Order Text
CBP,
Complainant,
-versus- NPC Case No. 16-004
ORANI WATER DISTRICT (formerly CDB and SRM),
Respondents.
x----------------------------------------------------x
ORDER
AGUIRRE, D.P.C.:
This Order refers to the compliance of Respondents with this Commission’s Decision1 involving a Complaint2 filed by CBP (Complainant) against CDB and SRM who were officers of the Orani Water District (OWD), for the alleged violations of R.A. 10173 (Data Privacy Act). Considering that they are no longer connected to OWD due to the latter’s change in management, SRM and CDB are dropped from the case which shall now continue to proceed with OWD as the Respondent.
The Facts
On 15 December 2017, this Commission issued a Decision with the following dispositive portion:
WHEREFORE, premises considered, CDB and SRM are STERNLY WARNED that repetition of the same or similar acts will be dealt with more severely. Respondents are hereby further ordered:
- To coordinate with the head of agency of Orani Water District and submit to the National Privacy Commission the organization’s privacy notice and existing privacy policies pertaining to their employees within fifteen (15) days from receipt of this Decision; and
- To submit to the National Privacy Commission proof of their attendance or participation in any orientation on the Data Privacy Act or similar events within sixty (60) days from receipt of this Decision.
On 25 January 2018, OWD filed a Compliance3 with this Commission where it submitted: (1) the office memorandum4 dated 18 May 2017 from BPA, OWD General Manager, requiring all employees to sign an Employee Non-Disclosure and Confidentiality Agreement; and (2) the signed Employee Non-Disclosure and Confidentiality Agreements including those of Ms. Milante and Mr. Buenaventura.
On 22 July 2019, this Commission, through its Enforcement Division (EnD), sent a letter5 to SRM and CDB informing them that they have not submitted their organization’s privacy notice and existing privacy policies pertaining to OWD’s employees, and proof of attendance or participation in any orientation on the Data Privacy Act or similar events. They were also advised to immediately comply with the directives of the Commission En Banc in the Decision dated 15 December 2017 to avoid further liabilities under the law. However, SRM replied to inform the Commission that they are no longer connected with OWD due to a change in management.6
On 10 August 2020, the EnD sent a letter7 to EFS, the new OWD General Manager, advising him to comply with the directives of the Commission En Banc in its Decision dated 15 December 2017 by submitting copies of the organization’s privacy notice and existing privacy policies pertaining to its employees, as well as proof of attendance or participation of the employees in any orientation on the Data Privacy Act or similar events within thirty (30) days from receipt of said letter.
On 16 September 2020, EFS wrote a letter8 to this Commission, through the Legal and Enforcement Office (LEO), informing it that there was a change of management within the OWD as a result of a Joint Venture Agreement (JVA). He also stated that there was no proper turn-over of documents by the previous management and that despite having exerted all efforts to locate any existing privacy notice and policies of OWD from the available files in the office, OWD cannot locate the same. Thus, OWD may not be able to submit the required documents. He also admitted that OWD’s personnel and employees have not attended any orientation regarding data privacy as of the writing.
On 24 September 2020, the EnD sent another letter9 to OWD emphasizing its obligation to comply with the orders of the Commission in a Decision dated 15 December 2017. It was also advised to go through this Commission’s website to check various resources that could help create their privacy manual and privacy notices. OWD was also urged to comply and submit its compliance report within thirty (30) days from receipt of said letter to avoid further liabilities under the law.
On 16 October 2020, EFS wrote a letter10 to EnD stating that OWD has started seeking and soliciting information from some of its fellow water districts for references that it can use to design its organization’s privacy notice and privacy policies pertaining to their employees. Moreover, OWD has appointed a Data Protection Officer (DPO) as an immediate action to adhere to the legal requirements of the Data Privacy Act. Lastly, it has already checked the Commission’s website and browsed over the page on the Creation of Privacy Manual.
OWD states in its letter:
[W]e would like to respectfully appeal for your utmost consideration on our ongoing undertakings to fully comply with the directive set in the decision issued by the Commission En Banc.
