Resolution Text
ODC,
Complainant,
-versus-
ODB & AE,
Respondents.
x-------------------------------------------------x
LIBORO, P.C.
For this Commission’s resolution is the Motion for Reconsideration dated 20 December 2017 assailing the Commission’s Decision dated 04 December 2017.
Facts
The facts are the following:
On 3 February 2017, Complainant filed a formal complaint before this Commission alleging that Respondent ODB, without consent, deducted from his ODB Savings Account his unpaid balance in his AE Credit Card. According to Complainant, his personal data was processed without his consent, thus, a clear violation of the Data Privacy Act of 2012 (DPA).
On 10 April 2017, Respondent ODB filed a Comment1 stating therein that the complaint should be dismissed due to several grounds. According to Respondent ODB, Complainant committed forum shopping as a prior complaint before the Bangko Sentral ng Pilipinas (BSP) has been lodged. Further, the complaint does not involve any violation of the DPA as no data sharing to a third party took place considering that Respondent ODB is the issuer of Complainant’s AE card. Respondent ODB likewise argued that Complainant was legally and contractually bound to pay his credit card bill.
This Commission, in its 04 December 2017 decision2, ruled that there was no forum shopping in this case as the right asserted by Complainant in his complaint before this Commission is for violation of the DPA while the one in BSP is for violation of the Bank Secrecy Act. This Commission likewise ruled that although Respondent ODB did not commit unauthorized processing of personal information as this was done with Complainant’s consent, it was sternly warned as it violated the Principle of Transparency required by law.
Discussion
In ruling that Respondent ODB violated the principle of transparency, this Commission stressed that the principle of transparency requires personal information controllers (PIC) to ensure that the data subject must always be able to understand how and why his or her personal information is being processed. For this Commission, Respondent ODB did not properly inform Complainant of its ability and intention to set off its legal claim. While this information can be found within the terms and conditions of the credit card agreement signed by complainant, the way the latter’s data was to be processed remained opaque and buried in legalese.
This prompted Respondent ODB to file a motion for partial reconsideration with a prayer that a new decision be rendered reversing the ruling that it violated the principle of transparency and its corresponding penalty. Respondent ODB argued that (1) the Civil Code allows for legal setoff or compensation for as long as the elements under Article 1278 and 1279 are complied with and that the law does not require notification before setoff; (2) the logic behind Article 1290 of the Civil Code as to the nonrequirement of notice in case of legal compensation is due to the fact that a party may remove the money against which the setoff would be applied once notice is served; and (3) the ruling that it violated the principle of transparency under the DPA run counter to the provisions of the Civil Code on legal compensation which is provided for in the Civil Code and not under the DPA.
We find no merit in the arguments.
While this Commission appreciates Respondent ODB’s lengthy discussion on the provisions of the Civil Code on legal setoff or compensation, the same is irrelevant as this was not questioned by the Commission nor did this Commission adjudge Respondent ODB to have violated the Civil Code.
In its 04 December 20173 Decision, this Commission in fact acknowledged the relationship between a bank and its depositor - that the bank and the data subject are debtors and creditors of each other, and that a bank has the right to setoff the deposits in its hands for payment of a depositor’s indebtedness. In other words, the Commission recognized ODB’s right to setoff the debt of Complainant from the latter’s savings account.
This Commission is likewise well aware that the Civil Code imposes no obligation on the part of the bank to notify their client prior to the actual legal compensation or setoff. When this Commission ruled that Respondent ODB should have properly informed Complainant of its ability and intention to set off its legal claim, this Commission did not mean Respondent ODB should have notified Complainant prior the actual setoff. Rather, it meant that the credit card terms and conditions of Respondent ODB should have complied with the principle of transparency.
Under Chapter III, Section 11 of the Data Privacy Act of 2012, the processing of personal information shall be allowed, subject to compliance with the requirements of said act and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality4.
Any processing of personal data should be lawful and fair. It should be transparent to natural persons that personal data concerning them are collected, used, consulted, or otherwise processed and as to the extent their personal data are or will be processed. The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used.
Further, the principle of transparency concerns, in particular, information to the data subjects on the identity of the controller and the purposes of the processing and further information to ensure fair and transparent processing in respect of the natural persons concerned and their right to obtain confirmation and communication of personal data concerning them which are being processed. It is imperative that natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing5.
This simply means that companies must state in clear and plain language how they will handle data, for what purpose and by whom. For example, if a company holds data related to children, then the reading level of the content must be accessible for those children6. In the same sense that if a company handles data related to a common person then the reading level should be understood by a common person.
Thus, it is imperative that every personal information controller must remember that transparency is a core principle of the DPA. Adherence to this principle is key to “fairness” which is an equally important criterion set for lawful processing of personal data under the DPA.
It is critical in establishing trust and confidence by a business to a customer and should evoke a sense of fairness and a response that encourages more meaningful participation by data subjects. Transparency is necessary to prove organizational accountability to data subjects. Thus, it is not only a legal tool but an instrument for any business to be trusted in today’s personal data driven society.
