NPC Issuance Wiki

NPC 19-909: In re: FCASH Global Lending, Inc., Operating Fastcash Online Lending Application

Issued Resolution

Resolution Text

IN RE: FCASH GLOBAL LENDING, INC., OPERATING FASTCASH ONLINE LENDING APPLICATION

x----------------------------------------------------x

NAGA, P.C.;

Before us is a Motion for Reconsideration dated 28 February 2022 (Motion) by Respondents FCash Global Lending Inc., KDM, TH, JPS, JCT, and ZS (Respondents) assailing the Decision dated 23 February 2021 (Decision), copy of which was received through counsel on 17 February 2022. The challenged Decision disposed as follows:

WHEREFORE, all the above premises considered, this Commission hereby:

  1. FINDS Respondent FCash Global Lending Inc. and its Board of Directors to have violated Section 25, 28, and Section 31 of the Data Privacy Act of 2012; and

  2. FORWARDS this Decision and a copy of the pertinent case records to the Secretary of Justice, recommending the prosecution of the Respondents for the crimes of Unauthorized Processing of Personal Information and Sensitive Personal Information under Section 25 of the DPA, Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes under Section 28 of the DPA, and Malicious Disclosure under Section 31 of the DPA. The maximum penalty for violations of the abovementioned provisions is recommended to be imposed following Section 35 of the DPA.1

Respondents’ Motion reiterated the grounds they relied upon in their Motion to Dismiss, to wit:

  1. The Decision was issued not in compliance with the National Privacy Commission (NPC) Rules of Procedure, hence, with grave abuse of discretion amounting to a lack or excess of jurisdiction;

  2. The Decision ignored the rule on exhaustion of remedies under Section 4, Rule II of the NPC Rules;

  3. The Decision ignored the rule on litis pendentia, there being pending cases involving Respondent FCash filed by specific individual complainants who appear to be the same parties in the case;

  4. The Decision violates and renders nugatory the provisions of the DPA on amicable settlement and alternative modes of dispute resolution which are expressly promoted by law;

  5. The Decision arbitrarily, unfairly, and erroneously impleaded the corporate officers of Respondent FCash despite the lack of evidence, let alone allegations, that any of them participated in the alleged acts nor committed any gross negligence.2

Thus, Respondents pray for the reconsideration and the setting aside of the Decision dated 23 February 2021, which in effect dismisses the case against FCash.

The Commission now resolves the Motion.

The Commission has, time and time again, adequately ruled on this matter. The Commission already addressed these issues in its Resolution dated 02 October 2019 for the Motion to Dismiss dated 16 September 2019 and the Resolution dated 23 January 2020 for the Motion for Reconsideration dated 10 December 2019.

Furthermore, in relation to the Petition for Certiorari under Rule 65 of the Rules of Court filed by Respondents with the Honorable Court of Appeals in reference to its denied Motion for Reconsideration dated 23 January 2020, the Commission argued that “[a]t the outset, it bears to point that the resort to certiorari is not the proper remedy to assail the denial [of Respondent’s] motion to dismiss.”3 The Commission reminded that it is settled in jurisprudence that the writ of certiorari is “available only where the tribunal, board or officer exercising judicial functions has acted without or in excess of their jurisdiction, or with grave abuse of discretion, and there is no appeal, or any plain, speedy and adequate remedy in the ordinary course of law. The special civil action should not be allowed as substitute for any ordinary appeal or where there are other remedies available.”4 Nevertheless, the Commission shall take this final opportunity to clarify matters with Respondents.

I. The assailed Decision was issued in compliance with the NPC Rules of Procedure

Respondents argue that the proceeding was not conducted in compliance with NPC Circular 16-04 or the NPC Rules of Procedure (Rules) as there was no complaint filed but instead a Fact-Finding Report, which Respondents argued does not satisfy the requirement to initiate a sua sponte investigation. Such matter has already been resolved by the Commission in its 02 October 2019 Resolution.

To reiterate, Section 23 of Rule IV of the Rules provides for the power of the Commission to investigate on its own initiative the circumstances surrounding a possible serious privacy violation or personal data breach, taking into account the risks of harm to a data subject. Consequently, the investigation shall be made in accordance with Rule III of the same Rules following the principle of uniform procedure sufficiently complied with in this case.5

The Fact-Finding Report dated 29 August 20196 (FFR) that was served to Respondents contains a narration of the material facts and the supporting documentary evidence which showed, among other things, the violations allegedly committed by Respondent FCash in operating its online lending application.7 The same FFR was submitted to the Commission for its perusal to determine whether violations of the Data Privacy Act of 2012 (DPA) were committed. Considering that the FFR contains all the findings of the investigating division of the NPC, such document is the complaint initiating the administrative proceedings in cases of sua sponte investigation. As sua sponte means “of one’s own accord”, the NPC, through the CID, has initiated, on its own, a complaint against Respondent by filing the FFR.

