Resolution Text
MNLC, INC., represented by
IKP,
Complainant,
-versus-
PXXX CORPORATION, RCM AND AD
Respondents.
x----------------------------------------x
For consideration of the Commission is the Motion filed by the respondents PXXX Corporation, RCM, and AD seeking reconsideration of the Order dated 11 September 2019, which stated the following:
Discussion
The DPA provides that it is the policy of the State to protect the fundamental human right of privacy.1 This policy taken together with the DPA’s interpretation provision that states “[a]ny doubt in the interpretation of any provision of this Act shall be liberally interpreted in a manner mindful of the rights and interest of the individual about whom personal information is processed,” signifies that the protection of the rights of the data subject is considered public interest as contemplated in Section 7(c) of the DPA.
xxx
In view of the foregoing, a temporary ban on the processing of personal data is hereby issued against the respondent PXXX Corporation. The temporary ban shall cover the following:
- The processing of personal data of the MNLCI’s church members who have not yet provided their identification documents to respondents for validation; and
- The requirement for the use of PXXX-issued IDs for the MNCLI church members who have already submitted their passports and IDs.
PXXX Corporation is hereby ordered to (1) return to MNLCI’s church members all the copies of their passports and valid IDs; (2) delete or dispose all copies of the passports and valid IDs, digital or otherwise; and (3) to allow MNLCI to provide IDs for their church members and officers bearing only their photos and English names.
On 25 September 2019, the respondents filed their Motion for Reconsideration which argues that “[t]o consider the complaint of MNLC as one permeated with public interest would create an absurdity.”2 The respondents also stated, in their Motion, that they have conformed and observed, “not just a sole condition mandated in the [Data Privacy] Act but several of which, if not all.”3
The Commission denies the Motion for Reconsideration.
The respondents argue that “public interest refers to what will benefit, affects or related [to] the public in general not those merely of a particular class. MNLC is a corporation, a particular and specified class, composed of church members which are mostly foreign individuals, certainly they cannot be considered public in general for the protection against public interest to apply.”4
The respondents enumerate cases decided by the Supreme Court that gave “illustrations of entities imbued with public interests” which they claim to have “common denominators,” yet they also admit that “the High Court did not categorically define public interest.”5 They also cited the case of Valmonte v. Belmonte Jr. which held that:
In determining whether or not a particular information is public concern there is no rigid test which can be applied. “Public concern” like “public interest” is a term that eludes exact definition. Both terms embrace a broad spectrum of subjects which the public may want to know, either because these directly affect their lives, or simply because such matters naturally arouse the interest of an ordinary citizen. In the final analysis, it is for the courts to determine on a case by case basis whether the matter at issue is of interest or important, as it related to or affects the public.6
This supports the basis of the Order dated 11 September 2019. Based on the pronouncements of the Supreme Court, the respondents cannot limit the definition of “public interest” on the basis of the number of individuals involved. The Supreme Court has even pronounced the term “public” is a “comprehensive, all-inclusive term” and said that “properly construed, it embraces everyone.”7
What the Data Privacy Act of 2012 (DPA) provides is that the Commission may “impose a temporary or permanent ban on the processing of personal information, upon finding that the processing will be detrimental to national security and public interest.”8 The Commission upholds the investigating officer’s position in the DPA provision stating “it is the policy of the State to protect the fundamental human right of privacy” is considered public interest as contemplated in Section 7(c) of the law. This declaration of policy in the DPA, having been enacted by Congress and the President, as representatives of the people, is a manifestation of a matter relating to the general welfare of the public.
Given all these, respondents’ position that it is absurd to consider the complaint of MNLC as one that is permeated with public interest is not convincing.
It must be emphasized that the personal data involved (citizenship, passport number, and individual’s ID number as determined by the issuing authority) fall under the enumeration of sensitive personal information which can only be processed based on the criteria provided under Section 13 of the DPA.9
The respondents anchor their claim of observing and conforming to the DPA on having obtained the consent of the members of MNLC to use the MXXX ID. They cite an email dated 28 June 2019 from IKP, an elder of MNLC, that stated:
I am now writing this letter to you as Head of the Elder Committee of MNLC that we MNLC officially confirm that all our church member including Pastors and Elders will use MXXX … for purposes of smooth and quick entrance to process for normal and spiritual worship on Sunday…because serving normal and spiritual worship for their Good God is really most important and worthy matter in their whole life.10
Indeed, consent is one criteria for the lawful processing of sensitive personal information under the DPA. A proper reliance on consent by a personal information controller, however, requires adherence to the provisions of the law.
