Issuance Text
NPC Circular No. 20-02
RULES ON THE ISSUANCE OF CEASE AND DESIST ORDERS
Pursuant to the authority vested in the National Privacy Commission through Section 7(c) of Republic Act No. 10173, otherwise known as the “Data Privacy Act of 2012,” (DPA) to issue cease and desist orders on the processing of personal data, the following Rules on the Issuance of Cease and Desist Orders of the National Privacy Commission are hereby prescribed and promulgated:
RULE I. PRELIMINARY PROVISIONS
Section 1. Title. These Rules shall be known as the Rules on the Issuance of Cease and Desist Orders of the National Privacy Commission, or the “Rules”.
Section 2. Scope and Coverage. These Rules shall apply to all applications for a Cease and Desist Order on the processing of personal data and other matters cognizable by the National Privacy Commission.
Section 3. Definition of Terms.
-
A. “Adverse Party” refers to a party against whom a Cease and Desist Order is sought.
-
B. “Aggrieved Party” refers to a data subject who claims to be the subject of a privacy violation or personal data breach, including the latter’s duly authorized representative: Provided, that the circumstances of the authority were established.
-
C. “Applicant” refers to any of the following (i) the aggrieved party, (ii) the Complaints and Investigation Division, or (iii) the Compliance and Monitoring Division of the NPC.
-
D. “Cease and Desist Order” or “CDO” refers to a type of injunction that requires a natural or juridical person to stop its complained act of processing personal information or the conduct of any act or practice in violation of the Data Privacy Act of 2012 (DPA).
-
E. “Commission” refers to the Privacy Commissioner and the two (2) Deputy Privacy Commissioners, acting as a collegial body.
-
F. “Complaints and Investigation Division” or “CID” refers to the Division of the National Privacy Commission whose function is to receive complaints and conduct investigations regarding violations of the DPA, its Implementing Rules and Regulations (IRR) and other related issuances, including violations of the rights of data subjects and other matters affecting personal data.
-
G. “Compliance and Monitoring Division” or “CMD” refers to the Division of the National Privacy Commission whose function is to monitor the compliance of personal information controllers (PICs) and personal information processors (PIPs) to ensure effective implementation of the DPA, its IRR and other related issuances.
-
H. “Compliance Check” refers to the systematic and impartial evaluation of a PIC or PIP, in whole or any part, process or aspect thereof, to determine whether activities that involve the processing of personal data are carried out in accordance with the standards mandated by the DPA and other issuances of the Commission. It is an examination, which includes Privacy Sweeps, Documents Submissions and On-Site Visits, as defined under NPC Circular 18-02, Guidelines on Compliance Checks, intended to determine whether a PIC or PIP is able to demonstrate organizational commitment, program controls and review mechanisms intended to assure privacy and personal data protection in data processing systems.
-
I. “Data Subject” refers to an individual whose personal, sensitive personal, or privileged information is processed.
-
J. “NPC” refers to the National Privacy Commission as a government agency.
-
K. “Rules of Procedure” refers to NPC Circular 16-04 or the “Rules of Procedure of the National Privacy Commission”, as may be amended.
-
L. “Sua Sponte Investigation” shall refer to an investigation initiated by the NPC itself for possible violation of the DPA by one or more entities.
RULE II. CEASE AND DESIST ORDER
Section 4. Grounds for the Issuance of Cease and Desist Order. No CDO shall be issued unless it is established by substantial evidence that all of the following concur:
-
A. the Adverse Party is doing, threatening or is about to do, is procuring to be done, some act or practice in violation of the DPA, its IRR, or other related issuances;
-
B. such act or practice is detrimental to national security or public interest, or the CDO is necessary to preserve and protect the rights of a data subject; and
-
C. the commission or continuance of such act or practice, unless restrained, will cause grave and irreparable injury to a data subject.
Section 5. Filing of Application. An action for the issuance of a CDO may be commenced upon the filing with the Commission of an application in writing, verified and under oath, by any of the following applicants:
-
A. the CID, through its sua sponte investigation or the CMD through its conduct of compliance checks and handling of breach notifications, if there is a finding that the grounds for the issuance of the CDO are present; or
-
B. the Aggrieved Party, either attached to a complaint or as an independent action, with payment of filing fees in accordance with the Rules of Procedure of the NPC, and upon recommendation by the CID after its assessment that the application is sufficient in form and substance.
Section 6. Contents of a Verified Application. The application for the issuance of a CDO must specify the following:
-
A. the material facts establishing the grounds for such issuance;
-
B. the name, contact information and address of the respondent where the orders, issuances, or communications from the NPC may be served; and
-
C. the relevant documentary, testimonial, and object evidence supporting the issuance of a CDO.
If the application is filed by an Aggrieved Party, it shall also specify the Aggrieved Party’s name, contact information and address where the orders, issuances, or communications from the NPC may be served, including a secure electronic mail address when available.
An application that does not comply with the foregoing requirements may still be acted upon at the discretion of the Commission if it merits appropriate consideration on its face, or is of such notoriety that it necessarily contains sufficient leads or particulars to enable the taking of further action.
The Commission may require the submission of additional information and/or evidence when it deems it necessary for the resolution of the application for CDO.
Until the Commission issues the CDO, the fact that an application has been initiated or a complaint has been filed, including the contents of the application and complaint, shall be confidential.
The rules on filing and service of processes under the Rules of Procedure of the NPC shall apply.
Section 7. Cease and Desist Order Bond. Unless the Aggrieved Party is exempted from the payment of filing fees under the Rules of Procedure of the NPC, upon filing of the application for the issuance of a CDO, the Aggrieved Party shall also file a bond in the form of cash deposit or surety bond executed to the Adverse Party in an amount fixed by the CID after its assessment. The bond is to answer for whatever damages that the adverse party may sustain by reason of the order, if it should be later decided that the applicant is not entitled thereto.
Section 8. Issuance of Cease and Desist Order. Upon its conduct of verification and investigation, the Commission may issue an ex-parte CDO, without the necessity of a prior hearing, when in its determination the grounds relied upon exist. The CDO shall specifically state the act or practice complained of and require the person to immediately cease and desist from the commission or continuance thereof.
The Commission shall ensure that a copy of the CDO be immediately furnished to each party subject thereto. The CDO shall be immediately executory and enforceable upon receipt of the Adverse Party.
Section 9. Order to Comment. The CDO shall also include an order for the Adverse Party to comment on its issuance and file the same within ten (10) days from receipt thereof. The order shall include a copy of the application for CDO, the annexes thereto, and receipt of the bond, if applicable.
Section 10. Implementation of the CDO. The Commission shall ensure the implementation of the CDO no later than seventy-two (72) hours from receipt thereof by the Adverse Party. The NPC unit tasked by the Commission to implement the order shall submit to the Commission a report within forty-eight (48) hours after the completion of the implementation, stating therein the actions taken. Should the CDO be implemented beyond seventy-two (72) hours or in case it cannot be implemented, the concerned NPC unit shall submit a written report to the Commission stating the causes of delay or non-execution.
Section 11. Clarificatory Hearing. After the submission of the Comment by the Adverse Party, the Commission may order the conduct of a clarificatory hearing, whenever in its discretion, additional information is needed to make a decision on the issued CDO. In case the Commission finds that a clarificatory hearing is necessary, it shall issue a notice of hearing addressed to all the parties concerned which shall indicate the scheduled time and date for the hearing.
Section 12. Decision on the Issued CDO. If after giving the Adverse Party the opportunity to be heard, it appears that the applicant is entitled to have the act or practice enjoined and that there is a need for the extension of the issued CDO, the Commission shall extend its effectivity, otherwise, the same shall be lifted.
The decision whether to extend or lift the issued CDO shall be made no later than thirty (30) days from the expiration of the period for the Adverse Party to file a comment or the termination of the clarificatory hearing if one is held. In the event that the Commission fails to render its decision within the said period, the CDO shall be deemed automatically lifted.
Section 13. When CDO is Extended. The extension of the CDO issued by the Commission shall also include an order to submit the necessary compliance report within the time prescribed for monitoring purposes. The concerned NPC unit shall ensure that a copy of such order be immediately furnished to each party subject thereto.
