NPC Issuance Wiki

NPC Case No. 17-003: MFS v. RJJ and SJJ

Issued Resolution

Resolution Text

MFS,

Complainant,

  • versus -

RJJ and SJJ,

Respondents.

For: Violation of Data Privacy Act of 2012

x------------------------------------------------x

LIBORO, P.C.:

Assailed in this Motion for Reconsideration1 is the Decision2 dated 19 March 2018 of the National Privacy Commission (NPC) which declared that Respondents RJJ and SJJ did not violate Sections 25, 28, 29, 31, and 33 of the Data Privacy Act of 2012 (DPA) on unauthorized processing of personal information, processing of personal information and sensitive personal information for unauthorized purposes, unauthorized access or intentional breach, malicious disclosure, and combination of series of acts.

Facts

MFS, through his Attorney-in-Fact GS, alleged in his complaint that Respondents RJJ and SJJ made use of their authority or connections to access sensitive personal information about the credit standing of complainant, the latter’s husband and mother-in-law.

According to the Complainant, Respondents committed unauthorized processing of personal information, processing of personal information for unauthorized purposes, unauthorized access or intentional breach and malicious disclosure, all of which are prohibited by the Data Privacy Act of 2012.

On 07 March 2017, this Commission received a Supplemental Complaint Affidavit3 alleging:

  1. In June 2016, I personally called RJJ’s mother to talk about RJJ and SJJ accessing our credit information and she verbally confirmed that SJJ is indeed looking into financial records, not only of ours, but the records of even another relative of hers named AMR.

  2. On February 27, 2017 at 9:10am, I visited BPI AB Branch and VA, verbally confirmed that I am included in the Negative Data list. She also said that pending cases of data subjects can also be viewed in the said data list, which proves that RJJ and SJJ also looked into my mother’s credit information as they emphasized that they are also aware that she has a hit in Makati RTC.

On 25 May 2017, this Commission received the Joint Counter-Affidavit of Respondents RJJ and SJJ, which stated in part:

  1. We both specifically deny the allegations of herein complainant.

  2. It is unfortunate that my name (SJJ) is dragged on this mess and the good name of my employer Banco De Oro (BDO) simply because of the assumption herein complainant that I have access to the computer system of BDO that contains sensitive personal information about credit standing, if any.

  3. First and foremost, I have no access to the computer system of BDO that contains sensitive personal information about credit standing of BDO’s clients, if any. To be honest, I really don’t know if BDO has sensitive personal information about credit standing of BDO’s clients.

  4. Assuming there is such, I could not access the same because it is highly confidential as stated in his own very complaint letter. I am just a TELLER of BDO whose work is basically transacting business in front of a desk of the bank.

  5. As correctly stated by BDO, I have no authority or access to such Negative Data Bank record.

  6. Secondly, assuming but without admitting that I have access to the computer system of BDO, again, there is no way I can access their personal details/information since they are not BDO clients. As per answer of BDO, they are non-BDO clients.

  7. Thirdly, assuming without admitting that they are BDO Clients, still BDO does not have any sensitive personal information about credit standing.

  8. Also, there is no truth on the allegation in the Supplemental Complaint Affidavit dated February 27, 2017 that there was a confirmation from RJJ’s mother that we were checking complainant’s financial records and respondent RJJ was aware regarding their unpaid credit cards.

  9. At the onset, I (RJJ) do not have access to the sensitive personal information of MFS from BDO or any institutions or offices.

  10. And to simply get back at them or get even in mocking and defaming me, I used two things: 1) My personal knowledge of how the banking system works through my previous affiliations with banks and 2) my personal knowledge of their family background.

  11. I (RJJ) previously worked for various BPO/Financial Companies, which provided him with detailed Customer Service Training in terms of Credit Card Transactions, Fraud, Collections, Write Offs and the Negative Data Bank/Negative Data Base, and how the general Credit Card System works across the Globe.

  12. In response to the complainant’s demeaning statements in their FB messenger, I just came up with a believable bluff.

On 18 June 2017, Complainant sent an email to complaints@privacy.gov.ph with the subject heading “Reply to Counter-Affidavits of Respondents” which states in part:

  1. RJJ has been badgering my mother, for several weeks, to plead to me and ask me to meet with them so he can apologize for what he has done. On April 23, 2017, I agreed on the basis that I would only want to know the truth. During the said meeting, it appears that his real intention is to force me to sign on an affidavit of desistance as he said; he does not want to be investigated further. The said affidavit is signed by my relatives RJJ’s mother, RJJ’s father and RC that served as witnesses to an agreement that never happened.

