NPC Issuance Wiki

NPC 19-278: JO v. MSM, Inc.

Issued Resolution

Resolution Text

JO,

Complainant,

-versus-

MSM, Inc.

Respondent.

x----------------------------------------------------x

NAGA, P.C.;

Before the Commission is a Motion for Reconsideration dated 15 May 2022 filed by JO on the Commission’s Decision dated 31 March 2022.

Facts

JO, through a Complaints-Assisted Form dated 27 March 2019, filed a case against the Respondent, MSM, Inc (MSMI).1 On 31 March 2022, the Commission issued a Decision dismissing the complaint for lack of merit.2

The Decision was served via email to both parties on 29 April 2022.3 Subsequently, JO submitted an unsigned Motion for Reconsideration on 16 May 2022 via email.4 In the email, JO stated that, “I will send physical copy personally (signed),”5 and attached his unsigned Motion.6 Based on the records, JO filed a signed physical copy of his Motion on 17 May 2022.7

In his Motion, JO claims that there was no “cogent reason” for the dismissal of his complaint.8 He states that “the complaint itself has shown an exceptionally good cause that indeed respondents unquestionably, deliberately and seriously violated the right(s) of the complainant and complaint itself involves a serious violation or wanton breach of the Data Privacy Act.”9

He claims that there was bias or partiality in the dismissal of his complaint. To support this claim, JO cites an alleged incident in the course of the preliminary investigation:

The Investigating Officer have already decided the favorable resolution of the complaint to the respondent(s) since, quoted thereat the following remarks, “MADEDEHADO KA DITO (REFERRING TO NPC) KUNG WALA KANG ABOGADO” (sic)10

JO also argues that MSMI has committed data privacy violations, especially by MSMI’s alleged admission that it was using “the account name and code of complainant who has effectively resigned since 31 December 2018.”11 He further contends that MSMI should be penalized under Section 33 of Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA).12 Lastly, JO claims that MSMI could have performed its tasks manually, but opted to breach his personal data.13

In response, MSMI filed an Opposition (to the Motion for Reconsideration dated 15 May 2022) dated 01 June 2022.14 MSMI argues that “[JO’s] Motion should be outrightly denied for being pro forma inasmuch as it fails to point out specifically the findings or conclusions of the Commission in its Decision which are not supported by the evidence or which are contrary to law…”,15 and thereafter citing Rule 37 of the 2019 Rules of Civil Procedure.16

MSMI also counters that JO “fails to provide any iota of evidence to show that this Honorable Commission exhibited any bias or partiality in its Decision other than to reference the period within which the said Decision was issued and to quote the Investigating Officer.”17 According to MSMI, the alleged statement, if true, also does not show bias but “only reflects the Investigating Officer’s prudent act of advising Complainant of the possibility of engaging counsel.”18 Even if this showed bias or partiality, MSMI claims that it is not one of the grounds for a motion for reconsideration.19

MSMI cites the Decision in claiming that there was no privacy violation, in that JO’s email and Philippine Overseas Employment Administration (POEA) code are company-owned assets, and not owned by JO.20 Thus, MSMI prays that the Commission deny JO’s Motion.

Issue

Whether the Motion for Reconsideration merits the reversal of the Decision dated 31 March 2022.

Discussion

The Commission denies JO’s Motion for Reconsideration.

I. The Decision has already attained finality. JO’s period to file a motion for reconsideration has already lapsed.

Rule VII, Section 30 of the NPC Circular 2016-04 or the Rules of Procedure (2016 NPC Rules of Procedure) states:

SECTION 30. Appeal. – The decision of the National Privacy Commission shall become final and executory fifteen (15) days after the receipt of a copy thereof by the party adversely affected. One motion for reconsideration may be filed, which shall suspend the running of the said period. Any appeal from the Decision shall be to the proper courts, in accordance with law and rules.21

(Emphasis supplied)

Likewise, Rule VIII, Section 4 of NPC Circular No. 2021-01, otherwise known as the 2021 NPC Rules of Procedure (2021 NPC Rules) states:

SECTION 4. Appeal. – The decision of the Commission shall become final and executory fifteen (15) calendar days after receipt of a copy by both parties. One motion for reconsideration may be filed, which shall suspend the running of the said period. Any appeal from the Decision shall be to the proper courts, in accordance with law and rules.22

The Decision dismissing the case was served to the parties via email on 29 April 2022. JO, in his Motion, claims that he received the Decision on 10 May 2022.23 Based on the records, this was the day he received the physical copy of the Decision after it was sent through private courier.24

Nevertheless, it should be noted that electronic service is allowed under Rule III, Section 6 of the NPC Rules.25 Also, there was no notification or other proof that there were problems with the electronic service.26 JO even sent an email attaching his unsigned Motion by replying to the Commission’s email which electronically served him the Decision.27

Thus, the Commission finds that the electronic service of its Decision on 29 April 2022 was valid. Consequently, the Decision already became final on 14 May 2022, which was the fifteenth day from receipt of the Decision, since there was no appeal filed within the fifteen (15)-day period.

