion, this case should not be dismissed on procedural grounds.

II. GoFluent did not violate Sections 25, 28, 31, and 32 of the DPA.

MBA alleged that GoFluent disclosed his health information without his consent and in violation of his right to privacy.108 According to MBA, his information was leaked as a result of the email sent by GoFluent through GLP to the Management Team and HR Team.109

GoFluent stated that “the email was for the sole purpose of contact tracing measures by the HR and Management of [GoFluent] to look for potential asymptomatic individuals in the workplace.”110

A. GoFluent did not violate Section 25 of the DPA (Unauthorized Processing).

Section 25 of the DPA provides:

Section. 25. Unauthorized Processing of Personal Information and Sensitive Personal Information. (a) The unauthorized processing of personal information shall be penalized by imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00) shall be imposed on persons who process personal information without the consent of the data subject, or without being authorized under this Act or any existing law.

  • (b) The unauthorized processing of personal sensitive information shall be penalized by imprisonment ranging from three (3) years to six (6) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Four million pesos (Php4,000,000.00) shall be imposed on persons who process personal information without the consent of the data subject, or without being authorized under this Act or any existing law.111

The following requisites must be present for a violation of Section 25 of the DPA:

  1. The perpetrator processed the information of the data subject;

  2. The information processed was personal information or sensitive personal information; and

  3. The processing was done without the consent of the data subject, or without being authorized under the DPA or any existing law.112

Only the first and second requisites are present in this case.

As to the first requisite, GoFluent processed MBA’s information.

In arguing that it did not violate Section 25 of the DPA, GoFluent claimed that there was no processing involved in this case.113 GoFluent also stated that “the email is not a process” and that “it is a mere notice to undergo quarantine if any staff is exposed to “MBA”.”114

Section 3 of the DPA provides:

Section 3. Definition of Terms. Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

  • (j) Processing refers to any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use,consolidation, blocking, erasure or destruction of data.115

Here, GoFluent is incorrect in claiming that it did not process MBA’s information. It processed MBA’s sensitive personal information when it sent out the email dated 18 November 2020 stating that “MBA has been tested positive with COVID-19.”116 According to MBA, GLP, GoFluent’s Country Manager, sent the email to GoFluent’s Management Team and HR Team.117 The act of sending out an email containing personal data is considered processing within the meaning of Section 3 (j) of the DPA.

As to the second requisite, the information processed by GoFluent was sensitive personal information.

Section 3 of the DPA provides:

Section 3. Definition of Terms. Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

  • (l) Sensitive personal information refers to personal information:

  1. About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;

  2. About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;

  3. Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and

  4. Specifically established by an executive order or an act of Congress to be kept classified.118

In the email dated 18 November 2020, GLP stated that “MBA has been tested positive with COVID-19.”119 Following the definition in Section 3 (l) of the DPA, this information that relates to MBA’s health is considered sensitive personal information.

Additionally, GLP’s statement sufficiently identifies MBA as the person who tested positive with COVID-19. In RJC v. DL, the Commission held that “the enumeration provided in Section 3 (l) of the DPA includes information from which an individual can be personally identified.”120 As pointed out by MBA, he was introduced within the GoFluent as “MBA.”121 This identifier was also used in MBA’s company email address, MBA.******@*****.com.122 As such, MBA’s information contained in the 18 November 2020 email falls under what is considered sensitive personal information under Section 3 (l) of the DPA.

GoFluent also argued that its use of “MBA” is a form of pseudonymized data consistent with NPC Advisory 2020-03.123

NPC Advisory 2020-03 (Guidelines for Workplaces and Establishments Processing Personal Data for COVID-19 Response) provides:

Section 5. General guidelines. The following guidelines are provided to ensure the implementation of reasonable and appropriate safeguards in the processing of personal data for the COVID-19 response.

…

C. Use of personal data collected. All establishments shall ensure that personal data collected are used only for the purpose of contact-tracing measures and the management of asymptomatic and symptomatic employees in the workplace.