The DPA provides that the consent of a data subject must be a “freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so.”11
In determining whether consent was freely given, the data subject must be given a real choice – that is, without any element of pressure or influence which could affect the outcome of the choice, resulting from an imbalance between the controller and the data subject. In relation to the requirement that consent be specific, such consent cannot be overly broad. For instance, “bundled” consent will generally not suffice as the data subject is not empowered to make a true choice.12 This means that consent to an enumeration of various, unrelated purposes of processing combined in a single paragraph cannot be considered specific because the data subject will be bound to sign off on the entire provision in toto.13 Consent given through an informed indication of will may include a signature, an opt-in box, sending a confirmation email, or oral confirmation, among other means.
The email that respondents cited in their Motion, supposedly an indication of consent as a lawful basis for processing, must be contextualized. This Commission notes that this email was written after several events that have already unfolded involving the respondent corporation and their policies and the MNLC church members. The respondents have not refuted the allegations in the Complaint-Affidavit dated 19 July 2019 which stated thus:
On 12 May 2019, tempers flared resulting in exchange of words between MNLCI members and PXXX’s guards. In a letter dated 15 May 2019, PXXX banned two (2) respected church members, Senior Pastor MH and LSB, from entering the Building from 14 to 19 May 2019.
xxx
Guard dogs are posted at the entrance and churchgoers are delayed for as long as an hour and a half before they can enter the Building.” They attach pictures of the long line at the entrance endured by MNLCI’s members on 23 June 2019, thereby leaving mostly vacant seats by 11:00AM, which is the start of our time of worship during Sundays. Such form of harassment was implemented by PXXX by significantly reducing the entrance line to one, intended to force churchgoers to surrender their passports and valid ID’s for processing by PXXX’s employees, supposedly for the production of PXXX-issued ID’s that shall be paid for by MNLCI’s members.14
While the consent evidenced by the email dated 28 June 2019 may be considered as specific and an informed indication of will, such cannot be considered “freely given” as contemplated in the law. An imbalance already exists between the controller and data subject, considering that the respondents control the MNLC members’ access to their worship service which they describe as a “really most important and worthy matter in their whole life.”15 As cited in the Motion, the email confirming the use of the MXXX ID was “purely for the purpose of smooth and quick entrance process for normal and spiritual worship on Sunday.”
Even assuming that the email from IKP can be taken as validly obtained consent, the collection of sensitive personal data for the mandatory issuance of uniform IDs to the members of MNLC still cannot find justification under the law for failing to meet the requirements of the proportionality principle.
In their Motion, the respondents state that “to ensure safety, security measures are needed to be imposed and part of which is to identify the tenants of the buildings, visitors coming to and from and requiring them to wear identification cards.”16
In arguing the observance of proportionality, the respondents state that “while indeed it is true that other tenants provide an ID of their own…[t]he reason why respondents allow them is due to the fact that other tenant’s [sic] employees have 201 files (employee record) with them.”17
Notably, this is a new argument that is inconsistent with their earlier position on the supposed need for stricter security measures imposed on the members of MNLC. During the summary hearings, respondent AD, acting as the respondent corporation’s Legal and Corporate External Affairs Head, stated that while the MNLC-issued IDs showed both the Korean and English names of the church members, the Korean characters were bigger and more prominent. He stated that this was a security threat to the other tenants of the building, because only the church members can read and understand the Korean characters. Also included in the annexes of the Complaint-Affidavit is a letter dated 16 May 201918 from the respondent corporation, through respondent AD, stating that “…after much review of your identification cards, our security and safety consultants have observed that the archetype of the MNLCI Identification Cards are without a doubt susceptible to security breach, which may include but not limited to meagre [sic] identification control system and counterfeit.”
