Issuance Text
Frequently Asked Questions on the Draft Rules on the Issuance of Cease and Desist Orders (CDO)
1. Does Section 4(B) in laying one of the requisites for the issuance of a CDO as “such act or practice is detrimental to national security or public interest, or the CDO is necessary to preserve and protect the rights of a data subject,” expand Section 7(C) of the Data Privacy Act (DPA) which provides that the National Privacy Commission (NPC) shall have the following functions, among others “Issue cease and desist orders, impose a temporary or permanent ban on the processing of personal information, upon finding that the processing will be detrimental to national security and public interest.”
No. At the outset, we note that this phrase is taken from Section 9(f)(3) of the Implementing Rules and Regulations (IRR) of the DPA which provides the functions of the NPC including “Enforcement: Issuing cease and desist orders, or imposing a temporary or permanent ban on the processing of personal data, upon finding that the processing will be detrimental to national security or public interest, or if it is necessary to preserve and protect the rights of data subjects.”
The IRR, in adding the phrase “or if it necessary to preserve and protect the rights of data subjects” did not expand the DPA but rather limit the national security and public interest issue involved in data privacy cases, which is the protection and preservation of the rights of a data subject. The addition of such a phrase prevents the issuance of a CDO for national security and public interest cases outside the jurisdiction of the Commission.
What the IRR does in adding the term “protection and preservation of the rights of the data subject” is to merely contextualize the public interest issue within the jurisdiction of the NPC. This is sanctioned by law and jurisprudence, which states that “[a]dministrative [a]gencies may implement the broad policies laid down in a statute by “filling in” the details which the Congress may not have the opportunity or competence to provide” (Eastern Shipping Lines, Inc. v. POEA, G.R. No. 76633, October 18, 1988).
To be clear, before a CDO may be issued, an applicant must be able to prove that the issue falls under either of the two grounds of national security or public interest. Further, the national security or public interest issue must relate to the preservation and protection of the rights of data subjects.
2. The CDO is issued ex parte. Is this not a violation of the due process rule?
No. The CDO is an extraordinary remedy reserved only for those cases wherein the commission or continuance of a certain act or practice, unless restrained, will cause grave and irreparable injury to a data subject (Section 4(C), CDO Rules).
The due process requirement is satisfied by the provision ordering the Adverse Party to comment on the issued CDO (Section 9, CDO Rules) which shall be set for adjudication by the Commission En Banc (Section 12, CDO Rules). After giving the respondent the opportunity to be heard, the Commission will decide whether to extend or lift the CDO no later than thirty (30) days from the expiration of the period for the Adverse Party to file a comment or the termination of the clarificatory hearing if one is held. In the event that the Commission fails to render its decision within the said period, the CDO shall be deemed automatically lifted (Section 12, CDO Rules).
3. How can the NPC justify an ex parte CDO when the DPA does not authorize the NPC to issue the same?
Jurisprudence has recognized the implied power of quasi-judicial agencies to issue ex parte cease and desist orders in accordance with its mandate. While it is a fundamental rule that an administrative agency has only such powers as are expressly granted to it by law, it is likewise a settled rule that an administrative agency has also such powers as are necessarily implied in the exercise of its express powers. Otherwise, it may well be reduced to a “toothless” paper agency (Laguna Lake Development Authority vs Court of Appeals, GR 110120, March 16, 1994).
4. Can you further qualify “grave and irreparable injury” or set the criteria for said injury?
Jurisprudence provides that damages are irreparable when “there is no standard by which their amount can be measured with reasonable accuracy.” An irreparable injury which a court of equity will enjoin includes that degree of the wrong of a repeated and continuing kind which produces hurt, inconvenience, or damage that can be estimated only by conjecture, and not by any accurate standard of measurement. An irreparable injury to authorize an injunction consists of a serious charge of or is destructive to, the property it affects, either physically or in the character in which it has been held and enjoined, or when the property has some peculiar quality or use, so that its pecuniary value will not fairly recompense the owner of the loss thereof (Power Sites and Signs Inc. vs. United Neon, etc. G.R. 163406, November 24, 2009).
5. Is this similar to a preliminary injunction under Rule 58 of the Rules of Civil Procedure?
The purpose of a CDO and a preliminary injunction is the same. According to Section 5 of Rule 58 of the Rules of Court, the court allows the issuance of an injunction ex parte if shown in a verified application, that there is a grave and irreparable injury that would result before the matter is heard on notice. The purpose of Rule 58, specifically Section 5, is of the same purpose as that of a CDO.
