NPC Issuance Wiki

NPC SS 20-001: In re: Familyhan Credit Corporation

Issued Resolution

Resolution Text

IN RE: FAMILYHAN CREDIT CORPORATION

INITIATED AS AN INDEPENDENT NPC INVESTIGATION INTO THE POSSIBLE DATA PRIVACY VIOLATIONS COMMITTED BY FAMILYHAN CREDIT CORPORATION

x----------------------------------------------------x

AGUIRRE, D.P.C.;

This Commission resolves a Motion to Lift Cease and Desist Order filed by Familyhan Credit Corporation (FCC) dated 21 June 2021.

Facts

On 15 October 2020, the Commission ordered FCC to cease and desist from the processing of personal information on their database:

WHEREFORE, premises considered, Familyhan Credit Corporation and its responsible officers and members of the Board, MTR, VBV, JPV, AA, and MDA are hereby ordered to:

  1. File a COMMENT, within ten (10) days from receipt of this Order, on the allegations in the attached Fact-Finding Report, pursuant to Section 24 of the NPC Rules of Procedure; and

  2. CEASE AND DESIST from the processing of personal data on their database until the Commission issues a decision on the submission of the Comment, which shall be made no more than thirty (30) days from the expiration of the period to file a Comment or of the termination of the clarificatory hearing if one is held, pursuant to NPC Circular No. 20-01.

SO ORDERED.1

FCC filed its Comment to the Cease and Desist Order (CDO) on 25 January 2021. It prayed that the Commission reconsider and dismiss the Order dated 15 October 2020 for lack of merit.2

The Commission sustained the CDO in an Order dated 23 February 2021. The Commission held that the CDO may be modified or lifted by the Commission only upon FCC’s showing that the factual or legal basis for which it was issued no longer exists:

WHEREFORE, premises considered, the Cease and Desist Order issued against Familyhan Credit Corporation and its responsible officers and members of the board, MTR, VBV, JPV, AA, and MDA to cease and desist from the processing of personal data on Familyhan’s database is hereby sustained until modified or lifted by the Commission upon showing that the factual or legal basis for which it was issued no longer exists xxx.3

On 08 April 2021, the Commission conducted a Clarificatory Hearing with FCC where it ordered FCC to submit additional documents.4

On 26 May 2021, FCC submitted a Motion to Clarify Order requesting additional time to submit the documents the Commission required during the Clarificatory Hearing. FCC also requested, by email, “for the possible amicable settlement and resolution of the case.”5

The Commission issued a Resolution dated 01 June 2021 granting a non-extendible fifteen-day period to submit the documents and denying the request for amicable settlement. The Commission emphasized that it is not in the position to enter an amicable settlement in a sua sponte investigation. Such would be a disservice to the data subjects who faced the risks and harm posed by the acts allegedly committed by FCC.6

On 21 June 2021, FCC filed a Motion to Lift Cease and Desist Order (Motion to Lift CDO), and prayed:

WHEREFORE, premises considered, it is most respectfully prayed unto this Honorable Office that the ORDER to CEASE AND DESIST from processing personal data on the LFA be LIFTED.7

Other reliefs just and equitable under the circumstances are likewise prayed for.

FCC maintains that it stopped processing personal information on its database and ordered its loan agents to discontinue from doing the same.8 It states that the loan agents’ access to its system has also been cut off by its IT Department.9 It further alleges that the CDO issued by the Commission on 15 October 2020 is deemed automatically lifted pursuant to Section 12 of the Rules on the Issuance of Cease and Desist Order (NPC Circular No. 20-02), and that the basis for issuing the CDO no longer exists since new security measures were introduced to its system.10

The Commission issued an Order dated 24 June 2021 directing the Complaints and Investigation Division (CID) of the National Privacy Commission (NPC) to Comment on FCC’s Motion to Lift CDO.11

Issue

Whether FCC’s Motion to Lift CDO should be granted.

Discussion

The Commission denies FCC’s Motion to Lift CDO. The Extended CDO remains in force and effect.

FCC hinges its prayer on the following: first, the CDO is automatically lifted pursuant to Section 12 of NPC Circular No. 20-02, and second, the basis for which the CDO was issued no longer exists. Both reasons cited by FCC are untenable.

First, contrary to FCC’s allegations, the issued CDO is not automatically lifted in line with Section 12 of NPC Circular No. 20-01.12

Section 12 of NPC Circular 20-02 refers to an ex-parte CDO. It allows the Commission to lift or extend the effectivity of an issued CDO after the adverse party is given an opportunity to be heard.13 It grants the Commission a thirty-day period within which the Commission decides to lift or extend the issued CDO.14 Section 12 provides:

Section 12. Decision on the Issued CDO. – If after giving the Adverse Party the opportunity to be heard, it appears that the applicant is entitled to have the act or practice enjoined and that there is a need for the extension of the issued CDO, the Commission shall extend its effectivity, otherwise, the same shall be lifted.

