NPC Issuance Wiki

NPC SS 21-006: In re: Wefund Lending Corporation (Temporary Ban Order)

Issued Order

Order Text

IN RE: WEFUND LENDING CORPORATION (JUANHAND) AND ITS RESPONSIBLE OFFICERS NPC SS 21-006

x----------------------------------------------------x

ORDER

This Commission resolves an Application for the Issuance of a Temporary Ban (Application for Temporary Ban) on the processing of personal data by Wefund Lending Corporation, the owner and operator of the online lending application, JuanHand, and its responsible officers (JuanHand). The matter is a sua sponte investigation initiated by the Complaints and Investigation Division (CID) of the National Privacy Commission (NPC).

On 09 June 2021, the CID submitted to the Commission the Fact-Finding Report (FFR) with Application for Temporary Ban against JuanHand. The CID recommended the Commission to:

  1. Grant the Application for the issuance of a temporary ban on the processing of personal data by the company as urgently required by public interest and rights of the data subjects; and

  2. Find the respondent, WEFUND LENDING CORPORATION, operator of JuanHand Application (JuanHand) and its responsible officers liable for violation of Sections 11, 16, 25 of the Data Privacy Act of 2012, NPC Circular 20-01, Section 3 (D) (4).

Other reliefs which are just and equitable under the premises are likewise prayed for.1

On 16 July 2021, the Commission issued an Order requiring JuanHand to submit within ten (10) days from its receipt a Position Paper on the Application for Temporary Ban.2

On 23 July 2021, the Commission attempted to personally serve the Order dated 16 July 2021 to JuanHand at its registered address. Personal service was unsuccessful, however, since JuanHand already moved out of its physical office.3

On 28 July 2021, by order of the Commission, the Order dated 16 July 2021 was served electronically to cs@juanhand.com, which is the email address listed on JuanHand’s website and mobile application.4

On 02 August 2021, the Commission received from JuanHand’s Data Protection Officer (DPO), Ms. NMA, a letter dated 01 August 2021 confirming receipt of the Order dated 16 July 2021 and requesting extension of time to submit the Position Paper. The DPO informed the Commission that while JuanHand moved out of its physical offices, it could still receive documents at their virtual office in the same building.5 Also, in an email to the Commission dated 04 August 2021, the DPO admitted that JuanHand received the Order dated 16 July 2021 on 30 July 2021. Counted from the date they admitted receiving the Commission’s Order, JuanHand had until 09 August 2021 to submit its Position Paper.6

On 09 August 2021, Atty. LAN, a lawyer purporting to represent JuanHand, visited the NPC’s office to insist that the Commission allow JuanHand to file its Position Paper until 12 August 2021 or ten (10) days from the time JuanHand acknowledged receipt of the Order dated 16 July 2021.7

On 10 August 2021, Atty. LAN entered his appearance as the counsel of JuanHand.8 He stated that there is no proof that the Order dated 16 July 2021 was “properly served” to JuanHand.9 He further alleged that he “volunteered to personally receive the subject [O]rder” to allow the Commission to acquire jurisdiction over the person of JuanHand and consequently, cause the ten-day period to submit the Position Paper to run.10 He also manifested that JuanHand shall submit its Motion to Properly Serve Order with Motion to Admit Position Paper Ad Cautelam (Motion) on 12 August 2021.11

On 12 August 2021, JuanHand submitted its Motion. In its Motion, JuanHand manifested that the Order dated 16 July 2021 was not “properly served” since JuanHand did not receive the Order by registered mail or in the email addresses registered with the Commission.12 In its Position Paper, JuanHand prayed:

WHEREFORE, it is most respectfully prayed that the honorable body, after review of the instant case, issue an order:

  1. dissolving and dismissing the application for the issuance of a temporary ban on the processing of personal data by the respondent company for lack of merit; and

  2. affirming and declaring the compliance made by the respondent company and its practices in managing the subject data to be in accordance with law.

Other relief just and equitable under the premises is likewise prayed for.13

Discussion

The Commission grants the Application for Temporary Ban on JuanHand’s Processing of Personal Data.

At the onset, the Commission notes that the period to submit the Position Paper lapsed on 09 August 2021. JuanHand submitted its Position Paper only on 12 August 2021 after the period to file had already lapsed.