  2. During our meeting with RJJ and SJJ, they showed me a list of his employers in which he has access to the Negative Data list. I took a photo of the document he gave us. However, upon reviewing RJJ’s statements in his counter-affidavit, I noticed that there is a clear omission of facts, whether deliberate or not, as details of his employment in BPI is not disclosed in the affidavit he sent you.

  3. We talked with SJJ on May 25, 2017. She told us that she is aware that she signed a second affidavit that counters her statements prior.

From the pleadings and pieces of evidence submitted by all the parties concerned, this Commission rendered its decision finding that Respondents did not violate Sections 25, 28, 29, 31, and 33 of the Data Privacy Act of 2012 due to the insufficiency of evidence to support the Complainant’s claim.

In the said decision, this Commission stressed that while it is a quasi-judicial body and unbound by strict technical rules of procedure, it is not a license to disregard certain fundamental evidentiary rules.4

While it is true that administrative or quasi-judicial bodies like the NLRC are not bound by the technical rules of procedure in the adjudication of cases, this procedural rule should not be construed as a license to disregard certain fundamental evidentiary rules. The evidence presented must at least have a modicum of admissibility for it to have probative value. Not only must there be some evidence to support a finding or conclusion, but the evidence must be substantial. Substantial evidence is more than a mere scintilla. It means such relevant evidence as a reasonable mind might accept as adequate to support a conclusion.

On 24 April 2018, the Complainant received a copy of the 19 March 2018 decision of this Commission. Thereafter, Complainant filed its Motion for Reconsideration on 02 May 2018.

In his Motion for Reconsideration, Complainant contends that although admitting that there was no direct evidence of Respondents’ actual access to the subject personal information, he was able to present circumstantial evidence to support his allegations.

According to Complainant, on 27 February 2017, the Bank of Philippine Islands (BPI) AB Branch Assistant Manager VA verbally confirmed that he is currently in the Negative Data List. Additionally, Complainant provided a Facebook Messenger conversation with RJJ dated 10 April 2016 where the latter accused the former of being an irresponsible payer based on a Negative Data List, among other things. Complainant likewise claimed that such accusations from the Respondents could only be had if the latter had actual access to the said negative data list.

Further, Complainant attached a copy of text messages sent by Respondent RJJ apologizing to his mother, for all the accusations he made about the complainant.

Lastly, Complainant MFS admitted that he was not a depositor of Banco De Oro (BDO), however, he claimed that the Negative File Information System (NFIS) can be accessed through registered users from different Banker Association of the Philippines (BAP) Member Banks rendering his status irrelevant for the issue on hand.

On 21 June 2018, this Commission received Respondents’ Comment/Opposition dated 16 May 2018. In their Comment/Opposition, Respondents contend that Complainant’s Motion for Reconsideration is pro forma for failure to state in particular the error or mistake in fact or law in the decision of the Commission.5

Further, the Motion for Reconsideration of Complainant is a mere reiteration or rehash of the complaint filed before the Commission as it contained the very same issues, assignment of errors, and discussions and arguments and that it failed to raise new matters or arguments to warrant the reversal of the assailed decision.6

Respondents argue that the Motion for Reconsideration is defective for failure to comply with requirements set forth under Sections 2, 4, 5, and 6 of Rule 15 of the Rules of Court and that the same was already filed out of time.

Lastly, Respondents assert that circumstantial evidence has no place in administrative proceedings since the same is applicable only to criminal proceedings.

The motion lacks merit.

Discussion

Substantial evidence, quantum of proof in administrative cases

Substantial evidence is defined as such amount of relevant evidence which a reasonable mind might accept as adequate to support a conclusion. It is more than a mere scintilla of evidence. The standard of substantial evidence is satisfied when there is reasonable ground to believe, based on the evidence submitted, that the respondent is responsible for the misconduct complained of. It need not be overwhelming or preponderant, as is required in an ordinary civil case, or evidence beyond reasonable doubt, as is required in criminal cases, but the evidence must be enough for a reasonable mind to support a conclusion.7

Complainant avers that he was able to present circumstantial evidence to support his claims against Respondents. However, the Supreme Court has reiterated time and again that in administrative proceedings, complainants carry the burden of proving their allegations with substantial evidence.

