NPC Issuance Wiki

NPC 21-010 to NPC 21-015: MCV, et al. v. DSL

Issued Resolution

Resolution Text

MVC,

Complainant,

-versus-

DSL,

Respondent.

x----------------------------------------------------x

RRB,

Complainant,

-versus-

DSL,

Respondent.

x----------------------------------------------------x

NMB,

Complainant,

-versus-

DSL,

Respondent.

x----------------------------------------------------x

RMP,

Complainant,

-versus-

DSL,

Respondent.

x----------------------------------------------------x

NDL,

Complainant,

-versus-

DSL,

Respondent.

x----------------------------------------------------x

MBN,

Complainant,

-versus-

DSL,

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before the Commission is the Motion for Reconsideration dated 05 April 2022 filed by DSL.

Facts

On 03 February 2022, the Commission issued a Decision finding DSL liable for Section 32 of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA) and recommending his prosecution to the Department of Justice:

WHEREFORE, premises considered, the Commission hereby:

  1. FINDS DSL liable for Section 32 (Unauthorized Disclosure) of the Data Privacy Act of 2012; and

  2. FORWARDS this Decision and a copy of the pertinent case records to the Secretary of Justice and recommends the prosecution of DSL for the offense of Unauthorized Disclosure under Section 32 of the DPA.

SO ORDERED.1

On 21 March 2022, DSL, through his counsel, received a copy of the Decision dated 03 February 2022.2

On 05 April 2022, DSL filed his Motion for Reconsideration alleging that the Commission erred in finding him liable for Unauthorized Disclosure under Section 32 of the DPA and recommending for his prosecution.3 He further asserted that the Commission committed an error when it took cognizance of the case despite the procedural lapses.4

In DSL’s Motion for Reconsideration, he claimed that he should not be held liable for Unauthorized Disclosure because as the President of the GA Tower 1 Condominium Corporation (GAT1CC), he was authorized to disclose the names of delinquent unit owners pursuant to the House Rules and Regulations of GAT1CC.5 He argued that the members of GAT1CC, which included Complainants MVC, RRB, NMB, RMP, NDL, and MBN (Complainants), are bound by the House Rules and Regulations of GAT1CC.6 Thus, according to DSL, the disclosure of the names of delinquent members through the publication of the letter dated 23 November 2021 was an obligation in accordance with Section 12 (c) of the DPA.7

He claimed that the Complainants failed to substantially prove that he was not authorized to bind GAT1CC.8 He also claimed that there was no evidence to prove that he did not issue the letter dated 23 November 2021 in the interest of GAT1CC nor was there evidence to support the Commission’s finding that he disclosed the personal information of the Complainants to cast doubt on their capability to manage the affairs of GAT1CC.9 To support his contentions, DSL pointed out that the Complainants “were not singled out” considering that the list included all the delinquent members.10

Further, DSL argued that the Commission did not have jurisdiction over the case because it involved an intra-corporate controversy:

  1. […] [The contentions of the [Complainants clearly make out an intra-]corporate controversy. The parties involved are the members of the corporation against the board members and officers of the corporation. In fact, the [C]omplainants did not deny and even admitted that they are members of the [C]ondominium [C]orporation, and [DSL] is the President of GAT1CC.

  2. The issues as to the right of the [C]ondominium [C]orporation to impose condominium dues, the validity of the provisions of its by-laws, enforce the provisions of its master deed and house rules are issues related to intra-]corporate controversy.11

In relation to DSL’s allegation that the case should have been dismissed outright due to procedural lapses, he claimed that the Complainants failed to observe the procedural requirement under NPC Circular 2021-01 (2021 NPC Rules of Procedure) when they did not attach their respective certificates against forum shopping to their complaints.12 He further alleged that the Complainants committed forum shopping since they failed to disclose that there were four (4) cases with same issues as the case at bar pending before various courts.13 To recall, DSL enumerated the following pending cases:

a. SEC Case No. 01-18-463, JM et., al., vs. GAT1CC, DSL et., al. […]

b. HSAC Case No. REM-050918-16656 entitled RP. Selected Homeowners of GA Tower 1 vs. DSL et., al. […]

c. Injunction Case (Condominium Dues and Cable Fees Issue), RTC, Br. 211, Mandaluyong City, Belnas et., al., vs. GAT1CC, DSL et., al. […]

d. Injunction Case. GAT1CC vs. JR, RB et., al., RTC, BR. 211, Mandaluyong City, Civil Case No. R-MND-20-01767-CV.[…]14

DSL argued that the Commission should set aside the Decision dated 03 February 2022 and issue a new decision dismissing the complaint filed against him.14

On 28 April 2022, the Commission issued an Order directing Complainants to comment on the Motion for Reconsideration dated 05 April 2022.15