Service by electronic means to a known electronic mail address is valid.

The Commission validly served the Order dated 16 July 2021 to JuanHand.

NPC Circular No. 2021-01 or the 2021 Rules of Procedure of the NPC (2021 NPC Rules of Procedure) permits service by electronic mail if the respondent’s whereabouts are unknown and if the respondent has a known electronic mail address. Section 5 of Rule III provides:

SECTION 5. Service by NPC to unknown respondent or respondent whose whereabouts are unknown. – x x x

In case the respondent has a known electronic mail address, service by the Commission may be effected upon him or her through electronic mail in lieu of publication.14

Section 6 of Rule III further provides that the Commission’s orders may be served by electronic mail:

SECTION 6. Service of judgments, orders, or resolutions of the NPC. – Judgments, orders, or resolutions shall be served either personally, by registered mail, by courier, or by electronic mail: Provided, that service by electronic mail shall only be made if the party recipient consents to such mode of service or by order of the Commission. x x x15

Here, the Commission attempted to serve the Order dated 16 July 2021 by personal means on 23 July 2021. However, the attempt proved futile since JuanHand moved out of its office premises. As a result, the Commission ordered the service of the Order dated 16 July 2021 by electronic mail to its known electronic mail address, cs@juanhand.com, the email address published on both its mobile application and website.

JuanHand’s contention that the Commission failed to acquire jurisdiction over the person of JuanHand because it did not receive the Order dated 16 July 2021 by registered mail or through its official email addresses registered with the Commission is erroneous.

There is no requirement under the 2021 NPC Rules of Procedure that the Commission should have served the Order dated 16 July 2021 by registered mail before resorting to service by electronic mail. The 2021 NPC Rules of Procedure permits service by electronic mail to a known email address of the respondent whose whereabouts are unknown. Since JuanHand moved out of its physical offices without any forwarding address, the Commission had no choice but to serve the Order dated 16 July 2021 by electronic mail to the email address available on JuanHand’s website and mobile application.

The Rules of Court is suppletory to the 2021 NPC Rules of Procedure.16 Section 15(2), Rule 13 of the 2019 Amendments to the 1997 Rules of Civil Procedure states when electronic service is deemed complete:

Section 15. Completeness of service. –

xxx

Electronic service is complete at the time of the electronic transmission of the document or when available, at the time that the electronic notification of service of the document is sent. Electronic service is not effective or complete if the party serving the document learns that it did not reach the addressee or person to be served. x x x17

On 28 July 2021, the Commission sent to JuanHand’s known electronic mail address the Order dated 16 July 2021, thus completing the valid service of the Order. With the completion of electronic service, the Commission validly served the Order dated 16 July 2021 and acquired jurisdiction over the person of JuanHand. This fact is supported by the admission of JuanHand’s DPO that they received a copy of the Order. Also, by this admission, the service of the Order on JuanHand electronically cannot be deemed ineffective or incomplete following the last sentence of Section 15 above.

Atty. LAN’s assertion that he be given a copy of the Order dated 16 July 2021 during his visit to the NPC’s offices for the Commission to acquire jurisdiction over the person of JuanHand is flawed. There was no basis for the Commission to accede to his request since he failed to show that he was an authorized representative of JuanHand. The Entry for Appearance was only filed a day after the request to personally receive the Order was made. In any event, considering that JuanHand’s DPO already admitted receiving the Order and communicated this to NPC prior to Atty. LAN’s visit, his offer to personally receive the Order is superfluous.

Nevertheless, in the interest of fully assessing the issue at hand, the Commission admits and considered JuanHand’s Position Paper dated 12 August 2021 in its decision to grant the Application for Temporary Ban.

All requisites for granting a temporary ban are satisfied.