…

  1. To address apprehensions on the safety of the workplace, the risk of reporting for work, and to avoid disclosing the identity of any probable or confirmed case, the establishment, through the Human Resources or Safety Officer, shall pseudonymize data on any probable or confirmed cases. This may enable information sharing and/or data analysis in the conduct of contact tracing without disclosing the identities of the probable or confirmed cases.124

Here, GoFluent’s use of “MBA” cannot be considered pseudonymized data within the meaning of NPC Advisory 2020-03. In his Complaint, MBA stated that he was introduced as “MBA” within GoFluent.125

RLL, in an email addressed to various GoFluent departments, referred to MBA as “MBA.”126 MBA was also referred to as “MBA” when he was greeted by his co-workers after he tested positive for COVID-19.127

Under the circumstances, MBA can be reasonably identified by the recipients of the 18 November 2020 email as “MBA.”128

As to the third requisite, GoFluent had lawful basis to process MBA’s sensitive personal information under Section 13 (b) of the DPA. Section 13 of the DPA provides:

Section 13. Sensitive Personal Information and Privileged Information. The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

…

  • (b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information[.]129

Here, GoFluent sent out the email dated 18 November 2020 to its Management Team and HR Team as a part of its contact tracing efforts in compliance with the prevailing health protocols at that time.130

Joint Memorandum Circular (JMC) No. 20-04-A, Series of 2020 (JMC 20-04A) issued by the Department of Trade and Industry (DTI) and Department of Labor and Employment (DOLE) provides:

III. Management of Asymptomatic and Symptomatic Employees in the Workplace

…

C. Contact Tracing

  1. Employers shall ensure strict compliance with the protocols established by the DOH and LGUs for contact tracing of employees in close contact with a COVID-19 case, as specified in DOH Memorandum No. 2020-0189 entitled, “Updated Guidelines on Contact Tracing of Close Contacts of Confirmed Coronavirus Disease (COVID-19) Cases”

  2. Close contacts shall be defined as employees with exposures two (2) days before or within 14 days from onset of symptoms of a suspect, confirmed or probable case. Exposure shall be any of the following:

    • a. Face-to-fact contact with a confirmed case within one (1) meter and for more than 15 minutes, with or without a mask;

    • b. Direct physical contact with a confirmed case; or

    • c. Direct care for a patient with probable or confirmed COVID-19 disease without using PPEs.

  3. Contact Tracing among the Workforce

    • a. Employers shall conduct contact tracing within their workplace to identify close contacts. Workplace CCTV may be used to determine close contacts.

    • b. Employers shall ensure that close contacts of employees whose RT-PCR test confirmed positive undergo a 14-day quarantine period.

    • c. During the 14-day quarantine, close contacts shall be required to regularly report to their employer any development, including new symptoms. Symptomatic employees should update their employer regarding their COVID-19 test results from a nationally accredited testing facility.

    • d. Close contacts who remain asymptomatic for 14 days may return to work without need for a test.

    • e. Employers shall make available work-from-home (WFH) arrangements for the close contacts when feasible.131

Department Memorandum No. 2020-0189 (DM 20-0189) ) issued by the Department of Health (DOH) provides:

III. GENERAL GUIDELINES

…

C. Contact tracing shall be initiated after case investigation of every reported confirmed COVID-19 cases, to include the following actions:

  1. Identify settings where the contacts have visited or social interactions where the contacts have been exposed.

  2. Identify all social, familial, work, and health care worker contacts who have had contact with a confirmed case from 2 days before symptom onset of the case (use date of sample collection for asymptomatic cases as basis) until the time that said case test negative on laboratory confirmation[.]

  3. Create a line list, including demographic information and geographic information at barangay and sitio levels, date of first and last exposure or date of contact with the confirmed or probable case, and, for symptomatic close contacts, date of onset of fever, respiratory symptoms, or other significant signs and symptoms;

  4. Thoroughly documented the common exposures and type of contact with the confirmed or probable case for any contact who become infected with COVID-19.132

Under the abovementioned regulations, GoFluent, as an employer, was obliged to conduct contact tracing within its workplace to identify close contacts of its employees. Both JMC 20-04-A and DM 20-0189 provide for the conduct of contact tracing which involves identifying those who came into contact with a confirmed case.

