NPC Issuance Wiki

NPC 19-030 and NPC 19-132: CL v. DDZ and DM v. DDZ

Issued Resolution

Resolution Text

CL,

Complainant,

-versus-

DDZ,

Respondent.

NPC No. 19-030

(formerly CID Case No. 19-A-030)

For: Violation of the Data Privacy Act of 2012

x-----------------------------------------------x

DM,

Complainant,

-versus-

DDZ,

Respondent.

NPC No. 19-030, NPC No. 19-132

(formerly CID Case No. 19-B-132)

For: Violation of the Data Privacy Act of 2012

x-----------------------------------------------x

NAGA, D.P.C.:

For consideration of the Commission is the Motion for Reconsideration dated 11 September 2021 filed by CL and DM (Complainants) on the Decision dated 10 June 2021 which dismissed their Complaints against DDZ (Respondent) for lack of merit.

Facts

The Commission issued a Decision dated 10 June 2021, dismissing the Complaints filed by CL and DM, with the following dispositive portion:

WHEREFORE, all premises considered, this Commission resolves that the instant Complaints filed by CL and DM are hereby DISMISSED for lack of merit. NPC 19-030 and NPC 19-132: CL vs. DDZ and DM vs. DDZ

SO ORDERED.1

Complainants filed a Motion to Suspend the Period of Filing of Pleadings dated 13 August 2021, seeking for the application of the Supreme Court Administrative Circular No. 56-2021 (SC Circular).2

On 02 September 2021, the Commission issued an Order denying the Motion to Suspend the Period of Filing of Pleadings. However, in the Order, the Commission granted Complainants a non-extendible period of five (5) days upon receipt of the Order to make the filing and service of necessary pleadings and motion.3

On 07 September 2021, Complainants filed a Manifestation that since the fifth day of the period it was given in the Order fell on 11 September 2021, a Saturday, they had until 13 September 2021 to submit their Motion for Reconsideration (Motion).4

On 13 September 2021, Complainants filed their Motion dated 11 September 2021.

In their Motion, Complainants stated that it is not clear how Respondent obtained a copy of their personal files and closed-circuit television (CCTV) footages of the MVP worksite.5 Complainants argued that Respondent readily proposed that he obtained it from SM and DMV through a legitimate request. However, no evidence was presented to show that such request was made. Further, the letter-request was omitted and no affidavit from SM and DMV was presented.6

Complainants then stated that no request appears in the records of the MVP office and that they were never informed that such request was processed by SM and DMV.7 Moreover, Complainants argued that they made the averment related to the database break-in by Respondent in their Complaints because they are unaware of any purported request for copies of their passports made to the responsible officers of MVP.8

Complainants further submits that Respondent is not a public authority, did not act under compulsion by order of such public authority, and that the passports were not essential to the prosecution of any of Respondent’s claims.9

Complainants, being aware of Respondent’s allegation that the passports were obtained through a valid request from the previous officers of MVP, the said corporation through its authorized representative, AR instituted a Complaint dated 11 September 2020 against SM, DMV, and DDZ.10

Complainants stated that such Complaint was received and duly acknowledged by the Commission’s Complaints and Investigation Division (CID).11 However, despite the acknowledgement of receipt and promise to review the Complaint, it remains to be undocketed and has not been acted upon by the Commission.12

Complainants filed a Motion to Consolidate on 16 December 2020. Additionally, they stated that more than two (2) months have passed without any Resolution on the Motion, they filed a Motion to Resolve on the issue of consolidation dated 24 February 2021.13 However, according to Complainants, the Commission did not act on these two (2) pending Motions and that it seems that the pending Motions and verified Complaint filed by MVP were not considered when the Commission rendered the Decision dated 10 June 2021.14

Complainants emphasized that the consolidation of the cases are important since it would expedite the resolution of the issue. Complainants added “if the cases were consolidated, DMV and SM could have been summoned and shed light on the factual circumstances claimed by Respondent DDZ.”15 Further, they stated that the proper resolution of this case will be incomplete, unfair, and unjust since SM and DMV are not allowed to be made part of the case and that the situation calls for a proper remand for investigation.16

