Order Text
IN RE: PILIPINAS2022.PH CID CDO 21-003
x----------------------------------------------------x
ORDER
This resolves the Application for Issuance of Cease and Desist Order (Application) dated 11 June 2021 of the Complaints and Investigation Division (CID) of the National Privacy Commission (NPC), praying for this Commission to issue a Cease and Desist Order against the PiliPinas2022.ph (Pilipinas2022), viz:
WHEREFORE, in view of the foregoing premises, it is most respectfully prayed that the instant application for CEASE AND DESIST ORDER against PiliPinas2022.ph be GRANTED and consequently require it to stop processing the personal information in its possession in order to preserve and protect public interest and the rights of the data subjects.
Pilipinas2022 is an online political survey platform designed to gather and display data to serve as an active pulse for the upcoming 2022 elections. It collects personal information from participants, particularly their full name, complete address, and mobile phone number, to be allowed to cast a vote and participate in the survey.1
The NPC is an independent body created to administer and implement the provisions of the Data Privacy Act of 2012 (DPA). As provided in Section 7 of the DPA, the NPC has Rule Making, Advisory, Public Education, Compliance and Monitoring, Complaints and Investigation, and Enforcement powers2 to enable it to protect the fundamental human right of privacy while ensuring the free flow of information to promote innovation and growth.3
Section 7(b) of the DPA specifically states that it is the mandate of the NPC to:
“(b) Receive complaints, institute investigations, facilitate or enable settlement of complaints through the use of alternative dispute resolution processes, adjudicate, award indemnity on matters affecting any personal information, prepare reports on disposition of complaints and resolution of any investigation it initiates, and, in cases it deems appropriate, publicize any such report: Provided, That in resolving any complaint or investigation (except where amicable settlement is reached by the parties), the Commission shall act as a collegial body. For this purpose, the Commission may be given access to personal information that is subject of any complaint and to collect the information necessary to perform its functions under this Act;” (Emphasis supplied)
In addition, the DPA explicitly provides for the Commission’s power to issue Cease and Desist Orders (CDO):
Section 7(c). Issue cease and desist orders, impose a temporary or permanent ban on the processing personal information, upon finding that the processing will be detrimental to national security and public interest.
This was reiterated in the Implementing Rules and Regulations (IRR) of the DPA:
Section 9. Functions. The National Privacy Commission shall have the following functions:
xxx
f. Enforcement. The Commission shall perform all acts as may be necessary to effectively implement the Act, these Rules, and its other issuances, and to enforce its Orders, Resolutions, or Decisions, including the imposition of administrative sanctions, fines, or penalties. This includes:
xxx
- Issuing cease and desist orders, or imposing a temporary or permanent ban on the processing of personal data, upon finding that the processing will be detrimental to national security or public interest, or if it is necessary to preserve and protect the rights of data subjects.
In the exercise of its rule-making power and to flesh out the provision above, the NPC issued NPC Circular 20-02, otherwise known as the Rules on the Issuance of Cease and Desist Order on 06 October 2020. Section 5 thereof provides who may apply for CDO, thus:
“Section 5. Filing of Application. – An action for the issuance of a CDO may be commenced upon the filing with the Commission of an application in writing, verified and under oath, by any of the following applicants:
A. the CID, through its sua sponte investigation or the CMD through its conduct of compliance checks and handling of breach notifications, if there is a finding that the grounds for the issuance of the CDO are present; or
B. the Aggrieved Party, either attached to a complaint or as an independent action, with payment of filing fees in accordance with the Rules of Procedure of the NPC, and upon recommendation by the CID after its assessment that the application is sufficient in form and substance.” (Emphasis supplied)
Section 4 of the same Rules provides for the grounds to be established by the applicant for the Commission to issue a CDO, viz:
- The Adverse Party is doing, threatening or is about to do, is procuring to be done, some act or practice in violation of the DPA, its IRR, or other related issuances;
- Such act or practice is detrimental to national security or public interest, or the CDO is necessary to preserve and protect the rights of a data subject; and
- The commission or continuance of such act or practice, unless restrained, will cause grave and irreparable injury to a data subject.
The Application details that Pilipinas2022 failed to comply with the general data privacy principles of Transparency, Legitimate Purpose, and Proportionality; it committed gross disregard and violation of the rights of the data subjects; and the continuance operation of Pilipinas2022 may cause grave and irreparable injury to the affected data subjects. The Report provides:
“First, the initial investigation and the technical report have shown that PiliPinas2022.ph does not meet the lawful criteria for processing of personal information and has failed to comply with the general data privacy principles of transparency, legitimate purpose and proportionality. It’s processing of the collected personal information is not being done fairly and lawfully, which is a blatant violation of the DPA and its IRR.
Second, PiliPinas2022.ph’s processing of personal information is detrimental to national security or public interest as it masquerades as an online political survey platform but does not specify all of their purposes in collecting the data, does not provide a clear and complete privacy notice sufficient to solicit an informed consent, and does not disclose their identity as a PIC. Not only is the data subject misinformed as to the true purpose and further processing of their personal information, but they are also left in the dark as to who will be held accountable in case their personal information is used for unlawful purposes. These acts are in gross disregard and violation of the rights of the data subjects.
Third, PiliPinas2022.ph’s continued operation, given the dangers as discussed above to which the personal information in its possession is exposed to, is a palpable risk that can cause grave and irreparable injury to affected data subjects.
Hence, based on the foregoing, it is clear that the grounds for the issuance of a cease and desist order are present, pursuant to Section 4 of NPC Circular No. 20-02.”
These findings exhibit that the entity is doing, threatening, or about to do, acts and practices which constitute a violation of the DPA. Furthermore, considering that, as of the date of the Application, the Pilipinas2022 website remains to be accessible online, it is necessary for the Commission to preserve and protect the rights of the data subjects involved by restraining the continuing processing of personal data by Pilipinas2022 including personal information that Pilipinas2022 already processed.
WHEREFORE, premises considered, PiliPinas2022.ph is hereby ordered to:
- File a COMMENT, within ten (10) days from receipt of this Order, on the allegations in the attached Application for Issuance of Cease and Desist Order, pursuant to Section 9 of the NPC Circular No. 20-02; and
- CEASE AND DESIST from the processing of personal data on their database until the Commission issues a decision on the submission of the Comment, which shall be made no more than thirty (30) days from the expiration of the period to file a Comment or of the termination of the clarificatory hearing if one is held, pursuant to Section 11 of the NPC Circular No. 20-02.
Furthermore, the NATIONAL TELECOMMUNICATIONS COMMISSION is hereby enjoined to take down the website of PiliPinas2022.ph immediately upon receipt of this Order.
SO ORDERED.
City of Pasay, Philippines. 16 June 2021.
JOHN HENRY D. NAGA Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
Copy furnished:
PILIPINAS2022.PH
NATIONAL TELECOMMUNICATIONS COMMISSION
COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT