Resolution Text
D.N.T.,
Complainant,
-versus-
K.K. and X.F.,
Respondent.
x---------------------------------------------x
LIBORO, PC.:
Before this Commission is the Mediated Settlement Agreement executed by and between complainant D.N.T. (Complainant) and respondents, K.K. and X.F. (collectively referred to as Respondents).
Facts
Record1 shows that Complainant is among the dependent and beneficiary of a retired employee of QBM (QBM). On 07 August 2019, he was not allowed by the Respondents herein to use the previously executed authorization from his brother which gives the Complainant the authority to avail travel benefits under QBM’s retirement plan. In addition to this, Complainant was also denied of his trip pass allocation information and was required by Respondent K.K. to secure a new letter of authorization in accordance with QBM’s new procedure for the availment of the travel benefits. When asked to explain, Respondent K.K. cited the Data Privacy Act of 2012 (DPA) as basis for the rules on letter of authorization and the non-disclosure of the details of the trip pass allocations of the Complainant. Complainant alleged that the Respondent cannot even point out the specific provision in the DPA which is the basis for the new procedure. Instead of explaining to the Complainant the purpose for the sudden changes in the new procedure, Respondent K.K. got upset and even allegedly said that the Complainant was not even the employee of QBM and was merely a dependent. Hence, this Complaint.
On 11 March 2020, the parties filed their Application for Mediation and on the same date, the Mediation Conference was conducted.
Through the sincere efforts of the parties to arrive at an amicable resolution of their dispute, they were able to execute a Mediated Settlement Agreement on 11 March 2020.
Discussion
Rule III, Section 9(e)(3) of the Implementing Rules and Regulations of the Data Privacy Act of 2012 (DPA) provides that:
The Commission shall adjudicate on complaints and investigations on matters affecting personal data: Provided, that in resolving any complaint or investigation, except where amicable settlement is reached by the parties, the Commission shall act as a collegial body. This includes:
xxx
- Facilitating or enabling settlement of complaints through the use of alternative dispute resolution processes, and adjudicating on matters affecting any personal data; (emphasis supplied)
In this case, pursuant to the Commission’s power to facilitate or to enable settlement of complaints through alternative dispute resolution processes, the parties were invited to a Mediation Conference on 11 March 2020. During the Mediation Conference, the parties agreed to settle their differences through the execution of a Mediated Settlement Agreement on 11 March 2020. Thereafter, the contents of the aforesaid have been thoroughly explained and understood by the parties. After a thorough study and adjudication of the case on hand, the Commission finds that the Mediated Settlement Agreement dated 11 March 2020 executed by and between the Complainant and the Respondents is not contrary to law, public policy, morals, or good customs.
In the case of Municipal Board of Cabanatuan City v. Samahang Magsasaka, Inc.,2 the court ruled that a compromise agreement is a contract between the parties, which if not contrary to law, morals, or public policy, is valid and enforceable between them.
With the foregoing, the Commission finds the executed Mediated Settlement Agreement dated 11 March 2020 by and between the Complainant and the Respondents as valid and enforceable.
However, in the instant case, this Commission would like to note the erroneous and misapplication of the DPA that was allegedly committed by the Respondents. This Commission will never get tired in calling out Personal Information Controllers (PICs) to adhere to the data privacy principles and uphold the data subject’s rights as enshrined in the DPA. The Commission understands that it takes effort, creativity, and innovation to cure this imbalance and not to prescribe disproportionate measures that may be too difficult for the PICs to implement and for the data subjects to comply with.
The new procedure being implemented by QBM of requiring the Complainant to secure a new letter of authorization for the availment of the travel benefits is not supported by the DPA.
The DPA should not be used to deprive the data subjects of their rights that are guaranteed by the DPA itself without a proper justification and notice to the data subjects.
Section 34(c) of the DPA provides for the right to access which a data subject is entitled, to wit:
Section 34. Rights of the Data Subject. The data subject is entitled to the following rights:
c. Right to Access. The data subject has the right to reasonable access to, upon demand, the following:
Contents of his or her personal data that were processed;
Sources from which personal data were obtained;
Names and addresses of recipients of the personal data;
Manner by which such data were processed;
Reasons for the disclosure of the personal data to recipients, if any;
Information on automated processes where the data will, or is likely to, be made as the sole basis for any decision that significantly affects or will affect the data subject;
Date when his or her personal data concerning the data subject were last accessed and modified; and
The designation, name or identity, and address of the personal information controller.
Considering the foregoing, the DPA assures that a data subject is entitled to the right to access. In consonance to this, the personal data must be provided by the PIC to the data subject or his authorized representative through a written document, or by any other format practicable to the PIC.3 The Respondent herein should have explained the purpose of securing a new letter of authorization and should not have merely cited the DPA as a shield to withhold information from the data subject. The aforesaid new procedure defeats the purpose of the right to access which is granted to data subjects by the DPA.
Moreover, QBM as a PIC, is required to develop, implement, and review policies and procedures, to ensure that the aforesaid policies and procedures shall enforce and effectively implement the provisions of the DPA, including those pertaining to the rights of data subjects.4
The data subject has been defined by Section 3(c) of the DPA as an individual whose personal information, sensitive personal information, or privileged information is processed. Record shows that the trip pass allocation contains personal information such as the name of dependents and beneficiaries, relationship, or even the personal information of the retired QBM employee himself. In this case, Complainant is considered as a data subject of QBM because his full name appears in the travel pass information. Hence, the Complainant has the right to access to his personal information as explicitly provided by the DPA and its Implementing Rules and Regulations (IRR).
WHEREFORE, premises considered, the Commission resolves to CONFIRM the Mediated Settlement Agreement executed by and between Complainant D.N.T. and Respondents K.K. and X.F. The case NPC 19-1201 - “D.N.T. VS. K.K. AND X.F.” is hereby CLOSED.
SO ORDERED.
Pasay City, Philippines. 18 March 2021.
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
WE CONCUR:
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Copy furnished:
D.N.T. Complainant
K.K. Respondent Employee Benefits and Services Office
X.F. Respondent Employee Benefits and Services Office
LEGAL DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission
Footnotes
-
Complaint-Affidavit dated 07 September 2019. ↩
-
Municipal Board of Cabanatuan City v. Samahang Magsasaka, Inc., G.R. No. L-25818 dated 25 February 1975, 62 SCRA 435. ↩
-
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC [EU GENERAL DATA PROTECTION REGULATION]. ↩
-
Section 26. Organizational Security Measures. Where appropriate, personal information controllers and personal information processors shall comply with the following guidelines for organizational security: xxx e. Processing of Personal Data. Any natural or juridical person or other body involved in the processing of personal data shall develop, implement and review: xxx 4. Policies and procedures for data subjects to exercise their rights under the Act; ↩