The Data Privacy Act of 2012, which is based on globally adopted privacy principles, introduces a much broader definition for transparency in that it must not only satisfy a legal mandate but more importantly, address the expectations of data subjects. The transparency principle as contemplated in the DPA and as differentiated from what the legal profession have become accustomed to, is centered on the reasonable expectations of the user to be informed and must go beyond legal compliance. Privacy Notices and Terms and Conditions (T & C’s for brevity) are prime examples where a company can show its transparency to customers. These are essential for legal purposes and a demonstrable proof of organizational accountability to the DPA. However, the presence of Privacy Notices and T & C’s alone, does not automatically translate to being transparent. They could be meaningless to data subjects if they are not concise and easy to understand and do not effectively explain the benefits, risks, potential harm, and even pain of data use and the choices and options available to them.
Businesses and their lawyers must realize that personal data processing is now set against a milieu that enunciates the rights to privacy and data protection. They must recognize that legal transparency is different from user-centric transparency. The former may be understandable to legal professionals and appreciated by the legal community while the latter should be understandable to the data subject and satisfy their desire to understand how their personal information will be used. The former addresses their broad legal mandate. The latter fulfills compliance to the DPA. The former uses legalese. The latter uses clear and plain language that is easy to understand. Clearly, they must comprehend that the rules in the processing of personal data have changed.
Admittedly, there is transparency tension whenever legalese cross paths with user expectation. This tension often appears in situations where a power imbalance is present. Power imbalance in data privacy parlance is a condition where meaningful information for the data subject becomes more difficult to obtain especially when the controller, like a bank, hold considerable power over a depositor or customer because they are offering financial services that is vital to the needs of an individual. This situation presents itself in other contexts such as in the health sector where a hospital or a health professional wields considerable power over a patient and even in schools where administrators and teachers exercise a significant degree of control over students.
Incidentally, these industries and sectors have been identified by the Commission to belong to a set of personal information controllers and processor that practice larger-scale and a higher-risk type of processing compared to other PICs and PIPs. They are all contained in Appendix 1 of NPC Circular 17-01 on the Registration of Data Processing Systems and Notification Regarding Automated Decision-Making7. A bank and a credit card issuer like Respondent ODB belongs to one of these sectors. Since it practices a higher-risk type of processing that could lead to situations where a data subject may experience risks or threats or exposed to harm or even pain, it is expected that the data subject should be provided with clear, concise, intelligible, and easy to understand information to guide and provide them with a clear picture and a genuine choice about the use of their personal data.
The NPC is aware of these contexts and seeks to reduce this tension. This is the reason why in these imbalanced conditions, the NPC takes a harder look on how controllers adhere to the principles of personal data processing, namely: transparency, legitimate purpose and proportionality. This Commission stands firm that the onus in resolving this transparency tension between legal mandates and user expectation lies with the business or the personal information controller and its processors. By treating data privacy accountability to their customers more seriously and having the data subject’s interest in mind, this tension can be reduced and potential transparency violations to the DPA prevented.
Further, this Commission will never tire in calling out personal information controllers to adhere to the data privacy principles. The Commission understands that it takes effort, creativity and innovation to cure this imbalance and strike that equality between clarity and the data subject desire to understand. It is also conscious not to prescribe disproportionate measures that may be too difficult for the controller to implement. We find amending contracts, privacy notices, and terms and conditions elementary practices that should not take disproportionate efforts to implement. We note that Respondent ODB took the first step in this direction by amending its Terms and Conditions in this case. We note further the effort of Respondent ODB to resolve and mitigate this imbalance by delivering a better crafted provision in the T & C on the consequences of default by a card holder in pursuit of their legitimate interest to process personal data. It was a manifestation that they completely agree with our determination of the shortcomings of their original Terms and Conditions in providing the clarity sought by the complainant.
In this case, while the terms and conditions of AE Credit Card was signed by Complainant, the way the latter’s data was to be processed for purposes of legal compensation or set off remained opaque and buried in legalese. The terms and conditions did little to provide Complainant transparency regarding the use of his data.
The Civil Code provides for the elements in order for a legal
compensation to take place, however, nothing stops Respondent ODB
or any personal information controller from setting out its terms and
conditions in a clear, plain, and concise language. This is in fact what
Respondent ODB did when it made some changes in its terms and
conditions governing the issuance and use of the AE Credit Cards. In
the version signed by Complainant, Paragraph 19 (b) of the Terms and
Conditions for issuance and use of the AE credit card states:
XXX XXX
b.) All monies, securities, and things of value that are now or
hereafter be in the hands of the ISSUER or any of its related
companies or both, on deposit or otherwise to the credit of or
belonging to the CARDMEMBER, shall be deemed assigned to the
ISSUER effective upon the occurrence of default. The ISSUER is also
authorized, without need of notice to the CARDMEMBER to
automatically debit his/her deposit account for such amounts may
be sufficient to cover full payment of the outstanding balance, or to
sell at public or private sale such securities or things of value owned
by CARDMEMBER and the n to apply the proceeds of such sale to
any outstanding obligation of CARDMEMBER;
c.) Any Funds of the CARDMEMBER that may now or later be in
the hands of the ISSUER or any of its Related Companies will be NPC Case no.
applied and set off against any amounts due and p ayable on the
CARDMEMBER’s CARD account.