Section 3 of Rule IX of the 2021 NPC Rules of Procedure provides for the requisites for temporary ban:

SECTION 3. Requisites for temporary ban. – A temporary ban on processing of personal data may be granted only when:

  1. it is necessary in order to preserve the rights of the complainant or to protect national security or public interest, or if it is necessary to preserve and protect the rights of data subjects;

  2. the motion shows facts entitling the complainant to the relief demanded;

  3. unless exempted from the payment of filing fees as provided for in these Rules, the complainant shall file with the NPC a bond in an amount to be fixed by the investigating officer executed in favor of the party or person so banned from processing personal data; and

  4. the parties are heard in a summary hearing.18

The first requisite for a temporary ban is present in this case. The FFR alleged that:

The capabilities of JuanHand’s system to read the borrower’s calendar events plus confidential information, add or modify calendar events, send email to guests without the owner’s knowledge, read borrower’s contacts, collect data from contacts and pinpoint the borrower’s approximate and precise location through its network and GPS are all unknown to the prospective borrower. The permission information (Annex “B”) is not shown to the users thru prompts or permissions when applying for a loan but was discovered by the CID Technical Team from the Google Play Store and not from the application itself x x x19

These undisclosed permissions violate the right of the data subjects to be informed of the data collected from them and the purpose for which they are collected. An analysis of JuanHand’s Position Paper, Service Agreement, and revised Privacy Policy shows that the issuance of the temporary ban is necessary to protect the rights of data subjects for the following reasons: (1) JuanHand’s preparation and submission of a “standalone and rectified Privacy Policy independent from the Service Agreement” does not necessarily change the manner it processes personal data; (2) JuanHand’s understanding and application of the criteria of lawful processing personal data, as gleaned from its revised Privacy Policy, is ambiguous; (3) JuanHand’s allegations in the Position Paper are inconsistent with its Service Agreement and revised Privacy Policy.

First, JuanHand alleged in its Position Paper that it prepared a “standalone and rectified Privacy Policy independent from the Service Agreement” to address the findings in the FFR.20 It further stated that the revised Privacy Policy “will be shown and given consent to by the users upon registration and loan application.”21 Since JuanHand did not state the specific findings in the FFR they were referring to, it appears that JuanHand submitted its revised Privacy Policy to refute the observation in the FFR that “no Privacy Policy was found on both JuanHand’s website and mobile application.”22

However, preparing and submitting a “standalone and rectified Privacy Policy” does not necessarily correct deficiencies in the processing of personal data. The purpose of the Privacy Policy, together with the Service Agreement, is to inform the data subject how JuanHand processes their personal information. The mere act of submitting a revised Privacy Policy is not sufficient to show that JuanHand effected changes in the manner it processes personal data. Moreover, while JuanHand provided the Commission with the revised Privacy Policy, it did not provide the same to the public, much less its data subjects. In fact, despite the claim in its Position Paper that “from the date of this Position Paper [12 August 2021], users may also review the new Privacy Policy in Juanhand App and Juanhand.com,”23 the link to the “Privacy Policy” on the JuanHand website still directs users to the original Service Agreement.24

The Commission investigated this claim. While it is true that the revised Privacy Policy was added to the mobile application as part of the latest update, it was difficult to find within the mobile application. Further, JuanHand failed to inform its users of the revised Privacy Policy. At the very least, JuanHand should have endeavored to state the revised Privacy Policy under the “What’s New” portion of Google Play Store to notify its users of the update in its mobile application and updated the redirect link to its Privacy Policy. It is as if JuanHand placed the revised Privacy Policy on its mobile application, without categorically informing users of the update, to claim that JuanHand is compliant with the DPA.

The Commission also notes that JuanHand did not submit a revised Service Agreement. This leads the Commission to reasonably conclude that JuanHand still uses the existing Service Agreement available on the website and its mobile application. The existing Service Agreement, however, is inconsistent with the revised Privacy Policy. JuanHand cannot simply revise the Privacy Policy while maintaining the contradictory practices discussed in the Service Agreement. The principles of the DPA should be reflected in both the revised Privacy Policy and Service Agreement and observed throughout JuanHand’s processing of personal data. As seen in their mobile application, it is the Service Agreement that potential borrowers are asked to consent to and is the one that governs the relationship between the borrower and JuanHand. A privacy policy, on the other hand, is simply a statement made to data subjects describing how the organization collects, uses, retains, and discloses personal information. In this case, what JuanHand’s revised Privacy Policy is describing is detached from the reality of what is provided in their Service Agreement.

