NPC Issuance Wiki

CID Case No. 18-D-012: JBD v. JI and VVV

Issued Order

Order Text

JBD,

Complainant,

-versus-

JI and VVV,

Respondent.

x--------------------------------------------x

ORDER

AGUIRRE, D.P.C.:

Before this Commission is a Complaint filed by Complainant JBD against the respondents JI and VVV for an alleged violation of R.A. 10173 (“Data Privacy Act”).

Facts

Complainant here alleges that his Social Security System (“SSS”) Employment and Payment history were illegally obtained by Respondent JI, his common law spouse, and her lawyers. He learned about this when he received a Position Paper against him with attached print-outs from the SSS. These contained his birthdate and SSS number, as well as his employment history and actual premiums.1 This Position Paper was filed with the Professional Regulation Commission (“PRC”) in connection with an ongoing case involving him and Respondent JI.

Complainant initially filed a complaint before the SSS. Upon inquiring with SSS, he was told by its Fraud and Legal Department that this data was not processed within the vicinity of the agency, and that an unauthorized individual accessed the SSS data portal where his work history and premiums were collected.2

Upon the filing of this Complaint with the National Privacy Commission, the parties were called for a Discovery Conference. Complainant and Respondent VVV were present, but Respondent JI failed to appear.

During the Discovery Conference, the parties manifested that they were not willing to enter into an amicable settlement. They further manifested that there is no need to secure evidence from each other to further their case.

Hence, an Order was issued by the Commission on 12 July 2018 directing Respondents to file their responsive Comment until 22 July 2018. Complainant was in turn given ten (10) days from the receipt of the Comment to file his Reply.

Arguments of the Parties

In his Complaint, Complainant argues that his SSS personal information was disclosed by Respondent VVV to PRC without his consent and for unauthorized purposes. He asserts that the contents of his SSS personal data were not authorized and authenticated by the organization since the annexes are pictures only from a personal computer of a certain individual who has access to the SSS data portal. He also alleges that he gave no consent for Respondents to acquire the sensitive personal information they presented as evidence in the PRC case.3 He prays for moral damages for the anxiety, sleepless nights, and extreme emotional pain that this caused.4

In their Comment, Respondent VVV asserts that he and his law firm are not covered by the Data Privacy Act, stating thus:

Under [Sections 3 and 4] of the Data Privacy Act, it can be deemed that Respondent VVV and Law Firm is not covered nor violated any provisions in [The Data Privacy Act] for the reason that respondents are not considered as personal information controller and processors… It is clear that Respondent VVV and Law Firm are not involved in personal information and even not [sic] considered as personal information controller and processors.5

He asserts that the Complaint must be dismissed outright, following the provisions of NPC Circular 16-04:

Section 12. Outright Dismissal – The Commission may dismiss outright any complaint on the following grounds:

b. The complaint is not a violation of the Data Privacy Act or does not involve a privacy violation or personal data breach;

xxx

d. There is insufficient information to substantiate the allegations in the complaint.6

They likewise argue that Complainant did not comply with the Exhaustion of Remedies provision under the same Circular:

Assuming without necessarily admitting that the complaint falls within the scope of this Honorable Commission, it is seemingly obvious that the Complainant did not comply with the exhaustion of remedies as there is no evidence showing that he informed, in writing, the personal information controller or concerned entity of the privacy violation or personal data breach to allow for appropriate action.7

Respondent VVV also raises the fact that Complainant attached a photocopy of pictures as his sole evidence and that it was not authenticated in accordance with the Rules on Electronic Evidence.8 On the same note, he cites the best evidence rule:

A photocopy, being a mere secondary evidence, is not admissible unless it is shown that the original is unavailable… Complainant cannot claimed [sic] thereafter that he was not given any time or opportunity to have his evidence authenticated as he was advised of his right to the assistance of counsel on the Order to Confer for Discovery dated 29 June 2018. Likewise, during the discovery conference dated 12 July 2018 complainant waived his right in connection to said authentication of evidence.9

According to Respondent VVV, lawyers act as mere agents to their clients and the pieces of evidence are provided by the client.

Respondent VVV asserts he acted as a substitute counsel at the time he handled the Respondent JI’s case with the PRC. Being a substitute counsel and due to time constraint, he states that he only relied on the pieces of evidence presented by his client, Respondent JI.10

Respondent JI, on the other hand, has not filed a Responsive Comment despite being copy furnished the Order to Confer for Discovery and the Order to file a Responsive Comment. It was manifested as well during the Discovery Conference that Respondent VVV is not representing Respondent JI in this case.11

In the Verified Reply, Complainant asserts that the allegations constitute a violation of the Data Privacy Act:

  1. [R]espondents violated the said data privacy law. The Social Security System disclosed that SSS premiums and work history of the Complainant were not processed within the vicinity of the agency. Hence, a certain individual, according to the Fraud and Legal Department, has unlawfully accessed the SSS data portal so the work history and premiums were collected.12

Complainant states that the Order by the Commission to the parties to confer for Discovery justified that the complaint reviewed by the Honorable Commission offers substance, hence their findings in the Order that the “allegations are sufficient.”13

As to the issue that the evidence is a mere photocopy that was not authenticated, Complainant states:

We respectfully emphasize that the SSS employment – Work history and actual premiums presented in the Honorable Board did not come from the Complainant but from the Respondents, JI and VVV, instead.14

For Complainant, both the lawyer and his client are liable under the Data Privacy Act. He states thus:

