NPC 18-010: RLA v. PLDT Enterprise

Resolution Text

RLA,
Complainant,

-versus-

PLDT ENTERPRISE
Respondent.

Resolution

AGUIRRE, D.P.C.;

This Commission resolves the Motion of Reconsideration filed by PLDT Enterprise on the Decision dated 17 December 2020.

Facts

On 17 December 2020, the Commission issued a Decision and held PLDT Enterprise (PLDT) liable for violation of RLA’s (RLA) rights under the Data Privacy Act of 2012 (DPA), particularly Section 28 (Processing of Personal Information for Unauthorized Purposes) and Section 32 (Unauthorized Disclosure) of the DPA:

WHEREFORE, all these premises considered, this Commission resolves to AWARD Complainant[,] RLA[,] nominal damages in the amount of Fifty Thousand Pesos (P50,000.00) for Respondent PLDT Enterprise’s violation of Complainant’s rights under the Data Privacy Act.

Moreover, this Commission also resolves to REMAND this case to the Complaints and Investigation Division for the limited purpose of determining and identifying the responsible persons, officers, or individuals of PLDT Enterprise who caused the violations of Sections 28 and 32 of the DPA prior to recommending the matter to the Secretary of Justice for criminal prosecution.

SO ORDERED.¹

On 26 July 2021, PLDT received the Decision.²

On 05 August 2021, PLDT filed its Motion for Reconsideration arguing the following:

PLDT, in compliance with existing laws, acted under a legal obligation to process RLA’s personal data, which is one of the conditions for lawful processing under Section 12 (c) of the DPA and the Implementing Rules and Regulations of the DPA (IRR)³;
None of PLDT’s “responsible persons, officers, or individuals” should be held criminally liable for violations of the DPA, as PLDT acted under a legal obligation to process RLA’s personal information⁴; and
For Corporate Accounts, PLDT acts as Personal Information Processor (PIP) for its Enterprise clients.⁵

PLDT asserts that it should not be held liable for violating Sections 28 and 32 of the DPA. It cites its legal obligation to process personal information under Section 149 of Revised Order No. 1, otherwise known as the Public Service Commission Rules and Regulations (Section 149 of Revised Order 1) and National Telecommunications Commission (NTC) Memorandum Circular No. 05-06-2007, otherwise known as the Consumer Protection Guidelines (NTC MC 05-06-2007):

[A]t the time the application of the Complainant was processed, through Knutsen Philippines, Inc. (“Knutsen”), Respondent was mandated by Section 149 of the Revised Order No. 1, otherwise known as the Public Service Commission Rules and Regulations (“Order No. 1”) and National Telecommunications Commission Memorandum Circular No. 05-06-2007, otherwise known as the Consumer Protection Guidelines (“NTC Circular”), to issue a listing directory of the names, addresses, and telephone numbers of all of its subscribers at least once a year. Acting on such mandate, Respondent processed and published Knutsen’s existing accounts in the White Pages, the listing directory for PLDT’s corporate accounts (“White Pages”).⁶

Section 149 of Revised Order 1 provides:

Section 149. Telephone Directory. – Each telephone public service shall at least once a year issue a listing directory showing therein the names of all subscribers arranged in alphabetical order, their addresses and telephone numbers and such other information as may be of interest to a subscriber’s everyday use of his telephone. Each subscriber shall be entitled to a free copy of the directory.⁷

Section 2.2 of NTC MC 05-06-2007 states:

Section 2.2 - Any data supplied by the consumer shall be treated as confidential by the entity or service provider mentioned under Section 1.1 hereof and shall not be used for purposes not authorized by him. Upon subscription, he shall be informed of his right to privacy and the manner by which his data would be protected. In cases where a public directory listing of subscribers is regularly published by the service provider, the consumer shall be given the option not to be listed in succeeding publications.⁸

PLDT further explains its legal obligation under NTC MC 05-06-2007 as follows:

Section 2.2 of NTC [MC 05-06-2007] shows that the subscriber is given the option not to be included in succeeding public directory listings of subscribers. From this provision, it can be gleaned that the subscriber may request for his/her exclusion in the subsequent publication of the directory listing. If s/he did not exercise this right to be excluded, his/her name will be included in the directory listing. As worded, the NTC Circular did not impose an obligation to secure from subscribers the affirmative act of consenting to the publication of his/her contact information before a service provider can include the subscriber’s information in the directory. Thus, while Respondent is obligated to publish a directory listing with the names, addresses, and telephone numbers of its subscribers, the Respondent must remove or refrain from publishing the details of any subscriber in the succeeding directory listing if the said subscriber opts not to be listed.⁹

PLDT argues that consent is not the sole criterion for lawful processing of personal information. It maintains that its act of processing is necessary to comply with a legal obligation, which is a basis for lawful processing under Section 12 (c) of the DPA¹⁰:

Clearly, consent of the data subject is only one of the allowed bases for processing of personal information. The processing of personal information is still allowed as long as any of the other lawful conditions provided under the DPA and DPA-IRR is present. In this case, Respondent published Complainant’s personal information in the 2017 directory listing in compliance with the requirement prescribed by Order No. 1 and the NTC Circular. Thus, Respondent is allowed to process and publish Complainant’s information in the listing directory as authorized under, and for the purpose of complying with, its legal obligation under Order No. 1 and the NTC Circular.¹¹

PLDT asserts that it fully complied with its legal obligation under NTC MC 05-06-2007:

It must also be noted that Respondent has complied with the qualifying clause under Section 2.2 of NTC Memorandum No. 05-06-2007. As will be further discussed, immediately upon receiving Complainant’s request, Respondent tagged the Corporate Individual Account under Knutsen as “Confidential” and confirmed that Complainant’s personal information would not be published in the succeeding directories.¹²

As to criminal liability, PLDT argues that it and its responsible persons, officers, or individuals should not be held criminally liable since it did not act with gross negligence¹³:

Assuming but without admitting that there was an unauthorized processing of Complainant’s personal information, Respondent submits that such does not rise to the level of gross negligence that would merit criminal sanction. Respondent notes that it immediately instituted the following measures in respect of this case: (i) upon receiving Complainant’s concerns, his account was promptly tagged as confidential; (ii) application forms were revisited to ensure compliance with the DPA; and (iii) policies and processes were redefined pursuant to the additional guidelines provided by this Honorable Commission in its Advisory Opinion No. 2018-021 dated 27 April 2018 (the “Advisory Opinion”). With these measures in place, none of Respondent’s “responsible persons, officers, or individuals” should be held criminally liable for violations of the DPA, because Respondent acted based on its understanding of its legal obligation to publish listing directory of the names, addresses, and telephone numbers of all of its subscribers.¹⁴

PLDT claims that it acted in good faith and even sought the guidance of the Commission on the matter:

To be sure, Respondent’s act of securing the Advisory Opinion from the Honorable Commission evinces its good faith desire and commitment to upholding the DPA in its operations.¹⁵

…

It is also worth noting that while the DPA has been in effect since 2012, the DPA-IRR was promulgated only in August 2016 and was fully implemented in 2017, and the recommended specific provisions and detailed guidance regarding services that involve the processing of personal data had not yet been implemented at the time that the Corporate Individual DSL of the Complainant was filed in 2015. With the implementation of this new law, Respondent, in good faith, voluntarily sought the guidance of this Honorable Commission on 16 November 2017 and 15 March 2018 in respect of the handling of telephone directory requirements under [Revised] Order No. 1 and NTC Circular.¹⁶

PLDT further provides that it revised its Corporate Individual DSL Application Form on 10 September 2018 based on the guidance provided by the Commission through Advisory Opinion No. 2018-021:

With the guidance provided by this Honorable Commission, through its Advisory Opinion, Respondent issued an email advisory dated 13 July 2018 informing all teams of the Enterprise Group that directory listing in its CRM system shall be defaulted to “CONFIDENTIAL” from the previous default of “PUBLISHED”. Respondent revisited its forms and implemented corresponding changes thereto. These new application forms were implemented starting 10 September 2018.¹⁷

PLDT argues that it only acted as a Personal Information Processor (PIP) for its Enterprise clients and that Knutsen Philippines, Inc. (Knutsen) is the Personal Information Controller (PIC):

The Respondent respectfully disagrees with the foregoing conclusion and reiterates that it is a PIP merely acting upon the instructions of its direct corporate customer, Knutsen, the PIC of Complainant’s personal information.¹⁸

It further added that:

As averred in the Comment to the Complaint, the Enterprise Group of the Respondent, which was made a party to this case, is in the business of providing communication services to corporate clients (i.e. juridical, non-individual customers). Consequently, the Enterprise Group does not directly provide services to individual subscribers or natural persons. Although the “ultimate recipients” of the communication services provided by the Respondent are composed of natural persons connected to the corporate clientele (e.g., primarily the corporate client’s designated employees), Respondent’s contract and transactions are only with corporate/group clients/customers. The relevant subscription agreements/ contracts are unequivocally signed between herein Respondent and the relevant corporate customer/client through its authorized officer or representative; in this case, Knutsen. In fact, the billing for services rendered is addressed to the corporate customer/client. Accordingly, it is such corporate clients/customers that provide to herein Respondent the required information to facilitate, among others, the installation of needed connectivity, equipment, and other requirements and the rendition of services, and directs Respondent as to the services to be rendered and for whom the services are to be provided.¹⁹

PLDT asserts that Knutsen provided RLA’s personal information to PLDT in order to allow PLDT to provide the necessary services:

Complainant had no participation in accomplishing the said form and that Complainant merely provided his personal information to Knutsen to allow Respondent to install the necessary connectivity for the rendition of the subscribed services. Since the application involved referred to a Corporate Individual DSL account, the details indicated therein were thereafter published by Respondent in the White Pages –Government and Business Book 2017, as required under Order No. 1.²⁰

It further justifies its position by arguing that the personal information collected from RLA is the standard information necessary for providing its services and according to the terms and conditions stated in its Corporate Individual DSL Application Form:

The information collected from the Complainant are standard information necessary for the purpose of providing the services under the DSL subscription (i.e. name, address, telephone number, and choice of plan). The provision of such services under the DSL subscription is “in accordance with the following terms and conditions and the rules and regulations issued by other appropriate government agencies, as provided in the back portion of the Application Form signed by MA. The publication of the same in the White Pages is one of the mandatory legal obligations of the Respondent which is necessarily read into the terms and conditions of the services provided by Respondent.²¹

PLDT further reasons that it was only tasked to process the personal information that Knutsen collected to allow it to provide DSL services to specific Knutsen employees:

As the corporate client, Knutsen collected the relevant personal data of the Complainant and provided such information to Respondent to enable the latter to provide the subscribed services. As noted by the Honorable Commission in its Decision, Complainant’s personal information was supplied by his employer, Knutsen, the subscription was named under Knutsen (but for the account of Complainant), Knutsen’s President and General Manager is the signatory in the Application form, and Knutsen’s address is indicated in the billing portion of the application form. Respondent only collected the information necessary to provide the service obtained by Knutsen for its employees. All of these facts are consistent with an outsourcing agreement for the processing of personal information between Knutsen and Respondent. Stated differently, Respondent is tasked with processing of the personal information of Knutsen’s employees for the purpose of providing the DSL services which Knutsen’s employees will use to perform their duties and responsibilities during their employment.²²

PLDT prays that the Commission reverse the Decision dated 17 December 2020 and dismiss the Complaint for lack of merit.²³

On 26 October 2021, RLA filed its Comment/ Opposition to PLDT’s Motion for Reconsideration.²⁴

Discussion

The Commission denies PLDT’s Motion for Reconsideration. The Commission finds no reason to overturn the Decision dated 17 December 2020 since PLDT has not provided any new or material allegation to justify a reversal of the Decision. Nevertheless, the Commission shall proceed to further clarify its reasons for denying PLDT’s Motion for Reconsideration.