CAR DMEMBER hereby gives ISSUER and its Related Companies
full power and authority to implement the foregoing acts 8.
XXX XXX
On the other hand, Respondent ODB ’s new terms and conditions
as provided for the use of AE credit card pertaining to consequences
of default states:
XXX XXX
ISSUER may, and is hereby authorized by the CARDMEMBER to
set off as full or partial payment, and/or withhold, to the extent
permitted by law, at ISSUER’s option and without need of prior
notice, all monies, funds, and/or proceeds of securities,
investments or receivables which may come into the possession or
control of the ISSUER and/or its Related Companies, to apply the
same in satisfying any or all obligations of the CARDMEMBER to
the ISSUER, whether left with them for safekeeping or otherwise,
or coming into any of their hands in any way, to settle any and all
obligations of the CARDMEMBER to the ISSUER. CARDMEMBER
irrevoca bly authorizes ISSUER and/or its Related Companies to
debit such amounts as may be necessary to implement this
provision from any of the CARDMEMBER’s accounts with the
ISSUER and/or its Related Companies, immediately after which
due notice shall be sent to the CARDMEMBER. In addition, all such
properties, receivables or securities in the possession or control of
the ISSUER and/or its Related Companies are hereby ceded,
transferred and conveyed by way of assignment unto ISSUER in
order that the same may be u sed to satisfy any and all obligations
of the CARDMEMBER to the ISSUER in accordance with this
provision. For such purpose, and to effectively carry out the powers
herein granted, CARDMEMBER hereby unconditionally or
irrevocably names and constitutes ISSUE R and/or its Related
Companies to be his/her true and lawful attorneyinfact, with full
power of substitution, to do or cause to be done any and all acts that
are necessary to carry out the purposes of this paragraph, including
the power to sell in accordance with law, based on zonal value or
fair market value for real or personal properties, respectively,
without the need for any further notice, demand or deed, and to
apply the proceeds of the sale to the satisfaction of the
CARDMEMBER’s obligations to the ISSUER. The appointment of
ISSUER and/or its Related Companies is coupled with interest and
is, therefore, irrevocable until any and all obligations to the ISSUER
are fully settled. For the foregoing purposes, the CARDMEMBER
hereby waives his/her rights in favor of the ISSUER and/or its
Related Companies under Republic Act 1405 (The Bank Secrecy Act
of 1955), as amended, Section 55 of Republic Act 8791 (The General
Banking Law of 2000), as amended, Republic Act 6426 (Foreign
Currency Deposit Act of the Philippines of 1974), as amended,
Republic Act 10173 (Data Privacy Act of 2012) and other
laws/regulations, including all subsequent amendments or
supplements thereto, relative to the confidentiality or secrecy of
bank deposits/accounts, placements, investments and similar or
related assets in the custody of the ISSUER and/or its Related
Companies. CARDMEMBER shall hold ISSUER and/or its Related
Companies, their directors, officers, employees, representatives
and agents, free and harmless from any liability arising from
ISSUER’s, and/or its Related Companies’ exercise of their remedies
and authorities hereunder, or from any action taken by ISSUER
and/or its Related Companies on the basis of and within the
framework of the foregoing appointment 9.
XXX XX X
The very fact that Respondent ODB made changes in its terms
and conditions is at the very least an acknowledgment of the lack of
full transparency in the terms and conditions signed by Complainant.
The dispositive portion of the 04 December 2017 decision states that
Respondent ODB should SUBMIT their privacy notices and consent
form that adequately informs the data subject of his rights within
fifteen (15) days from receipt of the Decision. This Commission did not
ORDER Respondent ODB to change its privacy notices and consent
form. The Commission merely asked Respondent ODB to SUBMIT
privacy notices and consent form that adequately informs that data
subject of his rights. Thus, if Respondent ODB truly believed that it did
not violate the principle of transparency as set forth in its motion for
partial reconsideration, it could have simply submitted the terms and
conditions signed by Complainant.
10 of
Nevertheless, this Commission finds this an appropriate
response by Respondent ODB to make its Terms and Conditions more
understandable to the subject and we expect the business to benefit
from this action. This simple step that could be complemented by
other accountability measures to be taken by Respondent ODB , could
help mitigate potential tension between them as data controller and
the d ata subjects like the complainant, in the future. This was a
response that proves better allocation of time, effort and resources by
Respondent ODB to address age-old transparency matters with
fairness to the data subject in mind.