Further, in accordance with the Rules, Respondents, then, were given an opportunity to submit an Answer, as prescribed by Rule IV of the Rules wherein the Responsive Comment or Answer is immediately required from Respondents after it receives the Fact-Finding Report, to wit:

SEC. 24. Uniform procedure. – The investigation shall be in accordance with Rule III of these Rules, provided that the respondent shall be provided a copy of the factfinding report and given an opportunity to submit an answer. In cases where the respondent or respondents fail without justification to submit an answer or appear before the National Privacy Commission when so ordered, the Commission shall render its decision on the basis of available information.8

As discussed by this Commission in its NPC 19-910 Resolution, “the procedure for a sua sponte investigation does not include a Discovery Conference because all the information and evidence in the hands of the Commission are already set out in and attached to the Fact-Finding report when it is provided to respondent.”9

It was emphasized by the Commission in NPC 19-910 Resolution that:

[W]hile Section 24 of Rule IV of the Rules provides that the investigation be in accordance with Rule III, it includes a provision: ‘that the respondent shall be provided with a copy of the Fact-Finding Report and given an opportunity to submit an answer.’ Rule IV does not state that the procedure should be exactly identical to the one described under Rule III. As used in Section 24 of Rule IV, ‘in accordance with Rule III’ simply means as far as practicable taking into consideration and giving effect to the difference between the two (2) procedures.10

Further, to recall, in the Resolution dated 02 October 2019:

[T]he provision on the Uniform Procedure under the Rules should be read in light of the unique situation arising from the sua sponte nature of the present investigation. Under the NPC Rules, discovery is a procedure employed by parties to avail of, to compel the production of, or to preserve the integrity of electronically stored information. This procedure need not be resorted to by the Commission, however, in its exercise of its power of original inquiry. This is all the more true in this case considering that there are no private parties that can be called to confer for discovery. It must be emphasized that this case was initiated by a team of investigators in the Commission in response to serious allegations of data privacy violations allegedly committed upon a large number of data subjects.11

Respondents claimed that the FFR already contained conclusions and recommendations for the prosecution of all the respondents for alleged violation of the provisions of the DPA.12 To recall, it has been pointed out by this Commission that “no judgement of any kind has been made on this case for or against Respondents.”13 As previously discussed, the FFR is treated as the complaint in cases that are initiated through a sua sponte proceeding. The FFR is not the view of the Commission En Banc but rather a brief narration of the material facts and the supporting evidence which shows among other things, the cause of action of the complainant against the respondent.

Further, as the FFR is the complaint in cases of sua sponte investigations, Respondents were given the opportunity to be heard by ordering them to file their Answer or Comment to the submitted FFR. However, despite these opportunities given by the Commission to Respondents, the orders were left unanswered and ignored. Instead, Respondents questioned the authority of the Commission to determine this case.

Given this, the investigation and procedure of recommending a possible violation of the DPA has all been done in accordance with the powers vested in the Commission to institute sua sponte cases provided by the DPA and the Rules. Respondents should note that the response of the Commission upon receiving the FFR was an Order to File an Answer and not a decision.

The fact that there exist hundreds of pending cases before the Commission against Respondents is no bar to the filing of the case on hand but instead highlights the seriousness of the data privacy violations and risks of harm to data subjects. The Commission notes that the other pending cases against the Respondents and the case at hand involves different parties with different causes of action and prayers for relief.

As held by the Supreme Court in Yap v. Court of Appeals14

Litis pendentia as a ground for the dismissal of a civil action refers to that situation wherein another action is pending between the same parties for the same cause of action, such that the second action becomes unnecessary and vexatious. The underlying principle of litis pendentia is the theory that a party is not allowed to vex another more than once regarding the same subject matter and for the same cause of action. This theory is founded on the public policy that the same subject matter should not be the subject of controversy in courts more than once, in order that possible conflicting judgments may be avoided for the sake of the stability of the rights and status of persons.

The requisites of litis pendentia are: (a) the identity of parties, or at least such as representing the same interests in both actions; (b) the identity of rights asserted and relief prayed for, the relief being founded on the same facts; and (c) the identity of the two cases such that judgement in one, regardless of which party is successful, would amount to res judicata in the other.15

In the present case, none of the foregoing requisites were met. As it was repeatedly emphasized, the pending cases against the Respondents and the case at hand involves different parties with different causes of action and prayers for relief.