I. PLDT is a Personal Information Controller.

PLDT acted as a PIC when it processed RLA’s personal information. As defined in the DPA, a PIC is “a person or organization who controls the collection, holding, processing or use of personal information.”²⁵ A PIC also includes “a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.”²⁶

In its Motion for Reconsideration, PLDT asserts that it was acting as a PIP or a “juridical person qualified to act as such…to whom a personal information controller may outsource the processing of personal data pertaining to a data subject.”²⁷ It contends that its Enterprise Group acted as a PIP since the installation and the publication of RLA’s personal information resulted from the instructions of the PIC, Knutsen.²⁸ It maintains that its Enterprise Group entered into a contract with Knutsen to provide the Corporate Individual DSL account to its employee, RLA, since it does not directly provide services to individual subscribers or natural persons.²⁹ It claims that Knutsen, as RLA’s employer, outsourced³⁰ or directed the transfer of RLA’s personal information to PLDT for the installation of the Corporate Individual DSL account to allow RLA to perform his duties and responsibilities during his employment.³¹ It asserts that it is Knutsen who “directs [it] as to the services rendered and for who[m] the services are provided.”³²

Contrary to PLDT’s assertions, PLDT is the PIC, and not the PIP. The test to determine if a person or an entity acts as a PIC or a PIP is if such person or entity controls the processing of personal information.

As discussed in the Decision dated 17 December 2020, PLDT decides the pieces of information that Knutsen collects from its employees, which Knutsen, in turn, supplies to PLDT³³:

[I]t is PLDT that decided what information were collected from Knutsen’s employees, including that of the Complainant, to apply for PLDT’s services. Knutsen merely supplied the personal information of its employees to PLDT, but the control over the personal information provided remained with PLDT.³⁴

The Implementing Rules and Regulations of the DPA (IRR) defines control as deciding on the information to be collected, or the purpose or extent of its processing.³⁵ Through its decision-making power, a PIC determines the purposes and means of processing personal information, the categories to be processed, and access to such personal information.³⁶ These are the very acts that PLDT performed.

In this case, PLDT maintains that “the information collected from [RLA] are standard information necessary for the purpose of providing the services under the [Corporate Individual] DSL subscription”³⁷ and that it was Knutsen who provided the required information to PLDT.³⁸ Although it was Knutsen who submitted RLA’s personal information to PLDT to facilitate the installation of the Corporate Individual DSL account, Knutsen and RLA would not have known what categories of personal information they needed to submit without PLDT’s instructions. Aside from this, it was PLDT that determined what “standard information” it will require from its prospective subscribers and the purpose for each category of personal information it collects.

To accept PLDT’s position will result in absurdity. It will shift the accountability for complying with the obligations under the DPA and absolve those that provide services of any responsibility whenever an employer submits the personal information of or pays for services for its employees.

Following PLDT’s logic, for instance, a company such as a health insurance provider, who processes a lot of sensitive personal information, will not be considered a PIC simply because it was the employer who chose which of its employees should be covered, provided their personal information to the insurance company, and paid the insurance premium. This is clearly not what the DPA contemplates.

The Terms and Conditions that PLDT requires its subscribers to consent to, further belies its claim that it is only acting as a PIP. The relevant portions of PLDT’s Terms and Conditions provide:

Acceptable Use Policy – In PLDT’s efforts to promote good citizenship within the Internet community, PLDT will respond appropriately in the event that it becomes aware of any inappropriate use of the service. PLDT reserves the right to monitor bandwidth, usage and content, and from time to time to operate the service to identify violators of the Acceptable Use Policy or any inappropriate use of its service and/or to protect the PLDT network and other PLDT subscribers.

If the PLDT Data Services is used in a way which in PLDT’s sole discretion, would be considered inappropriate, PLDT may take any action deemed appropriate, including but not limited to the temporary or permanent removal of content, cancellation of newgroup posts, filtering of Internet transmission, and the immediate suspension or termination of all or any portion of the PLDT Data Service, without incurring any liability for damages.

…

Amendment – PLDT reserves the right to amend any of the provisions of any of the foregoing terms and conditions. Any such amendment shall take effect fifteen (15) days from notice to the Subscriber, through whatever means.³⁹

Following the definition of a PIC, control of personal data is the determining factor in identifying the PIC. It is the controller that determines the purpose, scope, nature, and extent of the processing activity. In the case of PLDT’s Terms and Conditions, it expressly shows that PLDT undertakes certain processing activities such as monitoring the usage and the content that its subscribers access for its own purposes and benefit, i.e. “to protect the PLDT network and other PLDT subscribers.”⁴⁰ The Terms and Conditions also shows that PLDT processes all of these and can “take any action deemed appropriate” at its “sole discretion.” Lastly, despite its claim that it acts as a PIP for all of its Enterprise clients, PLDT claims for itself the authority to amend any provision of the Terms and Conditions without any need to consult, much less secure the consent of anyone, including its Enterprise clients that are supposed to be its PICs. All these are clearly inconsistent with the relationship between a supposed PIP and its PICs.

PLDT further maintains that it took the necessary steps to address RLA’s concerns on the publication of his personal information in the 2017 White Pages.⁴¹ Based on its representations, PLDT took steps to reclassify and tag RLA’s profile as “Confidential” so that his personal information will no longer be published in future listing directories.⁴² It also implemented measures to indicate the default setting of directory listings as “Confidential” instead of “Published”.⁴³

These acts show that PLDT can change the classification of subscribers and, corollary, choose when to publish subscriber information without any input from Knutsen or any of its enterprise clients who are supposed to be its PICs. These acts not only highlight PLDT’s control over the extent of the processing of its data subjects’ personal information, but also show the inconsistency of its claim with the limits of what PIPs can do on their own. Section 44(b)(1) of the IRR provides that the PIP shall be contractually bound to “[p]rocess the personal data only upon the documented instructions of the personal information controller.”⁴⁴ This is clearly not the case with PLDT. It would not have been able to do any of the foregoing acts had it been acting simply as a PIP.

For these reasons, it is clear that PLDT acted as the PIC. Its actions, together with its Terms and Conditions, demonstrate control over not only the types of personal information it required Knutsen and RLA to submit for the installation of the Corporate Individual DSL account but, more importantly, the purpose and extent of the processing it reserves for itself in providing DSL services to its subscribers.

II. There is no conflict between PLDT’s obligations under Section 149 of Revised Order 1 and NTC MC 05-06-2007 and the DPA.

The Commission finds no conflict between the obligations imposed on PLDT by the NTC, its primary regulator, and the DPA. In its analysis, the Commission is not enforcing NTC MC 05-06-07, but rather, it is fulfilling its mandate under the DPA to examine the presence of, and the proper application of the claimed lawful criteria to the processing undertaken by the PIC.

PLDT maintains that it published RLA’s personal information in the 2017 White Pages pursuant to a legal obligation stemming from its mandate under Section 149 of the Revised Order No. 1, and NTC MC 05-06-2007.⁴⁵

Section 149 of Revised Order 1 requires telephone public service providers, such as PLDT, to issue a listing directory at least once a year:

Section 149. Telephone Directory. – Each telephone public service shall at least once a year issue a listing directory showing therein the names of all subscribers arranged in alphabetical order, their addresses and telephone numbers and such other information as may be of interest to a subscriber’s everyday use of his telephone. Each subscriber shall be entitled to a free copy of the directory.⁴⁶

While it is true that Section 149 of Revised Order 1 mandates PLDT to publish a listing directory, this should not be read in isolation and must be taken together with Section 2.2 of NTC MC 05-06-2007. This is something that PLDT itself recognized when it identified both Revised Order 1 and NTC MC 05-06-2007 as the source of its legal obligation to publish a listing directory.⁴⁷

NTC MC 05-06-2007 is an administrative circular issued by the NTC. The nature of an administrative circular is “to supplement provisions of law or to provide means for carrying them out, including information relating thereto.”⁴⁸ NTC MC 05-06-2007 is intended to “fill in the details”⁴⁹ of Section 149 of Revised Order 1. Section 2.2 of NTC MC 05-06-2007 supplements Section 149 of Revised Order 1. It states:

Section 2.2 - Any data supplied by the consumer shall be treated as confidential by the entity or service provider mentioned under Section 1.1 hereof and shall not be used for purposes not authorized by him. Upon subscription, he shall be informed of his right to privacy and the manner by which his data would be protected. In cases where a public directory listing of subscribers is regularly published by the service provider, the consumer shall be given the option not to be listed in succeeding publications.⁵⁰

With the issuance of NTC MC 05-06-2007, PLDT’s obligation under Section 149 of Revised Order 1 is necessarily qualified by Section 2.2 of NTC MC 05-06-2007. The legal obligation to publish a listing directory at least once a year under Section 149 of Revised Order 1 still subsists but now carries with it the requirements under Section 2.2 of NTC MC 05-06-2007, as also acknowledged in the dissent.⁵¹

As the Commission held in its Decision dated 17 December 2020:

While the telephone service provider has the duty to publish yearly telephone directory, it now has the correlative duty to do so in a manner that upholds the data subject’s rights to data privacy.⁵²

Even a cursory reading of Section 2.2 of NTC MC 05-06-2007 will show that the obligations it imposes are not in conflict with the DPA. The obligations are clear and does not give rise to any credible or significant question that prevents PLDT from complying first with its provisions before soliciting guidance from this Commission.

In requiring public telecommunication entities to inform their subscribers of their right to privacy and how their data will be protected upon subscription, and to give their subscribers the option not to be listed in succeeding publications, Section 2.2 of NTC MC 05-06-2007 is consistent with the general privacy principle of transparency, the rights of data subjects, and the concept of consent under the DPA.

The DPA defines consent as follows:

Section 3. Definition of Terms. – Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

(b) Consent of the data subject refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so.⁵³

Contrary to PLDT’s claim that “the NTC Circular did not impose an obligation to secure from subscribers the affirmative act of consenting to the publication of his/her contact information before a service provider can include the subscriber’s information in the directory”⁵⁴, the public telecommunication entity’s publication of the personal information of its subscribers in a listing directory requires consent from its data subjects.

Section 2.2 of NTC MC 05-06-2007 imposes the following obligations on public telecommunication entities:

It shall treat the data as confidential and shall not use such data for purposes not authorized by the subscriber;
It shall inform the subscriber of the right to privacy and the manner by which his or her data would be protected;
It shall give the subscriber the option not to be listed in succeeding publications in cases where a public directory listing is regularly published by the service provider, and
It shall provide these pieces of information to its subscribers upon subscription.⁵⁵

Having been issued in 2007, it is not surprising that the wording in the NTC MC 05-06-2007 does not exactly mirror the concept of consent in the DPA. Nevertheless, the obligations under Section 2.2 of NTC MC 05-06-2007 resonate with the concept of consent that is freely given, specific, and an informed indication of will.

Upon subscription, a public telecommunication entity is required to inform its subscribers of their privacy rights, how their data will be protected, and the specific option to not be listed in the listing directory. If the subscribers exercise the option and choose not to be listed, then the public telecommunication entity may not publish their names and other personal information in the listing directory.⁵⁶ If the subscriber, however, chooses not to exercise the option, the subscriber is essentially consenting to the processing of his or her personal information for purposes of publishing the listing directory.⁵⁷

Aside from the obvious fact that subscribers should be given the free choice to exercise the option, whatever option they exercise should be “evidenced by written, electronic or recorded means.”⁵⁸ In the case of a subscriber who chooses not to exercise the option, evidence of that may be in the form of an unticked box in a form that provides all the requisite information. Although it is not ideal given the concept of consent under the DPA, as long as the information required to be given to subscribers is clearly provided, an unticked box still suffices to show the choice exercised by the subscriber for purposes of satisfying the requisites of Section 2.2 of NTC MC 05-06-2007.