JO electronically mailed his unsigned Motion on 16 May 2022. However, under Rule 7, Section 3 of the 2019 Rules of Civil Procedure (which finds suppletory application in this case),28 “[e]very pleading and other written submissions to the court must be signed by the party or counsel representing him or her.”29 JO, as the party filing the Motion, did not follow this clear obligation. It was only on 17 May 2022 when the Commission received a physical and signed copy of his Motion. Moreover, it bears emphasis that regardless whether JO filed his Motion on 16 May 2022 or 17 May 2022, the Decision had already attained finality.

Even if the Commission were to consider the unsigned Motion as duly filed, JO’s period to file a motion for reconsideration had already lapsed since the Decision was already final. On this ground alone, the Commission has sufficient cause to deny JO’s Motion.

II. On the merits, JO did not provide any substantial or adequate ground to reverse the Decision.

Setting aside the procedural infirmity, the Commission still finds that the Decision must be upheld. JO has not shown any substantial or adequate ground that would merit the reversal of the Decision.

JO does not explicitly state that the Commission is biased. His Motion does not even cite any particular statement from the Decision that would be indicative of partiality. However, he claims that during the preliminary investigation proceedings, the Investigating Officer “already decided the favorable resolution of the complaint to the respondent(s)”30 due to the alleged statement “MADEDEHADO KA DITO (REFERRING TO NPC) KUNG WALA KANG ABOGADO.”31

The Commission view allegations of bias seriously given that the National Privacy Commission is an independent body mandated to administer and implement the DPA.32 Taking into consideration its role, the Commission finds that JO has not proven that the Decision is tainted with bias against him.

In fact, in resolving JO’s complaint, the Commission even exercised its authority to rule on the merits, rather than dismissing the complaint outright for non-exhaustion of remedies based on Section 4(a) of NPC Circular 16-04. To quote the Decision:

I. The Commission exercises its authority to resolve the case on the merits.

MSMI contends that the case should be dismissed since JO did not prove that he complied with Section 4(a) of NPC Circular No. 16-04, also known as the 2016 NPC Rules of Procedure.

In response, JO claims that after resigning, he immediately informed the company to refrain from accessing his personal information.

xxx

Based on the record, JO has not concretely provided evidence that it has complied with Section 4(a) of NPC Circular No. 16-04, since there is no proof that he informed MSMI, in writing, about the alleged privacy violation. Other than his allegations stated in his various pleadings before the Commission, JO did not attach any letter or other written correspondence to MSMI relating to the alleged privacy violation. Thus, he did not provide substantial evidence that will lead the Commission to conclude that he complied with Section 4(a) of NPC Circular No. 16-04.

Nevertheless, the Commission exercises its authority to waive the requirement of exhaustion of administrative remedies, based on the last paragraph of Section 4 of the 2016 Rules of Procedure.

JO’s allegations, if substantially proven, may lead the Commission to conclude that there was a serious violation of the DPA. The allegations also show that there may be serious risk of harm to JO, given that the emails he provided allegedly show acts which he did not do, but may be liable for.

Thus, the Commission finds it appropriate to exercise its authority to resolve the case on the merits.33 (Emphases supplied, citations omitted.)

The Commission could have just resolved to dismiss outright JO’s complaint simply because he failed to prove that he informed MSMI in writing about the alleged privacy violation in order for it to appropriately act on the matter.34 Instead, it approached the case from the lens of substantial justice by assessing JO’s complaints based on the merits of his case. These actions are inconsistent with claims of bias or partiality against JO.

Further, regardless of the propriety of the Investigating Officer’s alleged statement, the Decision was made only after the Commission scrutinized each party’s submissions, evidence, and the law. The Commission ultimately decides on the matter, independent of the recommendations of the investigating officer, since “[t]he Commission shall review the evidence presented, including the Fact-Finding Report and supporting documents.”35 Though his complaint was dismissed, this in itself does not automatically prove that there was bias.

JO also repeats his claim that MSMI committed privacy violations when it “[used] the account name and code of complainant who has effectively resigned since 31 December 2018… There was a categorical admittance that the e-mail was provided for by the company (respondents), hence, bolster the fact that it is still being wantonly utilized by the company even after the complainant (data subject) effectively resigned since December 31, 2018 by another person. (sic)“.36 He also claims that MSMI should be penalized for Section 33 of the DPA to act as deterrence for those similarly inclined to violate the law or commit data breaches.37

The Commission has already extensively discussed JO’s contentions in its Decision. Further, the Commission finds that there are no new material facts or information presented by JO in his Motion that would warrant the reversal of the Commission’s Decision.

As explained in the Decision, the POEA code is a company asset and cannot be considered as part of JO’s personal information. While JO’s company-issued email indicates his name, its use after his resignation does not automatically equate to a violation of the DPA.