As argued by the Commission in its Comment dated 02 August 2021 for the case C.A. – G.R. SP No. 168046:

The cause of the individual complaints is to enforce the individuals rights vested by the DPA. Meanwhile, a complaint which arose from a sua sponte investigation is hinged on the [Commission’s] responsibility, as representative of the State, ‘to protect the fundamental human rights of privacy, of communication while ensuring free flow of information to promote innovation and growth.’ The individual complaints were only cited in the Fact-Finding Report to demonstrate the seriousness of the possible data privacy violation.

The [FFR] itself shows that the Task Force conducted an independent investigation against [FCash]. It reviewed [FCash’s] Privacy Policy, the user reviews alleging serious privacy violations, and the mobile application itself. The investigators evaluated how [FCash’s] application operates and the extent to which the privacy of its users is protected by examining the Android Manifest, including ‘permissions’ required by the application. The Fact-Finding Report itself states: ‘Examination of publicly accessible information and the initial technical evaluation of FCash and the Fast Cash online lending application shows that the company has failed to demonstrate compliance with the DPA.’

Clearly, the investigators made findings beyond the scope of the individual complaints filed by the data subjects. These includes inaccessible information regarding [FCash’s] Data Protection Officer, failure to exercise efforts in response to privacy complaints, inadequate Privacy Policy, and presence of dangerous permissions violating the principle of proportionality.16

II. The assailed Decision did not ignore the rule on exhaustion of remedies under Section 4, Rule II of the NPC Rules.

Respondents contend that the Commission failed to observe the mandatory exhaustion of remedies requirement under Section 4, Rule II of the NPC Rules as Respondents were not granted the opportunity to “take timely or appropriate action on the claimed privacy violation or personal data breach”17 before a complaint can be filed.

As held by the Commission in NPC 19-910, to wit:

The Respondent’s interpretation that the Commission should first reach out to respondents to be ‘given the opportunity to institute appropriate actions to rectify the alleged criminal violations of the DPA’ is purpose-defeating, if not plainly absurd. Sua sponte investigations are only conducted under specific premises under the Rules of Procedure, thus:

SEC. 23. Own initiative. – Depending on the nature of the incident, in cases of a possible serious privacy violation or personal data breach, taking into account the risks of harm to a data subject, the Commission may investigate on its own initiative the circumstances surrounding the possible violation. Investigations may include onsite examination of systems and procedures. If necessary, the Commission may use its enforcement powers to order cooperation of the personal information controller or other persons, with the investigation or to compel appropriate action to protect the interests of data subjects.

As seen with the abovementioned criteria for a sua sponte investigation, complaints are only initiated in cases of a possible serious privacy violation or personal data breach. In these actions, the Commission considers evident risks of harm to a data subject. The privacy violation or personal data breach that can be directly acted upon by the Commission is qualified with a degree of seriousness that makes it different from complaints under Rule III. This degree of seriousness is considered in relation to the level of risks posed to the data subjects, and may be manifested in different ways such as the scale of processing or the number of reports received by the Commission.

Thus, in cases of sua sponte investigations, it is futile for the Commission to exhaust remedies by communicating with the respondent. The provision on the exhaustion of remedies is meant to provide an opportunity for parties to amicably settle among themselves and rectify the situation. This is only resorted to when the possibility of rectification still exists.

The nature and purpose of sua sponte investigations make such exhaustion of remedies futile because by the time the Commission detects a privacy violation or personal data breach, the opportunity for rectification is no longer available. The requirement of exhaustion of remedies is thus inapplicable to sua sponte investigations.

Furthermore, such provision for the exhaustion of remedies is not an absolute rule that renders all nonconforming complaints invalid. The Commission has previously discussed the purpose for the exhaustion of remedies in an earlier Decision:

This rule was intended to prevent a deluge of vexatious complaints from those who waited for a long period of time to pass before deciding to lodge a complaint with the NPC, unduly clogging its dockets. Notably, however, the same Section provides that the Commission has the discretion to waive such period for filing upon good cause shown, or if the complaint involves a serious violation or breach of the DPA, taking into account the risk of harm to Complainant.18

Respondents also argue that the conduct of a sua sponte investigation is unnecessary as there were already several pending complaints against it.