The investigating officer’s Order imposing a temporary ban on processing by PXXX corporation was issued based on the evidence on record, pursuant to the NPC Rules of Procedure.19 The respondents cannot now assail such Order using arguments that have not been previously presented, much less substantiated.
Nevertheless, it remains undisputed that these stricter security measures applied only to MNLCI’s church members and not to the other tenants of the building.
The Implementing Rules and Regulations of the DPA elaborates on the requirements of the principle of proportionality stating that the “processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.”20
The MXXX Building House Rules and Regulations explain their access policies in this way:
- ACCESS AND OPERATING HOURS
xxx
3.4 Office visitors and clients may be allowed entry when properly identified and acknowledged by the person/s to be visited and prior processing by building security. Person/s not properly identified or covered by an authorization from unit owners or tenants shall not be allowed entry beyond regular hours.21
In determining what information can be collected for and displayed on the ID card, the respondents must consider the purpose for such ID. The above-cited House Rules and Regulations signifies that the ID is an exhibit of such authorization to enter from the building tenant. There is no documented policy which declares that the ID card should serve other purposes, nor is there anything that requires the tenant to be supported by 201 file records or to have specific security measures. Notably, the respondents in this case wrote to a letter dated 24 June 2019 to the Bureau of Immigration, which stated:
Dear [Bureau of Immigration] Commissioner Jaime H. Morente,
xxx [We] are dumbfounded by the blatant disregard of the simple NO-ID, NO-ENTRY Policy of the MNLC. In this regard, we ardently request your office to look into this matter as there might be Korean Nationals of the MNLC who have expired VISA or undesirable aliens or fugitives from other countries.22
All these premises considered, the Commission finds that there are no substantial grounds to overturn the investigating officer’s Order imposing a temporary ban on the processing of personal data by PXXX Corporation.
WHEREFORE, all premises considered, the Motion for Reconsideration of the Order dated 11 September 2019 is hereby DENIED and the respondents are ordered to submit an affidavit of compliance to the Order’s directive to (1) return to MNLCI’s church members all the copies of their passports and valid IDs; (2) delete or dispose all copies of the passports and valid IDs, digital or otherwise; and (3) to allow MNLCI to provide IDs for their church members and officers bearing only their photos and English names.
Let the records of this case be REMANDED to the Complaints and Investigation Division for the continuation of the proceedings.
Pasay City, 18 November 2019.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
IVY D. PATDU Deputy Privacy Commissioner
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
COPY FURNISHED:
ABELLERA AND CALICA LAW OFFICES Counsel for Complainant
MTCP Counsel for Respondents
ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission
Footnotes
-
Motion for Reconsideration, p. 3. ↩
-
Ibid., p. 5. ↩
-
Ibid., p. 3. ↩
-
Ibid., p. 3. ↩
-
G.R. No. 74930 (1989). Emphasis in the original. ↩
-
Subido v. Ozaeta (1948), G.R. No. L-1631. ↩
-
[[laws/data-privacy-act-of-2012#section-13-sensitive-personal-information-and-privileged-information|SEC. 13. Sensitive Personal Information and Privileged Information.]] – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases: (a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing; (b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information; (c) The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing; (d) The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, That such processing is only confined and related to the bona fide members of these organizations or their associations: Provided, further, That the sensitive personal information are not transferred to third parties: Provided, finally, That consent of the data subject was obtained prior to processing; (e) The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured; or (f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority. ↩
-
Motion for Reconsideration, p. 6. ↩
-
NPC Advisory Opinion 2018-063 dated 23 October 2018. ↩
-
Id. ↩
-
Records, pp. 3&5. ↩
-
Motion for Reconsideration, p. 6. ↩
-
Ibid at p. 7. ↩
-
Id. ↩
-
Complaint Affidavit, Annex E. Records, p. 34. ↩
-
See NPC Circular 16-04, § 19. Dated 15 December 2016. ↩
-
IRR, § 18(c), emphasis supplied. ↩
-
Records, pp. 190-191. Emphasis supplied. ↩
-
Ibid., at p. 62. ↩