In agreeing with PLDT’s position, the dissent argues that “PLDT’s legal obligation to publish is the default position, while an opt-out of the consumer is required for it to remove the personal information in the succeeding publications and thereby treat the same as confidential, consistent with Section 2.2 of the NTC MC 05-06-2007.”⁵⁹

Both PLDT and the dissent, however, neglected to discuss how the PLDT subscribers would even be able to exercise this opt-out considering that PLDT failed to specifically inform its data subjects of everything it needed to comply with under Section 2.2 of NTC MC 05-06-2007: 1) inform its subscribers of their privacy rights and how their data will be protected, and 2) the specific option to not be listed in the listing directory. Without fulfilling these conditions attached to its legal obligation, how would the subscribers even know that they can request this opt-out in the first place? Such an interpretation that renders useless the protections provided not just by NTC MC 05-06-2007 but also the DPA cannot be considered acceptable. It is a basic principle of statutory construction that “in interpreting a statute (or a set of rules as in this case), care should be taken that every part thereof be given effect… a construction that would render a provision inoperative should be avoided.”⁶⁰

Aside from this, PLDT also failed to acquire the consent of its subscribers before proceeding with the publication of personal information in the White Pages.

The dissent itself acknowledges that PLDT failed to comply with Section 2.2 of NTC MC 05-06-2007 but attempts to downplay its significance by claiming it only resulted in a violation of the general privacy principle of transparency, thus:

PLDT’s failure to abide by Section 2.2 of the NTC MC can be cited to be a violation of the transparency principle of the DPA which we can hold PLDT accountable for.⁶¹

Contrary to what the dissent claims, this violation of the principle of transparency is not a small thing. It affects the lawful basis relied upon by PLDT especially considering it resulted in rendering useless the protections provided by NTC MC 05-06-07 and consequently, the DPA.

At the time of RLA’s subscription in 2015, the Application Form that PLDT presented for the Corporate Individual DSL account only indicates the following statement:

The PLDT telephone service shall be provided by PLDT in accordance with the following terms and conditions and the rules and regulations as approved by the then Public Service Commission, now National Telecommunications Commission (NTC), as well as the rules and regulations issued by other appropriate government entities.⁶²

PLDT claims that the statement sufficiently complies with its legal obligation, which renders processing necessary for its compliance, simply because its Terms and Conditions, as stated in its Application Form, and its internal rules relating to the publication of directories, were approved by the then Public Service Commission.⁶³

The statement, however, is clearly not sufficient to adhere to the principle of transparency. This fact is also admitted by the dissent when it found that PLDT failed to provide “a valid and comprehensive privacy notice….”⁶⁴ Transparency requires that the information provided by the PIC, both in terms of content and the manner in which it was provided, would have allowed the data subject to understand the legitimate purpose of processing based on a legal obligation. As worded, the statement does not sufficiently make the lawful basis known to the data subject.

Based on the statement in its Terms and Conditions, PLDT cannot claim that its data subjects were aware of the nature, purpose, and extent of the processing of their personal information. Nowhere in the statement above does PLDT communicate its obligation to publish the personal information of its subscribers and inform RLA of his right to privacy and how his personal information would be protected. More importantly, it does not show that PLDT informed RLA of his option to not be listed in succeeding publications such as the 2017 White Pages. As stated in the Decision:

In this case, the recorded means that manifest the consent of the Complainant is PLDT’s Application Form and the attached PLDT’s Terms and Conditions that was printed on the back of the Form. We note however, that while the Terms and Conditions discuss the contractual relations that govern the usage, grant and maintenance of the DSL services between the Complainant and PLDT, the same does not include authority or consent to publish the list of names, contact information and address in the White Pages.⁶⁵

Despite the clear provisions of Section 2.2 of NTC MC 05-06-2007, PLDT failed to comply with the obligations provided therein from its issuance in 2007. PLDT had more than enough time to comply with its obligations and acquire its subscribers’ consent before publishing their personal information in the White Pages. As discussed in the Decision:

Thus, we find that the consent given by Complainant in filling up the application form relates only to the use and limitations of the DSL services offered by PLDT, and not as to the publication of Complainant’s personal information in the White Pages. Stated simply, the processing by PLDT was done for purposes not authorized by Complainant.⁶⁶

The Corporate Individual DSL Application Form for RLA’s account did not contain any of the information required under NTC MC 05-06-2007, including the option to be excluded from publication. As explained by the Commission in its Decision, this not only deprived RLA of the opportunity to give his consent but also prevented him from knowing that such an option even exists:

Pieces of evidence at hand, particularly the PLDT Application Form that was submitted by Knutsen on behalf of Complainant on 12 January 2016 to PLDT, revealed that said form did not include an option to be excluded from the public directories published by PLDT.

Without such option, the data subjects such as Complainant will not have an opportunity to give their consent to the publication of their personal information in public directories.⁶⁷

PLDT only complied with its obligations when it revised its Application Form on 10 September 2018 even though the DPA and its IRR were passed in 2012 and 2016, respectively.⁶⁸ The inaction and belated actions of PLDT from the issuance of NTC MC 05-06-2007 in 2007 can hardly be considered the proactive response claimed by the dissent.⁶⁹

In its Motion for Reconsideration, PLDT asserts that it “acted in good faith and in compliance with the prevailing regulations and practice at the time in providing its services.”⁷⁰

To bolster PLDT’s assertions, the dissent claims that:

PLDT Group explained that it commenced addressing and remediating this perceived “DPA gap” since 08 July 2017 with the implementation of PLDT Home’s new Customer Information Sheet (Application Form). This remediation measure notwithstanding, printed customer information for subscribers acquired pre-08 July 2017 have been included in the directory listing by default. PLDT Group determines and recognizes this to be in conflict with the general data privacy principles of transparency, legitimate purpose and proportionality – the hallmarks of the DPA and its IRR.

PLDT requested from NTC an advisory opinion on the matter and/or guidance as to how to best approach the situation to ensure that service providers such as PLDT will be both compliant with the rules and regulations prescribed by the NTC and the requirements of the DPA and its IRR.

In return, NTC in a letter dated 30 October 2017, requested an advisory opinion regarding the residential directory listing of PLDT and its group of affiliates to fulfill PLDT’s obligations as a telephone service provider vis-à-vis its compliance with the DPA. It attached PLDT’s letter dated 18 October 2017 and requested NPC to comment thereon.⁷¹

Curiously, however, none of these things claimed by the dissent can be found in the records of this case. On the contrary, the evidence on record shows that there was absolutely no action taken by PLDT from the time NTC MC 05-06-2007 was issued in 2007 until the events that gave rise to the Complaint.

PLDT hinges its claim of good faith on the measures it implemented after RLA had already filed his Complaint before the Commission on 03 April 2018. PLDT claims that it promptly tagged RLA’s account as “Confidential” upon receiving his concerns, revisited its Corporate Individual DSL Application Form which it only implemented on 10 September 2018, and redefined its policies and processes based on the Advisory Opinion⁷² it requested from the Commission.⁷³

PLDT’s obligation to comply with Section 2.2 of NTC MC 05-06-2007 cannot be excused simply because it sought guidance from the Commission by requesting an Advisory Opinion on the matter. Following ignorantia juris non excusat, “[t]hat every person is presumed to know the law is a conclusive presumption,”⁷⁴ l egal obligations are not put on hold simply because those subject to it supposedly require guidance. It remains incumbent upon those subject to the law to comply with it.

Also, PLDT only sought clarification from the Commission in 2017 despite NTC MC 05-06-2007’s issuance in 2007, and the DPA’s effectivity in 2012.⁷⁵ In fact, PLDT only provided the option for its subscribers to be excluded from publication in the listing directory in 2018.⁷⁶

The failure to comply with Section 2.2 of NTC MC 05-06-2007 for a period of eleven years from the issuance of this Memorandum Circular, despite knowing that the obligations provided therein applied to it, negates any claim of good faith on the part of PLDT. PLDT had sufficient time since 2007 to fulfil the obligations imposed by the NTC, its primary regulator, and yet, it failed to do so. Any claim of good faith is untenable because PLDT neither attempted nor took any action to comply with NTC MC 05-06-2007 from the time it was issued.

III. PLDT processed Personal Information for Unauthorized Purposes.

PLDT violated Section 28 of the DPA or the Processing of Personal Information for Unauthorized Purposes. Section 28 provides:

Section 28. *Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes. –*The processing of personal information for unauthorized purposes shall be penalized by imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00) shall be imposed on persons processing personal information for purposes not authorized by the data subject, or otherwise authorized under this Act or under existing laws.⁷⁷

Processing for Unauthorized Purposes is committed when:

a person processed information of a data subject;
the information processed is classified as personal information or sensitive personal information;
the person processing the information has obtained consent of the data subject or is granted authority under the DPA or existing laws for a specific purpose; and
the processing of personal or sensitive personal information is for a purpose that is neither covered by the authority given by the data subject and could not have been reasonably foreseen by the data subject nor otherwise authorized by the DPA or existing laws.

The first two requisites of Processing for Unauthorized Purposes have been established in this case. It is not disputed that PLDT processed its data subjects’ personal information for the purpose of rendering its services. Thus, the Commission shall proceed to discuss the third and fourth requisites of Section 28 of the DPA.

A. PLDT obtained the consent of the data subject to process his or her personal information for a specific purpose.

The third requisite of Section 28 of the DPA or “the person processing the information obtained consent of the data subject or is granted authority under the DPA or existing laws” is present. PLDT obtained RLA’s consent for the limited purpose of providing the services that RLA subscribed to.

In this case, PLDT obtained RLA’s consent to process his personal information through the Corporate DSL Individual Application Form and the Terms and Conditions indicated therein. PLDT processed RLA’s personal information to allow it to provide him with telephone and Corporate Individual DSL subscription services.⁷⁸ It is clear from the facts that PLDT processed RLA’s personal information for a specific purpose:

As the corporate client, Knutsen collected the relevant personal data of the Complainant and provided such information to Respondent to enable the latter to provide the subscribed services. As noted by the Honorable Commission in its Decision, Complainant’s personal information was supplied by his employer, Knutsen, the subscription was named under Knutsen (but for the account of Complainant), Knutsen President and General Manager is the signatory in the Application form, and Knutsen’s address is indicated in the billing portion of the application form. Respondent only collected the information necessary to provide the service obtained by Knutsen for its employees … Respondent is tasked with processing of the personal information of Knutsen’s employees for the purpose of providing the DSL services which Knutsen’s employees will use to perform their duties and responsibilities during their employment.⁷⁹

PLDT itself admitted in its Motion for Reconsideration that RLA provided his personal information for purposes of availing himself of the subscribed services:

Complainant merely provided his personal information to Knutsen to allow Respondent to install the necessary connectivity for the rendition of the subscribed services.⁸⁰

…

The information collected from the Complainant are standard information necessary for the purpose of providing the services under the DSL subscription (i.e. name, address, telephone number, and choice of plan).⁸¹

Without a doubt, RLA consented to the collection and processing of his personal information. RLA’s consent, however, is only for the limited purpose of availing of the telephone and Corporate Individual DSL services offered by PLDT. As stated in the Decision:

Thus, we find that the consent given by Complainant in filling up the application form relates only to the use and limitations of the DSL services offered by PLDT⁸²

RLA only expected PLDT to process his personal information for the purpose of providing the subscribed services since the authority that RLA gave to PLDT and the information provided by PLDT are limited only to what are covered in the Application Form and the Terms and Conditions. Considering that PLDT obtained the consent of RLA to process his personal information for such limited purpose, the third requisite is present in this case.

B. PLDT further processed the personal information of the data subject without any authority given by the data subject or under the DPA or existing laws, and such further processing could not have been reasonably foreseen by the data subject.

The fourth requisite of Section 28 is satisfied in this case. PLDT further processed RLA’s personal information by publishing his personal information in the listing directory without his authority.

PLDT asserts that it lawfully processed RLA’s personal information under a legal obligation when it published his personal information in the listing directory.⁸³ Proc essing necessary for compliance under a legal obligation is a criterion for lawful processing under Section 12 of the DPA. Section 12 provides:

Section 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

…

(c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;⁸⁴

The law that serves as the basis for processing personal information determines the purpose of the processing, establishes specifications to determine the identity of the PIC, the categories of personal information subject to processing, the data subjects concerned, the entities to which personal information can be disclosed to, the purpose limitations, the storage measures, and other measures to ensure lawful and fair processing.⁸⁵ As such, compl iance with a legal obligation as a criterion for lawful processing must be understood in relation to the law from which the purported legal obligation is derived from.