Therefore, this Commissi on stands by its decision that
Respondent ODB violated the principle of transparency. To reverse the
same would be to frustrate the operationalizing of the Data Privacy
Act of 2012. With the passage of this important law, personal
information controllers s hould put themselves in the shoes of its
stakeholders, clients, or customers to ensure that the language used in
privacy notices, consent forms, or terms and conditions is at the latter’s
level. Personal information controllers must be mindful of their
cli entele and should no longer rely on privacy policies or terms and
conditions written in legalese.
This Commission believes that conforming to the principle of
transparency will both benefit Respondent ODB ’s clients and its
business.
WHEREFORE, for all the foregoing, Respondent ODB’s MOTION FOR RECONSIDERATION is hereby DENIED.
SO ORDERED.
Pasay City, Philippines.
9 August
RAYMUND ENRIQUEZ LIBORO
Privacy Commissioner
I CONCUR:
IVY D. PATDU
Deputy Commissioner
DISSENTING OPINION
AGUIRRE, D.P.C.
This case raises for the Commission’s consideration the issue of
whether respondent ODB violated the principle of transparency under
RA 10173 or the Data Privacy Act of 2012 (“DPA”) 10 by not informing
complainant O DC when it opted to exercise its right to debit from his
ODB Savings Account the outstanding balance from his AE Credit
Card.
In its 04 December 2017 Decision (“Decision”),8 the Commission held that ODB violated the principle of transparency, thus:
The respondent should have properly informed the complainant of its ability and intention to set off its legal claim. Even though the information required can be found within the terms and conditions of the credit card
agreement signed by the complainant, the way the complainant’s data was to
be processed remained opaque and buried in legalese. What is wanting from
the Respondent is the transparency expected from banks when dealing with the
public.
Not satisfied with the Decision, respondent ODB filed their Motion for
Partial Reconsideration praying that this Commission reverse its
finding that it violated the principle of transparency. As summarized
by the majority in their Resolution:
[R]espondent ODB argued that (1) the Civil Code allows for legal setoff or
compensation for as long as the elements under Article 1278 and 1279 are
“An Act Protecting Individual Personal Information In Information And Communications
Systems In The Government And The Private Sector, Creating For This Purpose A National
Privacy Commission, And For Other Purposes.”
ODC v. ODB and AE , NPC Case No. 17001, 04 December 2017.
Ibid., at p. 9. NPC Case no.
complied with and that the law does not require notification before setoff; (2)
the logic behind Article 1 290 of the Civil Code as to the nonrequirement of
notice in case of legal compensation is due to the fact that a party may remove
the money against which the setoff would be applied once notice is served; and
(3) the ruling that it violated the principle of transparency under the DPA run
counter to the provisions of the Civil Code on legal compensation which is
provided for in the Civil Code and not under the DPA.
In denying ODB ’s Motion for Partial Reconsideration, the majority
dismissed ODB ’s discuss ion on the civil law concept of legal setoff or
compensation saying that “the same is irrelevant as this was not
questioned by the Commission nor did this Commission adjudge
respondent ODB to have violated the Civil Code.” 14 The majority then
went on to qualify its previous ruling despite the clear implication of
the text, saying:
When this Commission ruled that Respondent ODB should have properly
informed Complainant of its ability and intention to set off its legal claim,
this Commission did not mean Respondent ODB should have notified
Complainant prior [sic] the actual setoff. Rather, it meant that the credit card
terms and conditions of Respondent ODB should have complied with the
principle of transparency.
Expounding on the general data privacy principle of transparency, the
majority further stated:
The transparency principle as contemplated in the DPA and as differentiated
from what the legal profession have become accustomed to, is centered on the
reasonable expectations of the user to be inf ormed and must go beyond legal
compliance. Privacy Notices and Terms and Conditions (T&C’s for brevity) are
prime examples where a company can show its transparency to customers.
These are essential for legal purposes and a demonstrable proof of
organizati onal accountability to the DPA. However, the presence of Privacy
Notices and T&C’s alone, does not automatically translate to being transparent.
They could be meaningless to data subjects if they are not concise and easy to
understand and do not effectivel y explain the benefits, risks, potential harm,
and even pain of data use and the choices and options available to them.
Businesses and their lawyers must realize that personal data processing is now
set against a milieu that enunciates the rights to priv acy and data protection.
They must recognize that legal transparency is different from usercentric
transparency. The former may be understandable to legal professionals and
appreciated by the legal community while the latter should be understandable
Resolution, NPC Case No. 17001, pp. 23.
Ibid., at p. 3.
Id. NPC Case no.
to the data subject and satisfy their desire to understand how their personal
information will be used. The former addresses their broad legal mandate. The
latter fulfills compliance to the DPA. The former uses legalese. The latter uses
clear and plain language that is easy to understand. Clearly, they must
comprehend that the rules in the processing of personal data have changed.