On Respondent’s reliance on Section 13(f) of the Data Privacy Act (DPA) of 2012, Complainants argued that attaching the passports to Respondent’s Complaint-letter was not necessary since Complainants being Australian citizens without working visas is not relevant to the criminal and labor cases then existing.17 The nationality or citizenship is also neither an essential element of the crimes mentioned nor would constitute part of the labor case for dismissal. Complainants argued that the virtual nexus between Respondent and Complainants with regard to the contents of the passports does not exist and therefore fail the test provided by NPC Case No. 17-018.18

Moreover, according to Complainants it was Respondent, together with his cohorts, SM and DMV, who should be guilty of theft of Complainants’ sensitive personal information.19

Complainants also stated that the Office of the Prosecutor, Department of Labor and Employment (DOLE), Clark Development Corporation (CDC), and the Bureau of Immigration (BI) did not ask for the documents.20

The exemption in processing sensitive personal data only applies to the Government entities as part of their function which cannot be said on the part of Respondent since he is not public office or functionary and thus, cannot claim such exemption as a privilege.21

Complainants cited Section 19 of the DPA which states that “the personal information shall be held in strict confidentiality and shall be used only for the declared purpose”, but since Complainants’ have not seen a copy of Respondent’s request, they do not know for what purpose his request was made.22 Further, they argued that there is no transparency in the processing of their sensitive personal information.

Moreover, Complainants stated “the Personal Privacy Controller [sic] of the MVP is not even aware that a request was made by Respondent.”23 According to Complainants, it was SM and DMV who processed the sensitive personal information, without informing the data subjects and without authority to do so. Complainants stated that DDZ, SM, and DMV connived to steal their sensitive personal information for a malicious purpose.24

Complainants stated that there is also no legitimate purpose since Respondent did not provide the request made to MVP which shall state the purpose of processing. Further, there is also no proportionality since the information processed was already with the agencies concerned or within the grasp of government agencies, Respondent cannot borrow government’s rights and privileges.25

According to Complainants, Respondent should provide the evidence of the valid request for processing the information. Respondent has the burden of proving, as a matter of defense, that he is within the exception in the statute creating the offense. Complainants stated that like all matters of defense, the burden of establishing such claim is on the party relying or invoking it.26

They stated that there is no evidence to support Respondent’s supposed claim of a valid request existed. However, there is ample evidence that there were no requests appearing in the MVP records.27

Based on the Data Protection Officer (DPO) report by Atty. EV, the internal investigation shows that no consent was obtained from the management for the release of Complainants’ documents. There are also no copies of the request claimed by Respondent in the files of MVP.28 Complainants alleged that the intrusion to the data banks of MVP was accomplished in connivance with SM and DMV since they have access even without authority and without informing the data subjects of the processing.29

Further, if a valid request exist, it is within the capacity of Respondent to produce a copy of such request.30

Complainants prayed then that: (a) Decision dated 10 June 2021 be reconsidered and appropriate remedies and penalties be imposed against Respondent DDZ; and (b) Alternatively, that the cases be consolidated with the undocketed case filed by MVP as the issues are intimately related to each other. Should the Commission deem it fit and proper, to remand the case for proper determination with proper issuance of summons to DMV and SM so they can be held responsible for the violation of the DPA.31

On 17 September 2021, the Commission issued an Order, ordering Respondent DDZ, to file a Comment on the Motion for Reconsideration dated 11 September 2021 filed by Complainants and to submit the same within fifteen (15) days from receipt of the Order.32

On 22 October 2021, Respondent filed a Motion to Admit Comment together with his Comment.33

In his Comment, Respondent argued that Complainants’ arguments in their Motion are trivial and inconsequential and do not affect the substantial and material discussions of the Commission.34

According to Respondent, Complainants attached as Annex “A” in their Motion, a purported complaint which is totally unrelated to the case decided by the Commission and deserves no consideration to the resolution of the said Motion.35

Respondent also stated that the separate Complaints arose from the same set of facts, arguments, and evidence. However, Complainants opted to initiate a Complaint separately to harass and vex Respondent.36 Further, Respondent stated “the undocketed Complaint attached as Annex “A”, also falls to the same malicious story. These only proved Respondent’s claim that the instant cases were filed to unjustly annoy Respondent.”37

Respondent reiterated his allegations that the Complaints were being utilized by Complainants to have leverage over Respondent’s labor case. Since the Labor Arbiter ruled in favor of Respondent on the said labor case, Respondent stated that Complainants will hardly but uselessly pursue these cases, or any other cases against Respondent to get even.38