Both JMC 20-04-A133 and DM 20-0189134 guarantee the protection of sensitive personal information and personal information. Additionally, both JMC 20-04-A and DM 20-0189 do not require consent for the conduct of contact tracing in the workplace. Also, DM 20-189 does not require consent in instances where personal data is disclosed to an entity that is authorized by law:

I. Protecting Data Privacy of COVID-19 Cases and Close Contacts

…

  1. All identified close contacts shall be assigned anonymised identification for the purpose of information sharing to or data analysis by individuals other than the personal information controller or those designated to have access to personal and sensitive information. Names and other unique identifiers shall NOT be released publicly or shared with entities not directly involved in the care of the patient, or entities unauthorized by law or other legal instruments to process such information, without the patient’s consent. Violations of this provision shall be punishable by the penalties set under the Data Privacy Act.135

As previously discussed, GoFluent was authorized to disclose MBA’s name, along with his COVID-19 positive status, only to the members of its Management Team and HR Team who were tasked to conduct contact tracing. Based on the 18 November 2020 email sent by GLP, however, GoFluent disclosed MBA’s health information to the group email addresses of the entire Management Team (GF_PH_management@gofluent.com) and HR Team (hr@gofluent.com).136 RLL, MBA’s manager, also later forwarded a copy of the 18 November 2020 email to the SAT Team (sat@gofluent.com).137 According to MBA, these groups were composed of a number of individual members.138 GoFluent did not dispute this and instead alleged that the measures it took were “within the ecosystem [of its] Management and HR[.]”139

Since GoFluent processed MBA’s sensitive personal information based on Section 13 (b) of the DPA, it was obliged to comply with the provisions of the health protocols that mandated the contact tracing measures. MBA claimed that GoFluent processed his health information without his consent and that GoFluent violated his right to privacy.140 In this case, however, there is not enough information on record to show that GoFluent had violated the health protocols when it processed MBA’s health information. Aside from MBA’s allegations in his complaint, he did not provide additional information on how GoFluent violated health protocols when it sent the 18 November 2020 email to the Management Team and HR Team for contact tracing purposes. In fact, MBA did not file a pre-trial brief, comment to GoFluent’s pre-trial brief and memorandum as required by the CID in its Order dated 28 April 2022.141 While RLL had apparently forwarded the 18 November 2020 email to the SAT Team, MBA did not provide sufficient information to show that this violates the health protocols effective at that time.142 As such, GoFluent properly processed MBA’s sensitive personal information based on Section 13 (b) of the DPA.

Thus, GoFluent did not violate Section 25 of the DPA.

B. GoFluent did not violate Section 28 of the DPA (Processing for Unauthorized Purpose).

GoFluent stated that it did not violate Section 28 of the DPA because the email dated 18 November 2020 was solely for the purpose of containing the potential spread of COVID-19 and to isolate those who may have been exposed to MBA.143

Section 28 of the DPA provides:

Section. 28. Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes. The processing of personal information for unauthorized purposes shall be penalized by imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00) shall be imposed on persons processing personal information for purposes not authorized by the data subject, or otherwise authorized under this Act or under existing laws.

The processing of sensitive personal information for unauthorized purposes shall be penalized by imprisonment ranging from two (2) years to seven (7) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00) shall be imposed on persons processing sensitive personal information for purposes not authorized by the data subject, or otherwise authorized under this Act or under existing laws.144

The following requisites must be present for a violation of Section 28 of the DPA:

  1. A person processed information of a data subject;

  2. The information processed is classified as personal information or sensitive personal information;

  3. The person processing the information obtained the consent of the data subject or is granted authority under the DPA or existing laws to process the information for a specific purpose; and

  4. The personal or sensitive personal information is processed for another purpose that is neither covered by the authority given by the data subject and could not have been reasonably foreseen by the data subject nor otherwise authorized by the DPA or existing laws.145

Here, only the first, second, and third requisites are present. As discussed earlier, GoFluent processed MBA’s sensitive personal information. Additionally, GoFluent had lawful basis to process MBA’s sensitive personal information under Section 13 (b) of the DPA.

The fourth requisite, however, is not present in this case. GoFluent did not process MBA’s personal or sensitive personal information for a purpose other than to conduct contact tracing in compliance with health protocols.

In MLF v. MyTaxi.PH Corporation, the Commission held:

In processing of personal information for unauthorized purposes, the person processing the information either obtained the data subject’s consent or is authorized for a declared and specific purpose under the DPA or any existing laws. The processing becomes unlawful, however, when the information is processed for a different purpose that is neither covered by the authority obtained from the data subject or could not have been reasonably foreseen by the data subject or otherwise authorized under the DPA or any existing law.146

Here, GoFluent did not process MBA’s personal data for another purpose. In this case, GoFluent processed MBA’s personal data for the purpose of contact tracing and to implement health protocols when GLP sent out the email to GoFluent’s Management Team and HR Team.147 While RLL apparently later forwarded the 18 November 2020 email to the SAT Team, this is still covered by the same purpose which is to conduct contact tracing and to implement health protocols. According to GoFluent, it needed to conduct contact tracing within its organization to determine who may have been in close contact with MBA and in compliance with health protocols.148 Based on the foregoing discussion, the fourth element is absent in this case.