Complainant accuses Respondents of processing his personal information without authority and for an unauthorized purpose. This Commission reiterates its ruling that, “A mere claim that one has access to personal information is not enough. Without supporting evidence, this claim resides in the realm of supposition.”8 There is nothing in the complaint nor in the Complainant’s motion for reconsideration that would find support to show that Respondents’ had actual access to the former’s personal information.

In spite the fact that Complainant was able to provide this Commission with screen captures of the messages between him and Respondents, such claim does not of itself show proof that the Respondents accessed data that would show Complainant and his family are indeed in the negative data bank list.

Motion for reconsideration must be sufficient in form and in substance

Rule 37, Section 1 of the Rules of Court provides for the grounds for filing a motion for reconsideration, applicable provision to wit:

Within the same period, the aggrieved party may also move for reconsideration upon the grounds that the damages awarded are excessive, that the evidence is insufficient to justify the decision or final order, or that the decision or final order is contrary to law

A motion for reconsideration must satisfy the requirements of Rule 37 of the Rules of Court. A motion for reconsideration that does not comply with those requirements will be treated as pro forma intended merely to delay the proceedings.

In his Motion for Reconsideration, Complainant merely reiterates his arguments and assertions. He enumerates in the said motion his verbal communication dated 27 February 2017 with BPI AB Branch Assistant Manager VA, text message exchange with Complainant MFS’ mother RS and Respondent RJJ, paragraph 23 of the Joint Counter-Affidavit of Respondents and the fact that he is not a depositor of BDO where Respondent SJJ is connected as circumstantial evidence to prove that Respondents committed a violation under the Data Privacy Act of 2012.

These pieces of evidence have already been presented to this Commission and have been considered, weighed, and resolved adversely to him when the Commission rendered its Decision dated 19 March 2018.

“Under our rules of procedure, a party adversely affected by a decision of a trial court may move for reconsideration thereof on the following grounds: (a) the damages awarded are excessive; (b) the evidence is insufficient to justify the decision; or (c) the decision is contrary to law… A motion for reconsideration based on the foregoing grounds is deemed pro forma if the same does not specify the findings or conclusions in the judgment which are not supported by the evidence or contrary to law, making express reference to the pertinent evidence or legal provisions.”9

Complainant clearly failed to specify which finding of the Commission is not supported by evidence or is contrary to law. He merely attempts to assert his claim in his Motion for Reconsideration by rehashing the pieces of evidence previously ruled upon by the Commission.

The motion filed by Complainant is pro forma as it is but a reiteration of reasons and arguments previously set forth in his complaint and supplemental complaint and submitted to this Commission. Although Complainant’s Motion for Reconsideration had some flesh on its bones, it is nevertheless pro forma as it failed to make reference to pieces of evidence on record or provisions of law that is contrary to the decision of this Commission.

In other words, the movant is also required to point out succinctly why reconsideration is warranted. The Supreme Court declared that it is not enough that a motion for reconsideration should state what part of the decision is contrary to law or the evidence; it should also point out why it is so. Failure to explain why will render the motion for reconsideration pro forma.10

A motion must comply with Sections 4 and 5 of Rule 15 of the Rules of Court

Section 32 of NPC Circular 16-04 states that the Rules of Court shall apply in suppletory character, and whenever practicable and convenient. A motion must comply with the requirements set forth under Sections 4 and 5 of Rule 15 of the Rules of Court.

A motion that does not comply with the abovementioned rule is a worthless piece of paper. The Supreme Court has held time and again, that under the aforementioned rule; mandatory is the requirement in a motion. As a rule, a motion without notice of hearing is considered pro forma.11

Complainant’s motion for reconsideration, being a written motion must comply with the requirements of Rule 15 of the Rules of Court. Hence, the same is considered a mere scrap of paper for failure to comply with the abovementioned rule.

On-site examination under Section 16 of NPC Circular 16-04 is not mandatory

Complainant alleges the failure of this Commission to comply with the rules and procedure of the NPC pertaining to investigation and examination of systems and procedures. He argues that the decision rendered by the Commission solely relied on the pleadings and pieces of evidence submitted by the parties without undergoing the requisite investigation undertaken by the investigating officer.

NPC Circular 16-04 on the Rules of Procedure of the NPC outlines the procedure in filing complaints with the NPC. Complainant specifically raises in issue compliance with Section 16 of NPC Circular 16-04, pertinent portions reproduced below:

Section 16. Investigation; Examination of Systems and Procedures. – The investigating officer shall investigate the circumstances surrounding the privacy violation or personal data breach. Investigations may include on-site examination of systems and procedures.12

This Commission is well-aware of its own Rules of Procedure and has not been remiss in its duties and the service of justice in this case. This Commission hereby outlines the procedure undertaken in the determination of the presence or absence of any violation of the DPA in this case.