Second, JuanHand does not have a clear understanding of the lawful criteria for processing under the DPA that it is relying on. As reflected in its Position Paper, JuanHand considers access to and modification of a user’s calendar as legitimate and proportional to the purpose stated in the Service Agreement.25 However, JuanHand is unclear on which specific purpose it pertains to. JuanHand subsequently states that “when users give consent to the Service Agreement, users are materially informed [of] the kind of personal information [that] shall be processed in compliance with [S]ection 16(a) of the DPA and [users] have given consent to the above functions”.26 This statement is, at best, confusing.

The primary contract entered into by JuanHand and its users is a loan. When entering a loan, the borrower signifies consent to the purposes necessary to deliver the services contemplated in the contract, this necessarily includes the processing of relevant personal information. JuanHand, in including the privacy policies in its Service Agreement and in creating the revised Privacy Policy,27 acknowledges that its main basis for processing personal information is consent. In this case, however, for matters where it did not request consent from its data subjects, JuanHand erroneously attempts to fill in the gaps by conveniently citing legitimate interest as its basis in processing their personal information.

According to JuanHand, it considers accessing and modifying a user’s calendar as legitimate and proportional to the purpose in the Service Agreement:

Further, we do also read the borrower’s calendar events and add or modify calendar events. We consider that accessing and modifying user’s calendar is legitimate and proportional to the purpose stated in the Service Agreement for two reasons:

(i) Credit Analysis and Scoring: by accessing the calendar, we seek to identify due dates of other loans or payment obligations of the users to determine whether or not to provide loan services, and if so, his/her credit limits;

(ii) Due Day Reminder: by adding due date to the users’ calendar, it would be easier for the users to apprehend the due date and, thus, repayment obligation.28

In the next provision, JuanHand declares that users are “materially informed” of the kind of personal information it processes when users give consent:

Therefore, we consider that when users give consent to the Service Agreement, users are materially informed the kind of personal information shall be processed in compliance with section 16(a) of the DPA and have given consent to the above functions.29

The privacy provisions in the Service Agreement, however, do not mention access to the user’s phone calendar. In fact, the request for permission to access and modify the calendar is not included among the disclosed permissions JuanHand requests from its users, as presented in Annex 2 of the Position Paper. The access and modification of the calendar that JuanHand claims to be covered under its legitimate interest is not included in the categories of personal information that will be collected and processed, as set out in the Service Agreement. As a result, the access and modification of the calendar could not have been disclosed to the data subjects. JuanHand neither informed its borrowers of the additional personal information that will be processed nor acquired their consent to such processing. Having failed to inform its borrowers of such processing, much less acquired their consent, JuanHand cannot belatedly use legitimate interest to cure this defect especially since its borrowers could not have expected this at the time they gave their consent.

Third, JuanHand’s Position Paper is inconsistent with the Service Agreement and the revised Privacy Policy. In its Position Paper, JuanHand alleged that it “has never published the image or information of any of its user, real or fake, for the purpose of loan collection or harassment.”30 JuanHand further stated that it “will continue to publish/upload the personal information of delinquent users to Credit Information Corporation (CIC), a government-owned and controlled corporation created by Republic Act No. 9510 or the Credit Information System Act (CISA) in 2008 for the purpose of creat[ing] a centralized credit information system.”31 The Commission understands that JuanHand’s disclosure of the personal information of delinquent users to the CIC is pursuant to Section K(4)(c) of the Service Agreement:

After the repayment is overdue, Juanhand as the Facilitator is entitled to disclose to the Investor the personal information of the Borrower, and to or obtained by the Facilitator through this Agreement and other lawful means and include the personal information submitted by the Borrower or collected by Juanhand into the blacklist of the Juanhand Website and the national and local personal credit information systems. The Facilitator is also entitled to share with any third parties the personal information of the Borrower, which was submitted by the Borrower or collected by the Facilitator in public domain, so that the Facilitator and the third parties can collect the overdue amount and such personal information can be used for the approval of other loan applications made by the Borrower. All the legal liabilities shall be borne by the Borrower and Juanhand shall not take any responsibilities.32

However, Section K(4)(d) of the Service Agreement allows JuanHand to “publish the personal information of such user for the purpose of collecting debt”.33 Further, JuanHand categorically states that it “shall not be held liable” for such publication.34 The Commission notes that JuanHand did not address this specific provision in its Position Paper. Although the revised Privacy Policy no longer contains the provision, the fact remains that as of the date of this Order, the existing privacy policies of JuanHand made readily available to the public are those mentioned in the Service Agreement.

