NPC Issuance Wiki

NPC 19-605: GMT v. FCash Global Lending Inc. (Fast Cash)

Issued Resolution

Resolution Text

GMT,

Complainant,

-versus-

FCASH GLOBAL LENDING INCORPORATED (FAST CASH),

Respondent.

x-----------------------------------------x

NAGA, D.P.C.:

This resolves the Motion for Reconsideration (Motion) dated 9 February 2021 filed by FCash Global Lending Inc. (Respondent), which seeks reconsideration of the Decision issued by the Commission dated 5 November 2020. The dispositive portion reads:

WHEREFORE, premises considered, FCash Global Lending Inc. is hereby ORDERED by this Commission to pay GMT nominal damages in the amount of fifteen thousand peso (Php 15,000.00).

This Commission FORWARDS this Decision and a copy of the pertinent case records to the Department of Justice, recommending the prosecution of FCash Global Lending Inc. for the crimes of Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes as provided under Section 28 and Malicious Disclosure as provided under Section 31 of Republic Act No. 10173 otherwise known as the Data Privacy Act of 2012.1

Facts

The Respondent’s Motion for Reconsideration2 raises the following arguments in questioning the Decision of this Commission:

I. Evidence on record does not establish the commission of any violation of the Data Privacy Act (DPA).

II. There is no evidence to support the finding that Respondent’s Board of Directors are criminally liable for being negligent.

IV. There is no showing of compliance with the requirement of exhaustion of administrative remedy or of good cause to warrant a waiver thereof.

Discussion

This Commission finds no reversible error that would warrant reconsideration of the Decision dated 5 November 2020. We discuss the matter point-by-point.

I. There is a violation of the Data Privacy Act of 2012 (DPA)

Respondent argued that nothing in the records would warrant that they committed acts in violation of the DPA. The processing of Complainant’s personal data was conducted by the Respondent to impel the Complainant to comply with her legal obligations, which are due and demandable under the loan agreement. Such act, according to the Respondent, is allowable and is in adherence to the data privacy principles of transparency, legitimate purpose, and proportionality of the DPA. Complainant has given full, free, and voluntary consent to Respondent having entered in a contractual relation as obligor-obligee. Thus, according to the Respondent, the processing of personal information is lawful and permissible. Further, the allegations in the complaint were vague if not inexistent. The pieces of information are insufficient to substantiate the allegations in the complaint. Respondent concluded that such is a ground for the outright dismissal of the complaint.

As held by the Commission in its Decision,3 it acknowledges that the collection of the personal information was in the exercise of the lending company’s legitimate interest and part of fulfilling its contractual obligation. The Commission finds the Respondent liable not because of processing for collection per se but because of unauthorized and malicious sending of text blasts to Complainant’s contact lists for the purpose of collecting the latter’s loan. Such processing, as established in the 05 November 2020 Decision of this Commission, was not authorized by the data subject nor in accordance with the precepts of the DPA.

Further, even if the Complainant consented to give out a few references in her contact list for purpose of identity verification and alternative contacts for reaching out to Complainant in the event of default, this does not negate the fact that Respondent herein violated Section 28 of the DPA.4 The processing was done without authority from the data subject as it goes beyond the original agreement between the Complainant and the Respondents.

Moreover, the processing was made without being authorized by some other legal basis to process under the DPA.

From the foregoing, such violation was made clear when Respondent processed more personal information without her consent,5 specifically when it accessed and communicated with Complainant’s contact list without her consent. This is shown in the email sent by Complainant to the Commission seeking help as Respondent were sending messages to all her mobile contacts and not only to the few references she permitted to give.6 Further, when Respondent sent a malicious message to Complainant’s contact list, it resulted in the violation of the same provision as it used the contact information given by Complainant in ways other than the agreed purpose.

II. There is substantial evidence to recommend the prosecution of the Respondent’s Board of Directors

Respondent also argued that there is no evidence to support the finding that the members of Respondent’s Board of Directors (BOD) are criminally liable for being negligent. Respondent contends that the Commission declared that its BODs are criminally liable based solely on the fact that they are directors of the board. Further, Respondent argued that the cited jurisprudence7 has a different set of facts from those of the instant case. In the cited case, Respondent was indicted not on the fact of being a corporate officer but based on the execution of the trust receipt.

