Resolution Text
IN RE: FAMILYHAN CREDIT CORPORATION
Initiated as an Independent NPC Investigation into the Possible Data Privacy Violations Committed by Familyhan Credit Corporation
x--------------------------------------------x
NPC SS 20-001
For: Violation of the Data Privacy Act (DPA) of 2012
For Resolution of the Commission are the Motion to Clarify Order submitted by Respondent Familyhan Credit Corporation (Familyhan) and an email request by a collaborating counsel of Familyhan to enter into amicable settlement of this case.
Facts
On 08 April 2021, the Commission conducted a Clarificatory Hearing pursuant to its Order dated 23 February 2021. This was followed by an Order for the submission of several documents as agreed during the hearing. The pertinent excerpt of the dispositive portion stated:
WHEREFORE, all premises considered, the Commission hereby ORDERS Respondent Familyhan Credit Corporation to submit the above documents within FIFTEEN DAYS (15) from the date of the Clarificatory Hearing.
Failure to comply with this Order shall cause the Commission to adjudicate the issues on the basis of the evidence on record.
Following this, Respondent Familyhan filed a Motion to Clarify Order dated 26 May 2021. They stated thus:
-
On 26 May 2021, FCC received through LBC a copy of the Order dated April 2021 which indicates that it is directed to submit the documents listed therein within FIFTEEN (15) days from the date of the Clarificatory Hearing.
-
The FIFTEEN (15) day period to submit the documents listed in the Order dated 08 April 2021 lapsed on 23 April 2021. However, it was only on 26 May 2021, more than a month after the lapse of the fifteen (15) days from the date of the Clarificatory Hearing that FCC received a copy of the said Order;
-
There was no way before the receipt of the Order dated 08 April 2021 for FCC to determine which documents the Honorable Commission needs to resolve the above-mentioned case;
xxx
-
It seeks the kind indulgence of the Honorable Commission to allow FCC to submit the documents listed on the Order dated 08 April 2021, fifteen (15) days from receipt of the said Order, which is until 10 June 2021.
-
The filing of this motion has no intention to disregard the processes of the Honorable Commission nor delay the proceedings or much less frustrate the ends of justice.
On the same day, the Commission, through the Complaints and Investigation Division (CID), received an email from Atty. AVM, collaborating counsel of Respondent Familyhan, stating thus:
Good afternoon Sir Madam
Relative to the above entitled case, may we request for an appointment with the Commissioner Raymundo Liboro for the possible amicable settlement and resolution of the case.
Your favorable action on the matter will be appreciated.
Very Truly Yours,
Atty. AVM
Collaborating Counsel - Familyhan Credit Corp.
Discussion
Upon consideration of the allegations stated in the Motion to Clarify Order and in the interest of an exhaustive investigation, the Commission grants the request for Respondent Familyhan to submit the required documents within fifteen (15) days from receipt of the said Order, which is until 10 June 2021.
The Commission, however, refutes the allegation in paragraph 7 of Respondent Familyhan’s Motion which states that “there was no way before the receipt of the Order dated 08 April 2021 for FCC to determine which documents the Honorable Commission needs to resolve the above-mentioned case.” The Commission reminds Respondent Familyhan that all of the documents required in its Order were discussed and agreed upon during the Clarificatory Hearing on 08 April 2021. Given this, the additional time granted for the submission of documents will be non-extendible.
As to the email request for an appointment “for the possible amicable settlement and resolution of this case”, the Commission denies this request.
The Fact-Finding Report, which serves as the Complaint in this case, details how the personal and sensitive personal information of more than six thousand (6,000) data subjects were accessed by unauthorized persons using simple steps that can be done through a web browser. The Commission’s CID was able to confirm the accessibility of the database by following the steps as indicated in the email and in the Facebook group. Based on these, the Report stated:
In sum, there is sufficient ground to support the finding that FamilyHan violated the following penal provisions of law:
Section 26 of the DPA. Accessing Personal Information and Sensitive Personal Information Due to Negligence – (a) Accessing personal information due to negligence shall be penalized by imprisonment ranging from one (1) year to three (3) years and a fine of not less than five hundred thousand pesos (Php 500,000.00) but not more than two million pesos (Php 2,000,000.00) shall be imposed on persons who, due to negligence, provided access to personal information without being authorized under this Act or any existing law.