In the Complainants’ Consolidated Comment/Opposition dated 08 July 2022, they manifested that the Commission should deny DSL’s Motion for Reconsideration dated 05 April 2022.16 They argued that the Motion for Reconsideration is pro forma as it raised the same arguments already threshed out in the Decision dated 03 February 2022.17 According to the Complainants, the Motion for Reconsideration dated 05 April 2022, being merely pro forma, should be considered as “a mere scrap of paper that produces no legal and procedural effect.”18

In the alternative, the Complainants further argued that DSL failed to sufficiently establish any reason for the Commission to set aside and reverse its Decision dated 03 February 2022.19

The Complainants asserted that the Commission has jurisdiction over the subject matter considering that the issue involved the processing of personal information.20 They pointed out that the allegations concerning corporate issues “were only crucial to show the timing of the release of the personal information, as proof of malice which attended the disclosure.”21

As to DSL’s allegation that they committed forum shopping, the Complainants argued that the (4) pending cases that DSL cited do not have the same parties, issues, and reliefs as the case at bar.22

Lastly, the Complainants argued that the Commission correctly ruled that DSL’s processing of their personal information was done without lawful basis.23

Issue

Whether the Motion for Reconsideration dated 05 April 2022 should be granted.

Discussion

The Commission denies DSL’s Motion for Reconsideration dated 05 April 2022.

DSL asserted that GAT1CC, through him as the President, may post the names of delinquent unit owners pursuant to Section 12 (c) of the DPA:

  1. As members of GAT1CC, [C]omplainants are indisputably bound by the [C]ondominium House Rules which are authorized by GAT1CC’s Articles of Incorporation, By-Laws, the Master Deed, the Corporation Code, and the Condominium Act. As such, [GAT1CC] may validly disclose information such as the names of delinquent members pursuant to Section 12 (c) of the Data Privacy Act.

  2. It goes then without saying that GAT1CC, through its President [DSL], was well within its right when it posted the names of the delinquent unit owners of the subject [C]ondominium. Complainants are bound by law and contract to follow and respect the provisions of the House Rules and Regulations of GAT1CC.24

He further argued that “being the President of [GAT1CC] and being a member of the managing body thereof, [he] was in fact acting for the benefit of [GAT1CC] in the absence of proof to the contrary.”25

The Commission, in its Decision dated 03 February 2022, held that the publication of the letter dated 23 November 2021 was not necessary for compliance of GAT1CC’s legal obligation.26 It further ruled that DSL’s purpose for disclosing the Complainants’ personal information was not for the interest of GAT1CC.27

The Commission recognized that GAT1CC may process the personal information of delinquent unit owners to assess and collect outstanding obligations.28 It, however, ruled that DSL’s processing was neither necessary nor proportional to the alleged purpose:

The purpose of the letter was not for the collection of delinquent dues. Rather, the evidence on record shows that DSL disclosed Complainants’ personal information as delinquent unit owners to cast doubt on their capability to manage the affairs of the condominium corporation in light of the recently held election of the Board of Directors.29

DSL’s claim that the disclosure of personal information was based on a lawful criterion under Section 12 (c) of the DPA was insufficient considering that they were not substantiated by evidence.30 The Commission further explained that the Personal Information Controller (PIC) claiming lawful processing has the burden to prove that it complied with the requirements of the lawful criterion it was alleging:

When a PIC claims lawful processing on the basis of a legal obligation, the burden is on the PIC to show that all that is required by that particular lawful criterion is present. A PIC must be able to prove that the legal obligation it cites as basis exists and applies to the processing it performed, and that the processing is necessary to comply with the legal obligation.31

The Commission cannot give credence to DSL’s assertion since he failed to identify the actual Board of Directors that authorized his act nor was he able to present any document certifying that he was authorized by the Board of Directors to publish the letter dated 23 November 2021. The burden is on DSL to prove that he really had authority to represent GAT1CC.

The Commission emphasizes that once the complainant has proven that there was indeed a processing that occurred, it is incumbent upon the PIC that processed the personal data to prove that it is either exempted from the scope of the DPA or that the processing was based on lawful criteria under Sections 12 or 13 of the DPA.

Here, however, DSL failed to prove that he is exempted from the scope of the DPA or that his processing was based on any of the lawful criteria under Sections 12 or 13 of the DPA.

As regards the procedural issues, DSL argued that the Commission “inadvertently committed palpable error when it proceeded to decide the case despite having no jurisdiction over the subject matter thereof.”32 He claimed that the issue in the case at bar is an intra-corporate controversy because the parties involved are members and officers of a corporation.33 Thus, according to DSL, it is the Regional Trial Court that has jurisdiction over the case.34

He also claimed that the Commission should have dismissed the case outright because the Complainants failed to disclose that there were four (4) pending cases before different courts that have the same issues and circumstances with that of the case at bar.35

Further, DSL pointed out that the Complainants failed to comply with Section 3 (10), Rule II of the 2021 NPC Rules of Procedure when they did not attach certificates against forum shopping to their respective complaints.36

Contrary to DSL’s assertions, the Commission did not commit an error when it took cognizance of the case. The issue in the case at bar relates to the processing of personal information, which is within the scope of the DPA and under the jurisdiction of the Commission.37 The fact that the parties in the case at bar are members and officers of a corporation does not automatically result in the existence of an intra-corporate dispute. In addition, even if there was an intra-corporate dispute, the issue in this case is the propriety of the processing of personal information undertaken by DSL. This is precisely within the mandate of the Commission.