Thus, since the fourth element is absent, GoFluent did not violate Section 28 of the DPA.

C. GoFluent did not violate Section 31 of the DPA (Malicious Disclosure).

Section 31 of the DPA provides:

Section 31. Malicious Disclosure. Any personal information controller or personal information processor or any of its officials, employees or agents, who, with malice or in bad faith, discloses unwarranted or false information relative to any personal information or personal sensitive information obtained by him or her, shall be subject to imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).149

The following requisites must be present for a violation of Section 31 of the DPA:

  1. The perpetrator is a personal information controller or personal information processor or any of its officials, employees, or agents;

  2. The perpetrator disclosed personal information or sensitive personal information;

  3. The disclosure was with malice or in bad faith; and

  4. The disclosed information relates to unwarranted or false information.150

Here, only the first and second requisites are present.

As to the first requisite, GoFluent is a personal information controller (PIC).

Section 3 of the DPA provides:

Section 3. Definition of Terms. Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

  • (h) Personal information controller refers to a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.151

In this case, GoFluent is a PIC because it controlled the processing of MBA’s health information. GoFluent also determined what information was to be collected from MBA as well as the purpose and extent of the processing of the information. Here, GoFluent instructed MBA to test for COVID-19 and later used MBA’s test results to implement health protocols within its organization.152

As to the second requisite, GoFluent disclosed MBA’s sensitive personal information to its Management Team and HR Team.153 RLL also apparently forwarded the 18 November 2020 email containing MBA’s sensitive personal information to GoFluent’s SAT Team.154

The third requisite, however, is absent. There is not enough evidence on record to conclude that GoFluent acted with malice or in bad faith. The existence of malice and bad faith cannot be presumed.155

According to MBA, his health information was leaked as a result of the email dated 18 November 2020 that was sent by GLP to the Management Team and HR Team.156 MBA further stated that he assumed that the other managers informed non-management employees of his health status.157 These circumstances, however, do not sufficiently support a finding that GoFluent acted with malice or in bad faith.

The fourth requisite is also absent. MBA’s health information contained in the email dated 18 November 2020 is neither false nor unwarranted. Both MBA158 and GoFluent159 stated that MBA had indeed tested positive for COVID-19. Further, neither party contested the truthfulness, correctness or completeness of MBA’s health information contained in the 18 November 2020 email.

Thus, GoFluent did not violate Section 31 of the DPA.

D. GoFluent did not violate Section 32 of the DPA (Unauthorized Disclosure).

Section 32 of the DPA provides:

Section 32. Unauthorized Disclosure. (a) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party personal information not covered by the immediately preceding section without the consent of the data subject, shall he subject to imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).

  • (b) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party sensitive personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from three (3) years to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00).160

The following requisites must be present for a violation of Section 32 of the DPA:

  1. The perpetrator is a personal information controller or personal information processor;

  2. The perpetrator disclosed information;

  3. The information relates to personal or sensitive personal information;

  4. The perpetrator disclosed the personal or sensitive personal information to a third party;

  5. The disclosure was without any of the lawful basis for processing, consent or otherwise, under Sections 12 and 13 of the DPA; and

  6. The disclosure is neither malicious nor done in bad faith or the information disclosed is not unwarranted or false information.161

Here, the fifth requisite is not present.

The first three requisites are present in this case. As discussed earlier, GoFluent is a PIC, it disclosed information and the information relates to sensitive personal information.

The fourth requisite is also present. GoFluent disclosed MBA’s sensitive personal information by sending the email dated 18 November 2020 to the Management Team and HR Team group emails.162 RLL also apparently forwarded the email to the SAT Team.163

GoFluent argued that there was no disclosure to a third party since it was not sent to anybody outside GoFluent’s organization.164 Contrary to GoFluent’s position, however, Section 32 of the DPA does not require the third party to be a person outside the PIC’s organization. Here, GoFluent did not limit the recipients of the email to the members of the Management and HR Teams who were directly involved with implementation of health protocols.