When a PIC, such as PLDT, claims lawful processing on the basis of a legal obligation, it is incumbent upon the Commission to examine (1) if the legal obligation the PIC cites as lawful criteria exists and applies to the PIC; (2) if the processing that the PIC performs is necessary to comply with the legal obligation; and (3) if all the conditions imposed by the legal obligation for the processing of the personal information have been complied with. As such, the Commission is bound to look into the PIC’s degree of compliance with the specific requirements of the legal obligation that it is relying on. In determining if the PIC is complying with the specific requirements of its legal obligations, the Commission is not enforcing the law or regulation that the PIC claims to be subjected to. Rather, the Commission is strictly enforcing the provisions of the DPA and determining if the PIC’s claim of processing as necessary to comply with its legal obligation is proper. Such is clearly within the mandate of the Commission.

1. The legal obligation which the PIC claims to be subject to exists and applies to the PIC.

PLDT argues that its mandate to publish stems from its legal obligation under Section 149 of Revised Order 1 and Section 2.2 of NTC MC 05-06-2007⁸⁶:

Respondent was mandated by Section 149 of the Revised Order No. 1, otherwise known as the Public Service Commission Rules and Regulations (“Order No. 1”) and National Telecommunications Commission Memorandum Circular No. 05-06-2007, otherwise known as the Consumer Protection Guidelines (“NTC Circular”) to issue a listing directory of the names, addresses, and telephone numbers of all of its subscribers at least once a year.⁸⁷

PLDT also highlights that Section 2.2 of NTC MC 05-06-2007 provides that the subscriber may request for his or her exclusion from subsequent publications of the listing directory.⁸⁸ It explains that if the subscriber does not exercise the right to be excluded, then the subscriber’s name will be included in the listing directory.⁸⁹ PLDT categorically states that “[a]s worded, the NTC [Memorandum] Circular did not impose an obligation to secure from subscribers the affirmative act of consenting to the publication of [the subscriber’s] contact information before a service provider can include the subscriber’s information in the directory.”⁹⁰

There is no question that PLDT is subject to its legal obligation under Section 149 of Revised Order 1 and Section 2.2 of NTC MC 05-06 -07.

2. The processing of the data subject’s personal information is necessary to comply with the legal obligation. To consider compliance with a legal obligation as a valid criterion for lawful processing under Section 12 (c) of the DPA, there must be a clear showing that such processing is necessary.⁹¹ In determining what is considered “necessary”, the Commission takes into consideration both the processing undertaken and the legal obligation claimed by the PIC. The PIC should only process as much information as is proportional or necessary to achieve its clearly defined and stated purposes⁹², which in this case is to comply with the provisions of law and regulation. Aside from this, the processing undertaken by the PIC should relate to the fulfillment of its legal obligation.

In this case, the proportionality of the processing undertaken by PLDT is not in question. It is not claimed and no evidence has been presented to show that PLDT published more than what was required to be included in the listing directory. It is also not disputed that PLDT is required to publish a listing directory.

Even if the processing of the data subjects’ personal information is necessary to comply with its legal obligation, PLDT must still show that it fulfilled all the conditions imposed by the legal obligation it relied on.

3. All the conditions imposed by the legal obligation for the processing of personal information have not been complied with.

Processing based on a legal obligation requires that all conditions imposed by the legal obligation have been complied with. Section 12 (c) of the DPA requires not only that the processing is “necessary” but also that it be in “compliance with a legal obligation”. Compliance with everything required by the claimed legal obligation as a condition for the processing is an essential element for any claim of valid processing under this criterion.

In this case, PLDT’s compliance with a legal obligation as a valid criterion for lawful processing requires compliance with its legal obligation under both Section 149 of Revised Order 1 and Section 2.2 of NTC MC 05-06-2007. It, therefore, follows that determining the legal obligation that PLDT is required to comply with necessarily includes an examination of the obligations imposed by those two provisions. As previously discussed, for PLDT to say that it published the listing directory in compliance with a legal obligation under Section 149 of Revised Order 1 and Section 2.2 of NTC MC 05-06-2007, it must demonstrate that it also fulfilled the conditions under Section 2.2 of NTC MC 05-06-2007, which includes securing the consent of its subscribers before publishing their personal information in the listing directory.

The obligation to substantiate the fulfillment of the conditions that qualify the general obligation to publish the listing directory rests on PLDT. It necessarily follows that it is incumbent upon PLDT to show that first, it presented to the subscriber the option to not be listed in the directory listing; second, it presented the option at the time of subscription to PLDT’s services; and third, the subscriber refused the option presented to him. It is only when these conditions are satisfied that PLDT can publish the subscriber’s personal information in the listing directory.

The Commission reiterates that compliance with the legal obligation imposed by NTC MC 05-06-2007 necessitates securing the consent of the data subject, which is consistent with transparency and consent under the DPA. Stated simply, PLDT should have secured the data subject’s consent before it published his or her personal information in the listing directory.

If PLDT fully complied with its legal obligation, then it can validly claim that the processing by means of publishing personal information in the listing directory was proper. It is incumbent upon PLDT to show that the actions it took resulted in its compliance with its obligation or is an integral step in getting to the point of compliance. This is something PLDT failed to do.

Although PLDT obtained RLA’s consent, the authority granted to PLDT was only for the purpose of providing the telephone and Corporate DSL subscription services. It does not extend to the publication of RLA’s personal information in the listing directory.⁹³

RLA could not have reasonably foreseen that PLDT intended to process his personal information by publishing it in the listing directory. In fact, the statement in the Terms and Conditions stated in the Application Form that was presented to Knutsen does not adequately declare and specify the purpose of publishing data subjects’ personal information in the listing directory. Neither PLDT’s Application Form nor its Terms and Conditions provided the necessary information that would have allowed its subscribers, like RLA, to reasonably foresee that their personal information would be published, much less allow them to exercise their right to be excluded from the listing directory or even know that such a right exists in the first place.

It bears stressing that the obligations and conditions provided in Section 2.2 of NTC MC 05-06-2007 are directed to PLDT as the one subject to the regulatory jurisdiction of the NTC, its primary regulator. PLDT cannot pass the responsibility to its subscribers by saying that “[i]f [the subscriber] did not exercise this right to be excluded [from the publication], his/her name will be included in the directory listing”⁹⁴ especially considering that PLDT never informed its subscribers of this option in the first place.

Subscribers such as RLA are not obligated to determine for themselves the regulations their services providers are supposed to comply with. This is all the more true considering that Section 2.2 itself imposes a positive duty on PLDT to inform its subscribers of the specifically required information and to give them the option not to be listed in the public directory listing.

PLDT had several instances to comply with its obligation to apprise its subscribers of their right to privacy, the manner by which their personal information would be protected, and inform them of their option to not be listed in succeeding publications of PLDT’s listing directory. The NTC issued NTC MC 05-06-2007 as early as 2007, but PLDT failed to comply with the requirements under the Circular. Stemming from PLDT’s positive obligation to secure the consent of the data subject under both NTC MC 05-06-2007 and the DPA, PLDT must show that it communicated to its subscribers the option to not be listed in the listing directory and that they refused to take the option.

Specific to this case, PLDT could have apprised RLA of his right to be excluded from publication of his personal information in the listing directory it published in 2017. The Application Form for the Corporate Individual DSL account subject of this case was signed on 21 December 2015⁹⁵, and Knutsen requested the transfer of RLA’s Corporate Individual DSL account to a new address on 12 April 2016.⁹⁶ PLDT could have informed RLA in 2015, when Knutsen opened a Corporate Individual DSL account on his behalf, and again in 2016, when Knutsen requested a transfer of his account to his new address. PLDT, however, failed to do so. Even when the IRR of the DPA was issued on August 2016, PLDT still did not do anything before it published RLA’s personal information in the listing directory in 2017.

Absent a clear showing that PLDT fully complied with the obligations and conditions set out in both Section 149 of Revised Order 1 and Section 2.2 of NTC MC 05-06-2007, it failed to fulfil its legal obligation. As such, PLDT cannot rely on compliance with a legal obligation as its criterion for lawful processing. From its plain wording, this criterion necessarily requires compliance with the legal obligation claimed and, consequently, presupposes that everything required by that legal obligation has been complied with.

Considering that PLDT processed RLA’s personal information without satisfying a valid criterion for lawful processing under Section 12 (c) of the DPA, and in the absence of any other basis for lawful processing that has been validly asserted by PLDT, it is liable under Section 28 of the DPA on Processing of Personal Information for Unauthorized Purposes.

IV. PLDT committed Unauthorized Disclosure.

PLDT violated Section 32 of the DPA on Unauthorized Disclosure. As held in the Decision dated 17 December 2021, all the elements of Section 32 are present in this case.⁹⁷ In particular, the Decision provides:

[T]he copies of PLDT’s 2017 White Page[s] or Directory is distributed to its subscribers. All the personal information found therein are disclosed to PLDT’[s] subscribers and to other persons who may be given a copy thereof.⁹⁸

Section 32 of the DPA on Unauthorized Disclosure states:

Section. 32. Unauthorized Disclosure. – (a) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).⁹⁹

Section 32 of the DPA refers to “the immediately preceding section” or Section 31 of the DPA on Malicious Disclosure, which states:

Section 31. Malicious Disclosure. – Any personal information controller or personal information processor or any of its officials, employees or agents, who, with malice or in bad faith, discloses unwarranted or false information relative to any personal information or personal sensitive information obtained by him or her, shall be subject to imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00).¹⁰⁰

Malicious disclosure is committed when the following requisites concur:

the perpetrator is a personal information controller or personal information processor or any of its officials, employees, or agents;
the perpetrator disclosed personal or sensitive personal information;
the disclosure was with malice or in bad faith; and
the disclosed information relates to unwarranted or false information.

A PIC or a PIP may be held liable for malicious disclosure if it discloses unwarranted or false personal or sensitive personal information with malice or in bad faith.¹⁰¹ A finding of Malicious Disclosure requires that first, the disclosed personal information is unwarranted or false, and second, the disclosure is malicious or in bad faith. If either of these two requisites is absent, then the offense falls under Section 32 or Unauthorized Disclosure.

While it is true that criminal and penal statutes must be strictly construed,¹⁰² a strict reading of Section 32 of the DPA or Unauthorized Disclosure shows that a PIC or a PIP will be penalized if it discloses personal information without the consent of the data subject even if such disclosure is justified under some other criteria for lawful processing enumerated in Sections 12 and 13 of the DPA.

The rules of statutory construction are clear:

Where a literal meaning would lead to absurdity, contradiction, or injustice, or otherwise defeat the clear purpose of the lawmakers, the spirit and reason of the statute may be examined to determine the true intention of the provision.¹⁰³

If Section 32 is understood in its literal sense, then it will result in an absurd situation. A PIC or PIP will be held liable for unauthorized disclosure even if it validly processed personal information based on some other lawful criteria under Sections 12 and 13 but failed to obtain the data subjects’ consent.

Further, Section 32 of the DPA on Unauthorized Disclosure should be read together with the entire DPA:

A law must not be read in truncated parts; its provisions must be read in relation to the whole law. It is the cardinal rule in statutory construction that a statute’s clauses and phrases must not be taken as detached and isolated expressions, but the whole and every part thereof must be considered in fixing the meaning of any of its parts in order to produce a harmonious whole. Every part of the statute must be interpreted with reference to the context, i.e., that every part of the statute must be considered together with other parts of the statute and kept subservient to the general intent of the whole enactment.¹⁰⁴

Section 32 of the DPA should not be read in isolation. It should be read together with the other provisions of the DPA, particularly Sections 12 and 13 on the criteria for lawful processing of personal and sensitive personal information. A plain reading of Sections 12 and 13 will show that consent is just one of the lawful criteria for processing. As such, the presence of any of the criteria listed in either section is sufficient to justify the processing of personal or sensitive personal information as the case may be. To require the consent of the data subject when some other lawful criteria such as law or regulation requires or justifies the processing of the personal information, including its disclosure, will result in absurdity. Such literal interpretation based on an isolated reading of Section 32 of the DPA will render Sections 12 and 13 of the DPA inoperative.