Further, the four (4) pending cases and the case at bar do not have the same issue and cause of action. As previously stated, the issue in the case at bar relates to data privacy, particularly on the processing of personal information, and the Complainants’ cause of action stems from their rights as data subjects. The four (4) pending cases relate to a dispute in the election of the Board of Directors of GAT1CC, which is an intra-corporate controversy, and to the main actions for injunction of the implementation of the condominium’s rule on cable services.38 The issues and the circumstances of the four (4) pending cases in comparison to the present case are not identical.

As to the issue on the certificate against forum shopping, the Commission maintains that it did not err when it did not dismiss the case outright due to the lack of certificate against forum shopping. The Complaints-Assisted Forms were filed on 15 January 2021, when NPC Circular 16-04, which does not require a certificate against forum shopping, was still in effect. Thus, the lack of a certificate against forum shopping does not result in any error on the part of the Complainants.

Given the foregoing, the Commission finds that the issues raised in the Motion for Reconsideration dated 05 April 2022 failed to sufficiently establish a reason to set aside and reverse the Decision dated 03 February 2022. The Commission, therefore, reiterates its Decision dated 03 February 2022 finding DSL liable for Unauthorized Disclosure under Section 32 of the DPA and recommending for his prosecution to the Department of Justice.

WHEREFORE, premises considered, the Commission resolves to DENY the Motion for Reconsideration dated 05 April 2022 filed by DSL. The Decision dated 03 February 2022 is hereby AFFIRMED.

SO ORDERED.

City of Pasay, Philippines. 13 October 2022.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

I CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

Copy furnished:

MVC Complainant

RRB Complainant

NMB Complainant

RMP Complainant

NDL Complainant

MBN Complainant

CTB Counsel for Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, NPC 21-015, 03 February 2022, at 13 (NPC 2022) (unreported). ↩

  2. Motion for Reconsideration, 05 April 2022, ¶ 2, in MVL, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, NPC 21-015 (NPC 2022). ↩

  3. Id. ¶ 5. ↩

  4. Id. ¶ 18. ↩

  5. Id. ¶¶ 7 & 9. ↩

  6. Id. ¶¶ 8-9. ↩

  7. Id. ¶ 8. ↩

  8. Motion for Reconsideration, 05 April 2022, ¶¶ 10-11, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, NPC 21-015 (NPC 2022). ↩

  9. Id. ¶¶ 10 & 13. ↩

  10. Id. ¶ 13. ↩

  11. Id. ¶¶ 19-20. ↩

  12. Id. ¶ 26. ↩

  13. Id. ¶ 28. ↩

  14. Motion for Reconsideration, 05 April 2022, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, NPC 21-015 (NPC 2022). ↩

  15. Order, 28 April 2022, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, NPC 21-015 (NPC 2022). ↩

  16. Consolidated Comment/Opposition, 08 July 2022, at 1, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, NPC 21-015 (NPC 2022). ↩

  17. Id. at 2. ↩

  18. Id. at 3. ↩

  19. Id. at 3. ↩

  20. Id. ↩

  21. Id. ↩

  22. Consolidated Comment/Opposition, 08 July 2022, at 3, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, NPC 21-015 (NPC 2022). ↩

  23. Id. ↩

  24. Motion for Reconsideration, 05 April 2022, ¶¶ 8-9, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, NPC 21-015 (NPC 2022). ↩

  25. Id. ¶ 11. ↩

  26. NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, NPC 21-015, 03 February 2022, at 7 (NPC 2022) (unreported). ↩

  27. Id. ↩

  28. Id. at 8. ↩

  29. Id. ↩

  30. Id. at 9. ↩

  31. Id. at 7-8. ↩

  32. Motion for Reconsideration, 05 April 2022, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, NPC 21-015 (NPC 2022). ↩

  33. Id. ¶ 19. ↩

  34. Id. ¶ 22. ↩

  35. Id. ¶ 28. ↩

  36. Id. ¶ 24-26. ↩

  37. See An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, § 4 (2012). ↩

  38. See Comment, 06 October 2021, Annexes 2-8, in MVC, et al. v. DSL, NPC 21-010, NPC 21-011, NPC 21-012, NPC 21-013, NPC 21-014, NPC 21-015 (NPC 2022). ↩

Backlinks

  • No backlinks found