(b) Accessing sensitive personal information due to negligence shall be penalized by imprisonment ranging from three (3) years to six (6) years and a fine of not less than five hundred thousand pesos (Php 500,000.00) but not more than four million pesos (4,000,000.00) shall be imposed on persons who, due to negligence, provided access to personal information without being authorized under this Act or any existing law.
xxx
Section 30 of the DPA. Concealment of Security Breaches Involving Sensitive Personal Information – The penalty of imprisonment one (1) year and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php 500,000.00) but not more than One million pesos (Php 1,000,000.00) shall be imposed on persons who, after having knowledge of a security breach and of the obligation to notify the Commission pursuant to Section 20(f), intentionally or by omission conceals the fact of such security breach.
Such provisions impute criminal liability to the responsible officers of Respondent Familyhan. Due to the seriousness of the allegations and risks poses to the data subjects, it is the Commission itself, through the CID, that instituted action based on certain criteria provided in its Rules of Procedure. NPC Circular No. 16-04 or the Rules of Procedure of the NPC1 provides the circumstances which merit a sua sponte investigation:
SECTION 23. Own initiative. – Depending on the nature of the incident, in cases of a possible serious privacy violation or personal data breach, taking into account the risks of harm to a data subject, the Commission may investigate on its own initiative the circumstances surrounding the possible violation. Investigations may include on-site examination of systems and procedures. If necessary, the Commission may use its enforcement powers to order cooperation of the personal information controller or other persons, with the investigation or to compel appropriate action to protect the interests of data subjects.
Considering the public interests that the Commission represents, it is therefore not in the position to enter into amicable settlement with a respondent in a sua sponte investigation. Such would be a disservice to the data subjects that faced the risks and harm posed by the acts allegedly committed by the respondent in the sua sponte investigation.
This is all the more true considering the exception of criminal liability from the scope of the application of the Alternative Dispute Resolution Act of 2004 (ADRA).2
Despite the State Policy3 of the ADRA to “actively promote party autonomy in the resolution of disputes or the freedom of the party to make their own arrangements to resolve their disputes”, it explicitly provides an exception:
Section 6. Exception to the Application of this Act. – The provisions of this Act shall not apply to resolution or settlement of the following: (a) labor disputes covered by Presidential Decree No. 442, otherwise known as the Labor Code of the Philippines, as amended and its Implementing Rules and Regulations; (b) the civil status of persons; (c) the validity of marriage; (d) any ground for legal separation; € the jurisdiction of courts; (f) future legitime; (g) criminal liability; and (h) those which by law cannot be compromised.4
Lastly, the Commission warns Respondent Familyhan that such requests for amicable settlement in criminal cases may be admissible as evidence of guilt. The Rules of Evidence, which apply suppletorily to the proceedings of the Commission, provide:
Rule 130. Rules of Admissibility
Section 28. Offer of compromise not admissible. – In civil cases, an offer of compromise is not an admission of any liability, and is not admissible in evidence against the offeror.
xxx
In criminal cases, except those involving quasi-offenses (criminal negligence) or those allowed by law to be compromised, an offer of compromise by the accused may be received in evidence as an implied admission of guilt.
Respondent Familyhan, therefore, is advised to exercise prudence before it makes such requests without basis in the law.
WHEREFORE, all premises considered, the Commission hereby ORDERS Respondent Familyhan Credit Corporation to submit, within a non-extendible period of FIFTEEN DAYS (15) from its receipt of the Commission Order dated 08 April 2021 or until 10 June 2021, the documents required therein.
Failure to comply with this shall cause the Commission to adjudicate the issues on the basis of the evidence on record.
Further, the Commission DENIES the request of Respondent Familyhan Credit Corporation to enter into amicable settlement for the resolution of this case.
SO ORDERED.
City of Pasay, Philippines. 01 June 2021.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Copy furnished:
JRO Counsel Familyhan Credit Corporation
AVM Collaborating Counsel
MSV Counsel Former Respondents MTR, VBV, JPV, AA, and MDA
SMA President Familyhan Credit Corporation
RA Vice President Familyhan Credit Corporation
MRO Treasurer Familyhan Credit Corporation
MJR Corporate Secretary Familyhan Credit Corporation
PPM Director Familyhan Credit Corporation
COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission