Resolution Text
A.N.M.,
Complainant,
-versus-
MDMC, INC.,
Respondent.
FOR: Violation of the Data Privacy Act of 2012
x----------------------------------------------------x
LIBORO, P.C.:
This Resolution refers to the Complaint filed by A.N.M. (Complainant) against MDMC, Inc. (Respondent), for alleged violations of Republic Act No. 10173 (Data Privacy Act).
Facts
On 25 September 2017, Complainant received a letter dated 07 September 2017 from MDMC, Inc. informing him that he won twenty thousand (20,000) Mabuhay Miles points. Attached to the letter is a claim form that Complainant must fill out and submit to R.C., branch marketing manager of MD Fairview. In compliance, Complainant submitted photocopies of his Philippine Airlines Mabuhay Card, Tax Identification Number Identification Card, voter’s Identification Card, and MD Card. However, Complainant did not hear anything from Respondent despite numerous follow up for the past eight (8) months.
On 15 May 2018, Complainant filed a complaint against Respondent. He avers that the documents he submitted to Respondent contains sensitive personal information that might fall into the wrong hands and be used for purposes other than those he intended. Thus, as a precautionary measure, he appealed to the National Privacy Commission so that adequate protection may be accorded to the personal data that he submitted to Respondent.
On 14 March 2019, the parties were ordered to appear for discovery conference, with a reminder to the parties that the case will be deemed submitted for resolution should they fail to appear.
During the discovery conference, only Respondent appeared through counsel, Atty. M.R.A. Respondent manifested that the complaint should be dismissed outright for lack of merit, because the Complaint was only filed as a precautionary measure.
On 25 March 2019, Respondent filed its Formal Entry of Appearance and Manifestation with Motion to Dismiss on the ground of non-exhaustion of administrative remedies by the Complainant before filing the Complaint, noncompliance with formal requisites of a formal complaint, and for lack of merit since the Complaint contained no material allegation of any act or omission on the part of Respondent which violated Complainant’s right to data privacy. Further, Respondent manifests that the twenty thousand (20,000) Mabuhay Miles points had already been credited to Complainant’s account.
Issue
Whether Respondent processed the sensitive personal information of Complainant for an unauthorized purpose.
Discussion
The Commission hereby resolves to dismiss the instant case.
NPC Circular 16-041 (Rules) provides that the National Privacy Commission, sua sponte, or persons who are the subject of a privacy violation or personal data breach, or who are otherwise personally affected by a violation of the Data Privacy Act (DPA), may file complaints for violations of the Act.1
In this case, Complainant avers that the documents he submitted to Respondent contains sensitive personal information that might fall into the wrong hands and be used for purposes other than those he intended. Thus, as a precautionary measure, he appealed to the Commission so that adequate protection may be accorded to the personal data that he submitted to Respondent.
Justice Alicia Austria-Martinez, speaking for the Supreme Court, ruled that he who alleges a fact has the burden of proving it and a mere allegation is not evidence.2
Similarly, in NPC 17-015, the Commission held that, “Complainant’s stand-alone allegation is not sufficient to file a complaint before the Commission because she is neither the subject of a privacy violation or personal data breach, or who is otherwise personally affected by a violation of the DPA. Put simply, Complainant does not have a legal standing to sue Respondent since she is not the affected data subject or was personally affected by a violation of the DPA.”
With the aforementioned provisions and pronouncement of the Commission, the burden lies on Complainant to prove whether or not Respondent committed a violation of the DPA.
After a thorough evaluation, the Commission finds that the Complaint was filed merely for a precautionary measure because he is worried that his personal information might fall into the wrong hands and might be used for purposes other than those he intended. Other than the allegation of eight (8) months delay of crediting the Mabuhay Miles points on his account, Complainant did not allege any wrongdoing on the part of Respondent that would result to a violation of the Data Privacy Act or involve a privacy violation or a personal data breach.
Being that Complainant is neither the subject of a privacy violation or personal data breach, or is otherwise personally affected by a violation of the DPA, he does not have a legal standing to sue Respondent. The allegations based on mere suspicion that Complainant’s personal information might be used for purposes other than those he intended is insufficient for any action by the Commission against Respondent.
In view of the foregoing, the Commission adjudged that the case be dismissed as there is no actual and justiciable controversy that warrants the attention of the Commission.
WHEREFORE, premises considered, the case of A.N.M. vs. MDMC, Inc. is hereby DISMISSED for lack of merit.
SO ORDERED.
Pasay City, Philippines; 21 May 2020.
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
WE CONCUR:
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Copy furnished:
A.N.M. Complainant
MDMC, INC. Respondent
COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT
Footnotes
-
Luxuria Homes Inc. vs. CA, GR No. 125986, Jan 28, 1999 ↩