The fifth requisite, however, is not present. Here, GoFluent had lawful basis for processing under Section 13 (b) of the DPA. As earlier discussed, GoFluent processed MBA’s sensitive personal information pursuant to certain health protocols.

As to the sixth requisite, the disclosure made by GoFluent, as discussed earlier, is neither malicious nor made in bad faith or the information disclosed is not unwarranted or false information.

Given the foregoing, GoFluent cannot be held liable for violation of Sections 25, 28, 31 and 32 of the DPA.

III. GoFluent violated the principle of proportionality.

Section 11 of the DPA provides:

Section 11. General Data Privacy Principles. The processing of personal information shall be allowed, subject to compliance with the requirements of this Act and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.

Personal information, must be:

…

  • (c) Accurate, relevant and, where necessary for the purpose for which it is to be used the processing of personal information, kept up to date; inaccurate or incomplete data must be rectified, supplemented, destroyed or their further processing restricted;

  • (d) Adequate and not excessive in relation to the purposes for which they are collected and processed [.]”165

Section 18 of the IRR of the DPA provides:

Section 18. Principles of Transparency, Legitimate Purpose and Proportionality. The processing of personal data shall be allowed subject to adherence to the principles of transparency, legitimate purpose, and proportionality.

…

  • c. Proportionality. The processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.166

In a previous case, the Commission held that processing is deemed proportional when:

  1. Processing is adequate, relevant, and necessary to the declared and specified purpose; and

  2. The processing is performed using less intrusive means.167

Here, GoFluent violated proportionality when it sent out the email dated 18 November 2020 containing MBA’s status as COVID-19 positive to the group email addresses of its Management Team and HR Team.168 While GoFluent had lawful basis to process MBA’s sensitive personal information under Section 13 (b) of the DPA, it was not necessary for GoFluent to disclose this information to the whole Management Team and HR Team without distinction. In doing so, GoFluent exposed MBA’s health information to members of the Management Team and HR Team who were not involved in determining MBA’s close contacts. GoFluent could have easily carried out its purpose of implementing contact tracing measures while limiting the recipients of the email to the personnel actually tasked with carrying out these measures. Additionally, GoFluent did not present evidence to show that it was necessary for it to disclose MBA’s health information to the entire Management and HR Teams. In this case, GoFluent acted excessively by including as recipients GF_PH_management@gofluent.com and hr@gofluent.com.

GoFluent’s failure to comply with the principle of proportionality also resulted in the email containing MBA’s health information being eventually forwarded to other recipients including sat@gofluent.com.169

As a PIC, GoFluent was obliged to ensure the implementation of the general privacy principles under the DPA.170 GoFluent, however, failed to comply with the general privacy principle of proportionality under Section 11 (c) and (d) of the DPA. Based on the foregoing, it is proper for the Commission to hold GoFluent liable for damages.

According to Section 7 (b) of the DPA, the NPC, as part of its functions, is empowered to award indemnity on matters affecting any personal information.171 Further, the DPA provides that “restitution for any aggrieved party shall be governed by the provisions of the New Civil Code.”172

The Civil Code provides:

Art. 2221. Nominal damages are adjudicated in order that a right of the plaintiff, which has been violated or invaded by the defendant, may be vindicated or recognized, and not for the purpose of indemnifying the plaintiff for any loss suffered by him.173

The Supreme Court has also clarified that no actual present loss is required to warrant the award of nominal damages, thus:

Nominal damages are recoverable where a legal right is technically violated and must be vindicated against an invasion that has produced no actual present loss of any kind or where there has been a breach of contract and no substantial injury or actual damages whatsoever have been or can be shown.174

Here, in recognition of GoFluent’s violation of the principle of proportionality, the Commission awards nominal damages in favor of MBA.

WHEREFORE, premises considered, the Commission resolves that the Complaint filed by MBA against GoFluent Philippines Inc. is DISMISSED.

The Commission AWARDS nominal damages in the amount of Fifteen Thousand Pesos (Php 15,000.00) to MBA for GoFluent’s non-compliance with Section 11 (c) and (d) of Republic Act No. 10173 or the Data Privacy Act of 2012.

This is without prejudice to the filing of appropriate civil, criminal or administrative cases against the Respondent GoFluent Philippines Inc. before any other forum or tribunal, if any.

SO ORDERED.

City of Pasay, Philippines.