In addition, Respondent stated that not only that the Complaints were vexatious, but also absurd. According to Respondent, first, Complainants themselves disclosed their passport information with the Commission when they filed their Complaints.39 Second, following to their line of thinking, Complainants are guilty of the same charge of violation of the DPA considering that they disclosed sensitive personal information of Respondent, particularly his Alien Certificate of Registration as attachment to their Complaints.40

On Complainants’ allegation that he broke into MVP’s database, Respondent stated that Complainants solely relied on surmises and conjectures which are wholly unsupported by legal and factual bases.41

Respondent argued that like any other cases, Complainants have the burden of proof to show that Respondent violated the DPA.42 He further stated that Complainants failed to provide substantial evidence that Respondent knowingly and unlawfully broke into MVP’s database. Complainants also did not show that there was an actual storage of scanned copies of passports. Moreover, the facilities of MVP are covered by CCTV cameras but Complainants did not attach video clip or screen capture to prove their claims.43 Respondent stated that he fully subscribe to the findings of the Commission that he cannot be held liable for the violation of Section 29 of the DPA (Unauthorized Access or Intentional Breach).44

Further, Respondent stated that he agrees to a certain extent on Complainants’ allegations that passport contains personal and sensitive personal information.45 However, he reiterated that such information is excluded from the coverage of the DPA pursuant to Section 4(e) of the DPA. Additionally, he stated that the processing of information contained in the passport is permitted under Section 12(e) and (f) of the DPA, and exempted under Section 13(e) of the DPA.46

He also reiterated that the information of Complainants were necessary in order for the government agencies to perform their statutorily mandated functions.47

Moreover, Respondent stated “Complainants argued that Respondent’s processing of information were not exempted since it was not ‘necessary’ to protect his claim or interest. Complainants argued that the word ‘necessary’ connotes that the sensitive information that was processed should be needed to protect the claim or interest of the party using that information. However, the exemption that Respondent and the Honorable Commission pointed out is found under the phrase ‘or when provided to government or public authority’ of Section 13(f).”48

He also stated that he only processed Complainants’ information with the government agencies which were tasked to enforce laws and protect lawful rights and interests of natural or legal persons, the Philippine Government, and the Filipino citizens.49

Respondent stated that his legitimate interest was to report the illegal acts of Complainants, and although he is not a Personal Information Controller (PIC), his processing is permitted as a “third party” pursuant to Section 13(f) of the DPA.50 Further, Respondent stated that he processed the information in good faith pursuant to his moral obligation to promptly report on what he believes is an illegal act under Philippine Laws.51

Respondent prays that Complainants’ Motion for Reconsideration dated 11 September 2021 be denied for the lack of merit.52

Issues

Whether the Motion for Reconsideration dated 11 September 2021 on the Decision dated 10 June 2021 filed by Complainants should be granted.

Discussion

The Commission partially grants the Motion for Reconsideration filed by Complainants.

The Commission finds that in order to properly resolve the case, it shall first solely focus on the procedural issues raised by Complainants. The Commission shall not delve on the substantive issues raised by both parties in their respective pleadings until such time that Complainant’s pending Motions have been properly resolved.

In its Motion, Complainants stated that MVP, through its authorized representative, AR, instituted a Complaint dated 11 September 2020 against SM, DMV, and DDZ which was received and duly acknowledged by the Commission’s CID. Complainants attached in their Motion as Annex “A”, the copy of the Complaint.53 They also attached as Annex “B”, the copy of CID’s email stating that the Complaint has been received and will be reviewed shortly.54

Also, a Motion to Consolidate was filed by Complainants on 16 December 2020 stating that their Complaints and the Complaint filed by MVP contains issues are intimately related to each other.

Additionally, since the Commission has yet to issue a resolution on the Motion to Consolidate, Complainants filed a Motion to Resolve on the issue of consolidation dated 24 February 2021.

However, Complainants stated that the Commission did not act on these two (2) pending Motions and that the pending Motions and verified Complaint filed by MVP were not considered when the Decision dated 10 June 2021 was rendered.55

In terms of procedural issues, the resolution of the Motion to Consolidate and Motion to Resolve is a material fact that needs to be considered by the Commission. Further, the Commission notes that addressing the pending Motions filed by Complainants is imperative in the holistic resolution of the case, given that the Complaints filed by CL and DM and the Complaints filed by MVP are alleged to have similar and interrelated issues that must be reviewed and resolved by the Commission.

