NPC Issuance Wiki

NPC 22-180 and NPC 22-181: DVL v. Alamat Crewsers Motorcycle Club and LAE v. Alamat Crewsers Motorcycle Club

Issued Resolution

Resolution Text

DVL,

Complainant,

-versus-

ALAMAT CREWSERS MOTORCYCLE CLUB,

Respondent.

x----------------------------------------------------x

LAE,

Complainant,

-versus-

ALAMAT CREWSERS MOTORCYCLE CLUB,

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before this Commission are two separate complaints filed by DVL and LAE against Alamat Crewsers Motorcycle Club (Alamat Crewsers M.C.) for an alleged violation of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

In their Complaints-Assisted Forms (CAFs) dated 19 August 2022, DVL and LAE respectively claimed that Alamat Crewsers M.C. violated the DPA when it maliciously published, on 11 August 2022, a post on Facebook containing their names and pictures without their consent.1 The Facebook post containing their pictures states:

IMPORTANT PUBLIC NOTICE:

This is to inform the public that these individuals, LAE and DVL whose pictures are shown here are no longer MEMBERS of ALAMAT CREWSERS M.C. and hereby declared as PERSONA NON GRATA by the club. Please be informed that any transaction or representation made by them using and under the name of ALAMAT CREWSERS M.C. are false pretenses and will not be recognized by the Club.2

Though it’s not in our nature as a Club to air our laundry out in public, it has come to our attention that these individuals are misrepresenting our club by actively recruiting and using their status as former members as premise. We cannot just let this slide, leaving the Club with no other choice but be obligated to let it be known to the public. One of them was dismissed due to transgressions against the Club and the other one resigned. We have in good faith, tried to settle things under the prying eyes of the public but to no avail.

Also…

ALAMAT CREWSERS M.C. DOES NOT RECRUIT

Again, we would like to reiterate that LAE and DVL are NO LONGER MEMBERS nor are they in any way AFFILIATED with ALAMAT CREWSERS M.C.

PLEASE BE ADVISED ACCORDINGLY!

To all our friends, brothers and sisters on the road, kindly disseminate among your groups to allay any misrepresentation and ill intention in the motorcycle community.3

Both DVL and LAE opined that “private entities such as this motorcycle riding club is [sic] devoid of any legal basis to process the personal information of the complainant in any way such as publishing/posting their name and picture without consent[.]”4

Further, DVL and LAE stressed that as of the filing of their CAFs, the post is still present and has been liked by thirty (30) individuals and shared by fifty-six (56) individuals, thereby affecting their reputation.5

On 22 September 2022, the Commission through its Legal and Enforcement Office (LEO) issued two separate Decisions dismissing the complaints filed by DVL and LAE for lack of merit:

WHEREFORE, the instant complaint is hereby DISMISSED for lack of merit, without prejudice to the filing of the appropriate civil, criminal, or administrative cases in the appropriate forum or tribunal, as may be necessary, and without prejudice to the refiling with the National Privacy Commission (NPC) in accordance with the Rules of Procedures of the NPC.

SO ORDERED.6

The LEO emphasized in its Decisions that “the complaint[s] did not pertain to a violation of the DPA” and, therefore, may be dismissed outright.7 The LEO argued that Alamat Crewsers M.C.’s processing was allowed pursuant to Section 12 (f) of the DPA and drew a parallel between the circumstances of this case and that of Advisory Opinion No. 2019-024:

In Advisory Opinion No. 2019-024 dated 07 May 2019, the Commission explained that public notices for termination of employees are allowed under the DPA as an exercise of a personal information controller’s legitimate interests. In the same Opinion, the Commission explained the criteria to be used to determine the existence of legitimate interest, thus:

‘It has been the common practice for companies to publish notices in newspapers and other media that a certain person appearing in the photograph used to be their employee, but is now no longer connected with the company, and a warning that transactions with the said person on behalf of the company will no longer be honored.[‘8

‘The above is still allowed under the DPA. The basis for processing may be Section 12(f) which provides for the processing that is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.[‘9

‘Legitimate interest refers to matters that are desired by or important to a PIC, which must not be contrary to law, morals or public policy. This includes business, financial or other reasonable purpose.[‘10

…

Applying the foregoing to the instant case, respondent’s act of posting a notice informing the public that complainant was no longer affiliated with respondent may be considered as processing of personal information in furtherance of respondent’s legitimate interests.11

DVL and LAE, through their counsel, filed a joint Motion for Reconsideration dated 07 October 2022.12 They argued that Section 12 (f) of the DPA does not apply in this case:

As stated in the decision under Section 12 (f) of the DPA, the processing of personal information is allowed when pursued by a personal information controller for purposes of legitimate interests, thus: XXX ‘(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.’(emphasis supplied)

In our law, the concept of privacy is enshrined in the Constitution and is regarded as the right to be free from unwarranted exploitation of one’s person or from intrusion into one’s private activities in such a way as to cause humiliation to a person’s ordinary sensibilities.(emphasis supplied) Here we argue that the posting of names and pictures with unsubstantiated claims and tag as ‘persona non grata’ are an unwarranted exploitation of the complainant’s [sic] person and an intrusion to their private life which should not be allowed specially in the guise of a legitimate interest since their posting of the pictures and names are OVERRIDEN by the rights of the complainants as to their privacy.13

Further, DVL and LAE argued that Alamat Crewsers M.C.’s post which claimed to apprise the public regarding the status of their membership cannot fall within the scope of legitimate interest under Section 12 (f) of the DPA since “aside from providing information to the status of the complainants[‘] membership the post alluded to an existence of a tag of ‘persona non grata’ clearly beyond the scope of providing the status of membership of the complainants[.]”14 In relation to this, it stressed that:

Since the Club does not have any legal personality being a non-registered entity it does not have any other legal purpose other than being a riders club it cannot legally transact any ‘business’ aside from motorcycle riding. So, posting the status of membership, alluding malicious tag such as persona non grata serves no purpose at all.15

DVL and LAE alleged that Advisory Opinion No. 2019-024, which discusses Section 12 (f) of the DPA, does not apply because Alamat Crewsers M.C. is without juridical personality:

[T]he use of Legitimate Interest Test presupposes that the respondents [sic] on [sic] this case has a lawful purpose and lawful personality to be able to exercise a legitimate interest but since the case has been dismissed moto proprio by the Commission it has failed to note that the respondent is a non-entity without any juridical personality for it is not registered in the Securities and Exchange Commission (SEC) and is a mere ‘association’ of Motorcycle Riders as gentleman’s club to say the least without a personality or valid name to protect.

Therefore the application of the Advisory Opinion No. 2019-024 […] should not have any application in this case.

For in the Advisory Opinion the Company who posted a public notice the termination of its employees is validly exercising its rights to protect the business of the Company who has a valid Legal and Juridicial Personality granted to it by law through it registration with either the Department of Trade and Industry (DTI) and or the [SEC]. When the Company posted the names and pictures of its former employee it is an extension of the contractual bonds between them covered by an employee-employer contract and is secured and protected since the Company is mandated to process the information in compliance with the privacy principle of transparency (a privacy policy consented by the former employee), legitimate purpose (for the public not to transact with the separated employee), and proportionality (the information shared ends with the details that the employee is not anymore affiliated with the company and that the post will be available only within a period of retention as identified by the company).

Here since the riders’ club [sic] main purpose in existing is to bond as riders, travel the road together, socialize as motorcycle rider, and does not have any other rights and personality other than riding motorcycle as a group therefore there is no valid and legitimate interest to begin with.16

Similarly, DVL and LAE averred that the processing was excessive since the public announcement contained malicious imputation and disclosure of unsubstantiated allegations.17

Issue

Whether Alamat Crewsers M.C. violated the DPA.

Discussion

Alamat Crewsers M.C. did not violate the DPA since its processing of DVL and LAE’s personal information falls within the lawful criteria under Section 12 (f) of the DPA. Thus, the Commission denies the Motion for Reconsideration dated 07 October 2022.

Personal information may be processed when it is for a legitimate interest. Section 12 (f) of the DPA provides:

Section 12. Criteria for Lawful Processing of Personal Information. The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:

…

(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.18

The Commission has previously enumerated the conditions necessary for the application of legitimate interest under Section 12 (f) of the DPA:

Processing based on legitimate interest requires the fulfillment of the following conditions: (1) the legitimate interest is established; (2) the processing is necessary to fulfill the legitimate interest that is established; and (3) the interest is legitimate or lawful and it does not override fundamental rights and freedoms of data subjects.19

As to the first element, Alamat Crewsers M.C. clearly established its legitimate interest. What is deemed “legitimate” in relation to Section 12 (f) is viewed from the perspective of the Personal Information Controller (PIC). The Alamat Crewsers M.C., as an exclusive association, has its own criteria for membership. Thus, it has the legitimate interest of preserving the integrity of its membership to ensure that only official members of its association can claim actual affiliation.