The extended CDO shall remain in force and effect until the same is modified or lifted by the Commission upon showing that the factual or legal basis for which it was issued no longer exists.
Section 14. Not Stayed by Appeal. The CDO shall not be stayed by an appeal taken therefrom or by a petition for certiorari, unless otherwise ordered by the appropriate court, upon such terms as it may deem just.
RULE III. MOTION TO LIFT EXTENDED CEASE AND DESIST ORDER
Section 15. Motion to Lift Extended CDO. At any time during the effectivity of the extended CDO, the Adverse Party may file a motion to lift said order on the ground that the factual or legal basis for which it was issued no longer exists, furnishing a copy thereof to the applicant. The motion shall contain or specify the material facts establishing the ground/s relied upon, the relevant documentary, testimonial and object evidence supporting the motion, and the proof of service of the copy of the motion to the applicant.
Section 16. Comment or Opposition to the Motion. The applicant may file a comment/opposition to the motion to lift within ten (10) days from receipt thereof and furnishing a copy thereof to the Adverse Party. It shall contain the relevant documentary, testimonial and object evidence supporting its position, and shall specify the material dates relevant to the same and proof of service of the copy of the Comment/Opposition to the Adverse Party.
Section 17. Clarificatory Hearing on the Motion. Whenever in its discretion, the conduct of a clarificatory hearing on the motion to lift extended CDO is necessary, the Commission shall set the motion for hearing. The notice of hearing shall be addressed to all parties concerned and shall specify the time and date of the hearing.
Section 18. Resolution on the Motion. The motion shall be set for resolution by the Commission. If the Commission denies the motion to lift, the extended CDO shall continue to have force and effect.
Without need of filing a new application, the lifting of the extended CDO shall not preclude the issuance of another CDO, if after verification and investigation by the Commission, it is determined that the same acts complained of recommence within twelve (12) months from its lifting, subject to the penalties provided in Section 22 hereof. Beyond the said period, any future violation of the same adverse party shall warrant the filing of a new application for the issuance of a CDO.
RULE IV. MISCELLANEOUS PROVISIONS
Section 19. Publication. The fact that a CDO has been issued and extended, after giving the Adverse Party the opportunity to be heard, may be published when warranted by public interest as determined by the Commission.
Section 20. Separate Proceedings. The investigation by the CID or the compliance check or breach handling by the CMD shall be treated as a separate and distinct proceeding from the CDO proceeding.
Section 21. Cumulative Remedy. The remedy available under these Rules shall be cumulative and in addition to, not exclusive of or in substitution for, any rights or remedies available to the applicant under the DPA, its IRR or other related issuances: Provided, that when an applicant simultaneously or successively files an application for a temporary ban and for a CDO, the proceeding on the application for the temporary ban shall be suspended until the proceeding on the CDO is decided.
Section 22. Penalties for Non-Compliance. If upon monitoring and assessment, the Commission finds evidence of non-compliance, any natural or juridical person in violation of the orders issued under this Circular shall be subjected to fines and penalties as may hereafter be prescribed by the Commission; contempt proceedings, as may be permitted by law, before the appropriate court; and/or such other actions as may be available to the Commission.
Section 23. Application of Rules of Court. The Rules of Court shall apply in a suppletory character, and whenever practicable and convenient.
Section 24. Interpretation. These Rules shall be interpreted in a manner mindful of the rights and interests of the data subject while ensuring the free flow of information to promote innovation and growth.
Section 25. Separability Clause. In the event that any provision or part of these Rules is declared unauthorized or rendered invalid, those provisions not affected by such declaration shall remain valid and in force.
Section 26. Transitory Provision. These Rules shall govern all cases brought after its effectivity and further proceedings in pending cases, except to the extent that their application would not be feasible or cause injustice to any party.
Section 27. Effectivity. These Rules shall take effect fifteen (15) days after publication in a newspaper of general circulation.
Approved: 06 October 2020
Sgd.
RAYMUND ENRIQUEZ LIBORO
Privacy Commissioner
Sgd.
LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner
Sgd.
JOHN HENRY D. NAGA
Deputy Privacy Commissioner