Respondent further contended that the BOD should not be held to prove that they are not negligent and in the absence of proof to the contrary the legal presumption that they employed ordinary care in the discharge of their duties as the BOD stands. Nothing in the records prove that Respondent was duly informed of the alleged offensive text messages for it to be able to address Complainant’s grievance before the filing of the instant case.

While it is true that the facts of the case cited is different from the case at bar, the jurisprudence was cited to expound on the concept that the BOD’s gross negligence in overseeing its employees and the operational model of the company may warrant criminal prosecution if such gross negligence allowed the corporation, through its employees, to commit a criminal act, which is analogous to Section 34 of the DPA, viz:

SEC. 34. Extent of Liability. – If the offender is a corporation, partnership or any juridical person, the penalty shall be imposed upon the responsible officers, as the case may be, who participated in, or by their gross negligence, allowed the commission of the crime. If the offender is a juridical person, the court may suspend or revoke any of its rights under this Act. If the offender is an alien, he or she shall, in addition to the penalties herein prescribed, be deported without further proceedings after serving the penalties prescribed. If the offender is a public official or employee and he or she is found guilty of acts penalized under Sections 27 and 28 of this Act, he or she shall, in addition to the penalties prescribed herein, suffer perpetual or temporary absolute disqualification from office, as the case may be. (Emphasis supplied)

Further, while it is true that the legal presumption that the BOD employed ordinary care in the discharge of their duties, such presumption was already disputed when they failed to act and address the malicious disclosure at hand. Considering the voluminous number of complaints that were filed before this Commission prior to this case which contains similar issues, it is presumed that the BOD was already properly notified and informed of the subject matter. If they employed ordinary care in the discharge of their duties, they should have already acted and undertook remedial actions to change their collection practices after the company received all the complaints that they did. Having done none, this is gross negligence on their part.

Additionally, since they didn’t undertake any remedial actions as shown by the fact they didn’t allege or present any evidence on this, then the legal presumption that they exercised ordinary care in the discharge of their duties shows that they knew about the collection practices and their operational model and were fine with it or approved it. In which case, it’s not just gross negligence but actual participation on the part of the board of directors.

It is expected from the BOD to be alerted and immediately address the incident to protect its goodwill, but that is not what happened in this case. Nothing in the records would show that the Respondent, through its BOD, properly supervised or reprimanded the acts of the employees who committed such processing. Respondent also did not report remedial actions that they have undertaken to place organizational, physical, and technical measures to protect the personal information of their borrowers. Hence, the BOD’s inaction and omission to perform their duties to protect the processed personal information amounted to gross negligence.

The Supreme Court defines gross neglect of duty or gross negligence as follows:

“refers to negligence characterized by the want of even slight care, or by acting or omitting to act in a situation where there is a duty to act, not inadvertently but wilfully and intentionally, with a conscious indifference to the consequences, insofar as other persons may be affected. It is the omission of that care that even inattentive and thoughtless men never fail to give to their own property.”8

Evidently, and as can be seen from the records, there was no showing that the BOD herein performed any act that would demonstrate that they have the slightest care to address the incident.

It was further contended by Respondent that the BOD should not be held to prove that they are not negligent and in the absence of proof to the contrary, the legal presumption that they employed ordinary care in the discharge of their duties as BOD stands. As discussed by the Commission in the case of NPC 18-103, viz:

“The obligation to comply with the provisions of the DPA, IRR and other issuances of the Commission primarily rest on the PIC. The Respondent cannot use the fault of its staff to evade responsibility under the DPA.

xxx

xxx. It is its responsibility as PIC to secure personal information of its customers and relay the company’s privacy policies and procedures to its personnel, especially to those responsible in processing personal information of customers.”

Considering the mandate of the DPA and the responsibility vested in the PICs, Respondent’s BOD cannot deny that it was negligent in overseeing its employees and operational model.

In the case at bar, Respondent is the PIC of the personal data.9 Hence, Respondent, acting through its BOD, has the utmost legal responsibility to ensure that the personal data acquired is protected and used only for its authorized purposes. The BOD is responsible for ensuring that the provisions of the DPA are being observed and employed by their employees in the exercise of their functions, considering the nature and amount of personal data being collected from their customers. Thus, Respondent erred in contending that they should not be held to prove that they were not negligent.