6. What is the difference between a CDO and a temporary or permanent ban on the processing of personal information?
The CDO is an independent action that covers the processing of personal information and the conduct of any act or practice in violation of the DPA. It is commenced motu propio by the Complaints and Investigation Division (CID) or the Compliance and Monitoring Division (CMD), or through a verified application by the aggrieved party upon recommendation by the CID. It is issued ex parte, after the conduct of verification and investigation. Upon issuance, it is immediately executory and shall remain in force until lifted or modified by the Commission.
On the other hand, a temporary or permanent ban on the processing of personal information is a provisional remedy which only covers the processing of personal information. It is commenced upon the filing of the complaint or at any time before the finality of a decision of the Commission. It is issued after a summary hearing and notice. Upon issuance, it shall remain in effect until the final resolution of the case, or upon further orders by the Commission or lawful authority. (Section 19, NPC Circular 16-03).
7. From a practical perspective, is there still a benefit to seeking a temporary or permanent ban on processing in relation to a complaint instead of applying for a CDO?
As there are different grounds in the issuance of CDO and the issuance of a temporary or permanent ban, a party cannot apply for a CDO if only the grounds in the issuance of a temporary or permanent ban are present.
8. Should this not be merely an accessory to an original action?
The application for CDO may or may not be attached to a complaint. An aggrieved party may file an application for a CDO without a complaint in instances where the ultimate remedy desired is the issuance of the CDO against the adverse party.
9. Section 5 of the CDO Rules provide “filing with the Commission of an application in writing.” Is there a specific office where this can be filed or will it be filed with the Office of the Privacy Commissioner and the two (2) Deputy Privacy Commissioners?
The application is filed with the “Commission” composed of the Privacy Commissioner and the two Deputy Privacy Commissioners through the NPC’s General Record Unit. Upon filing by an aggrieved party, the CID will first assess if the application is sufficient in form and substance before transmitting the same with its recommendation to the Commission. The Commission will ultimately decide on the propriety of the application and the necessity of the issuance of the CDO.
10. What is the standard of proof in the issuance of the CDO?
Substantial evidence is the standard of proof in the issuance of a CDO as it is also the standard of proof for final decisions of quasi-judicial agencies. Jurisprudence provides that “substantial evidence” is such “relevant evidence that a reasonable mind might accept as adequate to support a conclusion. Complainants in administrative proceedings carry the burden of proving their allegations with substantial evidence (De Jesus v. Guerrero III, G.R. No. 171491, September 4, 2019; Office of the Ombudsman v. Loving Fetalvero Jr., G.R. No. 211450, July 23, 2018).
11. How will the bond be computed? How can CID assess or estimate any potential damage that the PIC/Adverse Party may suffer due to malicious or erroneously issued CDO? What will be their basis?
The bond will be computed based on the assessment of the CID. Further details such as rules on the assessment of bond, the period within which the bond should be posted, and the effect of non-posting of the bond will be subject to another circular on fines, fees, and penalties.
12. Is it possible for the adverse party to file a counterbond?
No. By its nature, a counterbond discharges the writ of attachment enforced against the respondent. The counterbond shall secure the payment of any judgment that the attaching party may recover in the action (Section 12, Rule 57, Rules of Court). Since the CDO is an extraordinary remedy reserved only for those cases which fall under national security and public interest, and where the continued act of the respondent, unless restrained, would cause grave and irreparable injury, a counterbond may not be filed to discharge the CDO.
Allowing the respondent to file a counterbond to discharge the CDO will go against the policy of the state to protect national security and public interest. Moreover, damages are grave and irreparable when they are incapable of pecuniary estimation. Hence, filing a counterbond will not discharge the obligation of the respondent since the possible damage to the aggrieved party is grave and irreparable which is incapable of pecuniary estimation
13. What is the rule on filing and service?
Rules on filing and service shall follow NPC Circular 16-04 or the Rules of Procedure of the NPC as may be amended. Currently, filing may be made personally or electronically while service may be made by personal or substituted service. If personal or substituted service is impossible, by private courier.
14. Explain the rationale behind the phrase “The lifting of the CDO shall not preclude the issuance of another CDO based on the same acts complained of, should such acts after lifting of the CDO, would then continue within twelve (12) months from its lifting.”
The phrase means that the Commission may issue another CDO only upon verification and investigation, without the need for a new application. This is to provide an immediate remedy in cases wherein the respondent will stop the acts complained of to lift the CDO, then resume the acts complained of shortly thereafter.
15. What happens if there is a CDO that refers to the same processing lodged as a complaint, breach notification, or compliance check, and the CID or CMD process is not yet done but the CDO has been executed already?