16 January 2025.

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA

Privacy Commissioner

NERISSA N. DE JESUS

Deputy Privacy Commissioner

Copy furnished:

RDT

Counsel for Complainant

PARAS & MANLAPAZ LAWYERS

Counsel for Respondent

JCZ

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

Footnotes

  1. Complaints-Assisted Form, 24 May 2021, Narration of Facts, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. ↩

  6. Id. ↩

  7. Complaints-Assisted Form, 24 May 2021, Narration of Facts, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  8. Id. Annex C. ↩

  9. Id. Annex A. ↩

  10. Id. Annex B. ↩

  11. Id. ↩

  12. Id. ↩

  13. Complaints-Assisted Form, 24 May 2021, Annex B, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  14. Id. Narration of Facts. ↩

  15. Id. Annex C. ↩

  16. Id. Narration of Facts. ↩

  17. Id. ↩

  18. Id. ↩

  19. Verified Comment, 08 November 2021, at 5, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  20. Complaints-Assisted Form, 24 May 2021, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  21. Order (To File Verified Comment and Appear Virtually for Preliminary Conference), 14 October 2021, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  22. Id. ↩

  23. Verified Comment, 08 November 2021, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  24. Id. at 2. ↩

  25. Id. ↩

  26. Id. ↩

  27. Id. ↩

  28. Id. at 5. ↩

  29. Verified Comment, 08 November 2021, at 5, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  30. Id. at 7. ↩

  31. Id. ↩

  32. Id. ↩

  33. Id. at 8. ↩

  34. Id. ↩

  35. Verified Comment, 08 November 2021, at 8, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  36. Id. ↩

  37. Id. at 8-9. ↩

  38. Id. at 9. ↩

  39. Id. ↩

  40. Id. ↩

  41. Verified Comment, 08 November 2021, at 9, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  42. Id. ↩

  43. Id. at 9-10. ↩

  44. Id. at 11-12. ↩

  45. Order (After the 1st Preliminary Conference held on 18 January 2022), 18 January 2022, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  46. Id. ↩

  47. Order (After the 2nd Preliminary Conference held on 15 February 2022 and for the Parties to Appear Virtually for the 3rd Setting of the Preliminary Conference), 15 February 2022, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  48. Id. ↩

  49. Entry of Appearance, 21 February 2022, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  50. Order (Noting the Entry of Appearance for Counsel of Complainant), 23 February 2022, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  51. Order (After the 3rd Preliminary Conference held on 23 March 2022 and Requiring the Parties to Submit a Filled-Out Application for Mediation Form), 23 March 2022, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  52. Id. at 3. ↩

  53. Application for Mediation, 29 March 2022, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  54. Application for Mediation, 13 April 2022, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  55. Order to Mediate, 13 April 2022, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  56. Notice of Non-settlement of Dispute, 28 April 2022, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  57. Order, 28 April 2022, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  58. Id. at 1. ↩

  59. Order (After the 3rd Preliminary Conference held on 23 March 2022 and Requiring the Parties to Submit a Filled-Out Application for Mediation Form), 23 March 2022, at 1, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  60. Order, 28 April 2022, at 2, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  61. Compliance, 16 May 2022, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  62. Id. Annex 1-A. ↩

  63. Order (Noting Respondent’s Compliance, 20 May 2022, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  64. Pre-Trial Brief, 03 June 2022, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  65. Order (Noting the Respondent’s Pre-Trial Brief), 06 June 2022, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  66. Manifestation, 17 June 2022, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  67. Id. ↩

  68. Order (Noting the Respondent’s Manifestation ), 20 June 2022, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  69. Memorandum, 30 June 2022, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  70. Verified Comment, 08 November 2021, at 2, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  71. Id. ↩

  72. National Privacy Commission, 2021 Rules of Procedure of the National Privacy Commission, Circular No. 1, Series of 2021 [NPC Circular No. 2021-01], Rule II, § 2 (25 January 2021). ↩

  73. Complaints-Assisted Form, 24 May 2021, at 3, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  74. Verified Comment, 08 November 2021, Annex 3, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  75. Id. ↩

  76. Complaints-Assisted Form, 24 May 2021, Narration of Facts, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  77. Id. at 3. ↩

