Order Text
BOA,
Complainant,
-versus- NPC Case No. 18-130 (Formerly NPC Case No. 18-I-130) For: Violation of the Data Privacy Act of 2012
HSBC PHILIPPINES,
Respondent.
x----------------------------------------------------x
ORDER
AGUIRRE, D.P.C.:
This refers to an Order1 by the Complaints and Investigation Division (CID) of this Commission which required the production of certain documents previously requested by Complainant BOA (Complainant) from Respondent HSBC Philippines (Respondent) during a Discovery Conference2 pursuant to the Complaint in this case.
The Facts
On 18 September 2018, the CID received a Complaint3 from Complainant via its online complaints-assisted portal who reported that there was a leakage of his personal and private information. He reported a change of his credit card information without his authority.
An Order to Confer for Discovery4 was scheduled on 14 November 2018 for the parties to discuss whether discovery of information and of electronically-stored information will be sought, the issues relating to preservation of information, the period to produce the information, the method of asserting and preserving claims of privilege information, confidentiality, the proprietary status of information, the appropriateness of allocating expenses of production of information, and any other issues relating thereto. Both parties were present but only the Complainant filed a Discovery Conference Report.5
In the Discovery Conference Report,6 the Complainant listed the documentary or electronically-stored information needed from the Respondent, to wit:
- Sworn Statement from the staff of HSBC who made the alteration and modification in his account;
- Rules and regulations as to how clients can change their personal information on file; and
- File or any record in case the Complainant’s information was linked or forwarded to a third party.
On 23 November 2018, the CID received the Complaint Affidavit7 of the Complainant formally charging the Respondent for violation of the Data Privacy Act in relation to the unauthorized changes, modification, and alteration of his two (2) credit card accounts, namely, HSBC GOLD Visa and HSBC RED MasterCard.
On 15 April 2019, an Order8 was issued by the CID requiring the Respondent to submit the above-mentioned documents requested by the Complainant. In addition, the CID also required the Respondent to submit its Privacy Management Program.
The Order9 also directed the Respondent to file a Responsive Comment with the following disposition:
Pursuant to Section 15 of NPC Circular No. 16-04, Respondent is also given a period of ten (10) days from the receipt of this Order to file a Responsive Comment to the Complaint and Supplemental Complaint, together with any supporting documents the respondent or respondents may have, including affidavits of any of the respondents’ witness, if any.
On 20 May 2019, the Respondent filed its Comment10 and submitted its Privacy Management Program. However, the documents requested by the Complainant were not submitted.11
Discussion
Section 14(a) of NPC Circular 16-0412 provides that:
The National Privacy Commission may issue an Order governing the discovery of electronically stored information pursuant to:
- a motion by a party seeking discovery of the information or from which discovery of the information is sought; or
- a stipulation of the parties and of any person not a party from which discovery of the information is sought.
The Order governing the discovery will cover the same matter a discovery conference report is to address. Absent exceptional circumstances, the National Privacy Commission may not impose sanctions on a party for failure to provide electronically stored information lost as a result of the routine, good-faith operation of an electronic information system.13
The Order of the CID specifically directed the Respondent to submit the subject documents as requested by the Complainant. The Respondent, however, opted to make of record its observation that the Discovery Conference Report attached to the Order was unsigned by its representative. It also argued that the Discovery Conference Report should have been issued by the Investigating Officer within five (5) days after the conference rather than the parties submitting their own respective Discovery Conference Reports as stated in the Order. Hence, it doubted the propriety of the circumstances surrounding the issuance of the Discovery Conference Report signed by the Complainant only.14
Be that as it may, the Respondent failed to take into consideration that there was already an Order from the CID, which it should have complied with accordingly. Regardless of the surrounding issues on the Discovery Conference Report as alleged by the Respondent, the fact remains that it was already ordered by the CID to submit the subject documents requested by the Complainant.
It is also noteworthy that in its Comment, Respondent did not object to the submission of the subject documents, which necessarily involves electronically-stored information. Section 14(c) of the same Circular provides that:
A party may object to discovery of electronically stored information from sources that the party identifies as not reasonably accessible because of undue burden or expense. In its objection the party shall identify the reason for the undue burden or expense. On motion to compel discovery or for a protective order relating to the discovery of electronically stored information, a party objecting to discovery under the next preceding paragraph bears the burden of showing that the information is from a source that is not reasonably accessible because of undue burden or expense.15
The Complainant essentially demands for the relevant information surrounding the alleged unauthorized alteration or modification of his credit card information which was done electronically. In fact, the Respondent has admitted that there was indeed an alteration thereof. The information relating to such incident was requested by the Complainant through the submission of the documents he listed in the Discovery Conference Report, in accordance with his rights under the Data Privacy Act and NPC Circular 16-04.
Respondent should have complied with the Order of the CID and submitted the documents to address the requests of the Complainant pertaining to the processing of his credit card information due to the alteration thereof rather instead of merely contending in its Comment that there was no eventual disclosure of the same. After all, the processing of personal data, which resulted in the alteration of Complainant’s credit card information, and the disclosure of the same are two (2) completely different matters.
WHEREFORE, premises considered, HSBC Philippines is ORDERED to:
- SUBMIT the documents requested by the Complainant and as directed by the Complaints and Investigation Division of this Commission in the Order dated 15 April 2019; and
- SHOW CAUSE in writing why it should not be subject to contempt proceedings, before the appropriate court, as permitted by law, for its failure to submit the same within the required period, and such other actions as may be available to this Commission.
These shall be submitted to the Commission within five (5) days from receipt of this Order.
SO ORDERED.
Pasay City, Philippines; 05 November 2020.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Copy furnished:
HSBC PHILIPPINES Respondent
BOA Complainant
COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT
Footnotes
-
Order dated 15 April 2019. ↩
-
Discovery Conference Report for the Complainant dated 14 November 2018. ↩
-
Complaint via online complaints-assisted portal dated 18 September 2018. ↩
-
Order to Confer for Discovery released on 06 November 2018. ↩
-
Fact-Finding Report dated 29 October 2020. ↩
-
Discovery Conference Report dated 14 November 2018. ↩
-
Complaint Affidavit dated 22 November 2018. ↩
-
Supra note 2. ↩
-
Ibid. ↩
-
Comment dated 20 May 2019. ↩
-
Supra note 5. ↩
-
NPC Circular 16-04. Rules of Procedure of the National Privacy Commission. Dated 15 December 2016. ↩
-
Emphasis supplied. ↩
-
Supra note 10. ↩
-
Emphasis supplied. ↩