The rectification alleged and explanations provided by JuanHand in its Position Paper seem to be belated attempts on the part of JuanHand to ineffectively address the problems discussed by CID in its FFR. For these reasons, the temporary ban is necessary to preserve and protect the rights of data subjects.

The second requisite for temporary ban is satisfied. As discussed in the first requisite, the FFR alleged that undisclosed permissions that violate the right of the data subjects to be informed exist. The FFR further contains allegations that merit the issuance of a temporary ban.

First, CID alleged that a separate Privacy Policy cannot be found on both JuanHand’s website and mobile application since the link “Privacy Policy” directs users to a Service Agreement:

In a Supplemental Report dated 31 May 2021, the CID Technical Team reported that no Privacy Policy was found on both JuanHand’s website and mobile application. The CID searched for the privacy policy of JuanHand and got a link for the “service agreement”, https://privacy.juanhand.com/html/user-agreement.html. This “service agreement” is found only during the signup process in the application and the user will not be able to see or read the service agreement again as there is no link of this agreement inside the application and no visible link on their website.35

The fact that the Privacy Policy is not readily accessible to the public may be construed as a violation of the right of the data subjects to be informed.

Second, as alleged in the FFR, the provisions pertaining to the Privacy Policy included in the Service Agreement violate the rights of the data subjects:

  1. I authorize Juanhand to process Mobile device data (e.g., mobile phone number/s, mobile phone message data, SIM, IMEI, or other device identifiers, type of device, device operating system, device settings, user account information for your mobile device or Google PlayStore account, information about mobile network provider, device specifications), Location data (e.g., mobile device location, time zone setting); Phone data (e.g., contact lists, SMS metadata, types and nature of mobile applications found on your mobile device); mobile app usage data (e.g., traffic volume, mobile app usage) and telecommunications usage data or “telco usage score”.

  2. When the Borrower is overdue for payment, Juanhand may publish the personal information of such user for the purpose of collecting debt. Juanhand shall not be held liable.

  3. The Data Privacy Act (DPA) establishes that you have the following rights as a data subject:

  • You have the right to indicate your refusal to the collection and processing of your personal data. You also have the right to be informed and to withhold your consent to further processing in case there are any changes or amendments to information given to you. Once you have notified us of the withholding of your consent, further processing of your personal data will no longer be done, unless (i) the processing is required pursuant to a subpoena, lawful order, or as required by law; or (ii) the collection and processing is pursuant to any lawful criteria indicated under the terms of this Policy.

  • You have the right to reasonable access to your personal data. Furthermore, you have the right to limit and prevent disclosure of your personal data and to receive notification of any possible breaches of your personal data.

  • You may also correct or remove any information that you think is inaccurate. You have the right to dispute any inaccuracy or error in your personal data. You may request for the correction or removal of any inaccuracy or error in your personal data by logging into your account or making a formal request with our Data Privacy Officer.

  • You have the right to the destruction of your personal data;

  • You have the right to damages; and

  • You have the right to lodge a complaint with the National Privacy Commission (NPC).

If you would like to make any request in relation to your rights as a data subject, please contact our Data Protection Officer (“DPO”) with the contact details listed below. Please note that the exercise of some of your rights as a data subject is subject to review and may result in the denial of any application currently pending.36

Third, the FFR showed that JuanHand’s system processes personal information beyond its disclosure to its users:

The capabilities of JuanHand’s system to read the borrower’s calendar events plus confidential information, add or modify calendar events, send email to guests without the owner’s knowledge, read borrower’s contacts, collect data from contacts and pinpoint the borrower’s approximate and precise location through its network and GPS are all unknown to the prospective borrower. The permission information (Annex “B”) is not shown to the users thru prompts or permissions when applying for a loan but was discovered by the CID Technical Team from the Google Play Store and not from the application itself. Thus, the data subjects are uninformed that his or her personal information and/or sensitive personal information, including that of his or her contacts, have been processed in violation of Section 16 of the DPA.37

These allegations in the FFR show that there is merit in the Application for a Temporary Ban.

The third requisite for temporary ban is present in this case. Section 4 of Rule II of the NPC Circular No. 21-01 provides:

Section 4. Filing fees - No further action on a complaint shall be made unless the appropriate filing fees have been paid, except when: (a) the complainant is the government, or any agency or instrumentality, and government-owned and controlled corporations organized and existing under their own charter; excluding government-owned and controlled corporations organized and incorporated under the Corporation Code; (b) the complaint is filed by an indigent complainant as defined in the Rules of Court or as otherwise prescribed by NPC through an advisory; or (c) the NPC, upon motion by the requesting party, waives this requirement based on discretion and for good cause shown.38

The NPC, as a government agency, is exempt from the payment of filing fees. Thus, it is not required to file a bond for the Application for Temporary Ban.

Lastly, the fourth requisite for temporary ban is satisfied. While there was no summary hearing, the Commission, in an Order dated 16 July 2021, required JuanHand to submit a Position Paper on the Application for Temporary Ban. Section 6 of Rule XI of the 2021 NPC Rules of Procedure states:

SECTION 6. Submission of position papers or other pleadings as alternative to summary hearing. - The investigating officer may, upon motion or in its discretion, compel the parties to submit simultaneous position papers in lieu of a summary hearing.39

In Flores-Concepcion v. Castañeda, the Supreme Court stated that:

In administrative proceedings, the essence of due process is simply the opportunity to explain one’s side. One may be heard, not solely by verbal presentation but also, and perhaps even much more creditably as it is more practicable than oral arguments, through pleadings. An actual hearing is not always an indispensable aspect of due process. As long as a party was given the opportunity to defend his interests in due course, he cannot be said to have been denied due process of law, for this opportunity to be heard is the very essence of due process.40

The Commission gave the Respondent the opportunity to be heard when it was ordered to file a Position Paper. JuanHand filed its Position Paper out of time but in the interest of fully appreciating the merits of the Application for Temporary Ban, the Commission admitted its Position Paper and considered it in issuing this Order.

WHEREFORE, all these premises considered, this Commission GRANTS the Application for Temporary Ban on the processing of personal data filed by the Complaints and Investigation Division (CID) of the National Privacy Commission. A TEMPORARY BAN ON PROCESSING OF PERSONAL DATA is hereby issued against Respondent Wefund Lending Corporation, as the operator of the online lending application, JuanHand.

Further, pursuant to the TEMPORARY BAN, Respondent Wefund Lending Corporation shall:

  1. Immediately take down its online lending application, JuanHand, to ensure that it is no longer available for download, installation or use by data subjects; and

  2. Stop personal data processing activities, including those activities outsourced to third parties, where the processing operations involves use of information from the phonebook, directory, and contact list of data subjects, disclosure of false or unwarranted information, and other unduly intrusive personal data processing methods.

The TEMPORARY BAN ON PROCESSING OF PERSONAL DATA shall remain in effect until the final resolution of the sua sponte investigation against Respondent and its responsible officers.

Let copies of this Order be furnished to the National Telecommunications Commission for their appropriate action, and Google LLC, which operates the Google Play Store for its compliance in accordance with the terms and conditions of its platform.

Furthermore, Respondent Wefund Lending Corporation and its responsible officers are ORDERED, within ten (10) days from receipt of this Order, to file a COMMENT on the allegations in the attached Fact-Finding Report, pursuant to Section 6 of Rule X of NPC Circular No. 2021-01 (2021 NPC Rules of Procedure).

In case of failure by the Respondent and its responsible officers to file a Comment, this case shall be deemed submitted for resolution based on the evidence on record.

The proceedings before the Commission based on the Fact-Finding Report of the CID, which serves as the Complaint against Respondent Wefund Lending Corporation and its responsible officers, will now resume, pursuant to Section 2, Rule IX of the 2021 NPC Rules of Procedure.

SO ORDERED.