  78. GJJ v. Creditable Lending Corporation (Easy Peso), NPC 19-465, 03 March 2022, at 6, available at https://privacy.gov.ph/wp-content/uploads/2024/05/NPC-19-465-2022.03.03-GJJ-v.-Easy-Peso-Decision-FinalP.pdf (last accessed 19 March 2025). ↩

  79. Complaints-Assisted Form, 24 May 2021, Narration of Facts, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  80. Id. at 5. ↩

  81. Verified Comment, 08 November 2021, at 2, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  82. Ray Peter O. Vivo v. Philippine Amusement and Game Corporation (PAGCOR), G.R. No. 187854 (2013). ↩

  83. Verified Comment, 08 November 2021, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  84. Complaints-Assisted Form, 24 May 2021, Narration of Facts, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  85. Verified Comment, 08 November 2021, at 5, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  86. Id. ↩

  87. Id. at 2. ↩

  88. NPC Circular No. 2021-01, Rule II, § 3. Emphasis supplied. ↩

  89. Armando S. San Juan, et al. v. Miguel L. Arambulo, Sr., G.R. No. 143217 (2005). ↩

  90. Complaints-Assisted Form, 24 May 2021, at 3, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  91. Verified Comment, 08 November 2021, at 2, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  92. GSS v. Global Dominion Financing Inc., NPC 21-064, 16 June 2022, at 7, available at https://privacy.gov.ph/wp-content/uploads/2024/05/NPC-21-064-2022.06.16-GSS-v.-Global-Dominion-Financing-Inc-Decision-FinalP.pdf (last accessed 19 February 2025). ↩

  93. Complaints-Assisted Form, 24 May 2021, Narration of Facts, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  94. Id. Annex B. ↩

  95. Complaints-Assisted Form, 24 May 2021, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  96. Id. Annex B. ↩

  97. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 § 3 (h) (20120. Emphasis supplied. ↩

  98. MVC v. DSL, NPC 21-010, 03 February 2022, at 6, available at https://privacy.gov.ph/wp-content/uploads/2024/06/NPC-21-010-to-NPC-21-015-2022.02.03-Decision-FinalP.pdf (last accessed 19 February 2025). ↩

  99. Verified Comment, 08 November 2021, at 2, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  100. Apostolic Vicar of Tabuk, Inc. v. Spouses Ernesto and Elizabeth Sison and Venancio Wadas, G.R. No. 191132 (2016). Emphasis supplied. ↩

  101. Complaints-Assisted Form, 24 May 2021, Narration of Facts, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  102. Roa v. Spouses Sy, G.R. No. 221586 (2021) (citing Asia Brewery Inc. and Charlie S. Go v. Equitable PCI Bank, G.R. No. 190432 (2017)). ↩

  103. Verified Comment, 08 November 2021, at 8, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  104. Id. ↩

  105. Data Privacy Act of 2012, § 4. ↩

  106. Verified Comment, 08 November 2021, at 8, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  107. Id. ↩

  108. Complaints-Assisted Form, 24 May 2021, Narration of Facts, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  109. Id. ↩

  110. Verified Comment, 08 November 2021, at 8, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  111. Data Privacy Act of 2012, § 25. ↩

  112. VVC v. CJB, NPC 19-134, 10 December 2021, at 12, available at https://privacy.gov.ph/wp-content/uploads/2023/05/NPC-19-134-VVC-v.-CJB-Decision-2021.12.10.pdf (last accessed 19 February 2025). ↩

  113. Verified Comment, 08 November 2021, at 8, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  114. Memorandum, 30 June 2022, at 13, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  115. Data Privacy Act of 2012, § 3 (j). Emphasis supplied. ↩

  116. Complaints-Assisted Form, 24 May 2021, Annex B, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  117. Id. ↩

  118. Data Privacy Act of 2012, § 3 (l). Emphasis supplied. ↩

  119. Complaints-Assisted Form, 24 May 2021, Annex B, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  120. RJC v. DL, NPC 22-012, 10 November 2022, at 7, available at https://privacy.gov.ph/wp-content/uploads/2023/08/NPC-22-012-2022.11.10-RJC-v.-DL-Decision.pdf (last accessed 19 February 2025). ↩

  121. Complaints-Assisted Form, 24 May 2021, Annex B, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  122. Id. ↩

  123. Verified Comment, 08 November 2021, at 7, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  124. National Privacy Commission, Guidelines for Workplaces and Establishments Processing Personal Data for COVID-19 Response, Advisory No. 03, Series of 2020 [NPC Advisory 2020-03], § 5 (C) (2) (23 October 2020). ↩