The decision whether to extend or lift the issued CDO shall be made no later than thirty (30) days from the expiration of the period for the Adverse Party to file a comment or the termination of the clarificatory hearing if one is held. In the event that the Commission fails to render its decision within the said period, the CDO shall be deemed automatically lifted.15

In the Order dated 23 February 2021, the Commission extended the issued CDO within the period provided by law.16 As a result, the nature of the issued CDO is that of an Extended CDO that remains in force and effect until the Commission modifies or lifts it. The applicable provision is Section 13 of NPC Circular No. 20-02, which provides:

Section 13. When CDO is Extended. – The extension of the CDO issued by the Commission shall also include an order to submit the necessary compliance report within the time prescribed for monitoring purposes. The concerned NPC unit shall ensure that a copy of such order be immediately furnished to each party subject thereto.

The extended CDO shall remain in force and effect until the same is modified or lifted by the Commission upon showing that the factual or legal basis for which it was issued no longer exists.17

FCC will recall that it was given the opportunity to be heard when the Commission issued an Order dated 15 October 2020 and required FCC to file a Comment on the Fact-Finding Report.18 An opportunity to be heard means an opportunity to explain or to adduce any evidence a party may have to in support of his defense.19 It must be emphasized that an opportunity to be heard is not strictly limited to the conduct of a hearing. No less than the Supreme Court explained that:

In administrative proceedings, the essence of due process is simply the opportunity to explain one’s side. One may be heard, not solely by verbal presentation but also, and perhaps even much more creditably as it is more practicable than oral arguments, through pleadings. An actual hearing is not always an indispensable aspect of due process. As long as a party was given the opportunity to defend his interests in due course, he cannot be said to have been denied due process of law, for this opportunity to be heard is the very essence of due process. xxx20

Here, FCC was given several opportunities to present its side. It submitted a Comment on the Fact-Finding Report dated 21 January 2021, a Comment on the Order dated 25 January 2021, and an Answer dated 01 February 2021. However, none of these submissions warranted a lifting of the issued CDO, as provided in the Commission’s Order dated 23 February 2021.21

In paragraph 6 of the Motion to Lift CDO, FCC claims that “it is clear from the Rules … the [CDO] dated 15 October 2020 to which FCC filed a Comment on 25 January 2021 is deemed automatically lifted.”22 FCC erroneously relies on the last sentence of Section 12, which states:

Section 12. Decision on the Issued CDO. – xxx In the event that the Commission fails to render its decision within the said period, the CDO shall be deemed automatically lifted.23

FCC failed to appreciate that the Commission rendered its decision to extend the CDO on 23 February 2021, which is within the thirty-day period provided under Section 12.24

Section 12 clearly states that the thirty-day period is computed either from the expiration of the period for FCC to file a Comment or the termination of the clarificatory hearing.25 The Commission ordered FCC to file a Comment within ten (10) days from receipt of the Order dated 15 October 2020.26 In its Comment dated 21 January 2021, FCC maintained that it received the Order on 15 January 2021, thus allowing it to file a Comment until 25 January 2021.27 Hence, the thirty-day period to file FCC’s Comment commenced on 25 January 2021 and ended on 24 February 2021.

Considering the foregoing, FCC’s contention that the CDO is automatically lifted due to the Commission’s alleged failure to render a decision within the thirty-day period is wrong. The Commission rendered its decision to extend the CDO in an Order dated 23 February 2021, which is within the thirty-day period from the expiration of the period given to FCC to issue a Comment.

On the second ground, the basis for which the CDO was issued continues to exist. FCC failed to sufficiently prove that the risk of unauthorized disclosure is no longer present.

To reiterate, Section 13 of NPC Circular No. 16-03 provides:

Section 13. When CDO is Extended. – xxx

The extended CDO shall remain in force and effect until the same is modified or lifted by the Commission upon showing that the factual or legal basis for which it was issued no longer exists.26

Here, FCC failed to submit evidence to show, much less prove, that these new security measures are already in place and the manner by which these security measures effectively eliminate the risk to the data subjects, as FCC claims in its Motion to Lift CDO.

In the Motion to Lift CDO, FCC reiterated the security features it implemented to address the security breach.27 The discussion was directly lifted from FCC’s Comment dated 25 January 2021.28 These include the expiration of the link for the borrower-clients’ e-signatures, randomization of password and pin code of the General Manager, and limitation of system access to the General Manager.29 FCC claims that:

Once the NPC lifts the [CDO] dated 15 October 2020 issued against FCC, the new security features of the [FCC System], which are already in place, will eliminate the risk of unauthorized disclosure.30

FCC supposedly introduced new security features to their system. However, it failed to concretely show how these will eliminate the risk of unauthorized disclosure. It is not sufficient for FCC to simply enumerate the security features it introduced and categorically claim that these will eliminate risk once the Extended CDO is lifted. Merely alleging that FCC has implemented new security measures that will eliminate risk does not satisfy the requirement to lift the Extended CDO under Section 13 of NPC Circular No. 16-03. It is incumbent upon FCC to show that the factual or legal basis for which the Extended CDO was issued no longer exists.