The rule is that a construction that would render a provision inoperative should be avoided; instead, apparently inconsistent provisions should be reconciled whenever possible as parts of a coordinated and harmonious whole.¹⁰⁵

A proper reading of Section 32 should be that Unauthorized Disclosure is committed when the perpetrator processes personal information without any of the lawful basis for processing under Sections 12 and 13. This interpretation is more in line with the principle that “when two or more interpretations are possible, that interpretation which is favorable or beneficial to the accused must be adopted.”¹⁰⁶ As such, Section 32 of the DPA is violated if none of the lawful basis of processing, consent or otherwise, supports the disclosure of personal information. This interpretation is more beneficial to the accused since it actually narrows the extent to which disclosure of personal information may be considered as unauthorized disclosure.

In this case, however, the obligation imposed by NTC MC 05-06-2007 is based on the consent of the subscribers. As previously discussed, public telecommunications entities must secure the consent of their subscribers before publishing their personal information in the listing directory. Absent any showing of consent, PLDT is not permitted to publish personal information in the listing directory. It is only when the subscribers avail themselves of the option to be included in the listing directory after being informed by PLDT of such option that PLDT may publish their personal information.

Here, PLDT published the personal information of its subscribers in the listing directory without securing their consent. In fact, PLDT failed to present the option to not be included in the listing directory to any of its subscribers despite being required to do so by NTC MC 05-06-2007, which was issued as early as 2007. PLDT did not present the option and secure its subscribers’ consent until 10 September 2018.¹⁰⁷ It took PLDT eleven years to revise its Application Form for the Corporate Individual DSL account to include the option to not be listed in the listing directory. PLDT failed to obtain the consent of its data subjects before it published their personal information in the listing directory.

By publishing its subscribers’ personal information in the White Pages without their consent, contrary to the provisions of Section 2.2 of NTC MC 05-06-2007, and distributing free copies of the White Pages to all its subscribers, who are considered third parties under the DPA, PLDT violated Section 32 of the DPA on Unauthorized Disclosure.

V. PLDT is grossly negligent.

PLDT manifested gross negligence when it failed to acquire its subscribers’ consent to publish their personal information in the listing directory since 2007. Its failure to inform its subscribers of the option to not be listed in the listing directory resulted in its violation of Section 28 of the DPA. The Supreme Court defines gross negligence as:

Gross negligence implies a want or absence of or a failure to exercise slight care or diligence, or the entire absence of care. It evinces a thoughtless disregard of consequences without exerting any effort to avoid them.¹⁰⁸

In its Motion for Reconsideration, PLDT maintains that its actions do not “rise to the level of gross negligence that would merit criminal sanction.”¹⁰⁹ PLDT, however, failed to present substantial evidence to support its statement that its responsible officers should not be held liable for PLDT’s violations of Sections 28 and 32 of the DPA.

It is established that bare allegations without evidence is neither considered as nor equivalent to clear and convincing proof.¹¹⁰ As held in the Decision dated 17 December 2020, PLDT can only act through the members of its Board of Directors, its Corporate Officers, and its employees. It would not have violated Sections 28 and 32 of the DPA without the participation of one or some of these individuals:

Since a corporation, like PLDT, can only act through its Board of Directors, Corporate Officers, and employees, these DPA violations must have been committed by the Board of Directors, Corporate Officers, or employees of PLDT either directly or through their gross negligence. Information necessary to identify these responsible officers/ employees is usually within the control of the respondent PIC and not readily or easily available to the Complainant.¹¹¹

The case has been remanded to the Commission’s Complaints and Investigation Division to identify the responsible officers liable for the violations of Sections 28 and 32.¹¹²

In any case, the violation of Sections 28 and 32 arose because PLDT failed to abide by Section 2.2 of NTC MC 05-06-2007. PLDT should have been aware of the conditions stated in Section 2.2 since it was issued by NTC, its primary regulator.

Further, in its representations, PLDT made it seem that Section 149 of Revised Order 1 and Section 2.2 of NTC MC 05-06-2007 require the mandatory publication of the personal information of the data subject.

[PLDT] published [RLA’s] personal information in the 2017 directory listing in compliance with the requirement prescribed by Order No. 1 and the NTC Circular.¹¹³

As previously discussed, however, while it is true that Section 149 of Revised Order 1 requires public telecommunications entities to publish a directory listing at least once a year, such legal obligation is subject to the conditions in Section 2.2 of NTC MC 05-06-2007.

PLDT, however, made no effort whatsoever to bring its processing of personal information in line with the obligations imposed on public telecommunication entities enumerated in NTC MC 05-06-2007, much less the DPA. In fact, PLDT selectively limited its appreciation of Section 2.2 of NTC MC 05-06-2007 to the last sentence. In its Motion for Reconsideration, PLDT argues that:

Section 2.2 of NTC Circular shows that the subscriber is given the option not to be included in succeeding public directory listings of subscribers. From this provision, it can be gleaned that the subscriber may request for his or her exclusion in the subsequent publication of the directory listing. If s/he did not exercise this right to be excluded, his or her name will be included in the directory listing. As worded, the NTC Circular did not impose an obligation to secure from subscribers the affirmative act of consenting to the publication of his/ her contact information before a service provider can include the subscriber’s information in the directory.¹¹⁴

The dissent noted the applicability of the principle ut res magis valeat quam pereat to this case and correctly explained that “care should be taken that every part thereof be given effect and a construction that could render a provision inoperative should be avoided, and inconsistent provisions should be reconciled whenever possible as parts of a harmonious whole.”¹¹⁵

Despite this, both the dissent and PLDT conveniently ignored the other sentences in Section 2.2 of NTC MC 05-06-2007. They failed to address or recognize its other obligations, which are in fact harmonious with the DPA. Contrary to PLDT’s assertions, the subscriber must give his or her consent before his or her personal information may be published in the directory listing. PLDT, however, by failing to provide RLA with the proper mechanism to exercise the option, disregarded RLA’s right to consent to the publication of his personal information in the 2017 White Pages.

In failing to fulfil its obligations according to Section 2.2 of NTC MC 05-06-2007, PLDT’s acts resulted in a violation of the DPA since it processed personal information for an unauthorized purpose, and disclosed personal information without the consent of the data subject. By failing to present the option to not be listed in the directory listing to RLA, PLDT deprived RLA of his right to exercise such option. For these reasons, PLDT is grossly negligent as shown by its repeated failure to comply with the obligations imposed on it.

Any finding of gross negligence is not removed by any corrective actions taken by PLDT. It had all the opportunities to comply with its obligations under NTC MC 05-06-2007. PLDT should have complied with its obligations from the time the Circular was issued in 2007. The passage of the DPA in 2012 and the IRR in 2016 should have also prompted PLDT to conduct a closer examination of its processing activities, including the obligations imposed by its primary regulator in NTC MC 05-06-2007. Yet, PLDT failed to do so.

PLDT should have at least tried to acquire the consent of all its subscribers in order to lean towards the safe mandate of the law, and if such consent was not acquired, it should not have pushed through with publishing the personal information of the subscriber.

After all, in the event of uncertainty, a PIC must always be mindful of the rights and interests of the data subjects. Section 38 of the DPA provides:

Section 38. Interpretation. – Any doubt in the interpretation of any provision of this Act shall be liberally interpreted in a manner mindful of the rights and interests of the individual about whom personal information is processed.¹¹⁶

The Commission reiterates that while PLDT is mandated to publish a listing directory by Section 149 of Revised Order 1, such obligation to publish necessarily requires acquiring the consent of its subscribers. The Commission cannot overlook PLDT’s inaction since 2007 in failing to acquire the consent of its subscribers since the DPA mandates that doubts in the interpretation should be in favor of the rights and interests of the data subject whose personal information is processed.¹¹⁷ Had PLDT intended to act to the best of its intentions, it would have resolved any supposed confusion in favor of an interpretation that gives greater protection to the rights of its data subjects.

In arguing in favor of PLDT, the dissent harps on the supposed fact, “NTC did not disallow the succeeding publications of PLDT… [nor did it] admonish PLDT nor issue other orders that would indicate that PLDT has been publishing in White Pages in violation of the NTC MC 05-06-2007.”¹¹⁸

Aside from the fact that these cannot again be found in the records of this case, the argument is misplaced. To be clear, the Commission is not enforcing the provisions of NTC MC 05-06-07. Rather, it is simply fulfilling its mandate under the DPA to examine the presence of, and the proper application of lawful criteria to the processing undertaken by the PIC.

Considering that PLDT claims its compliance with a legal obligation as basis for its publishing the name of RLA in the White Pages, the Commission is mandated to look into whether all conditions imposed by the legal obligation have been complied with. After all, an essential element for any claim of valid processing under this criterion is that everything required by the claimed legal obligation as a condition for the processing has been complied with.

The dissent also claims that “the Decision dated 17 December 2020 overlooked certain aspects which, if not corrected, will cause extreme and irreparable damage and prejudice as to how the DPA should be interpreted and applied.”¹¹⁹ The Decision dated 17 December 2020 was written by the dissenting Commissioner. If he truly believed that it will cause “extreme and irreparable damage and prejudice,” he should not have written the Decision in that way. And if the Decision supposedly overlooked certain things, he only has himself to blame.

Besides, despite the dissent’s protestations that the Commission should not apply the law mechanically and must consider “fairness, equity, and judiciousness in its decisions”¹²⁰, the dissent never bothered to discuss what about the majority opinion, and consequently his own Decision, is unfair or unjust based on the law and the records of this case.

It bears stressing that the Commission’s Decision cannot be overturned based simply on equity as claimed by the dissent. It also cannot be overturned based on a convenient change of mindset and a rejection of the idea that recommending an organization for prosecution will have the deterrent effect intended by the legislators in favor of some abstract notion of organizational accountability.¹²¹

The Commission does not exercise any discretion in applying the penalty provisions of DPA. As long as all the elements of the offense are met by the facts and evidence on record, then the Commission is constrained to apply the law and recommend the prosecution of the PIC and its responsible officers. It is not up to the Commissioners to arbitrarily introduce a subjective interpretation restricting the applicability of these provisions only to those “who wilfully violate the law” under the guise of “put[ting] on wider lenses” when implementing the law.¹²²

It should go without saying that any change in the Commission’s Decision must be based on the law and the available evidence on record. In the case of PLDT, it has failed to present anything new or substantial to warrant a reversal of the Decision dated 17 December 2020.

Considering the foregoing, the Decision dated 17 December 2020 should be maintained. PLDT is liable for violations of the DPA, particularly Section 28 or Processing of Personal Information for Unauthorized Purposes and Section 32 or Unauthorized Disclosure. In failing to comply with the directive of its primary regulator, PLDT likewise failed to comply with its obligation under the DPA to ensure that any processing it undertakes finds basis under one of the lawful criteria provided under the law.

WHEREFORE, premises considered, the Commission resolves to DENY the Motion for Reconsideration filed by PLDT Enterprise. The Decision dated 17 December 2020 is hereby AFFIRMED.

SO ORDERED.

City of Pasay, Philippines.
10 December 2021.

Sgd.
LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner

I CONCUR:

Sgd.
JOHN HENRY D. NAGA
Deputy Privacy Commissioner

See Dissenting Opinion.
RAYMUND ENRIQUEZ LIBORO
Privacy Commissioner

Copy furnished:

RLA
Complainant

AACRC
Counsel for Respondent

COMPLAINTS AND INVESTIGATION DIVISION
ENFORCEMENT DIVISION
GENERAL RECORDS UNIT
National Privacy Commission

RLA,
Complainant,

-versus-

PLDT ENTERPRISE
Respondent.

NPC 18-010
(Formerly CID Case D-010)
For: Violation of the Data Privacy Act of 2012

Dissenting Opinion

LIBORO, P.C.:

The main issue before the Commission is whether or not the Decision dated 17 December 2020 (Decision) of the Commission should be sustained.

On 17 December 2020, the Commission issued a Decision with the following dispositive portion, to wit:

WHEREFORE, all these premises considered, this Commission resolves to AWARD Complainant, RLA, nominal damages in the amount of Fifty Thousand Pesos (P50,000.00) for Respondent PLDT Enterprise’s violation of Complainant’s rights under the Data Privacy Act.

