Resolution Text
MNLC, INC. represented by IKP,
Complainant,
-versus-
PXXX CORPORATION, RCM and AD,
Respondent.
x----------------------------------------------------x
NAGA, D.P.C.:
For consideration of the Commission is the Motion for Reconsideration dated 17 January 2021 filed by Respondents PXXX Corporation, RCM, and AD of the Decision dated 29 October 2020 which finds that Respondents have violated Section 25(b) of the Data Privacy Act of 2012 (DPA). Respondents pray for the Decision to be reconsidered and set-aside and a new one should be issued dismissing the present complaint.
Facts
On 18 January 2021, Respondents filed a Motion for Reconsideration dated 17 January 2021 before this Commission. In their Motion for Reconsideration, Respondents questioned the jurisdiction of the Commission over the case considering that the Complainant has no personality to file the instant complaint.1
The Respondents further argued that the real party-in-interest are the individual members of the MNLCI (MNLCI) which have not executed authorization for IKP, GSP, and HCM to represent MNLCI in the proceedings before this Commission. Further, Respondents contended that for the Commission to have jurisdiction, the complaints must be filed by a data subject. They stated that it is a serious error not to dismiss the case since it is filed by a person with no legal interest nor personality to institute the case. Respondents argued that considering MNLCI is a corporate or artificial being, no personal information could be processed nor there is a privacy right to be protected.2
Respondents maintained that as stated in the NPC Circular No. 2021-013, there is a need of a special power of attorney in case one or more data subjects is represented by a single juridical entity. IKP, who filed the complaint, does not have the required special power of attorney empowering him to represent MNLCI in this case. Further, Respondents stated that since IKP does not have authority to represent the individual members of the MNLCI, they are deemed to not have participated in this case. Hence, it is improper for the Commission to award damages to the said members.3 In relation thereto, Respondents stated that the Commission may not capriciously nor arbitrarily waive its own rules by mere invocation of, “serious violation of the Data Privacy Act”.4
Moreover, Respondents argued that the Complainant failed to exhaust the remedies available to them as provided by Section 4 of the NPC Circular 16-046, which provides that no complaint shall be entertained unless the complainant has informed the concerned entity. Respondents added that the individual members of the MNLCI have not informed them of the alleged privacy violation. Although letters were sent to ACLO (Counsel for the Respondents), Respondents stated that they have the right not to entertain letters considering that the Complainant does not have Special Power of Attorney nor Secretary’s Certificate.
On the substantive matters, Respondents maintained that MNLCI consented on the processing of their personal data. They further argued that there is no need to contextualize the contents of the emails and Secretary’s Certificate given that MNLCI explicitly consented on the processing of personal information.
On the issue of legitimate interest to collect and process personal information, the Respondents stated that the processing of personal information was made pursuant to their legitimate interest. They argued that as manager and administrator of the MXXX Plaza Building, they have the duty and legal obligation to protect and secure said premises.5
Lastly, on the Commission’s finding that the Complainants are entitled to damages, Respondents contended that the data subjects must be individually identified to be entitled to damages. They stated that the identities of the individual members of MNLCI must be established and it must be proven that they are indeed members of the church. Respondents stated that in this case, there is no evidence presented to establish the names of MNLCI members.6
Complainant submitted an Opposition to the Respondents’ Motion for Reconsideration dated 29 January 2021. In their Opposition/Comment to the Motion for Reconsideration, the Complainant stated that the Respondents based their argument on the Frequently Asked Questions (FAQs) of the 2021 Rules of Procedure in arguing that the Commission has no jurisdiction over the case. Complainant argued that FAQs to a proposed administrative rule have no bearing on the matter of jurisdiction and that the Commission correctly ruled in its Decision that jurisdiction was validly acquired.7
In terms of jurisdiction over the parties, Complainant stated that there was implied consent of the church members to bring the violation of data privacy rights to the Commission, and that the Respondents themselves admitted that the data processing involved all the MNLCI church members.8
On the Respondents’ argument that the Complainant failed to exhaust remedies when the latter failed to inform them in writing of the privacy violation, the Complainant assailed the Respondents’ argument by stating that the NPC Rules of Procedure should be liberally interpreted to better serve the objective of the DPA.
