Order Text
IN RE: LISENSYA.INFO, INITIATED AS AN INDEPENDENT NPC INVESTIGATION INTO THE POSSIBLE DATA PRIVACY VIOLATIONS COMMITTED BY THE WEBSITE LISENSYA.INFO.
x----------------------------------------------------x
ORDER
LIBORO, P.C.:
On 12 November 2020, this Commission issued a Cease and Desist Order (Cease and Desist Order) against the Lisensya.Info website and its owner/operator, respondents Jose Minao and Billy James Jimena (Respondents) for unauthorized processing and unauthorized access of personal information and sensitive personal information which are violations of the Data Privacy Act of 2012 (DPA), with the following dispositive portion:
WHEREFORE, premises considered, Lisensya.Info and its owner/operator, JOSE MINAO, BILLY JAMES JIMENA and other responsible officers are hereby ordered to:
File a COMMENT, within ten (10) days from receipt of this Order, on the allegations in the attached Application for Issuance of Cease and Desist Order, pursuant to Section 9 of the NPC Circular No. 20-02; and
CEASE AND DESIST from the processing the personal and sensitive personal information in its possession, until the Commission issues a decision on the submission of the Comment, which shall be made no more than thirty (30) days from the expiration of the period to file a Comment or of the termination of the clarificatory hearing if one is held, pursuant to NPC Circular No. 20-02.
Furthermore, the NATIONAL TELECOMMUNICATIONS COMMISSION is hereby enjoined to take down the website Lisensya.Info immediately upon receipt of this Order.
SO ORDERED.
From the time the Cease and Desist Order was first served to the Respondents, the following were the developments:1
-
The National Telecommunications Commission (NTC) issued a Memorandum dated 16 November 2020 directing Internet Service Providers (ISPs) to block access to Lisensya.Info and it was sent through electronic mail to various ISPs on 20 and 23 November 2020.
The Memorandum directs ISPs to submit a report to the NTC of its actions within five (5) days from receipt of the same.
As of 25 November 2020, the NTC has not yet provided a report on the response of the ISPs to the Memorandum it issued.
-
As of 24 November 2020, Lisensya.Info has already been flagged by Google and Firefox. Upon accessing the site through Google Chrome, users can see a security warning saying that Google Safe Browsing recently detected phishing activities on Lisensya.Info.
Unlike in the previous weeks when users can still access the site upon ignoring the security warning, users who choose now to proceed despite the warning will be directed to a Youtube video. The same happens when users use browsers without a security warning like Safari. Some users also reported that upon accessing the site, they are directed to a statement that “Lisensya.Info’s server IP address could not be found.”
From the above, it can be concluded that Lisensya.Info is no longer easily accessible to the general public.
Section 12 of NPC Circular 20-02 or the “Rules on the Issuance of Cease and Desist Order” provides:
Section 12. Decision on the Issued CDO. – If after giving the Adverse Party the opportunity to be heard, it appears that the applicant is entitled to have the act or practice enjoined and that there is a need for the extension of the issued CDO, the Commission shall extend its effectivity, otherwise, the same shall be lifted.
The decision whether to extend or lift the issued CDO shall be made no later than thirty (30) days from the expiration of the period for the Adverse Party to file a comment or the termination of the clarificatory hearing if one is held. In the event that the Commission fails to render its decision within the said period, the CDO shall be deemed automatically lifted.
The Cease and Desist Order was first served to the Respondents through electronic mail on 12 November 2020, while the revised Cease and Desist Order2 was sent through email the following working day on 16 November 2020.
The requirements of due process were complied with when the Respondents were apprised, through their last known email addresses, of the results of the Commission’s investigation and were given a reasonable opportunity to present their defense.3
In administrative proceedings, the filing of charges and giving reasonable opportunity for the person so charged to answer the accusations against him constitute the minimum requirements of due process. The essence of due process is simply to be heard, or as applied to administrative proceedings, an opportunity to explain one’s side, or an opportunity to seek a reconsideration of the action or ruling complained of.4
Nonetheless, following the Complaints and Investigation Division’s Supplemental Report which provided for a possible physical address of one of the respondents, Billy James Jimena, the physical copy of the Cease and Desist Order was also served to Respondent Jimena’s physical address on 26 November 2020. As of this writing, there is still no registry return receipt. On the other hand, Jose Minao’s address is still left unknown because of limited information on the said person.
From the foregoing, the Respondents had until 22 November 2020 to file a Comment. From that period, the Commission has thirty (30) days or until 22 December 2020 to decide whether to extend or lift the issued Cease and Desist Order.
This Commission hereby resolves to extend the Cease and Desist Order against the Respondents as owner/operator of the Lisensya.Info website, as the Respondents failed to counter the allegations made therein.
Furthermore, the Commission orders the publication of the Cease and Desist Order and this Order extending the same in the NPC website and its social media channels in order to apprise the public regarding the said website and further protect the rights of the data subjects.
Section 12 of NPC Circular 20-02 provides:
Section 19. Publication. – The fact that a CDO has been issued and extended, after giving the Adverse Party the opportunity to be heard, may be published when warranted by public interest as determined by the Commission.
WHEREFORE, premises considered, the Cease and Desist Order dated 12 November 2020 issued against Lisensya.Info and its owner/operator, JOSE MINAO, BILLY JAMES JIMENA and other responsible officers is hereby extended until modified or lifted by the Commission upon showing that the factual or legal basis for which it was issued no longer exists.
The Enforcement Division of NPC is hereby ordered to submit the necessary compliance report within the time prescribed in NPC Circular 20-02 for monitoring purposes on the enforcement action on Lisensya.Info and its owner/operator.
SO ORDERED.
City of Pasay, Philippines; 17 December 2020.
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
WE CONCUR:
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Footnotes
-
Memorandum dated 17 and 25 November and 15 December 2020 of the Enforcement Division. ↩
-
Copy furnished portion of the Cease and Desist Order was amended to reflect personal information of recipients. ↩
-
Memorandum dated 17 November 2020 of the Enforcement Division. ↩
-
Primanila Plans, Inc. vs. SEC (G.R No. 193791, August 6, 2014). ↩