As held by the Commission in NPC 19-910, the Commission wishes to highlight:

Nowhere in its Decision did the Commission ‘admit that the sua sponte investigation was conducted in lieu of the several complaints received by the Honorable Commission against Respondent[.]’ On the contrary, the Decision explicitly stated that the sua sponte investigation is independent and separate from the individual cases by stating that ‘the pending cases and the case on hand involve different parties, different causes of action with different prayers of relief.’

xxx

The individual complaints were only cited to demonstrate the seriousness of the possible data privacy violation.19

The sua sponte investigation was conducted due to the potential harm to the data subjects. This is in consideration of the Commission’s mandate in the DPA to ensure a personal information controller’s compliance with the law20 and institute investigations when necessary.21 This is likewise in consideration of the provision in NPC Circular 202101, which allows conduct of sua sponte investigations of possible privacy violations or personal data breaches.22 Hence, the sua sponte investigation of the Commission was conducted due to its mandate and function and not because of several complaints.

III. The assailed Decision did not ignore the rule on litis pendentia, there being pending cases involving Respondent FCash filed by specific individual complainants who appear to be the same parties in the case

Further, Respondents claim that the conduct of a separate proceeding involving the same subject matter as cases which are currently being investigated and pending for adjudication by this Commission through its investigating officers violates the principle of litis pendentia.

As previously discussed, the pending cases before the Commission filed by different complainants is entirely different from the case initiated by a sua sponte investigation. These cases have different parties, different causes of action with different prayers of relief. The cited complaints in the FFR were, to reiterate, used to emphasize the gravity and seriousness of the violation of data privacy. Respondents erred in saying that they are being vexed for the same subject matter.

IV. The assailed Decision does not violate nor renders nugatory the provisions of the DPA on amicable settlement and alternative modes of disputes resolution which are expressly promoted by law.

As to the contention that the Decision is totally in conflict with the other decisions of this Commission approving the amicable settlement entered into by specific complainants, the Commission wishes to remind Respondents that the previous decisions of the Commission approving the amicable settlements are entirely different from the case initiated by the sua sponte investigation. These cases which are settled and dismissed by virtue of an amicable settlement are not decided based on the merits of the case but due to the mutual understanding of the parties. The final amicable settlement that contains the terms and conditions of the parties for the settlement of the case has the force and effect of law between these parties. No provision of the DPA was used to arrive at the settlement. As held by the Supreme Court in the case of Miguel v. Montañez:

Being a by-product of mutual concessions and good faith of the parties, an amicable settlement has the force and effect of res judicata even if not judicially approved. It transcends being a mere contract binding only upon the parties thereto, and is akin to a judgment that is subject to execution in accordance with the Rules.23

Further, “[w]hile the Rules on Mediation embodied in NPC Circular No. 18-03 did not provide a distinction between cases which can and cannot undergo mediation, NPC Circular No. 16-04 categorically states that ‘no settlement is allowed for criminal acts.‘”24

The Commission also wishes to emphasize that the purpose of the mediation settlement is to help parties arrive at an acceptable compromise. Considering that the cause of action in a complaint borne out of a sua sponte investigation is the State’s duty to protect the right to privacy and not to prosecute to claim reparation on behalf of private individuals, no compromise can be had between the State and the Respondent.

Hence, the previous decisions of the Commission confirming the amicable settlement of the parties are not contrary to the Decision as no interpretation and application of the DPA was used nor preceding decisions of the Commission was applied. The decisions of the Commission were merely a recognition of the agreement of the parties to settle the case based on their mutual understanding and not through the remedial procedures of this Commission.

V. The assailed Decision does not arbitrarily, unfairly, and erroneously impleaded the corporate officers of Respondent FCash despite the lack of evidence, let alone allegation, that any of them participated in the alleged acts nor committed any gross negligence.

Lastly, Respondents contend that impleading its corporate officers of despite the lack of evidence, let alone allegations, that any of them participated in the alleged acts or committed any gross negligence is arbitrary, unfair, and erroneous.25 This Commission points out that the DPA is clear that the liability of the responsible officers in cases where the offender is a corporation does not rely on active participation alone. Gross negligence is explicitly stated in the DPA as a ground for criminal liability, to wit:

SEC. 34. Extent of Liability. – If the offender is a corporation, partnership or any juridical person, the penalty shall be imposed upon the responsible officers, as the case may be, who participated in, or by their gross negligence, allowed the commission of the crime. If the offender is a juridical person, the court may suspend or revoke any of its rights under this Act. If the offender is an alien, he or she shall, in addition to the penalties herein prescribed, be deported without further proceedings after serving the penalties prescribed. If the offender is a public official or employee and he or she is found guilty of acts penalized under Sections 27 and 28 of this Act, he or she shall, in addition to the penalties prescribed herein, suffer perpetual or temporary absolute disqualification from office, as the case may be.26