On the issue of consent and legitimate purpose in the processing of personal information, the Complainant agreed to the previous ruling made by the Commission in its Decision. First, their consent was not validly obtained considering the imbalance of power between the parties. And the legitimate interest of the Respondents, however legitimate, was disproportionate to the means used by them.9
Complainants stated that they failed to see the Respondents’ argument that in awarding the damages, the data subjects must first be identified as basis to reverse the Decision.10 They argued that if it is the Respondent’s belief that church members must be identified before awarding the damages, then they only need to ask for the list of church members to MNLCI. Complainant then opined that the Respondents filed the Motion for Reconsideration just to delay the payment of indemnification. Lastly, Complainant prayed that the Motion for Reconsideration be denied by this Commission for lack of merit.11
Issue
Whether the Motion for Reconsideration merits the reversal of the 29 October 2020 Decision of this Commission.
Discussion
We deny the Respondents’ Motion for Reconsideration.
Ruling on the Procedural Issues
This Commission finds that there are no new material facts added for our consideration and that the Respondents merely restated their prior arguments in their 17 January 2021 Motion for Reconsideration.
On the Respondents’ contention of this Commission’s jurisdiction over the case, this Commission reminds that the essential aspect of determining the Commission’s jurisdiction is whether the allegations manifest a privacy violation against a data subject. Again, the fact that IKP in his Complaint-Affidavit alleged the Respondents committed acts that are violative of his privacy rights and other church members executed affidavit in support of his Complaint-Affidavit does not alter their status as affected data subjects, who are clearly within the scope of DPA’s protection and this Commission’s jurisdiction.
On the matter concerning the exhaustion of remedies, the Respondents maintain their argument that the individual members of MNLCI have not informed PXXX Corporation with regard to the alleged privacy violation. Respondents contested this Commission’s statement in the previous Decision whereas Section 4 of the NPC Circular 16-04 provides that the Commission has the discretion to waive any of the requirements upon good cause shown, or if the complaint involves a serious violation or breach of the Data Privacy Act, taking into account the risk of harm to Complainant.12 As stated by the Respondents in their Motion for Reconsideration:
With all due respect, respondents posit that the Honorable Commission may not capriciously or arbitrarily waive its own Rules simply because of mere invocation of “serious violation or breach of Data Privacy Act” on the part of the complainant. If we are to follow such reasoning, there can be no occasion where the rule on exhaustion of remedies will be applied because of every litigant’s bare invocation of “serious violation or breach of the Data Privacy Act.”
Again, this Commission refers to the last paragraph of Section 4 of NPC Circular 16-04 which was carried over in the NPC Circular 2021-01, viz:
SECTION 4. Exhaustion of remedies. – No complaint shall be entertained unless:
a. the complainant has informed, in writing, the personal information controller or concerned entity of the privacy violation or personal data breach to allow for appropriate action on the same;
b. the personal information controller or concerned entity did not take timely or appropriate action on the claimed privacy violation or personal data breach, or there is no response from the personal information controller within fifteen (15) days from receipt of information from the complaint;
c. and the complaint is filed within six (6) months from the occurrence of the claimed privacy violation or personal data breach, or thirty (30) days from the last communiqué with the personal information controller or concerned entity, whichever is earlier.
The failure to comply with the requirements of this Section shall cause the matter to be evaluated as a request to the National Privacy Commission for an advisory opinion, and for the National Privacy Commission to take such further action, as necessary. The National Privacy Commission may waive any or all of the requirements of this Section, at its discretion, upon good cause shown, or if the complaint involves a serious violation or breach of the Data Privacy Act, taking into account the risk of harm to the affected data subject.13 (Emphasis supplied)
Just the same, Rule II, Section 2 of the NPC Circular 2021-01 provides:
SECTION 2. Exhaustion of remedies. – No complaint shall be given due course unless it has been sufficiently established and proven that:
the complainant has informed, in writing, the personal information controller (PIC), personal information processor (PIP), or concerned entity of the privacy violation or personal data breach to allow for appropriate action on the same; and
the PIC, PIP, or concerned entity did not take timely or appropriate action on the claimed privacy violation or personal data breach, or there is no response from the PIC, PIP, or concerned entity within fifteen (15) calendar days from receipt of written information from the complainant.