  1. In their PRC Position Paper, they [used] unlawfully and maliciously disclosed the Complainants SSS details. Their common position to use the same is unlawful under the above law. They are both bound by the same.15

Moreover, he asserts that the lawyer should be considered as a personal information controller, to wit:

  1. NPC has jurisdiction over the respondent [Respondent] VVV since he is considered as a personal information controller for instructing another person to collect, hold, process, use, transfer and disclose personal information on his behalf. As such, he should have provided the Honorable Commission on when, where, who, and how they were able to unlawfully obtained [sic] Complainant’s SSS personal information.16

Issues

a. Whether the Complaint should be dismissed for non-exhaustion of remedies; b. Whether Complainant violated the Best Evidence Rule, precluding the Commission from taking cognizance of the photocopies of the SSS documents; c. Whether the Respondent VVV should be treated as an agent and not a personal information controller; d. Whether the Complaint should be dismissed for insufficient substantiation of the allegations in the Complaint; and e. Whether Respondents committed unauthorized processing of Complainant’s SSS employment history and actual premiums.

Discussion

Respondent VVV argues that Complainant failed to exhaust remedies available to him as they were not informed of the alleged violation prior to the filing of the instant case. The alleged privacy violation subject of this case supposedly resulted from the access and disclosure to the PRC of Complainant’s SSS documents without his knowledge and consent. Contrary to the contention of Respondent VVV, to require Complainant to first exhaust his remedies with the Respondents would be unreasonable. First, Respondents already accessed and submitted the SSS documents of Complainant as evidence in the PRC case. These facts were never disputed. Second, there is nothing in the records or the statements and submissions of the Respondents show either their willingness or capability to provide an adequate remedy to Complainant. The requirement to exhaust available remedies does not contemplate exercises in futility that only delay justice for data subjects whose rights are violated.

In addition, the Commission emphasizes that this requirement in Circular 16-04 also provides that:

The National Privacy Commission may waive any or all of the requirements of this Section, at its discretion, upon good cause shown, or if the complaint involves a serious violation or breach of the Data Privacy Act, taking into account the risk of harm to the complainant.17

Respondent VVV also claims that Complainant violated the best evidence rule, citing the fact that the evidence provided showing the alleged SSS employment history and actual premiums is a mere photocopy. The Commission reminds Respondent that the best evidence rule applies only when the subject of the inquiry is the contents of the document.18 In this case, the intent of Complainant in submitting the photocopy of the SSS employment history and actual premiums is to show that his personal and sensitive personal information was used as evidence in a PRC case without his knowledge and consent. The accuracy of the SSS premiums or the details of Complainant’s employment history is not in dispute.

The Commission notes that the fact that Complainant’s SSS documents were accessed and used without his consent was never disputed by Respondents.

These documents contained not just his employment history and premiums but his date of birth and SSS Number as well. These fall squarely under the enumeration of what is considered sensitive personal information under the Data Privacy Act:

(l) Sensitive personal information refers to personal information:

(1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;

xxx

(3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns;19

Absent any basis to process such sensitive personal information,20 the access and use of Complainant’s SSS documents as attachments in a position paper may constitute unauthorized processing under Section 25 of the Data Privacy Act.

In the interest of giving due course to Complainant’s claims, the Commission resolves to order Complainant to provide the following:

  1. A Certified True Copy of the Position Paper containing the subject SSS documents filed with the PRC; and
  2. Documents to substantiate the allegations made in Paragraph 10 of the Verified Reply which refers to the findings of the SSS Fraud and Legal Department.

The foregoing is pursuant to NPC Circular 16-04 which provides that the Commission may, on the basis of its review of the evidence, order the conduct of a clarificatory hearing if in its discretion, additional information is needed to make a Decision.21

WHEREFORE, all the above premises considered, the Commission hereby ORDERS Complainant JBD to submit the documents enumerated above within fifteen (15) days from receipt of this Order. The failure of Complainant to submit such documents shall cause this case to be submitted for resolution.

SO ORDERED.

Pasay City, 21 May 2020.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

Concurring:

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

JOHN HENRY DU NAGA Deputy Privacy Commissioner

Copy furnished:

JBD Complainant

JI Respondent

VVV Respondent

ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Records, p. 9-10. ↩

  2. Id., p. 59. ↩

  3. Id., p. 5. ↩

  4. Ibid. ↩

  5. Id., p. 48. ↩

  6. Section 12, NPC Circular 16-04. Dated 15 December 2016. ↩

  7. Id., p. 49-50. ↩

  8. Id., p. 50-51. ↩

  9. Id., p. 51. ↩

  10. Id., p. 51. ↩

  11. Id., p. 54. ↩

  12. Id., p. 59. ↩

  13. Ibid. ↩

  14. Records, p. 60. ↩

  15. Id., p. 61. ↩

  16. Ibid. ↩

  17. Supra note 6 at Section 4. ↩

  18. Section 3, Rule 130, Rules of Court. ↩

  19. Section 3 (l), R.A. 10173. Emphasis supplied. ↩

  20. Section 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases: (a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing; (b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information; (c) The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing; (d) The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, That such processing is only confined and related to the bona fide members of these organizations or their associations: Provided, further, That the sensitive personal information are not transferred to third parties: Provided, finally, That consent of the data subject was obtained prior to processing; (e) The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured; or (f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority. ↩

  21. Supra note 6, at Section 21. ↩

Backlinks

  • No backlinks found