Moreover, this Commission resolves to REMAND this case to the Complaints and Investigation Division for the limited purpose of determining and identifying the responsible persons, officers, or individuals of PLDT Enterprise who caused the violations of Sections 28 and 32 of the DPA prior to recommending the matter to the Secretary of Justice for criminal prosecution.

SO ORDERED.¹²³

The majority opines that the Decision dated 17 December 2020 of the Commission should be sustained which found that PLDT Enterprise (Respondent or PLDT) is liable for violation of Sections 28 and 32 of the Data Privacy Act of 2012 (DPA), awarded nominal damages to RLA (Complainant or RLA) and remanded the case to the Complaint and Investigation Division of the National Privacy Commission (NPC) for further investigation and for the determination of the responsible officers of PLDT, who by participation, negligence, or omission, allowed the violations of Section 28 and 32 of the DPA.

With all due respect, I am constrained to dissent.

At this juncture, it must be stressed that the Commission is adjudicating not only the merits of the case, but also how present and future Commissioners of the NPC will apply the provisions of the law.

The Commission must breathe life and meaning to the law. The Commission must consider real scenarios that affect real lives and livelihood to provide guidance to present and future privacy practitioners, litigators, judges, or justices for all DPA-related cases.

Rather than applying the law mechanically or in a straight-jacket, the Commission must also factor equity, fairness, and judiciousness in its decisions to prevent unjust decisions, since each case that the Commission adjudicates has its peculiar facts which may have a bearing on the present issue at hand.

Each decision has the potential to create far-reaching implications. The Commission can set precedents that may enhance how privacy is applied or change how data privacy is practiced in the country.

Beginning with the easiest point, I agree with the majority that that PLDT is a personal information controller (PIC). Hence, PLDT’s argument in its Motion for Reconsideration dated 05 August 2021 (Motion for Reconsideration) that it is a Personal Information Procession (PIP) for its enterprise clients does not warrant further deliberation.

However, I dissent to deny the Motion for Reconsideration filed by PLDT Enterprise for the following reasons:

I. PLDT has lawful basis for processing Complainant’s personal information

The personal data of Complainant involved in this case is personal information, i.e. name, telephone number and residence address. Personal information is treated differently from sensitive personal information under the DPA. Processing of personal data is allowed as a general rule,¹²⁴ whereas processing of sensitive personal information is prohibited by default.¹²⁵ Section 12 of the DPA provides:

SEC. 12. Criteria for Lawful Processing of Personal Information. The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

(a) The data subject has given his or her consent; (b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract; (c) The processing is necessary for compli ance with a legal obligation to which the personal information controller is subject; (d) The processing is necessary to protect vitally important interests of the data subject, including life and health; (e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or (f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.¹²⁶

When personal information is processed, it is enough that one (1) of the criteria for lawful processing under Section 12 of the DPA is present. Without any of these criteria, the PIC or PIP can be held liable for violation of Section 28 of the DPA.

Section 28 of the DPA penalizes processing of personal information for purposes not authorized by the data subject, or otherwise authorized under the DPA or under existing laws, to quote:

SEC. 28. Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes. – The processing of personal information for unauthorized purposes shall be penalized by imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00) shall be imposed on persons processing personal information for purposes not authorized by the data subject, or otherwise authorized under this Act or under existing laws.¹²⁷ (Emphasis and underlining supplied)

Consent, which is the main argument of Complainant, is only a criterion. To be held liable under Section 28, the PIC or PIP must process personal data in violation of the purpose consented to or authorized by the data subject, or otherwise authorized by the DPA or under existing laws.

It is crucial then to determine if aside from consent, did PLDT process Complainant’s information on the basis of other lawful criteria provided for under Section 12 of the DPA?

PLDT hinges the lawfulness of its processing on the compliance with a legal obligation to which it is subjected, as required by Section 149 of the Revised Order No. 1, the Public Service Commission (PSC) Rules and Regulations, implementing Commonwealth Act No. 146 or the Public Service Act enacted in 1940.

Section 149 of Revised Order No. 1 clearly mandates each telephone public service to issue a listing directory at least once a year*, to wit:*

Section 149. Telephone Directory. – Each telephone public service shall at least once a year issue a listing directory showing therein the names of all subscribers arranged in alphabetical order, their addresses and telephone numbers and such other information as may be of interest to a subscriber’s everyday use of his telephone. Each subscriber shall be entitled to a free copy of the directory.¹²⁸

At that time, this type of processing is necessary. People or institutions did not have access to the internet and other means to publicly look for telephone numbers and addresses. The circumstances of the times dictate the need for the publication. The wordings of Section 149 were prepared at a time where people used paper copies of telephone directories.

The most popular device to communicate back then is the telephone. Undoubtedly, being part of the telephone directory have its benefits and corresponding trade-offs. Each one of us who had landlines experienced receiving prank calls by reason of being part of the PLDT White Pages. However, the White Pages proved to be helpful when the need arises, and one needs the contact information of a friend or relative that they need to reach.

In the year 2000, there was a shift from analogue to digital in the way people communicate with each other. A technological convergence happened marked by introductions of new technologies and innovations. This created new products and services and started to blur the boundaries of platforms then used for communication. New platforms were used in entertainment and communication which undermined consumer rights and protection. There was a time when the Philippines was the texting capital of the world, and to date, it remains as home for the Top SMS Senders in the world.

In relation to Section 149 of Revised Order No. 1, the National Telecommunications Commission (NTC) issued Memorandum Circular No. 05-06-2007 dated 08 June 2007 (Consumer Protection Guidelines or NTC MC 05-06-2007), which provides:

Section 2.2-Any data supplied by the consumer shall be treated as confidential by the entity or service provider mentioned under Section 1.1 hereof and shall not be used for purposes not authorized by him. Upon subscription, he shall be informed of his right to privacy and the manner by which his data would be protected. In cases where a public directory listing of subscribers is regularly published by the service provider, the consumer shall be given the option not to be listed in succeeding publications.¹²⁹

Since NTC MC 05-06-2007 is a later issuance, the provisions of Section 149 of Revised Order No. 1, the PSC’s Rules and Regulations for all public services, is considered amended or modified only insofar as giving the consumer the option not to be listed in succeeding publications.

While it is true that NTC MC 05-06-2007 effectively subjected Section 149 of Revised Order No. 1 the PSC’s Rules and Regulations to the condition set forth by NTC MC 05-06-2007, NTC MC 05-06-2007 did not remove the legal obligation of telephone public service providers to publish the telephone directory at least once a year.

That the NTC MC 05-06-2007 did not remove the legal obligation to publish the list of names in telephone directories, is bolstered upon closer scrutiny of the NTC MC.

For everyone to benefit from these new technologies and innovations, the free flow of information needs to be ensured. Thus, the NTC MC 05-06-2007 was issued to address wider consumer protection. NTC MC 05-06-2007 is an issuance that aims to address Consumer Protection Guidelines.¹³⁰ It was issued by the NTC to curb the then proliferation of push messaging,¹³¹ spam messages,¹³² and value-added services¹³³ (VAS) by Public Telecommunications Entities (PTEs) such as PLDT, Broadcast and Cable Television Companies (CATV), and Value-Added Service (VAS) and Content Providers (CPs).¹³⁴

By way of example, common VAS encountered by subscribers included Content and Program service¹³⁵ which includes music, ringtones, logos, video clips that would expose consumers to charges without their consent. These are what the NTC Memorandum Circular sought to address.

The intent of the guidelines become more obvious when reading through Sections 2.2 to 2.12 of the NTC MC 05-06-2007 which revolve around the obligation of Telecommunications providers to prevent unauthorized charges against subscribers to protect and uphold consumer rights.¹³⁶

NTC MC 05-06-2007 did not make the publication of the telephone directory optional. Neither did the NTC Memorandum Circular mandate the telephone public service providers to stop the publication of telephone directories.

PLDT in its Motion for Reconsideration, argued that the subscriber may request for his/her exclusion in the subsequent publication of the directory listing. If he/she did not exercise this right to be excluded, his/her name will be included in the directory listing. As worded, the NTC MC did not impose an obligation to secure from subscribers the affirmative act of consenting to the publication of his/her contact information before a service provider can include the subscriber’s information in the directory.¹³⁷

In effect, PLDT is introducing an interpretation that PLDT’s legal obligation to publish is the default position, while an opt-out of the consumer is required for it to remove the personal information in the succeeding publications and thereby treat the same as confidential, consistent with Section 2.2 of the NTC MC 05-06-2007.

To address this contention, NTC MC 05-06-2007 must be read as a whole applying the principle of “ut res magis valeat quam pereat” as adequately explained by the Supreme Court in the case of Philippine International Trading Corporation v. Commission on Audit:¹³⁸

It is a rule in statutory construction that every part of the statute must be interpreted with reference to the context, i.e., that every part of the statute must be considered together with the other parts, and kept subservient to the general intent of the whole enactment. Because the law must not be read in truncated parts, its provisions must be read in relation to the whole law. The statute’s clauses and phrases must not, consequently, be taken as detached and isolated expressions, but the whole and every part thereof must be considered in fixing the meaning of any of its parts in order to produce a harmonious whole. Consistent with the fundamentals of statutory construction, all the words in the statute must be taken into consideration in order to ascertain its meaning. (Emphasis and underlining supplied)

Moreover, the Supreme Court held that in construing the law, care should be taken that every part thereof be given effect and a construction that could render a provision inoperative should be avoided, and inconsistent provisions should be reconciled whenever possible as parts of a harmonious whole. For taken in solitude, a word or phrase might easily convey a meaning quite different from the one actually intended and evident when a word or phrase is considered with those with which it is associated.¹³⁹

Following the foregoing postulates and construing the provisions of Section 2.2 of NTC MC 05-06-2007 in its entirety, the consumer must opt-out before he/she can be removed from the succeeding publications which remain to be the default procedure for telecommunication companies as provided by Section 149 of Revised Order No. 1.

Prior to the issuance of the NTC MC 05-06-2007, since 1958, PLDT has been publishing in the White Pages the list of names, addresses and numbers of its subscribers pursuant to Section 149 of Revised Order No. 1. Hence, all subscribers have reasonable expectation that some of their information may be published even without their consent. This processing has become an industry practice supported by a legal obligation.

When the NTC MC 05-06-2007 came to effect, the consumers were given an option to opt-out of the publication in succeeding publications. Nevertheless, publication in the White Pages remain to be the default option without the consumers opting out.

In other words, the passage of the NTC MC 05-06-2007 did not stop the publication of the personal information of subscribers in the White Pages in the absence of their consent. Otherwise, the NTC MC would have expressly stated so in its issuance.

It may be surmised that NTC’s interpretation of the NTC MC 05-06-2007 treating the subscriber’s personal information as confidential once they opt-out from the publication is consistent with PLDT’s interpretation.

Apparently, the NTC did not disallow the succeeding publications of PLDT. It did not admonish PLDT nor issued other orders that would indicate that PLDT has been publishing in White Pages in violation of the NTC MC 05-06-2007. Neither did NTC issue succeeding issuances that would clarify the matter and enforce the standards of consumer protection in NTC MC 05-06-2007. This is how NTC enforced the NTC MC 05-06-2007.

These badges manifest that to a certain extent, PLDT has been performing its legal obligation to publish in the White Pages within the standards set by the NTC for the industry during that time.

As explained by Respondent in its Motion for Reconsideration, it has complied with the qualifying clause under Section 2.2 of NTC MC 05-06-2007. Upon receiving Complainant’s request, Respondent tagged the Corporate Individual Account under Knutsen Philippines, Inc. (Knutsen) as “Confidential” and confirmed that Complainant’s personal information would not be published in the succeeding directories.¹⁴⁰

Now we come to the question on the effects of the failure of PLDT to strictly comply with the provisions of NTC MC 05-06-2007 as to the validity of its processing activities after the DPA came to effect and the NPC was established.