xxx
[W]e humbly request for your guidance and assistance through the conduct of trainings and capacity building activities for our personnel.11
Discussion
Section 7 of the Data Privacy Act provides for the functions of the Commission, thus:
(a) Ensure compliance of personal information controllers with the provisions of this Act;
(b) Receive complaints, institute investigations, facilitate or enable settlement of complaints through the use of alternative dispute resolution processes, adjudicate, award indemnity on matters affecting any personal information, prepare reports on disposition of complaints and resolution of any investigation it initiates, and, in cases it deems appropriate, publicize any such report: Provided, That in resolving any complaint or investigation (except where amicable settlement is reached by the parties), the Commission shall act as a collegial body. For this purpose, the Commission may be given access to personal information that is subject of any complaint and to collect the information necessary to perform its functions under this Act;
(c) Issue cease and desist orders, impose a temporary or permanent ban on the processing of personal information, upon finding that the processing will be detrimental to national security and public interest;
(d) Compel or petition any entity, government agency or instrumentality to abide by its orders or take action on a matter affecting data privacy;
(e) Monitor the compliance of other government agencies or instrumentalities on their security and technical measures and recommend the necessary action in order to meet minimum standards for protection of personal information pursuant to this Act;
(f) Coordinate with other government agencies and the private sector on efforts to formulate and implement plans and policies to strengthen the protection of personal information in the country;
(g) Publish on a regular basis a guide to all laws relating to data protection;
(h) Publish a compilation of agency system of records and notices, including index and other finding aids;
(i) Recommend to the Department of Justice (DOJ) the prosecution and imposition of penalties specified in Sections 25 to 29 of this Act;
(j) Review, approve, reject or require modification of privacy codes voluntarily adhered to by personal information controllers: Provided, That the privacy codes shall adhere to the underlying data privacy principles embodied in this Act: Provided, further, That such privacy codes may include private dispute resolution mechanisms for complaints against any participating personal information controller. For this purpose, the Commission shall consult with relevant regulatory agencies in the formulation and administration of privacy codes applying the standards set out in this Act, with respect to the persons, entities, business activities and business sectors that said regulatory bodies are authorized to principally regulate pursuant to the law: Provided, finally, That the Commission may review such privacy codes and require changes thereto for purposes of complying with this Act;
xxx.12
This Commission ordered SRM and CDB to submit OWD’s privacy notice and existing privacy policies, and proof of their attendance or participation in any orientation on the Data Privacy Act or similar events as early as 15 December 2017.13 On 22 July 2019, a letter14 was sent advising them to immediately comply with the directives of this Commission. On 10 August 2020, this Commission sent another letter15 to EFS reiterating its directives for OWD. On 24 September 2020, this Commission again sent a letter16 to Mr. Santos urging OWD to comply and submit their compliance report.
However, despite the Decision and the three (3) letters directing them to comply with the orders of this Commission, OWD has not fully complied to this date. Instead, it submitted documents which are not responsive to this Commission’s directives, and explained that there was a change of management17 and there was no proper turn-over of documents from the previous management.18
It is noteworthy that this Commission’s Orders to OWD were made almost three (3) years ago. OWD has had more than enough time to comply with those directives. In fact, this Commission sent three (3) additional letters reiterating its previous orders. While this Commission acknowledges that there was a change in management, the new management should have conducted the proper due diligence when it entered into a JVA. OWD should have informed itself of the status of this case so that it could have required the proper turn-over of the necessary documents. Despite all these, the new management of OWD has also had more than enough time to comply with this Commission’s Orders. Had the new management started their compliance efforts when EnD wrote to OWD on 22 July 201919 or even on 10 August 2020,20 it could have already come up with the necessary assessments and documents for its privacy manual.
Be that as it may, taking into consideration the latest actions of OWD, it is given a final opportunity to comply with this Commission’s directives.
WHEREFORE, premises considered, OWD is hereby ordered to SUBMIT the final draft of its Privacy Manual and Notices within thirty (30) days from receipt of this Order.
SO ORDERED.
Pasay City, Philippines 19 November 2020.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Copy furnished:
CBP Complainant
CDB SRM Former Respondents Orani Water District
EFS General Manager Orani Water District
COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT
Footnotes
-
Decision dated 15 December 2017. ↩
-
Complaint Affidavit dated 25 November 2016. ↩
-
Compliance with NPC Case No. 16-004 dated 25 January 2018. ↩
-
Signing of Employee Non-Disclosure and Confidentiality Agreement dated 18 May 2017. ↩
-
Letter to Mr. CDB and SRM with the subject: Compliance with Decision date 15 December 2017 “CBP v. CDB and SRM” NPC Case No. 16-00. Dated 22 July 2019. ↩
-
Fact-Finding Report dated 09 November 2020. ↩
-
Letter to EFS, General Manager, through the Data Protection Officer with the subject: Compliance with Decision dated 15 December 2017 “CBP v. CDB and SRM” NPC Case No. 16-00. Dated 10 August 2020. ↩
-
Letter to MTP Dated 16 September 2020. ↩
-
Letter to EFS, General Manager with subject Compliance with Decision dated 15 December 2017 “CBP v. CDB and SRM” NPC Case No. 16-00. Dated 24 September 2020. ↩
-
Letter to MTP, Dated 16 October 2020. ↩
-
Ibid. ↩
-
Emphasis supplied. ↩
-
Supra note 1. ↩
-
Supra note 5. ↩
-
Supra note 7. ↩
-
Supra note 9. ↩
-
Supra note 8. ↩
-
Ibid. ↩
-
Supra note 5. ↩
-
Supra note 7. ↩