The principle of transparency is indeed, as the majority has put it,
“critical in establishing trust and confidence by a business to a
customer and should evoke a sense of fairness and a response that
encourages more meaningful participation by data subjects.” 17 There
is no question about that. As to how the majority interpreted and
applied it to this case, however, I respec tfully dissent.
In saying that respondent ODB ’s discussion on the civil law concept of
legal setoff is irrelevant, the majority overlooks the significance of
respondent ODB ’s arguments. First, it bears stressing that the
Commission is not tasked with and has no authority to examine the
propriety of the legal setoff and determine whether respondent ODB
violated the Civil Code. That is a matter for the regular courts to
decide, not the Commission. Second, ODB ’s discussion, premised on
the clear implication of this Commission’s Decision stating that
“r espondent should have properly informed the complainant of its
ability and intention to set off its legal claim,” 18 seeks to show that the
matter of the legal setoff is governed by a specific provision of law
and, as such, its validity cannot be attacked collaterally using the Data
Privacy Act.
In their Motion for Partial Reconsideration, respondent ODB argues:
To allow the data subject/complainant to question the setoff provision, to
which he gave his consent, when he accepted his ODB AMEX Card (see A nnex
“1” hereof), by ruling that ODB violated the principle of transparency under the
Data Privacy Act, runs counter to the provisions of the Civil Code on legal
compensation / setoff and the elements required to effect said legal
compensation / setoff. It must be noted that the matter of setoff /
compensation is governed by a different law, i.e. the Civil Code of the
Philippines, and not the Data Privacy Act.
In disregarding the Civil Code provisions on legal setoff and insisting
that the DPA is an overarching law the provisions of which supersedes
the requirements of other laws governing specific circumstances, the
majority is pushing the NPC to play the role of an overbearing
regulator . The majority puts the Commission in a position where it acts
without any sense of the delicate balance it still has to play in ushering
data privacy as a new cog in already functioning mechanism s. Such a
position paves the way for creative litigants to weaponize the DPA for
purposes not germane to the intent of the l aw.
The supposed violation of the
principle of transparency was
neither raised as an issue in the
Complaint nor is it supported by
substantial evidence.
The Complaint hinges on the following assertions of the complainant:
AE is a credit card company while ODB is in banking. I did not sign any
authority for AE to debit my ODB account. Also, the business of AE was only
acquired by the ODB group and thus, it is impossible for me to have signed any
authority to debit.
As correctly summarized by respondent ODB :
What the date subject / complainant accused the Bank of is the supposed
violation of the Data Privacy Act, in that he was under the mistaken notion that
AE and ODB are different entities, and that the sharing of his deposit
information is a violation of said law. He only claimed that he did not sign any
agreement to debit his account or to autodebit his account.
In its Decision dated 04 December 2017, the Commission already ruled
on the issue of consent st ating that the complainant voluntarily gave
his consent when he agreed to and signed the terms and conditions.
On the issue of data sharing, the Commission also held that since ODB
and AE are one and the same entity in this jurisdiction, “the
informati on was not shared with any affiliate or subsidiary of ODB
[and as such] there is no need to further discuss consent of the data
subject and the absence of a data sharing agreement…”
Since the complainant did not move for the reconsideration of these
fac tual findings of the Commission, these findings are final as to him.
Considering also that the Complaint was based on only those two
issues, that should have been the end of it. Instead, the majority found
respondent ODB to have violated the principle of t ransparency and
gave it a stern warning.
In discussing the substantial evidence requirement for administrative
agencies in the exercise of their quasijudicial powers, the Supreme
Court has repeatedly held that “ complainants bear the burden of
proving the allegations in their complaints by substantial evidence. If
they fail to show in a satisfactory manner the facts upon which their
claims are based, the respondents are not obliged to prove their
exception or defense. ”
In this case, the majority found a supposed violation that was not only
never alleged by the complainant but, more importantly, not
supported by any evidence on record, much less substantial evidence.
Aside from the complainant’s bare assertion that he “d id not sign any
authority for AE to debit my ODB account [and that he] did not enroll
said ODB account to any autodebit facility,” 25 there is nothing else on
record to support the majority’s finding that ODB violated the
principle of transparency.
Denial, without more, cannot rise to the level of substantial evidence.
This is all the more true in this case since the very thing the
complainant is denying has already been decided by the Commission
in favor of the respondent.
To allow, as the majority d oes in this case, the mere claim of a data
subject of supposedly not knowing of or understanding the effects of
the contract they signed to result in a violation of the Data Privacy Act
would cause great uncertainty in existing contracts with legitimate
ends.
Requirements of the Principle of
Transparency
The Resolution of the majority perpetuates the misconception that
using legal language violates the principle of transparency
While the Data Privacy Act of 2012 does not define “transparency,” the
Implementing Rules and Regulations provide:
a. Transparency. The data subject must be aware of the nature,
purpose, and extent of the processing of his or her personal data,
including the risks and safeguards involved, the identity of personal
information controller, his or her rights as a data subject, and how
these can be exercised. Any information and communication relating
to the processing of personal data should be easy to access and
understand, using clear and plain language.