MSMI had a legitimate interest to continue using the POEA Account to access the Sea-based e-Contracts System (SBECS). MSMI’s interest stems from POEA Memorandum Circular No. 06, series of 2018, which established the mandate for licensed manning agencies, like MSMI, to use POEA’s web-based facility for its business processes with the agency.38

MSMI also proved that it timely informed POEA about JO’s resignation, and that it had to rely on POEA in order for MSMI to gain access to SBECS.39

Lastly, the Commission finds that JO failed to justify why MSMI should be penalized under Section 33 of the DPA “[a]s a deterrent to others who are similarly inclined to commit such serious Data Privacy Violations or Personal Data Breach (sic)“.40

Section 33 of the DPA provides:

SEC. 33. Combination or Series of Acts. – Any combination or series of acts as defined in Sections 25 to 32 shall make the person subject to imprisonment ranging from three (3) years to six (6) years and a fine of not less than One million pesos (Php1,000,000.00) but not more than Five million pesos (Php5,000,000.00).41

JO has not proven that MSMI is liable for violating any of Sections 25 to 32 of the DPA, much more be penalized for a combination or series of acts meriting the application of Section 33 of the law.

Indeed, after reviewing the records and considerably weighing the evidence and arguments of both parties, the Commission finds no reason to reverse its Decision.

WHEREFORE, premises considered, the Motion for Reconsideration is DENIED. The Decision dated 31 March 2022 is hereby AFFIRMED.

SO ORDERED.

City of Pasay, Philippines. 16 June 2022.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

DUG CHRISTOPER B. MAH Deputy Privacy Commissioner

(Inhibited)

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

Copy furnished:

JO Complainant

MSM, INC. Respondent

ATTY. FT Counsel for Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Complaints-Assisted Form dated 27 March 2019 of JO. ↩

  2. JO vs MSM, Inc., NPC 19-278, Decision dated 31 March 2022. ↩

  3. See Electronic mail dated 29 April 2022 to JO and MSM, Inc.; Electronic Mail Delivery Receipts. ↩

  4. Motion for Reconsideration dated 15 May 2022 (unsigned) of JO. ↩

  5. Electronic Mail dated 16 May 2022 from JO. ↩

  6. Id. ↩

  7. Motion for Reconsideration dated 15 May 2022 (signed) with stamp receipt of JO. ↩

  8. Id., at pp. 1-2. ↩

  9. Id., at p. 2. ↩

  10. Id. ↩

  11. Motion for Reconsideration dated 15 May 2022 of JO, at p. 2. ↩

  12. Id. ↩

  13. Id. ↩

  14. Opposition (to the Motion for Reconsideration dated 15 May 2022) dated 01 June 2022 of MSM, Inc. ↩

  15. Id., at ¶ 2. ↩

  16. Id. ↩

  17. Id., ¶ 4. ↩

  18. Opposition (to the Motion for Reconsideration dated 15 May 2022) dated 01 June 2022 of Multinational Ship Management, Inc., ¶ 4(b). ↩

  19. Id., ¶ 4(c). ↩

  20. Id., ¶ 7. See JO vs MSM, Inc., NPC 19-278, Decision dated 31 March 2022, at p. 12. ↩

  21. National Privacy Commission, Rules of Procedure of the National Privacy Commission, NPC Circular No. 16-04, Rule VII, § 30 (15 December 2016) (2016 NPC Rules of Procedure) ↩

  22. National Privacy Commission, 2021 Rules of Procedure of the National Privacy Commission, NPC Circular No. 2021-01, Rule VIII, § 4 (28 January 2021) (2021 NPC Rules of Procedure). ↩

  23. Motion for Reconsideration dated 15 May 2022 of JO, at p. 1. ↩

  24. As per LBC tracking number. ↩

  25. 2021 NPC Rules of Procedure, Rule III, § 6. ↩

  26. See Electronic mail delivery receipts. ↩

  27. Electronic mail dated 16 May 2022 of JO. ↩

  28. See 2021 NPC Rules of Procedure, Rule XII, § 8. ↩

  29. 2019 Rules of Civil Procedure, Rule VII, § 3. (Emphasis supplied) ↩

  30. Motion for Reconsideration dated 15 May 2022 of JO, at p. 2. ↩

  31. Id. ↩

  32. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes, Data Privacy Act of 2012, Republic Act No. 10173, Chapter II, § 7 (2012). ↩

  33. JO v. MSM, Inc., NPC 19-278, Decision dated 31 March 2022, at pp. 9-11. ↩

  34. See National Privacy Commission, Rules of Procedure, NPC Circular No. 16-04, § 4(a) (15 December 2016). ↩

  35. 2021 NPC Rules of Procedure, Rule VIII, § 1. ↩

  36. Motion for Reconsideration dated 15 May 2022 of JO, at p. 2. ↩

  37. Id. ↩

  38. Philippine Overseas Employment Administration, Memorandum Circular No. 06, series of 2018, New Procedure for Online Registration of Seafarers and Seabased e-Contracts System (SBECS). ↩

  39. JO vs MSM, Inc., NPC 19-278, Decision dated 31 March 2022, at p. 14; see Motion to Dismiss dated 02 July 2019 of Multinational Ship Management, Inc., Annex “F”. ↩

  40. Motion for Reconsideration dated 15 May 2022 of JO at p. 2. ↩

  41. Data Privacy Act of 2012, Chapter VIII, § 33. ↩

Backlinks

  • No backlinks found