  125. Complaints-Assisted Form, 24 May 2021, Narration of Facts, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  126. Id. Annex B. ↩

  127. Id. Annex A. ↩

  128. Id. Annex B. ↩

  129. Data Privacy Act of 2012, § 13 (b). ↩

  130. Verified Comment, 08 November 2021, at 10-11, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  131. Department of Trade and Industry and Department of Labor and Employment, DTI and DOLE Supplemental Guidelines on Workplace Prevention and Control of COVID-19, Joint Memorandum Circular No. 04-A, Series of 2020 [JMC No. 20-04-A], III (C), (15 August 2020). ↩

  132. Department of Health, Updated Guidelines on Contact Tracing of Close Contacts of Confirmed Coronavirus Disease (COVID-19) Cases, Department Memorandum No. 0189, Series of 2020 [DM No. 2020-0189], III (C), (17 April 2020). ↩

  133. JMC No. 20-04-A. ↩

  134. DM No. 2020-0189. ↩

  135. Id. ↩

  136. Complaints-Assisted Form, 24 May 2021, Annex B, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  137. Id. ↩

  138. Id. Narration of Facts. ↩

  139. Verified Comment, 08 November 2021, at 9, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  140. Complaints-Assisted Form, 24 May 2021, Narration of Facts, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  141. Order, 28 April 2022, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  142. Complaints-Assisted Form, 24 May 2021, Annex B, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  143. Verified Comment, 08 November 2021, at 9, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  144. Data Privacy Act of 2012, § 28. ↩

  145. NPC 23-054, 17 September 2024, at 29, (NPC 2024) (unreported). ↩

  146. MLF v. MyTaxi.PH Corporation, NPC 19-142, 31 March 2022, at 16, available at https://privacy.gov.ph/wp-content/uploads/2023/05/NPC-19-142-MLF-v.-Grab-Philippines-2022.03.31.-Decision.pdf (last accessed 19 February 2025). ↩

  147. Verified Comment, 08 November 2021, at 12, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  148. Memorandum, 30 June 2022, at 13, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2022). ↩

  149. Data Privacy Act of 2012, § 31. ↩

  150. JCB v. JME, NPC 21-032, 16 May 2022, at 12-13, available at https://privacy.gov.ph/wp-content/uploads/2024/05/NPC-21-032-2022.05.16-JCB-v.-JME-Decision-FinalP.pdf (last accessed 19 February 2025). ↩

  151. Data Privacy Act of 2012, § 3 (h). ↩

  152. Complaints-Assisted Form, 24 May 2021, Narration of Facts, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  153. Id. Annex B. ↩

  154. Id. ↩

  155. Cruz v. Intermediate Appellate Court, G.R. No. 66327 (1984). ↩

  156. Complaints-Assisted Form, 24 May 2021, Narration of Facts, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  157. Id. ↩

  158. Id. ↩

  159. Verified Comment, 08 November 2021, at 4, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  160. Data Privacy Act of 2012, §32. ↩

  161. JCB v. JME, NPC 21-032, at 15-16. ↩

  162. Complaints-Assisted Form, 24 May 2021, Annex B, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  163. Id. ↩

  164. Verified Comment, 08 November 2021, at 9, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  165. Data Privacy Act of 2012, §11. ↩

  166. National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, rule IV, § 18 (2016). ↩

  167. See MAF v. Shopee Philippines, Inc., NPC 21-167, 22 September 2022, at 14, available at https://privacy.gov.ph/wp-content/uploads/2024/05/NPC-21-167-2022.09.22-MAF-v.-Shopee-Decision-FinalP.pdf (last accessed 19 February 2025). ↩

  168. Complaints-Assisted Form, 24 May 2021, Annex B, in MBA v. GoFluent Philippines Inc., NPC 21-082 (NPC 2021). ↩

  169. Id. ↩

  170. Data Privacy Act of 2012, §11. ↩

  171. Id. §7 (b). ↩

  172. Id. §37. ↩

  173. An Act to Ordain and Institute the Civil Code of the Philippines [CIVIL CODE ], Republic Act No. 386, art. 2221 (1949) ↩

  174. Seven Brothers Shipping Corporation v. DMC-Construction Resources, Inc. G.R. No. 193914 (2014). ↩

Backlinks

  • No backlinks found