Contrary to the majority’s condemnation of the use of legal language
in privacy notices, consent forms, or terms and conditions in its
exposition on the difference between legal transparency and user -
centric transparency, the requirement to use “clear and plain
language” does not prohibit the use of legal language. The principle of
transparency does not also require personal i nformation controllers to
use layman’s terms to replace technical words and concepts at the risk
of not capturing the complex concepts they represent.
In explaining the “clear and plain language” requirement in the
European Union’s (“EU”) General Data Protection Regulation
(“GDPR”), the independent European working party that dealt with
issues relating to the protection of privacy and personal data known
as the Article 29 Working Party explained in its Guidelines on
Transparency (“Guidelines”):
The requi rement for clear and plain language means that information should
be provided in as simple a manner as possible, avoiding complex sentence and
language structures. The information should be concrete and definitive; it
should not be phrased in abstract or a mbivalent terms or leave room for
different interpretations. In particular the purposes of, and legal basis for,
processing the personal data should be clear.
It further added that in structuring sentences, language qualifiers such
as “may”, “might”, “some”, “often” and “possible” should be
avoided.
Aside from the “clear and plain language” requirement, another
element of the principle of transparency is that the “information and
communication relating to the processing of personal data should be
easy to access and understand .” 29 To help us understand the meaning
of “easy to access and understand,” the interpretation of similar
language in the GDPR is useful.
Under the GDPR, it is required that the information or communication
to be provided to data subjects should be “concise, transparent,
intelligible and easily accessible.” 30 Although this specific language
did not find its way into either the Data Privacy Act or its IRR, it is
nevertheless helpful to consider given that the principle of
transparency was adopted from the European Commission’s Directive
95/46/EC, the predecessor of the GDPR.
In the Article 29 Working Party’s Guidelines, which has since been
endorsed by the European Data Protection Board, 31 they elaborated on
the meaning of each of these additional elements, thus:
Guidelines on transparency under Regulation 2016/679 of the Article 29 Working Party,
April 2018, available at https://ec.europa.eu/newsroom/article29/item -
detail.cfm?item_id=622227 .
Ibid.
IRR, Sec. 18.
Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data
Protection Regulation), 27 April 2016.
European Data Protection Board Endorsement 1/2018, 25 May 2018, available at
https://edpb.europa.eu/sites/edpb/files/files/news/endorsement_of_wp29_documents_en_0.
pdf.
The European Data Protection Board, composed of the data protection authorities of the Member
States and the European Data Protection Supervisor, is an independent body with legal
personality responsible for ensuring the consistent application of the General Data Protection
Regulation. NPC Case no.
- The requiremen t that the provision of information to, and communication
with, data subjects is done in a ‘concise and transparent’ manner means that
data controllers should present the information/ communication efficiently
and succinctly in order to avoid information f atigue. This information should
be clearly differentiated from other nonprivacy related information such as
contractual provisions or general terms of use …
- The requirement that information is ‘intelligible’ means that it should be
understood by an ave rage member of the intended audience . Intelligibility is
closely linked to the requirement to use clear and plain language. An
accountable data controller will have knowledge about the people they collect
information about and it can use this knowledge to determine what that
audience would likely understand. For example, a controller collecting the
personal data of working professionals can assume its audience has a higher
level of understanding than a controller that obtains the personal data of
children .
xxx
- The ‘easily accessible’ element means that the data subject should not have
to seek out the information ; it should be immediately apparent to them where
and how this information can be accessed, for example by providing it directly
to them, by linking them to it, by clearly signposting it or as an answer to a
natural language question …
i. What information is required to
be disclosed to data subjects?
In our jurisdiction, we generally recognize the relationship between
the credit card issuer and the credit card holder as a contractual one
that is governed by the terms and conditions found in the card
membership agreement. 33 Such terms and conditions constitute the
law between the parties.
To determine the content of the privacyrelat ed information that
should be provided to data subjects, we look at the prescribed
information covered by the data subject’s right to information:
Guidelines on Transparency under Regulation 2016/679 of the Article 29 Working Party,
April 2018, available at https://ec.europa.eu/newsroom/article29/item -
detail.cf m?item_id=622227 . Emphasis and underscoring supplied.
Pantaleon v. American Express International, Inc (2010). GR No. 174269 .
BPI Express Card Corporation v. Armovit (2014). GR No. 163654. NPC Case no.
ODC vs ODBand AE Page
19 of
(1) whether personal information pertaining to him shall be, are
being, or have been processed;
(2) a desc ription of the personal information to be entered into
the system;
(3) scope and method of the personal information processing;
(4) the recipients or classes of recipient to whom they are or may
be disclosed;
(5) methods utilized for automated access, i f the same is allowed
by the data subject, and the extent to which such access is
authorized;
(6) the identity and contact details of the personal information
controller or its representative;
(7) the period for which the information will be stored; and
(8) the existence of their rights, i.e. to access, correction, as well
as the right to lodge a complaint before the Commission.