After evaluating the context of the issuance behind the NTC MC 05-06-2007, the peculiar facts and circumstances surrounding the processing activities, and the position adopted by the NTC which is the implementing agency for both issuances, the NTC MC 05-06-2007 certainly did not remove PLDT’s legal obligation to publish and process the personal data.

It must be noted that the failure of PLDT to include an opt-out option to be listed in succeeding publications is not fatal to its legal obligation to publish telephone directories. In other words, the inclusion of an opt-out function is not one that is so necessary to the processing questioned. The absence of the opt-out function would not outright remove the publication requirement in the Public Service Act since the legal obligation subsists even without this additional safeguard. Nevertheless, the opt-out function is a consumer protection mechanism under the NTC MC 05-06-2007 that is aligned with the DPA. In particular, the option not to be published in the White Pages enhances the data subject’s control over how his/her data would be processed. Moreover, Section 2.2 of NTC MC 05-06-2007 also essentially requires a privacy notice that would indicate how PLDT will protect the data.

PLDT’s failure to abide by Section 2.2 of the NTC MC can be cited to be a violation of the transparency principle of the DPA which we can hold PLDT accountable for.

However, the violation of the general data privacy principle of transparency does not equate to a violation of Section 28 of the DPA, which is applicable when personal information is processed without the consent of the data subject, or otherwise authorized by law.

II. There is no unauthorized disclosure of Complainant’s personal information under Section 32 of the DPA

In the same vein, the Commission must revisit the interpretation and application of Section 32¹⁴¹ of the DPA. The Decision dated 17 December 2020 failed to consider the operational act that is being penalized, which is the disclosure to third parties of personal information “without the consent” of the data subject.

A plain reading of this provision would qualify the application of Section 32 in instances where consent is the sole basis for processing. However, it excludes instances where the processing is done according to other lawful bases of processing under Sections 12 and 13 of the DPA.

Stated differently, if the alleged processing of personal and sensitive personal information is based on other lawful criteria, then such disclosure does not come within the purview of Section 32 of the DPA but under a different Section of the DPA.

To interpret otherwise would result in an absurd situation where all forms of disclosure, without the data subject’s consent, would be penalized under Section 32 even if they have other bases for processing. Moreover, this interpretation would create fear on the PICs to process any form of personal information without consent, even though they may have different bases for processing under Sections 12 and 13 of the DPA.

Instead of promoting the free flow of information to promote innovation and growth – the underlying state policy behind the DPA – it will create an environment of fear and uncertainty for the PICs that impede progress.

That is not how the DPA should be implemented. Its provisions should not apply mechanically, lest it will hurt the country more than the benefits that can be reaped by maximizing the beneficial uses of data.

As previously stated, PLDT has a lawful basis for processing and publishing the list of names of its telephone and DSL subscribers in the White Pages that is founded on a legal obligation according to the Public Service Act.

Since PLDT has a lawful basis for processing other than the consent requirement, then it follows that Section 32 (which penalizes disclosure without the consent of a data subject) of the DPA is not likewise applicable.

III. PLDT’s accountability

It must be reiterated that although the PLDT may not be liable for Sections 28 and 32 of the DPA, the Commission can still hold them accountable for other violations of the DPA. This is especially concerning their failure to include a transparency mechanism, mainly a valid and comprehensive privacy notice, that will caution the data subject that their personal information would be published in the White Pages according to law.

The NPC may exact accountability through various means without necessarily resorting to the penalties under Chapter VIII of the DPA, which involve criminal liabilities.

There are two (2) sides to accountability. On the one hand, the lack of accountability demonstrated by the PIC can be considered an aggravating factor in the imposition of fines and other liabilities. On the other hand, demonstrable proof of accountability is deemed in enforcement and fining actions, often mitigating the liabilities of the PIC.

There is a global consensus that factoring privacy-enhancing measures of PIC in the enforcement actions encourage organizational accountability. As a result, data privacy regulators worldwide have begun giving organizations credit for their good faith efforts to implement accountability.¹⁴²

Data privacy regulators can use organizational accountability as evidence of good-faith efforts by organizations. Through its responsive regulatory approach, the NPC has pivoted from a deterrence-only regulatory approach (that threatens enforcement of legal requirements through sanctions) to an outcomes-based approach to regulatory oversight.¹⁴³

PLDT has been publishing in the White Pages the list of subscribers since 1958. And they have been doing so because they rely on the law – the Public Service Act – which imposes the legal obligation to publish the list of names in public directories.

It must be stressed that the PLDT itself raised the matter of the printing of customer information (name, address, and telephone number) via the Directory Listing and the need for the consent of these customers to the NTC back in October 2017. They did so to clarify the matter and ask for guidance on how to best approach and address the situation they perceived as a “DPA gap.” The “DPA gap” may be a consequence of the imperfections in the road to compliance of companies.

In the questioned Decision, reference to NPC Advisory Opinion No. 18-021 was made wherein the Privacy Policy Office (PPO) of the NPC was sought to clarify the claim of PLDT that its “base of customers whose details have been printed have not expressly provided their consent to print their details in the existing DPC White Pages that meet the standards of a valid consent as contemplated by the DPA and DPA IRR.”

Records from the NPC’s PPO show that in a letter dated 18 October 2017, even before the Complaint filed by RLA against PLDT, the latter already sought guidance from NTC on the matter of printed telephone directories of PLDT and its group and affiliates and related companies in light of the DPA and its IRR.

According to PLDT, since 1958, PLDT has been printing customer information via the Directory Listing as part of the fulfillment of its obligation as a telephone service provider. In its review, PLDT discovered that its base of customers whose details have been printed in the directory listing have not expressly provided their consent to print their details in the existing DPC White Pages that meet the standards if a valid consent as contemplated by the DPA and its IRR.¹⁴⁴

PLDT Group explained that it commenced addressing and remediating this perceived “DPA gap” since 08 July 2017 with the implementation of PLDT Home’s new Customer Information Sheet (Application Form). This remediation measure notwithstanding, printed customer information for subscribers acquired pre-08 July 2017 have been included in the directory listing by default. PLDT Group determines and recognizes this to be in conflict with the general data privacy principles of transparency, legitimate purpose and proportionality – the hallmarks of the DPA and its IRR.¹⁴⁵

PLDT requested from NTC an advisory opinion on the matter and/or guidance as to how to best approach the situation to ensure that service providers such as PLDT will be both compliant with the rules and regulations prescribed by the NTC and the requirements of the DPA and its IRR.¹⁴⁶

In return, NTC in a letter dated 30 October 2017, requested an advisory opinion from NPC regarding the residential directory listing of PLDT and its group of affiliates to fulfill PLDT’s obligations as a telephone service provider vis-à-vis its compliance with the DPA. It attached PLDT’s letter dated 18 October 2017 and requested NPC to comment thereon.

Upon evaluation, NPC’s PPO opined that subscribers have the right to decide whether they want their name, address, and telephone number to be listed and included in the directory for publication. Hence, the NPC recommended the strict implementation of the said NTC Memorandum Circular.

As facts would dictate, PLDT was able to adjust accordingly.

Again, it must be stressed that the publication requirement emanates from the exigencies of times, its context and necessity. Telephone numbers and addresses could not be accessed in a world without the internet. People had to do things manually. They had to write letters, call by telephone, and refer to these White or Yellow pages to get the information they needed to reach someone.

Nothing in the DPA prohibits per se the publication of personal information in the White Pages, mainly when it is rooted in law. What the DPA requires is that such processing should uphold the general data privacy principles of transparency, legitimate purpose, and proportionality, among other things. PLDT failed in this regard – failing to include the transparency mechanisms to be compliant with Section 2.2 of NTC Memorandum Circular 05-06-2007.

Recommendation

To recap, since NTC MC 05-06-2007 is a later issuance, the provisions of the provisions of Section 149 of Revised Order No. 1, the PSC’s Rules and Regulations for all public services, is considered amended or modified as follows:

The listing of the subscribers’ names, addresses and telephone numbers is mandatory pursuant to Revised Order No. 1 of the Public Service Commission (1941). All telephone public service providers are mandated to publish the telephone directory at least once a year.
Pursuant to Section 2.2 of NTC MC 05-06-2007, the consumer shall be given the option not to be listed in succeeding publications.
NTC MC 05-06-2007 did not make the publication of the telephone directory optional and neither did it stop the publication of the same. Said NTC Memorandum Circular has given the consumer the option not to be listed in succeeding publications.
NTC MC 05-06-2007 did not provide for the procedure or mechanism on how the consumer shall exercise his/her option not to be listed. But NTC MC 05-06-2007 is clear that when the consumer exercises his/her option not to be listed in the telephone directory, the telephone public service provider shall comply. The option appears to be initiated by the consumer.

Admittedly, PLDT in compliance with its legal obligation to publish telephone directories**,** failed to include an opt-out option for its subscribers to be listed in succeeding publications. Such failure to abide by Section 2.2 of the NTC MC can be cited to be a violation of the general data privacy principle of transparency but does not equate to a violation of Section 28 of the DPA, which is applicable when personal information is processed without the consent of the data subject, or otherwise authorized by law.

After a thorough re-examination of the case, the Decision dated 17 December 2020 overlooked certain aspects which, if not corrected, will cause extreme and irreparable damage and prejudice as to how the DPA should be interpreted and applied.

In good conscience, there is no qualms about imposing damages against PLDT for its failure to include a privacy notice in the application form.

However, it must be emphasized that PLDT has since responded proactively by instilling privacy-protecting measures in its DSL application forms by 2017, even before Complainant filed the instant Complaint. They also sought clarification with the NTC, culminating in NPC Advisory Opinion No. 18-021. In addition, PLDT has registered with the NPC and attempted to comply with all the requirements of NPC.

There is no perfect compliance journey. For example, back in 2016 to 2018, when the NPC has newly started, admittedly, the compliance journeys of companies with the DPA varied. This is because no one fully understood the operationalization of the DPA, even when said law became effective in 2012.

It is simplistic to believe that every action or decision within a company results from either a calculation of costs and benefits or is governed solely by maximization of profits. Events can result from mistakes, accidents, confusion, poor judgment on prioritization, and especially from the complexity that arises from integrating multiple people and systems. Thus, the idea of imposing a penalty on “the organization” in the belief that “it” will respond as a single integrated organism and avoid some future actions that result in breaches of a rule simplistic and may not always prove true.¹⁴⁷

Even now, the NPC continues to conduct awareness campaigns to guide the PICs or PIPs. NPC have been leaders and protectors. And enforcers, especially against those who willfully violate the law. As NPC advances, the Commission is urged to put on wider lenses when adjudicating cases to enable the PICs to thrive and encourage organizational accountability without fear of being put behind bars while meting justice to data subjects.

Following the previous discussions, my recommendation is for this Commission to partially grant the Motion for Reconsideration filed by PLDT.

PLDT should not be liable for violating Section 28 of the DPA since it has a lawful criterion for processing, which is a legal obligation pursuant to the Public Service Act.

PLDT should not be liable for violating Section 32, which is not applicable in this case. Again, the data subject’s consent is not the basis for the disclosure; hence, the consent requirement under Section 32 of the DPA is immaterial.

There being no violations of Sections 28 and 32, it follows that the PLDT’s “responsible persons, officers or individuals” have no criminal liability. For this purpose, the directive in the Decision dated 17 December 2020, remanding the case to NPC’s Complaints and Investigation Division for the limited purpose of determining and identifying the responsible persons, officers, or individuals of PLDT who caused the violations of Sections 28 and 32 of the DPA must be set aside.

Finally, since PLDT did not violate Sections 28 and 32 of the DPA but committed only a violation of the general data privacy principle of transparency for its failure to include a notice to the data subject that their information would be published on the White Pages, the nominal damages of Fifty Thousand Pesos (P50,000.00) awarded to RLA in the Decision dated 17 December 2020 must be reduced to just Ten Thousand Pesos (P10,000.00). It must be stressed that the damages are imposed on this occasion due to the peculiarity of the instant Complaint and its surrounding circumstances.