Anent the argument that the BOD was not duly informed of the alleged offensive text messages for it to be able to address the Complainant’s grievance, Respondent should be reminded that under Section 20 (a) of the DPA, the personal information controller must, “implement reasonable and appropriate organizational, physical and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing”. If the said mandate of the law is being strictly observed and implemented in the company wherein reasonable and appropriate organizational measures are in place, it is certain that the BOD would have known and acted on the incident. Otherwise, if Respondent would deny that the BOD was not informed of the alleged offensive text messages, then this just adds to the conclusion that the provisions of the DPA are ineptly implemented in the company.

Further, Respondent asserts that the instant proceeding, although administrative in nature, criminally penalizes the person or organization who violated its provisions. Therefore, the standard of evidence of proof beyond reasonable doubt must be strictly observed.

The Commission wishes to clarify this misplaced argument. It is true that the violation of the DPA can lead to criminal prosecution. However, it is beyond the jurisdiction of the Commission to decide on cases that are criminal in nature. The Commission is only empowered to recommend to the Department of Justice (DOJ) the prosecution and imposition of penalties specified in Sections 25 to 29 of the DPA.10 Hence, the standard of evidence for a criminal case does not apply at this stage. The Commission only requires substantial evidence as basis for its proceedings considering that it is an administrative agency.11

Respondent concluded that due to the absence of any proof, the findings of the Commission of negligence against Respondent’s BOD is not merely an error in judgement but constitute grave abuse of discretion that is tantamount to lack or excess of jurisdiction.

The Commission disagrees. In the case of Yu vs Judge Reyes-Carpio,12 the Supreme Court explained:

“The term “grave abuse of discretion” has a specific meaning. An act of a court or tribunal can only be considered as with grave abuse of discretion when such act is done in a “capricious or whimsical exercise of judgment as is equivalent to lack of jurisdiction.” The abuse of discretion must be so patent and gross as to amount to an “evasion of a positive duty or to a virtual refusal to perform a duty enjoined by law, or to act at all in contemplation of law, as where the power is exercised in an arbitrary and despotic manner by reason of passion and hostility.” Furthermore, the use of a petition for certiorari is restricted only to “truly extraordinary cases wherein the act of the lower court or quasi-judicial body is wholly void.” From the foregoing definition, it is clear that the special civil action of certiorari under Rule 65 can only strike an act down for having been done with grave abuse of discretion if the petitioner could manifestly show that such act was patent and gross x x x.”

In this case, there is no hint of whimsicality, nor of gross and patent abuse of discretion as would amount to an evasion of a positive duty or a virtual refusal to perform a duty enjoined by law or to act at all in contemplation of law on the part of the Commission. The Commission is clothed with authority to decide on the subject matter while carefully following its Rules of Procedure. Absent clear and convincing evidence from the Respondent herein the presumption of regularity shall remain.

As aptly described by the Supreme Court in Yap v. Lagtapon, viz:

“The presumption of regularity in the performance of official duties is an aid to the effective and unhampered administration of government functions. Without such benefit, every official action could be negated with minimal effort from litigants, irrespective of merit or sufficiency of evidence to support such challenge. To this end, our body of jurisprudence has been consistent in requiring nothing short of clear and convincing evidence to the contrary to overthrow such presumption.”13

III. The Commission is mandated to award nominal damages

Respondent further argued that there is no factual nor legal basis for the finding and imposition of nominal damages against the Respondent. Respondent contends that the authority of this Commission to award “indemnity on matters affecting any personal information” is limited only to actual and compensatory damage. Respondent argued that nominal damages are adjudicated not for the purpose of indemnifying the plaintiff for any loss suffered by him. Thus, Respondent finds that the Commission may have overstepped the bounds of its statutory authority by granting a form of civil damages that it has no power to grant under the law creating it.

Respondent’s interpretation of the power of the Commission to award indemnity is restrictive and defeats the wisdom and spirit behind the legislative intent of the DPA.