City of Pasay, Philippines. 12 August 2021.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

JOHN HENRY D. NAGA Deputy Privacy Commissioner

Copy furnished:

ATTY. LAN Counsel for Respondent WEFUND LENDING CORPORATION

LG

NS

CF

XS

CTS

NMA

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Fact-Finding Report, 9 June 2021, at 16. ↩

  2. Order, 16 July 2021, in In re: Wefund Lending Corporation. ↩

  3. Affidavit of Service, 23 July 2021. ↩

  4. JuanHand Website, available at https://www.juanhand.com/ (last accessed 12 August 2021). ↩

  5. Letter from NMA, Legal Compliance Officer of Wefund Lending Corporation to National Privacy Commission, 02 August 2021. ↩

  6. Email from NMA, Legal Compliance Officer of Wefund Lending Corporation to National Privacy Commission, 04 August 2021. ↩

  7. Entry of Appearance with Manifestation, 10 August 2021, at 1. ↩

  8. Id. ↩

  9. Entry of Appearance with Manifestation, 10 August 2021, at 2. ↩

  10. Id. ↩

  11. Id. ↩

  12. Motion to Properly Serve Order with Motion to Admit Position Paper Ad Cautelam, 12 August 2021, at 3. ↩

  13. Position Paper by Wefund Lending Corporation, 12 August 2021, at 10. ↩

  14. National Privacy Commission, NPC Circular No. 21-01, “2021 Rules of Procedure of the National Privacy Commission” [NPC Circ. No. 2021-01], Rule III, § 5 (28 January 2021). ↩

  15. Id. at § 6. ↩

  16. Supreme Court of the Philippines, A.M. No. 19-10-20-SC, “2019 Amendments to the 1997 Rules of Civil Procedure” [Rules of Court], Rule XII, § 8 (01 May 2020). ↩

  17. Rules of Court, Rule XIII, § 15(2). Emphasis supplied. ↩

  18. NPC Circ. No. 2021-01, Rule IX, § 3. ↩

  19. Fact-Finding Report, 9 June 2021, at 5. ↩

  20. Position Paper by Wefund Lending Corporation, 12 August 2021, at 2. ↩

  21. Id. ↩

  22. Fact-Finding Report, 9 June 2021, at 3. ↩

  23. Position Paper by Wefund Lending Corporation, 12 August 2021, at 2. ↩

  24. JuanHand Website, available at https://www.juanhand.com/, last accessed on: 12 August 2021. ↩

  25. Position Paper by Wefund Lending Corporation, 12 August 2021, at 4. ↩

  26. Id. ↩

  27. “12. Consent and Acknowledgement — By providing us with your Personal Data, you hereby consent to the usage, processing and/or disclosure of your Personal Data in accordance with this Privacy Notice. If you are a corporation whereby you have provided/disclosed Personal Data of individual third-parties including but not limited to your directors, individual shareholders, employees, authorized signatories, agents, representative or otherwise, you hereby represent and warrant to us that you have the consent of such third parties and are entitled to provide their Personal Data to us to be used, processed and/or disclosed in accordance with this Privacy Notice. You also consent that Juanhand may be required to disclose your Information to the Securities and Exchange Commission, Bangko Sentral ng Pilipinas, Anti-Money Laundering Council, credit bureaus and/or any other governmental body, in compliance with its legal obligations.” ↩

  28. Position Paper by Wefund Lending Corporation, 12 August 2021, at 5. ↩

  29. Id. ↩

  30. Id. at 3. ↩

  31. Id. ↩

  32. Wefund Lending Corporation, Service Agreement § K(4)(c), available at https://privacy.juanhand.com/html/user-agreement.html (last accessed 12 August 2021). ↩

  33. Id. § K(4)(d). ↩

  34. Id. ↩

  35. Fact-Finding Report, 9 June 2021, at 3. ↩

  36. Id. at 4. Emphasis supplied. ↩

  37. Id. at 5. Emphasis supplied. ↩

  38. NPC Circ. No. 2021-01, Rule II, § 4. Emphasis supplied. ↩

  39. NPC Circ. No. 2021-01, Rule XI, § 6. ↩

  40. Flores-Concepcion v. Castañeda, A.M. No. RTJ-15-2438, 15 September 2020 (citing Lumiqued v. Exevea, G.R. No. 117565, 18 November 1997). Emphasis supplied. ↩

Backlinks

  • No backlinks found