There is no reason for the Commission to reverse its earlier finding that the Respondent officers are liable for gross negligence. As stated in the Decision of this Commission in the case of NPC 19-910:

The Supreme Court has consistently defined gross negligence as ‘the negligence characterized by the want of even slight care, or by acting or omitting to act in a situation where there is a duty to act, not inadvertently but willfully and intentionally, with a conscious indifference to the consequences of, insofar as other persons may be affected. It is the omission of that care that even inattentive and thoughtless men never fail to give their own property.’27

The fact that the Board of Directors (BOD) failed to act on the voluminous and alarming privacy issues of their borrowers negates the legal presumption that the BOD employed ordinary care in the discharge of their duties and instead, presumes that the BOD knew about these collection practices and approved of it. There are one hundred and sixty-six (166) complaints against Respondent as of July 2019. The Complaint also attached user reviews on Respondent application in Google Play Store. The user comments narrated experiences on how the Respondent gains access to mobile phonebook/directory/contact list for the purpose of disclosing their transactions without their consent and authority.28 It can be reasonably said that the privacy complaints against Respondent have reached into the public’s consciousness.29 Thus, it is the responsibility of the BOD to show to this Commission that they have employed the necessary diligence expected from them. However, no evidence was presented by the Respondent to rebut this presumption against them. Further, despite the BOD’s responsibility to show the Commission that it employed necessary diligence, it unfortunately still refuses to present any evidence demonstrating that it addressed, or at the very least, did not allow such actions.

Citing the SEC registration records of the Respondent, the Complaint specifically named KDM, TH, JPS, JCT, and ZS as the original incorporators, registered directors, and officers of Respondent. Thus, the abovementioned violations of the DPA shall be imputed against all of them due to their gross negligence following Section 34.30

Considering the foregoing, Respondents have not provided any new or material allegations that would merit the reversal of the Decision.

WHEREFORE, all the above premises considered, this Commission hereby resolves to DENY the Motion for Reconsideration filed by FCash Global Lending Inc. The Decision of the Commission dated 23 February 2021 is hereby AFFIRMED.

SO ORDERED.

City of Pasay, Philippines.

28 April 2022.

JOHN HENRY D. NAGA

Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

DUG CHRISTOPER B. MAH

Deputy Privacy Commissioner

Copy furnished:

BTLO Counsel for FCash Lending Inc.

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Decision dated 23 February 2021 ↩

  2. Motion to Dismiss dated 16 September 2019 ↩

  3. FCash Global Lending Inc., rep by KDM vs National Privacy Commission, Comment of Respondent National Privacy Commission dated 02 August 2021 ↩

  4. Id. ↩

  5. Resolution dated 02 October 2019. ↩

  6. In re: FCash Global Lending Inc Fact-Finding Report dated 29 August 2019 ↩

  7. Resolution dated 02 October 2019 ↩

  8. Section 24, Rule IV of NPC Circular 16-04 ↩

  9. NPC 19-910, Resolution dated 11 March 2021 ↩

  10. Id ↩

  11. Resolution dated 02 October 2019 ↩

  12. R.A. 10173 ↩

  13. Resolution dated 02 October 2019 ↩

  14. G.R. No. 186730, June 13, 2012 ↩

  15. Id. ↩

  16. Supra Note 3, page 23 ↩

  17. Section 4 (b), Rule II of NPC Circular No. 16-04 ↩

  18. NPC 19910, Resolution ↩

  19. Id. ↩

  20. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter II, § 7(a) (2012). ↩

  21. Id. § 7(b). ↩

  22. NPC Circular No. 202101, rule X, §§ 56. ↩

  23. Miguel v. Montañez, G.R. No. 191336, 25 January 2012 ↩

  24. NPC 19-910, Resolution ↩

  25. Motion for Reconsideration dated 28 February 2022 ↩

  26. Section 34 of R.A. 10173 ↩

  27. Fernandez vs Office of the Ombudsman, GR No. 193983, March 14 2012. ↩

  28. Fact-Finding Report dated 29 August 2019, pg. 11-13. ↩

  29. See: https://manilastandard.net/business/bizplus/335368/sec-voids-license-of-fcash-global.html. ↩

  30. Fact-Finding Report dated 29 August 2019, pg. 9-10. ↩

Backlinks