Moreover, in this case, the Commission deems that the proper resolution of the pending Motions shall be addressed by the Commission. Thus, the Commission finds that the Motions filed by Complainants shall be remanded to the Complaints and Investigation Division (CID) of the Commission to resolve whether the Complaints filed may be consolidated, as allowed by Section 7 of the NPC Circular No. 2021-01 (2021 NPC Rules of Procedure), viz:

SECTION 7. Consolidation of cases. – Except when consolidation would result in delay or injustice, the NPC may, upon motion or in its discretion, consolidate two (2) or more complaints involving common questions of law or fact and/or same parties.56

Further, the Commission shall await for the Resolution of the CID on the pending Motions filed by Complainants before fully deciding on Complainants’ Motion including its substantive issues. Hence, the Commission partially grants Complainants’ Motion for Reconsideration.

As to the Motion to Admit Comment and the attached Comment dated 22 October 2021 filed by Respondent, the Commission notes that Respondent received the Commission’s Order dated 17 September 2021 on 30 September 2021. Therefore, Respondent has fifteen (15) days from receipt of the Order or until 15 October 2021 to submit his Comment. However, Respondent only submitted his Comment on 22 October 2021 which is beyond the allowed period. Hence, it was filed out of time.

Nonetheless, in consideration of substantial justice, the Commission resolves to admit Respondent’s Motion to Admit Comment and Comment despite being filed out of time.

WHEREFORE, premises considered, this Commission resolves to PARTIALLY GRANT the Motion for Reconsideration dated 11 September 2021 filed by Complainants CL and DM.

SO ORDERED.

City of Pasay, Philippines. 11 November 2021.

JOHN HENRY D. NAGA Deputy Privacy Commissioner

WE CONCUR:

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

Copy furnished:

CL Complainant

DM Complainant

MJRVLO Counsel for Complainants

DDZ Respondent

PMB Counsel for Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Decision, 10 June 2021 at p. 10. NPC 19-030 and NPC 19-132. ↩

  2. Id. at p. 2. ↩

  3. Order dated 02 September 2021. ↩

  4. Id at p. 3. ↩

  5. Motion for Reconsideration dated 11 September 2021. At p. 3. ↩

  6. Id. ↩

  7. Id. ↩

  8. Id. ↩

  9. Id. ↩

  10. Id. at p. 5. ↩

  11. Id. ↩

  12. Id. ↩

  13. Id. ↩

  14. Id. ↩

  15. Id. at p. 6. ↩

  16. Id. ↩

  17. Id at p. 7 ↩

  18. Id. ↩

  19. Id. at p. 8. ↩

  20. Id. at p. 9 ↩

  21. Id. at p. 10 ↩

  22. Id. at p. 11. ↩

  23. Id. at p. 12. ↩

  24. Id. at p. 13 ↩

  25. Id. ↩

  26. Id. at p.14. ↩

  27. Id. at p. 17. ↩

  28. Id. at p. 17-18. ↩

  29. Id. at p. 18. ↩

  30. Id. ↩

  31. Id. at p. 20. ↩

  32. Order dated 17 September 2021. ↩

  33. Motion to Admit Comment and Comment dated 22 October 2021. ↩

  34. Id. at p. 1. ↩

  35. Id. ↩

  36. Id. at p. 2 ↩

  37. Id. ↩

  38. Id. ↩

  39. Id. ↩

  40. Id. ↩

  41. Id. ↩

  42. Id. at p. 3. ↩

  43. Id. at p. 4 ↩

  44. Id. at p. 4 to 5. ↩

  45. Id. at p. 5. ↩

  46. Id. ↩

  47. Id. at p. 7. ↩

  48. Id. ↩

  49. Id. ↩

  50. Id. at p. 7 to 8. ↩

  51. Id. at p. 8 to 9. ↩

  52. Id. at p. 9 ↩

  53. Motion for Reconsideration dated 11 September 2021. At p. 23. ↩

  54. Id. at p. 52. ↩

  55. Id. ↩

  56. Section 7 of the NPC Circular No. 2021-01 ↩

Backlinks

  • No backlinks found