WHEREFORE, it is recommended that the Motion for Reconsideration dated 05 August 2021 filed by PLDT Enterprise be PARTIALY GRANTED. PLDT Enterprise and its responsible officers should NOT BE LIABLE for violations of Sections 28 and 32 of the Data Privacy Act of 2012.

However, it is recommended that the award to Complainant, RLA of nominal damages must be SUSTAINED but in the reduced amount of Ten Thousand Pesos (P10,000.00) on account of PLDT Enterprise’s violation of the general data privacy principle of transparency.

The remand of the case to the Complaints and Investigation Division of the National Privacy Commission (NPC) for the limited purpose of determining and identifying the responsible persons, officers, or individuals of PLDT Enterprise should be SET ASIDE.

Instead, the Compliance and Monitoring Division (CMD) of the NPC is hereby directed to CONDUCT A COMPLIANCE CHECK on PLDT Enterprise to determine whether the measures and standards being implemented by the company are in line with the Data Privacy Act of 2012 and upholds data subjects’ rights.

Further, PLDT Enterprise is ordered to submit to the CMD its Privacy Impact Assessment particularly on data flows on the application and subscription process of its customers to PLDT Enterprise’s products and services.

(Sgd.)
RAYMUND ENRIQUEZ LIBORO
Privacy Commissioner

Footnotes

Decision, 17 December 2020, at 26, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2020) (pending). ↩
Motion for Reconsideration, 05 August 2021, at 1, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Id. at 1-2. ↩
Id. at 5. ↩
Id. at 9. ↩
Id. at 2. Emphasis supplied. ↩
Public Service Commission, Rules and Regulations for all Public Services, Revised Order No. 1, Commonwealth Act No. 146, § 149 (1941). ↩
National Telecommunication Commission, Consumer Protection Guidelines [NTC Memo. Circ. No. 05-06-2007], § 2.2 (8 June 2007). ↩
Motion for Reconsideration, 05 August 2021, at 3, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). Emphasis supplied. ↩
Id. at 3. ↩
Id. at 5. Emphasis supplied. ↩
Id. ↩
Id. at 6. ↩
Id. Emphasis supplied. ↩
Motion for Reconsideration, 05 August 2021, at 6, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Id. at 7. Emphasis supplied. ↩
Id. ↩
Id. at 9. Emphasis supplied. ↩
Id. ↩
Id. at 11. ↩
Motion for Reconsideration, 05 August 2021, at 11, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Id. ↩
Id. at 12. ↩
Comment/ Opposition to the Respondent’s Motion for Reconsideration, 26 October 2021, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 § 3 (h) (2012). ↩
Id. ↩
Id. § 3 (i). ↩
Motion for Reconsideration, 05 August 2021, at 10-11, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Id. at 10. ↩
National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, rule I, § 3 (f) (2016). ↩
Motion for Reconsideration, 05 August 2021, at 10-11, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Id. at 10. ↩
Decision, 17 December 2020, at 10, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2020) (pending). ↩
Motion for Reconsideration, 05 August 2021, at 10, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, rule I, § 3 (m). ↩
EUROPEAN UNION AGENCY FOR FUNDAMENTAL RIGHTS AND COUNCIL OF EUROPE, HANDBOOK ON EUROPEAN DATA PROTECTION LAW 104–105 (2018). ↩
Motion for Reconsideration, 05 August 2021, at 11, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Id. at 10. ↩
PLDT Terms and Conditions, at 2. Emphasis supplied. ↩
Id. ↩
Motion for Reconsideration, 05 August 2021, at 6, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Id. ↩
Id. ↩
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, rule X, § 44 (b) (1). ↩
Motion for Reconsideration, 05 August 2021, at 1-2, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Rules and Regulations for all Public Services, Revised Order No. 1, Commonwealth Act No. 146, § 149. Emphasis supplied. ↩
Motion for Reconsideration, 05 August 2021, at 2, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Office of the President, Instituting the Administrative Code of 1987, Executive Order No. 292, Series of 1987 [E.O. No. 292, s. 1987], Book IV Chapter 11 § 50 (25 July 1987). ↩
Tanada v. Tuvera, G.R. No. L-63915 (1986). ↩
NTC Memo. Circ. No. 05-06-2007, § 2.2. ↩
See, Liboro Dissenting Opinion, 10 December 2021, at 6, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Decision, 17 December 2020, at 14, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2020) (pending). Emphasis supplied. ↩
Data Privacy Act of 2012, § 3 (b). Emphasis supplied. ↩
Motion for Reconsideration, 05 August 2021, at 3, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
NTC Memo. Circ. No. 05-06-2007, § 2.2. ↩
Id. ↩
Id. ↩
Data Privacy Act of 2012, § 3 (b). Emphasis supplied. ↩
Liboro Dissenting Opinion, 10 December 2021, at 6, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
JMM Promotions & Management, Inc. v. National Labor Relations Commission, G.R. No. 109835, 22 November 1993. ↩
Liboro Dissenting Opinion, 10 December 2021, at 10, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Motion for Reconsideration, 05 August 2021, at 11, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Comment to the Complaint dated 31 March 2018, 05 October 2018, at 4-6, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2018). ↩
Liboro Dissenting Opinion, 10 December 2021, at 12, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Decision, 17 December 2020, at 11, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). Emphasis supplied. ↩
Id. at 11-12. Emphasis supplied. ↩
Id. at 14. Emphasis supplied. ↩
Comment to the Complaint dated 31 March 2018, 05 October 2018, at Annex B, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2018) (pending). ↩
Liboro Dissenting Opinion, 10 December 2021, at 16, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Motion for Reconsideration by PLDT, Inc., 05 August 2021, at 8, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Liboro Dissenting Opinion, 10 December 2021, at 14, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
See National Privacy Commission, Advisory on Telephone Directories, Advisory Opinion No. 21, Series of 2018 (27 April 2018). ↩
See Liboro Dissenting Opinion, 10 December 2021, at 6, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Villafuerte v. Cordial, Jr., G.R. No. 222450 (2020). ↩
See National Privacy Commission, Advisory on Telephone Directories, Advisory Opinion No. 21, Series of 2018 (27 April 2018). ↩
See Liboro Dissenting Opinion, 10 December 2021, at 6, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Data Privacy Act of 2012, § 28. Emphasis supplied. ↩
Motion for Reconsideration by PLDT, Inc., 05 August 2021, at 11, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Id. ↩
Id. ↩
Id. ↩
Decision, 17 December 2020, at 11, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2020) (pending). Emphasis supplied. ↩
Motion for Reconsideration, 05 August 2021, at 2, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Data Privacy Act of 2012, § 12 (c). Emphasis supplied. ↩
EUROPEAN UNION AGENCY FOR FUNDAMENTAL RIGHTS AND COUNCIL OF EUROPE, HANDBOOK ON EUROPEAN DATA PROTECTION LAW 152 (2018). ↩
Motion for Reconsideration, 05 August 2021, at 2, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Id. ↩
Id. at 3. ↩
Id. ↩
Id. ↩
Data Privacy Act of 2012, § 12 (c). ↩
Id. § 11. ↩
Decision, 17 December 2020, at 11 in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2020) (pending). ↩
Motion for Reconsideration, 05 August 2021, at 3, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
PLDT Application Form for Corporate Individual DSL Account (21 December 2015). ↩
Letter from Knutsen Philippines, Inc. to PLDT, Inc. (12 April 2016). ↩
Decision, 17 December 2020, at 19, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2020) (pending). ↩
Id. ↩
Data Privacy Act of 2012, § 32. ↩
Id. § 31. ↩
Id. ↩
U.S. v. Go Chico, G.R. No. 4963 (1909). ↩
Metropolitan Bank and Trust Co. v. Liberty Corrugated Boxes Manufacturing Corp., G.R. No.184317 (2017). ↩
Fort Bonifacio Development Corp. v. Commissioner of Internal Revenue, G.R. Nos. 158885 & 170680 (Resolution) (2009). ↩
JMM Promotions & Management, Inc., G.R. No. 109835 (1993). Emphasis supplied. ↩
People v. Liban, G.R. Nos. 136247 & 138330 (2000). ↩
Comment to the Complaint dated 31 March 2018, 05 October 2018, at Annex B, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2018) (pending). ↩
Casco v. NLRC, G.R. No. 200571 (2018). ↩
Motion for Reconsideration, 05 August 2021, at 6, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). Emphasis supplied. ↩
United Claimants Association of NEA v. National Electrification Administration, G.R. No. 187107 (2012); Cordova v. Ty, G.R. No. 246255 (2021). ↩
Decision, 17 December 2020, at 22, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2020) (pending). ↩
Id. at 23. ↩
Motion for Reconsideration, 05 August 2021, at 5, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Id. at 3. ↩
Liboro Dissenting Opinion, 10 December 2021, at 8, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Data Privacy Act of 2012, § 38. Emphasis supplied. ↩
Id. ↩
Liboro Dissenting Opinion, 10 December 2021, at 9, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
Id. at 9. ↩
Id. at 2. ↩
Id. at 17. “Thus, the idea of imposing a penalty on “the organization” in the belief that “it” will respond as a single integrated organism and avoid some future actions that result in breaches of a rule simplistic and may not always prove true. Even now, the NPC continues to conduct awareness campaigns to guide the PICs or PIPs. NPC have been leaders and protectors. And enforcers, especially against those who willfully violate the law. As NPC advances, the Commission is urged to put on wider lenses when adjudicating cases to enable the PICs to thrive and encourage organizational accountability without fear of being put behind bars while meting justice to data subjects.” ↩
See, Liboro Dissenting Opinion, 10 December 2021, at 17, in RLA v. PLDT Enterprise, NPC 18-010 (NPC 2021) (pending). ↩
NPC 18-010 Decision dated 17 December 2020. ↩
Section 12 of the DPA. ↩
Section 13 of the DPA. ↩
Supra. ↩
Section 28 of the DPA. ↩
Public Service Commission, Public Service Commission Rules and Regulations for all Public Services, Revised Order No. 1, Section 149. ↩
National Telecommunication Commission, Consumer Protection Guidelines [NTC Memo. Circ. No. 05-06-2007], Section 2.2 (08 June 2007). ↩
Subject Title, Id. ↩
National Telecommunication Commission, Consumer Protection Guidelines [NTC Memo. Circ. No. 03-03-2007], Section 3 (03 July 2006). ↩
Section 4, Id. ↩
National Telecommunication Commission, Voice Over Internet Protocol [NTC Memo. Circ. No. 05-08-2005], Section 2 (e), (23 August 2005) ↩
National Telecommunication Commission, Consumer Protection Guidelines [NTC Memo. Circ. No. 05-06-2007], Section 1.1 (08 June 2007). ↩
National Telecommunication Commission, Voice Over Internet Protocol [NTC Memo. Circ. No. 02-05-2008], Section 2 (I). (30 May 2005). ↩
See National Telecommunication Commission, Voice Over Internet Protocol [NTC Memo. Circ. No. 02-05-2008], at Sections 2.2 to 2.11. (30 May 2005). ↩
Motion for Reconsideration filed by PLDT on NPC 18-010 dated 05 August 2021 at pp. 3. ↩
G.R. No. 183517, 22 June 2010. ↩
[Footnote 139 is referenced on page 48 but no footnote text appears in the source PDF.] ↩
Id. at p. 5. ↩
SEC. 32. Unauthorized Disclosure. – (a) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party personal information not covered by the immediately preceding section without the consent of the data subject, shall he subject to imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00). (b) Any personal information controller or personal information processor or any of its officials, employees or agents, who discloses to a third party sensitive personal information not covered by the immediately preceding section without the consent of the data subject, shall be subject to imprisonment ranging from three (3) years to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00). ↩
According to Hodges (2021), “Organizational Accountability in Data Protection Enforcement” (pp. 8 to 10) [Whitepaper]. ↩
Id. ↩
Paragraph 3 of PLDT letter dated 18 October 2017 at p. 1. ↩
Id., Paragraph 4 at p. 1. ↩
Id., Paragraph 2 at p. 1. ↩
According to Hodges (2021), “Organizational Accountability in Data Protection Enforcement” (at p. 8) [Whitepaper]. ↩

NPC Issuance Wiki

Corpus