If there is a pending complaint or investigation under CID or if a compliance check or breach notification is pending with the CMD, and if there is an application for a CDO on the same matter, both can proceed independently of one another. They are separate proceedings.
16. Will a CDO be proper after a mere privacy sweep or document submission? Will a Data Breach Notification by itself be a good cause for the issuance of a CDO?
Every application will be decided on a case to case basis after the conduct of verification and investigation. A CDO may issue after or during the conduct of a compliance check or a data review breach notification if the Commission finds that the CDO is proper under the circumstances.
17. At which stage will the Complaints and Investigations Division (CID) recommend the issuance of a CDO? Is it possible the CID will recommend a CDO even before the order to confer for discovery?
The CID will not recommend the issuance of a CDO. Once an application is filed by an aggrieved party, the CID will only make a preliminary assessment to determine if the application is sufficient in form and substance. Ultimately, it is for the Commission to decide whether to grant the CDO or not.
18. What is the remedy if the CID does not recommend the filing of the application?
CID will only recommend whether the application is sufficient in form and substance. Upon its assessment, it will forward the application to the Commission together with its recommendation. Ultimately, it would still be the Commission that will decide on the propriety of the application and the necessity of issuing a CDO. If the application is then denied, the remedy is still against the decision of the Commission.
19. Does the rule on exhaustion of administrative remedies apply in this case?
No. Since an application for a CDO may proceed independently of a complaint, Section 4 of NPC Circular 16-04 does not apply. The CDO is an extraordinary remedy that will give an applicant immediate relief in cases where the stringent criteria under the law are met. Requiring the applicant to comply with the rule on exhaustion will defeat the main purpose of the application, which is to prevent a grave or irreparable injury.
20. What will be the basis of the CID for conducting a sua sponte investigation?
The NPC initiates an investigation of the circumstances surrounding a possible data privacy violation or personal data breach in cases of, but not exclusive to, matters that arose from pending cases before the NPC, reports from the daily news, trends or academic studies, information gathered from corroborated and substantiated anonymous tips or reports from other offices of the Commission.
21. The CDO also talks about “future action,” or “threatening to do something.” In this case, how will this fall under the jurisdiction of the NPC if there is no violation, to begin with?
The CDO is an extraordinary remedy and by its nature a remedy to prevent grave and irreparable injury. Since the purpose is to prevent said injury, future actions, by implication, are covered by the Rules. Future actions that, if not prevented, will cause grave or irreparable injury are actions which the CDO ultimately intends to enjoin.
22. Can a CDO be immediately published regardless of the public interest or public education?
For publication of Decisions, the Commission has released NPC Advisory 2020-01 on “Protocols for the Publication of Decisions, Resolutions, and Orders On the NPC Website.” Section 1, “Scope of Publication” provides,
-
a) These guidelines shall cover all Commission Decisions, Resolutions, and Orders issued by the Commission En Banc.
-
b) The following shall not be published on the NPC website:
- (i) Cases decided based on compromise agreements, mediated settlement agreements, quitclaims, and other modes of alternative dispute resolutions as these are not decided based on merit and therefore lack teaching value for the public
- (ii) Interlocutory Decisions, Orders, and Resolutions that do not dispose of the case or breach notification with finality.
- (iii) Decisions, Orders, and Resolutions that may be subject of a Motion for Reconsideration, unless the reglementary period to file such has lapsed.
-
c) Notwithstanding the enumeration in paragraph (b), the Commission may, at its discretion, publish Decisions, Orders and Resolutions where public interest warrants or for the education of the public.
However, in the case of a CDO, the publication is only after allowing the Adverse Party to be heard and is only limited to instances of public interest as determined by the Commission.
23. Does the “Aggrieved Party” include a juridical person? May the corporation file a petition for issuance of CDO on behalf of its employees?
No, an aggrieved party or a data subject as contemplated by the DPA only refers to a natural person, privacy being a fundamental human right. (Advisory Opinion No. 2017-006) However, according to NPC Circular 16-04, a natural person may be represented by a juridical person (Section 3).
24. May the aggrieved party be represented by counsel?
Yes, based on the suppletory application of the Rules of Court as well as NPC Circular 16-04.
25. Does this apply to online sellers, who due to the quarantine restrictions are maximizing mobile banking and online transactions?
Yes, these Rules apply to every personal information controller or processor.
26. How will the penalties or fines be imposed? Will there a table of penalties to be included in this circular or referred to?
The penalties, fees, fines, as well as the determination of the bond will be subject to a separate Circular.
---Nothing follows---