The NPC may waive any or all of the requirements of this Section at its discretion upon (a) good cause shown, properly alleged and proved by the complainant; or (b) if the allegations in the complaint involve a serious violation or breach of the Data Privacy Act of 2012, taking into account the risk of harm to the affected data subject, including but not limited to:
i. when there is grave and irreparable damage which can only be prevented or mitigated by action of the NPC;
ii. when the respondent cannot provide any plain, speedy or adequate remedy to the alleged violation;
iii. or the action of the respondent is patently illegal. (Emphasis supplied)
This Commission reiterates its ruling that Section 4 of the NPC Circular 16-04 was intended to avoid the undue clogging of the Commission’s dockets and prevent instances that a case shall be dismissed even if there is good cause shown by the Complainant or the case involves serious violation or breach of the DPA. Further, the rule is intended to avoid instances of deciding cases based on mere technicalities. This approach in resolving issues was expounded by the Supreme Court in Aguam v. Court of Appeals:
“The law abhors technicalities that impede the cause of justice. The court’s primary duty is to render or dispense justice. ‘A litigation is not a game of technicalities.’ ‘Lawsuits unlike duels are not to be won by a rapier’s thrust. Technicality, when it deserts its proper office as an aid to justice and becomes its great hindrance and chief enemy, deserves scant consideration from courts.’ Litigations must be decided on their merits and not on technicality.”14 (Emphasis supplied)
In this case, there was good cause shown by the Complainant, considering the Complaint-Affidavit alleges series of acts of harassment by PXXX Corporation to force MNLCI’s members to comply and submit their passports and ID’s. Further, as already expounded in our 29 October 2020 Decision, the case involves a serious violation or breach of the DPA due to violations of the General Data Privacy Principles15 and Criteria for Lawful Processing of Personal Information and Sensitive Personal Information16. Such are enough grounds for this Commission to waive the requirement of Section 4.
Moreover, this Commission highlights that as the country’s independent body mandated to implement the Data Privacy Act, the Commission is afforded with broad range of powers in implementing the legislation that was solemnly delegated to it.
Ruling on the Substantive Issues
On the Respondents’ argument that there is no need to contextualize the emails and Secretary’s Certificate provided that MNLCI explicitly consented the processing of personal information, the Respondents must be reminded that context is essential in determining validity of consent and cannot be brushed aside as espoused by the Respondents. This Commission emphasizes that in determining whether consent was freely given, the data subject must have a real choice where there is no risk of deception, intimidation, coercion or significant negative consequences if he or she does not consent. If the consequences of giving consent undermine the individual’s freedom of choice, consent would not be free.17 The allegations of the Complainant against Respondent remain unrefuted wherein Complainant alleges that two church members were banned from entering the church and guard dogs were posted at the entrance of the building which resulted in the delay of entrance of church members for over an hour and a half. Clearly, there is already an imbalance of power between PC and MNLCI.18 With this imbalance existing between the two, the supposed consent given by the church members cannot be deemed as freely given.
The Respondents further argued that the processing of personal information was made to pursue their legitimate interest. Although protecting the safety of the tenants of the building and security of the premises is a legitimate interest, Respondents only implemented stricter security measures to Complainant’s church members and not to other tenants of the building. There was no record that exhibits that church members were suspected to cause any of the security incidents mentioned by Respondents. Such fact is disproportionate to the Respondents’ claim that processing of personal information was made to pursue their legitimate interest of protecting and securing the premises since it is only targeted to only a specific group of individuals, in this case, the MNLCI church members.