Following the abovementioned Guidelines on Transparency, the
required information should be distinguished, from other nonprivacy
related information such as contractual provisions or general terms of
use. 36 Notably, the list of required information under Section 16 of the DPA does not include legal remedies provided under existing laws,
such as the right to setoff under the law on obligations and contracts
in the Civil Code that is subject of the present case. As such, the subject
provision on the “Consequences of Default” is not one of those
contemplated by and intended to be covered by the principle of
transparency. Expres sio unius est exlusio alterius.
Given this , the language for provisions that encompass legal concepts
should not be overly burdened with unreasonable impositions of
simplification on the supposed reliance on the transparency principle.
ii. What is the required manner of
disclosing the required
information to data subjects?
Even assuming that it is one of those provisions that is required to be
disclosed to data subjects, the other question that needs to be answered
is whether the information provided is “intelligible” such that it can be
understood by an average member of the intended audience.
At the outset, it should be clarified that compliance with the principle
of transparency does not require the personal information controller
to determine if the data subject actually understood how their
information will be processed. What is required is whether the
information provided by the personal information controller, both in
terms of the content and manner in which it was provided, would have
allowed the data subject to understand if they wanted to.
Elaborating on this, the majority points out in its Resolution, “if a
company holds data related to children, then the reading level of the
content must be accessible for those children. In the same sense that if
a company handles data related to a common person then the reading
level should be understood by a common person.”
While the majority’s statements in its Resolution are not incorrect, they
fail to consider that the principle of transparency is contextspecific.
Simply stating “common person” is not enough because the “common
person” for a simple transaction may be different from the “common
person” for a complicated transaction. As the Guidelines explain, the
important thing to consider is the “average member of the intended
audience … [such that] a controller collecting the personal data of
working professionals can assume its audience has a higher level of
understanding than a controller that obtains the personal data of
children.”
The 2013 version of the AE Terms and Conditions provide:
- Consequences of Default . The following shall be consequences of default,
whether singly, concurrently, or successively:
xxx
b) All monies, securities, and things of value that are now or may hereafter be
in the hands of the ISSUER or any of its Related Companies or both, on deposit
or otherwise to the credit of or belonging to the CARDMEMBER, shall be
deemed assigned to the ISS UER effective upon the occurrence of default. The
ISSUER is also authorized, without need of notice to the CARDMEMBER, to
automatically debit his/her deposit account for such amount as may be
sufficient to cover full payment of the outstanding balance, or to sell at public
or private sale such securities or things of value owned by CARDMEMBER and
then to apply the proceeds of such sale to any outstanding obligation of
CARDMEMBER;
c) Any funds of the CARDMEMBER that may now or later be in the hands of
the I SSUER or any of its Related Companies will be applied and set off against
any amounts due and payable on the CARDMEMBER’s CARD account.
From the earlier discussion on the requirement of “clear and plain
language,” there is no basis to find the 2013 vers ion as violative of the
transparency principle. The information provided is definitive; it does
not leave room for different interpretations. The sentences do not
contain language qualifiers such as “may”, “might”, or “possibly.” Its
real intent is eviden t, by using terms such as “automatically debit”,
“apply”, and “set off.” The heading itself, “Consequences of Default”
indicates that it talks about the remedial measures that the respondent
bank may resort to. It is neither ambiguous nor overly broad. The
language is that which is typically found in contracts involving credit
transactions of similar nature.
Aside from this, the complainant, by his own admission, has been a
cardholder of AE Platinum since 2005 and a depositor of ODB since
- 40 From t he website of AE , it can be seen that complainant’s AE
card is the highest tier nondollar charge credit card offered by AE and
requires a minimum annual income of Php 1,800,000.00 in order to
qualify. 41 It is reasonable to expect that average member of the
intended audience, i.e. persons with at least that level of income among
others, would have a sufficient level of understanding to appreciate
such terms as “default,” “credit,” “debit,” “obligation,” “deposit
account” as well as the other informati on being provided to them in
the AE Credit Card Terms and Conditions.
The change in the Terms and
Conditions is not an acknowledgment
of a lack of transparency in the Terms
and Conditions signed by the
complainant .
In an effort to provide additional justification for respondent ODB ’s
supposed violation of the transparency principle, the majority
examined two (2) versions of AE Credit Card’s Terms and Conditions:
the 2013 version, as attached by respondent ODB , and the 2019 version,
as found in the ODB website. 42 Finding variations in the provisions,
the majority stated that “the very fact that Respondent ODB made
changes in its terms and conditions is at the very least an
acknowledgment of the lack of full transpare ncy in the terms and
conditions signed by [the] complainant.” 43 Although this analysis by
the majority is appreciated, I cannot agree with their conclusion after
comparing the two provisions.