FCC did not present anything, either in the Comment dated 25 January 2021 or in the Motion to Lift CDO, to convince the Commission otherwise. In fact, the Motion to Lift CDO also reiterated the Comment that referred to the Affidavits of Undertaking of FCC’s General Manager and President.31 FCC furnished Affidavits of Undertaking to the Commission as part of the Comment dated 25 January 2021.32 The Motion to Lift CDO33 and the Comment34 both state that, as stated in the Affidavits of Undertaking, FCC “will adopt methods and protocols to ensure compliance with NPC rules and regulations.”

Despite a period of almost six (6) months from the time FCC filed the Comment on 25 January 2021, FCC has not presented any details or evidence in the Motion to Lift CDO on the supposed methods and protocols it undertook to adopt in its Affidavit of Undertaking.35

FCC also failed to conduct the necessary audits to verify that these security measures are effective to eliminate risk. The Commission emphasizes that FCC should have verified the adequacy and efficacy of these security measures against unauthorized disclosure, even while the CDO is in place. There is no need for FCC to wait until the CDO is lifted to demonstrate to the Commission that these security features can actually eliminate the risk of unauthorized disclosure sought to be prevented by the CDO. Absent proof to the contrary, the Commission finds no reason to lift the Extended CDO.

WHEREFORE, premises considered, the Motion to Lift Cease and Desist Order filed by Familyhan Credit Corporation is DENIED. The Extended CDO shall REMAIN IN FORCE AND EFFECT until the Commission modifies or lifts the same upon showing that the basis for which it was issued no longer exists.

SO ORDERED.

City of Pasay, Philippines. 23 July 2021.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

JOHN HENRY D. NAGA Deputy Privacy Commissioner

Copy furnished:

ATTY. JRO Counsel Familyhan Credit Corporation

ATTY. AVM Collaborating Counsel Familyhan Credit Corporation

SMA President Familyhan Credit Corporation

RA Vice President Familyhan Credit Corporation

MRO Treasurer Familyhan Credit Corporation

MJR Corporate Secretary Familyhan Credit Corporation

PPM Director Familyhan Credit Corporation

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Order, 15 October 2020, at 7, in In re: Familyhan Credit Corporation. ↩

  2. Comment by Familyhan Credit Corporation, 25 January 2021, at 5. ↩

  3. Order, 23 February 2021, at 4, in In re: Familyhan Credit Corporation. ↩

  4. Order, 08 April 2021, in In re: Familyhan Credit Corporation. ↩

  5. E-mail from AVM, Collaborating Counsel of Familyhan Credit Corporation to National Privacy Commission (26 May 2021). ↩

  6. Resolution, 01 June 2021, at 4, in In re: Familyhan Credit Corporation. ↩

  7. Motion to Lift Cease and Desist Order by Familyhan Credit Corporation, 21 June 2021, at 3. ↩

  8. Id, at 1. ↩

  9. Id. ↩

  10. Id, at 2. ↩

  11. Order, 24 June 2021, at 4, in In re: Familyhan Credit Corporation. ↩

  12. National Privacy Commission, NPC Circular No. 21-02, “Rules on the Issuance of Cease and Desist Orders” [NPC Circ. No. 21-02], § 12 (6 October 2020). Emphasis supplied. ↩

  13. Id. ↩

  14. Id. ↩

  15. Id. ↩

  16. Order, supra note 3, at 4. ↩

  17. NPC Circ. No. 21-02, § 13. Emphasis supplied. ↩

  18. Order, supra note 1, at 7. ↩

  19. National Power Corporation Board of Directors v. Commission on Audit, G.R. No. 218052, 26 January 2021. ↩

  20. F-Cv. C, A.M. No. RTJ-15-2438, Sept. 15, 2020 (citing Lumiqued v. Exevea, G.R. No. 117565, 18 November 1997). Emphasis supplied. ↩

  21. Order, supra note 3, at 4. ↩

  22. Motion to Lift Cease and Desist Order, supra note 7, at 2. ↩

  23. NPC Circ. No. 21-02, § 12. ↩

  24. Order, supra note 3, at 5. ↩

  25. NPC Circ. No. 21-02, § 12. ↩

  26. Order, supra note 1, at 7. ↩ ↩2

  27. Comment by Familyhan Credit Corporation, 21 January 2021, at 1. ↩ ↩2

  28. NPC Circ. No. 21-02, § 13. Emphasis supplied. ↩

  29. Motion to Lift Cease and Desist Order, supra note 7, at 2. ↩

  30. Id, at 1. ↩

  31. Id, at 2. ↩

  32. Id. ↩

  33. Id. ↩

  34. Comment, supra note 2, at 5. ↩

  35. Id. ↩

Backlinks

  • No backlinks found