On 13 February 2017, Complainant submitted his Complaint Affidavit via email. On 20 March 2017, the Commission through its Complaints and Investigation Division (CID) issued an Order to Confer for Discovery directing all parties to appear before the Commission in accordance with Section 13, NPC Circular 16-04. On 15 May 2017, the Discovery Conference Hearing was held at the office of the Commission.

Pursuant to the Discovery Conference Hearing dated 15 May 2017 where both parties agreed that there will be no additional evidence to be presented, the CID issued an Order dated 23 May 2017 for Respondents to file their responsive pleadings and thereafter, the case will be resolved. This is in full compliance with Section 15 of NPC Circular 16-04.

On 5 January 2018, the CID submitted its Investigation Report on NPC Case No. 17-003, on the alleged violation of the DPA of herein respondents. The said Report recommended for the dismissal of the case for lack of merit, to wit:

“A mere claim that one has access to personal information is not enough, it should be proven. From the evidence that were presented before this Commission, the complainant was not able to substantiate his claim that respondent has access to personal information. A supposition cannot in any way be treated as evidence against respondent if the same is not substantiated as this violates fundamental evidentiary rules.”13

Clearly, the CID had properly conducted a substantive examination and investigation of the case at hand in accordance with its mandate under NPC Circular 16-04 before submitting its Investigation Report. The same Investigation Report was properly considered by this Commission during adjudication in addition to all the pieces of evidence and pleadings submitted by both parties. Allegations made by Complainant that no investigation of the privacy violation is completely baseless and unfounded.

This Commission thus reminds Complainant that the on-site examination of systems and procedures is discretionary to the investigating officer. The Supreme Court has ruled that, “where the provision reads ‘may,’ this word shows that it is not mandatory but discretionary. It is an auxiliary verb indicating liberty, opportunity, permission and possibility. The use of the word ‘may’ in a statute denotes that it is directory in nature and generally permissive only.”14

It is the prerogative of the investigating officer whether to conduct an on-site examination and exercising its option to not undergo one does not, in any way, connote a failure to fulfill its duties and responsibilities.

WHEREFORE, for all the foregoing, Complainant’s MOTION FOR RECONSIDERATION is hereby DENIED.

SO ORDERED.

Pasay City. 25 July 2019.

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

WE CONCUR:

IVY D. PATDU Deputy Privacy Commissioner

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

Copy Furnished:

MFS Complainant

RJJ and SJJ Respondents

(x) ENFORCEMENT DIVISION Legal and Enforcement Office

(x) GENERAL RECORDS UNIT

(x) by personal service

Footnotes

  1. Records, p. 112-116. ↩

  2. Id., at pp. 88-95. Penned by Privacy Commissioner Raymund E. Liboro, with Deputy Privacy Commissioners Ivy Patdu and Leandro Aguirre, concurring. ↩

  3. Page 1, Supplemental Complaint-Affidavit of Complainant. ↩

  4. Primo Miro v. Marilyn Mendoza et al., G.R. Nos. 172532-172544-45, 20 November 2013. ↩

  5. Records, p. 122. ↩

  6. Ibid. ↩

  7. Primo Miro v. Marilyn Mendoza et al., G.R. Nos. 172532-172544-45, 20 November 2013. ↩

  8. Records, pp. 88-95. Penned by Privacy Commissioner Raymund E. Liboro, with Deputy Privacy Commissioners Ivy Patdu and Leandro Aguirre, concurring. ↩

  9. PNB v. Hon. Paneda, et. al., G.R. No. 149236, 14 Feb. 2007. ↩

  10. Marikina Valley Development Corporation et. Al. v. Hon. Napoleon Flojo et.al., G.R. No. 11080, 8 December 1995. ↩

  11. Marylou Cabrera v. Felix Ng, G.R. No. 201601, 12 March 2014. ↩

  12. NPC Circular No. 16-04, Rules of Procedure of the National Privacy Commission. ↩

  13. Investigator’s Report dated 5 January 2018, In re: NPC Case No. 17-003 Salipot v Jimenez, p. 6. ↩

  14. Demaala v. COA, G.R. No. 199752, Feb. 17, 2015. ↩

Backlinks

  • No backlinks found