NPC Issuance Wiki

NPC 24-005: RVB v. JTL

Issued Order

Order Text

RVB,

Complainant,

-versus-

JTL,

Respondent.

x----------------------------------------------------x

ORDER

Before the Commission is a Motion for Reconsideration (MR) filed by RVB (Complainant) dated 26 March 2024.

On 24 January 2024, Complainant filed a complaint against Respondent for violation of Section 26 (Access Due to Negligence) of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).1

Complainant and Respondent were colleagues who worked at the same office.2 Complainant alleged that they were “engaged in private conversations through a messaging platform where [they] exchanged sensitive and confidential information.”3 He further claimed that without obtaining his “explicit consent,” Respondent shared screenshots of their conversations to individuals who were not part of their conversation.4

Complainant stated that on 22 September 2023, he received a Notice of Preventive Suspension from his employer’s (KMC) Human Resource Business Partner effective from 23 September 2023 to 22 October 2023.5 In the notice, Complainant was not informed of the company violation he allegedly committed or the identity of the complainant.6

Respondent submitted an Administrative Case Report dated 02 October 2023 to KMC detailing his allegations against Complainant.7 In the case report, Respondent accused Complainant of sexual harassment and misuse of authority in the workplace.8 To support his claims, Respondent attached several screenshots of his conversations with the Complainant.9

On 04 October 2023, Complainant received a copy of a Notice to Explain from KMC, which reiterated the allegations in the Administrative Case Report submitted by Respondent.10 KMC also attached the screenshots that were previously attached to the Administrative Case Report.11

On 22 October 2023, KMC issued a Memorandum (Notice of Decision) absolving Complainant and clearing the Complainant of any wrongdoing.12 The Memorandum also states that the evidence provided by the Respondent did not substantiate the allegations of sexual or workplace harassment.13 Subsequently, the Complainant was reinstated after being suspended.14

Thus, Complainant alleged that Respondent should be held liable under Section 26 of the DPA.15 Complainant prayed for a fine and reprimand against Respondent together with a formal written apology for unauthorized disclosure and any other appropriate remedies deemed fit by the Commission.16

On 08 March 2024, the NPC, through its Legal and Enforcement Office (LEO), issued a Decision dismissing the complaint outright on the basis that “it does not pertain to a violation of the Data Privacy Act of 2012 or does not involve a privacy violation or personal data breach.”17 In its Decision, the LEO held that the complaint “does not involve a privacy violation” because Respondent supposedly had lawful basis under Section 13 (f) in relation to Section 12 (f) of the DPA when it processed Complainant’s personal data.18

In response to the LEO’s Decision, Complainant filed an MR dated 26 March 2024.19

The Commission grants Respondent’s MR. The LEO misinterpreted the application of Section 1 (3) of Rule IV of the NPC Circular 2021-01 (2021 NPC Rules of Procedure).

Section 1 (3) of Rule IV of the 2021 NPC Rules of Procedure provides:

Section 1. Outright dismissal, when allowed. Within thirty (30) calendar days from receipt of the complaint, the investigating officer may give the complaint due course or dismiss the complaint without prejudice, on any of the following grounds:

…

  1. The complaint does not pertain to a violation of the Data Privacy Act of 2012 or does not involve a privacy violation or personal data breach[.]20

In a previous case, the Commission explained that a complaint does not involve a privacy violation when the allegations in the complaint, assuming they are true, do not set forth a violation of the DPA, its IRR, or other issuances of the Commission.21 Such complaints are considered “without a privacy issue” and are outside the Commission’s jurisdiction.22 It further explained “privacy violation” as follows:

A privacy violation pertains to the processing of personal information in violation of a person’s reasonable expectation of confidentiality or privacy or in violation of any law, rules, or regulation relating to the protection of personal data, such as the DPA.23

In this case, the LEO went beyond its authority and performed a function reserved for the Commission En Banc. The LEO erroneously dismissed the complaint on substantive grounds and concluded that the complaint “does not involve a privacy violation.”24

The LEO’s discussion on the supposed presence of a lawful criterion for processing shows that a privacy violation exists. The presence or applicability of a lawful basis to process is a matter for the determination of the Commission En Banc.

Rather than dismissing the complaint, the LEO should have given the complaint due course and directed Respondent to file a verified comment. Section 3 of Rule IV of the 2021 NPC Rules of Procedure provides:

Section 3. Submission of comment. Upon finding that the complaint may be given due course, respondent shall be required to file a verified comment within fifteen (15) calendar days from receipt of the order. A copy of the complaint, together with its supporting evidence, shall be attached to the order to comment. A complaint may be submitted for resolution if respondent does not file a comment within the period provided.25

Following Section 3, Rule IV of the 2021 NPC Rules of Procedure, the Commission directs Respondent to submit his Comment on the complaint, Complainant to submit his Reply, if any, to the Comment, and Respondent to submit his Rejoinder, if any, to the Reply.

WHEREFORE, premises considered, the Commission resolves to GRANT the Motion for Reconsideration dated 26 March 2024 filed by Complainant RVB.

Respondent JTL is ORDERED, within fifteen (15) days from receipt of this Order, to file his COMMENT on the allegations in the complaint.

Complainant may, in his discretion, submit his REPLY within five (5) days from receipt of Respondent’s Comment.

Respondent may, in his discretion, submit his REJOINDER to the Reply within five (5) days from receipt of Complainant’s Reply.

SO ORDERED.

City of Pasay, Philippines. 18 April 2024.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

RVB Complainant

JTL Respondent

LEGAL AND ENFORCEMENT OFFICE COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Complaints-Assisted Form, 19 January 2024, at 3, in RVB v. JTL, NPC 24-005 (NPC 2024). ↩

  2. Decision, 08 March 2024, in RVB v. JTL, NPC 24-005 (NPC 2024). ↩

  3. Complaints-Assisted Form, 19 January 2024, at 2, in RVB v. JTL, NPC 24-005 (NPC 2024). ↩

  4. Id. ↩

  5. Id. at 3. ↩

  6. Id. ↩

  7. Id. Annexes. ↩

  8. Id. ↩

  9. Complaints-Assisted Form, 19 January 2024, Annexes, in RVB v. JTL, NPC 24-005 (NPC 2024). ↩

  10. Id. ↩

  11. Id. ↩

  12. Id. ↩

  13. Id. ↩

  14. Id. ↩

  15. Complaints-Assisted Form, 19 January 2024, at 3, in RVB v. JTL, NPC 24-005 (NPC 2024). ↩

  16. Id. ↩

  17. Decision, 08 March 2024, at 2, in RVB v. JTL, NPC 24-005 (NPC 2024). ↩

  18. Id. at 4. ↩

  19. Motion for Reconsideration, 26 March 2024, in RVB v. JTL, NPC 24-005 (NPC 2024). ↩

  20. National Privacy Commission, 2021 Rules of Procedure of the National Privacy Commission [NPC 2021 Rules of Procedure], rule IV, § 1 (3) (28 January 2021). ↩

  21. GSS v. Global Dominion Financing, Inc., NPC 21-064, 16 June 2022, at 10, available at https://privacy.gov.ph/wp-content/uploads/2023/05/NPC-21-064-2022.06.16-GSS-v.-Global-Dominion-Financing-Inc.-Decision.pdf (last accessed 24 April 2024). ↩

  22. Id. at 10. ↩

  23. Id. at 7. ↩

  24. Decision, 08 March 2024, at 2, in RVB v. JTL, NPC 24-005 (NPC 2024). ↩

  25. NPC 2021 Rules of Procedure, rule IV, § 3. Emphasis supplied. ↩

Backlinks

  • No backlinks found