As held by the Supreme Court in the case of Office of the Ombudsman vs Court of Appeals:14

“In our recent ruling in Office of the Ombudsman v. Court of Appeals, we reiterated Ledesma and expounded that taken together, the relevant provision of RA 6770 vested petitioner with “full administrative disciplinary authority” including the power to “determine the appropriate penalty imposable on erring public officers or employees as warranted by the evidence, and, necessarily, impose the said penalty,” thus:

[The] provisions in Republic Act No. 6770 taken together reveal the manifest intent of the lawmakers to bestow on the Office of the Ombudsman full administrative disciplinary authority. These provisions cover the entire gamut of administrative adjudication which entails the authority to, inter alia, receive complaints, conduct investigations, hold hearings in accordance with its rules of procedure, summon witnesses and require the production of documents, place under preventive suspension public officers and employees pending an investigation, determine the appropriate penalty imposable on erring public officers or employees as warranted by the evidence, and, necessarily, impose the said penalty. (Italicization in the original; boldfacing supplied)

We see no reason to deviate from these rulings. They are consistent with our earlier observation that unlike the “classical Ombudsman model” whose function is merely to “receive and process the people’s complaints against corrupt and abusive government personnel,” the Philippine Ombudsman, as protector of the people, is armed with the power to prosecute erring public officers and employees, giving him an active role in the enforcement of laws on anti-graft and corrupt practices and such other offenses that may be committed by such officers and employees. The legislature has vested him with broad powers to enable him to implement his own actions.” (Emphasis supplied)

Similarly, Section 7(b)15 and Section 3716 of the DPA when taken together reveals the manifest intent of the lawmakers to bestow to the NPC the full administrative disciplinary authority, which includes the authority to award all types of damages that deems appropriate to the circumstances to warrant justice and equity to the injured party. Limiting the word “indemnity” to actual and compensatory damages will only be prejudicial to the injured party especially in privacy cases, where the magnitude of the damages sustained cannot be quantified most of the time and the gravity of the effect cannot be immediately determined.

Further, as discussed by the Commission in one of its decided cases,17 viz:

“The DPA provides that every data subject has the right to be indemnified for “any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information.” Indeed, it is part of the Commission’s mandate to award indemnity on matters affecting any personal information.18

xxx

xxx. The DPA does not require actual or monetary damages for data subjects to exercise the right to damages.

As provided in the law, the consequences of processing inaccurate information is enough for the right to arise.19

The DPA provides that restitution for any aggrieved party shall be governed by the provisions of the New Civil Code.20 The relevant provision in this Code states:

Art. 2221. Nominal damages are adjudicated in order that a right of the plaintiff, which has been violated or invaded by the defendant, may be vindicated or recognized, and not for the purpose of indemnifying the plaintiff for any loss suffered by him.

The DPA gives individuals the right to receive indemnification from personal information controllers and personal information processors for both material and non-material damages.21 The Supreme Court has also clarified that no actual present loss is required to warrant the award of nominal damages, thus:

Nominal damages are recoverable where a legal rights is technically violated and must be vindicated against an invasion that has produced no actual present loss of any kind or where there has been a breach of contract and no substantial injury or actual damages whatsoever have been or can be shown.22

In consideration of the foregoing, the Commission does not find any reversible error in awarding the Complainant with nominal damages.

IV. The requirement of exhaustion of administrative remedies is not absolute

Respondent claims that there is no showing of compliance with the requirement of exhaustion of administrative remedy or of good cause to warrant a waiver thereof. Respondent contends that there was no allegation in the Complaint that the requirement of exhaustion of administrative remedy under Section 4, Rule II of the NPC Rules has been complied with prior to the filing thereof. Respondent further states that neither was there any allegations in the Complaint of good cause to warrant the waiver of the said requirement. Hence, Respondent concludes that the complaint is dismissible on the ground that a condition precedent for filing the claim has not been complied with under Paragraph (j), Section 1, Rule 16 of the Rules of Court.

The Commission would like to point out to Respondent that the provision of the law is not absolute and is subject to certain exceptions. As provided by Section 4 of NPC Circular 16-04 in relation to Section 2, Rule II of the 2021 NPC Rules of Procedure:23

“xxx. The National Privacy Commission may waive any or all of the requirements of this Section, at its discretion, upon good cause shown, or if the complaint involves a serious violation or breach of the Data Privacy Act, taking into account the risk of harm to the affected data subject.”