On the issue of award of damages, this Commission reiterates that our Decision used a clear language and had a clear directive—that nominal damages shall be awarded to each member of the church, thus:
- AWARDS damages, in the amount of P1,000.00, to each member of Complainant MNLCI as of the date of filing of the Complaint Affidavit on 23 July 2019 for Respondent’s unlawful collection of their sensitive personal information, pursuant to Section 16 (f) of the Data Privacy Act; and19 (Emphasis supplied)
The Respondents cannot insert additional requirements which was not given by the law in awarding nominal damages. Article 2221 of the New Civil Code is clear that nominal damage can be awarded in recognition of the violated legal rights of a plaintiff or complainant.20 In this case and as ruled by the Commission, the award of nominal damages to Complainant is warranted, pursuant to the Commission’s findings that the Respondents unlawfully processed the data subjects’ sensitive personal information and failed to observe the general privacy principle of proportionality. Hence, compliance to the Decision in awarding nominal damages to the Complainant is within the responsibility and obligation of the Respondents, which includes coordination with the Complainant to obtain the official list of MNLCI church members.
In summary and as established above, the Respondents failed to present new material facts and evidence for the Commission to reconsider and/or amend its Decision.21 The Respondents’ Motion for Reconsideration is a mere reiteration of its previous arguments and submissions to the Commission.
Lastly, this Commission maintains its Decision22 where the Commission: (1) finds that Respondent ACD, Respondent ACM, and the Board of Directors of PXXX Corporation, namely EPA, CAS, RCM, HABJR, and JRB, as its responsible officers, have violated Section 25(b) of the Data Privacy Act; (2) forwards this Resolution and Decision dated 29 January 2020 and a copy of the pertinent case records to the Secretary of Justice, recommending the prosecution of respondents for the crime of Unauthorized Processing under Section 25 of the Data Privacy Act, and for its further actions; (3) awards damages, in the amount of P1,000.00, to each member of Complainant MNLCI as of the date of filing of the Complaint Affidavit on 23 July 2019 for Respondent’s unlawful collection of their sensitive personal information, pursuant to Section 16 (f) of the Data Privacy Act; and (4) orders the submission of proof of compliance by Respondents with abovementioned award within thirty (30) days of receipt of this Decision.
WHEREFORE, premises considered, this Commission resolves to DENY the Motion for Reconsideration filed by Respondents PXXX Corporation, RCM, and AD. The Decision of this Commission dated 29 October 2020 is hereby AFFIRMED.
SO ORDERED.
City of Pasay, Philippines. 23 February 2021.
JOHN HENRY D. NAGA Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
On Official Business
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
Copy furnished:
ACLO Counsel for the Complainant
M.C. PLO Counsel for the Respondents
ENFORCEMENT DIVISION GENERAL RECORDS UNIT
Footnotes
-
Motion for Reconsideration dated 17 January 2021, p. 1 ↩
-
Ibid. at p. 2 ↩
-
2021 Rules of Procedure of the National Privacy Commission, effective on 12 February 2021; Ibid. at p. 3 ↩
-
Ibid. at p. 5 ↩
-
Ibid. at p. 9 ↩
-
Ibid. at p. 10 ↩
-
Opposition to the Respondents Motion for Reconsideration dated 29 January 2021, at p. 2 ↩
-
Ibid. ↩
-
Ibid. at p. 5 ↩
-
Decision dated 29 October 2020. ↩
-
Opposition to the Respondent’s Motion for Reconsideration dated 29 January 2021, at p. 5 ↩
-
Decision dated 29 October 2020. At p. 12. ↩
-
Section 4 of NPC Circular 16-04 ↩
-
Paz Reyes Aguam vs. Court of Appeals, G. R. No. 137672, 31 May 2000 ↩
-
Section 11, DPA ↩
-
Sections 12 and 13, DPA ↩
-
National Privacy Commission. Advisory Opinion 2019-034 Re: Consent and Its Withdrawal for Employment Purposes. 02 September 2019, citing European Commission, Article 29, Data Protection Working Party, Opinion 15/2011. ↩
-
Records dated 19 July 2019, p. 3 ↩
-
Decision dated 29 October, at p. 30 ↩
-
Republic Act No. 286, at § 2, Article 2221 ↩
-
Decision dated 29 October 2020 ↩
-
Ibid. ↩