2013 Version 2019 Version
- Consequences of Default . The
following shall be consequences of
default, whether singly, concurrently,
or successively:
xxx
b) All monies, securities, and things of
value that are now or may hereafter be
in the hands of the ISSUER or any of its
- Consequences of Default. The
following shall be the consequences of
default, whether singly, concurrently, or
successively:
xxx
b) “the ISSUER may, and is hereby
authorized by the CARDMEMBER to set
off as full or partial payment, and/or
Related Companies or both, on deposit
or otherwise to the credit of or
belonging to the CARDMEMBER, shall
be deemed assigned to the ISSUER
effective upon the occurrence of
default. The ISSUER is also
authorized, without need of notice to
the CARDMEMBER, to automatically
debit his/her deposit account for such
amount as may be sufficient to cover
full payment of the outstanding
balance, or to sell at public or private
sale such securities or things of value
owned by CARDMEMBER and then to
apply the proceeds of such sale to any
outstanding obliga tion of
CARDMEMBER;
c) Any funds of the CARDMEMBER
that may now or later be in the hands of
the ISSUER or any of its Related
Companies will be applied and set off
against any amounts due and payable
on the CARDMEMBER’s CARD
account.
withhold, to the extent permitted by law,
at ISSUER’s option and without need of
prior notice all the monies, funds, and/or
proceeds of securities, investments or
receivables which may come into the
possession or control of the ISSUER
and/or its Related Companies, to apply
the same in satisfying any or all
obligations of the CARDMEMBER to the
ISSUER, whether left with them for
safekeeping or otherwise, or coming into
any of their hands in any way, to settle any
and all obligations of the CARDMEMBER
to the ISSUER. CARDMEMBER
irrevocably authorizes ISSUER and/or its
Related Companies to debit such
amounts as may be necessary to
implement this provision from any of the
CARDMEMBER’s accounts with the
ISSUER and/or its Related Companies,
immediately after which due notice shall
be sent to the CARDMEMBER . In
addition, all such properties, receivables
or securities in the possession or control of
the ISSUER and/or its Related Companies
are hereby ceded, transferred and
conveyed by way of assignment unto
ISSUER in order that the same may be
used to satisfy any and all obligations of
the CARDMEMBER to the ISSUER in
accordance with this provision. For such
purpose, and to effectively carry out the
powers granted herein, CARDMEMBER
hereby unconditionally or irrevocably
names and constitu tes ISSUER and/or its
Related Companies to be his/her true and
lawful attorneyinfact xxx For the
foregoing purposes, the CARDMEMBER
hereby waives his/her rights in favor of
the ISSUER and/or its Related
Companies under…Republic Act
(Data Privacy Ac t of 2012) and other
laws/regulations, including all
subsequent amendments or supplements
thereto, relative to the confidentiality or
secrecy of bank deposits, accounts,
placements, investments and similar or
related assets in the custody of the ISSUER
and /or its Related Companies.
Contrary to how the majority finds the 2019 version as an “appropriate
response by Respondent - ODB to make its Terms and Conditions more
understandable to the subject [sic],” 46 even a cursory reading of the
two versions woul d show that they are substantially the same on all
the important points except that subsections (b) and (c) in the
version have now been merged into subsection (b) in the 2019 version.
The terms “debit,” “apply,” “setoff,” and other legal terms are s till
used such that it can hardly be said that the 2019 version has already
cured the supposed issues the majority found in the previous version.
In fact, rather than being the “appropriate response” the majority
claims it to be, the 2019 version is more problematic for data subjects
since it contains an improper waiver of rights under the DPA. Surely
a waiver of the fundamental human right to informational privacy
enshrined in the DPA cannot be said to have “fairness to the data
subject in mind” as the m ajority claims.
In light of all these considerations, I vote to GRANT the Motion for
Partial Reconsideration based on a finding that there was no violation
of the principle of transparency.
(sgd)
LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner
Footnotes
-
Records, p. 19. ↩
-
Decision dated 04 December 2017 at p. 9; Penned by Privacy Commissioner Raymund E. Liboro with Deputy Privacy Commissioner Ivy Patdu concurring. ↩
-
Id., at p. 9. ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector (Data Privacy Act of 2012) Chapter III Section 11. ↩
-
Recital 39 of the European General Data Protection Regulation (GDPR) available at http://www.privacyregulation.eu/en/recital-39GDPR.htm ↩
-
Fergal McGovern, The GDPR and Plain Language: What you need to do to comply, available at https://www.cmswire.com/digital-experience/the-gdpr-and-plain-language-what-you-need-to-do-to-comply/, October 18, 2017. ↩
-
National Privacy Circular 17-01 Registration of Data Processing Systems and Notification Regarding Automated Decision Making. ↩
-
Guidelines on Transparency under Regulation 2016/679 of the Article 29 Working Party, 11 April 2018, available at https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=622227. ↩