Clearly, the Commission is given the discretionary power, upon good cause shown, to waive any or all the requirements of this Section.

In this case, the Commission cannot turn a blind eye on the harm done to the Complainant’s data privacy rights considering that the very contents of the text blast sent by the Respondent to the Complainant’s contact list contain malicious disclosure of the Complainant’s personal information.

WHEREFORE, premises considered, the Motion for Reconsideration dated 9 February 2021 of FCash Global Lending Inc. is hereby DENIED for lack of merit. The Decision of this Commission dated 5 November 2020 is hereby AFFIRMED.

SO ORDERED.

Pasay City, Philippines 11 March 2021.

JOHN HENRY D. NAGA Deputy Privacy Commissioner

WE CONCUR:

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

Copy furnished:

GMT Complainant

BRJYTLO Counsel for FCash Lending Inc.

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. The dispositive portion of the prior Decision dated 5 November 2020. ↩

  2. Motion for Reconsideration dated 09 February 2021. ↩

  3. Decision dated 5 November 2020. ↩

  4. SEC. 28. Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes. –The processing of personal information for unauthorized purposes shall be penalized by imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than One million pesos (Php1,000,000.00) shall be imposed on persons processing personal information for purposes not authorized by the data subject, or otherwise authorized under this Act or under existing laws. The processing of sensitive personal information for unauthorized purposes shall be penalized by imprisonment ranging from two (2) years to seven (7) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00) shall be imposed on persons processing sensitive personal information for purposes not authorized by the data subject, or otherwise authorized under this Act or under existing laws. ↩

  5. Records, page 39. ↩

  6. Id., page 34. ↩

  7. Alfredo Ching vs Secretary of Justice, G.R. No. 164317, February 6, 2006. ↩

  8. Fernandez v. Office of the Ombudsman, G.R. No. 193983. March 14, 2012. ↩

  9. Section 2 (h) of R.A. 10173. ↩

  10. Section 7(i) of R.A. No. 10173. ↩

  11. Department of Health vs Aquintey, G.R. No. 204766, March 5, 2017. ↩

  12. 667 Phil. 474 (2011). ↩

  13. G.R. No. 196347, 23 January 2017. ↩

  14. GR No. 167844. November 22, 2006. ↩

  15. SEC. 7. Functions of the National Privacy Commission. – To administer and implement the provisions of this Act, and to monitor and ensure compliance of the country with international standards set for data protection, there is hereby created an independent body to be known as the National Privacy Commission, which shall have the following functions: xxx (b) Receive complaints, institute investigations, facilitate or enable settlement of complaints through the use of alternative dispute resolution processes, adjudicate, award indemnity on matters affecting any personal information, prepare reports on disposition of complaints and resolution of any investigation it initiates, and, in cases it deems appropriate, publicize any such report: Provided, That in resolving any complaint or investigation (except where amicable settlement is reached by the parties), the Commission shall act as a collegial body. For this purpose, the Commission may be given access to personal information that is subject of any complaint and to collect the information necessary to perform its functions under this Act. ↩

  16. SEC. 37. Restitution. – Restitution for any aggrieved party shall be governed by the provisions of the New Civil Code. ↩

  17. Pascual vs Maersk, NPC 18-038. ↩

  18. R.A. No 10173, Section 7(b). ↩

  19. Pascual vs. Maersk. ↩

  20. RA NO 10173, Section 37. ↩

  21. See, Handbook on European Data Protection Law, p. 246. ↩

  22. Seven Brothers Shipping Corporation vs. DMC-Construction Resources, Inc., G.R. No. 193914, November 26, 2014. ↩

  23. Section 2. Exhaustion of remedies. – No complaint shall be given due course unless it has been sufficiently established and proven that: xxx. The NPC may waive any or all of the requirements of this Section at its discretion upon (a) good cause shown, properly alleged and proved by the complainant; or (b) if the allegations in the complaint involve a serious violation or breach of the Data Privacy Act of 2012, taking into account the risk harm to the affected data subject, including but not limited to: xxx ↩

Backlinks