As to the second element, its processing of DVL and LAE’s names and pictures by publishing a Facebook post is necessary to fulfill this legitimate interest because Alamat Crewsers M.C. merely used this medium to disseminate the information to the public. As a PIC, it is in Alamat Crewsers M.C.’s legitimate interest to ensure that the public is not misled to believe that certain individuals are still members of its association. To recall, the public notice posted on Facebook specifically stated that it endeavored to inform the public that “any transaction or representation made by [DVL and LAE] using and under the name of ALAMAT CREWSERS M.C. are false pretenses and will not be recognized by the Club.”20

To fall under legitimate interest, it is not necessary that DVL and LAE made actual transactions or misrepresentations in the name of Alamat Crewsers M.C.. It is sufficient that there is a possibility or risk that DVL and LAE, as non-members, may misrepresent and enter into transactions affecting Alamat Crewsers M.C.. Thus, Alamat Crewsers M.C. may, in its legitimate interest, protect itself by ensuring that the public is aware of the status of the membership of DVL and LAE so that they will not be misled should DVL and LAE transact or make representations under the name of Alamat Crewsers M.C. without authority.

Moreover, in considering what it is necessary to achieve the legitimate interests of the PIC, the Commission stresses the importance of the principles of proportionality and fairness. In this case, the Facebook post only disclosed information necessary to achieve Alamat Crewsers M.C.’s purpose of notifying the public that DVL and LAE are no longer affiliated with it and that any false pretenses or transactions made by them would not be recognized.21 The Facebook post was factual.22 It neither disclosed any information other than their names and pictures nor did it disclose their supposed transgressions to the club. Although the Facebook post stated that “[o]ne of them was dismissed due to transgressions against the Club and the other one resigned,”23 this statement is not violative of any privacy violation per se because it did not provide any details regarding the matter.

As to the third element, not only was Alamat Crewsers M.C.’s interest legitimate but the manner in which it was sought to be achieved did not override the fundamental rights and freedoms of DVL and LAE. Alamat Crewsers M.C. has the right to protect its interests by informing the public of DVL and LAE’s membership status. This legitimate interest did not in any way disregard the fundamental rights and freedoms of DVL and LAE. Taking into account the principles of proportionality and fairness, the published factual Facebook post did not go beyond what was necessary to adequately notify the public of DVL and LAE’s current standing with the exclusive association.

Lastly, the Commission emphasizes that contrary to the assertions of DVL and LAE, legitimate interest does not require that the PIC be a juridical entity registered with SEC or DTI. Section 3 of the DPA defines a PIC:

Section 3. Definition of Terms. Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

(h) Personal information controller refers to a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf. The term excludes:

(1) A person or organization who performs such functions as instructed by another person or organization; and

(2) An individual who collects, holds, processes or uses personal information in connection with the individual’s personal, family or household affairs.24

A PIC, as defined in the DPA, may be an individual or organization so long as it controls the processing of personal information. It does not matter whether the entity is registered with the SEC or DTI because it need not be a juridical entity. An ‘association’ of gentlemen riders can be considered a PIC for purposes of the DPA.

In determining the applicability of the lawful criteria in Section 12 (f) of the DPA, the Commission examines how the PIC processed personal information and does not look at its juridical personality or registration.

With regard to the procedural aspect of the case, DVL and LAE are barred from submitting a second motion for reconsideration. The Commission, through the LEO, already issued two separate Decisions dated 22 September 2022.25 DVL and LAE had the opportunity to appeal the Decisions by way of filing one motion for reconsideration following Rule VIII, Section 4 of NPC Circular 2021-01 (2021 NPC Rules of Procedure):

Section 4. Appeal. The decision of the Commission shall become final and executory fifteen (15) calendar days after receipt of a copy by both parties. One motion for reconsideration may be filed, which shall suspend the running of the said period. Any appeal from the Decision shall be to the proper courts, in accordance with law and rules.26

Given that DVL and LAE filed their joint Motion for Reconsideration dated 07 October 2022 in response to the separate Decisions dated 22 September 2022,27 no further motions for reconsideration or appeals will be entertained.

WHEREFORE, premises considered, this Commission hereby DENIES the Motion for Reconsideration dated 07 October 2022 filed by DVL and LAE for lack of merit and AFFIRMS the Decision dated 22 September 2022.

This is without prejudice to the filing of appropriate civil, criminal, or administrative cases before any other forum or tribunal, if any.

SO ORDERED.

City of Pasay, Philippines. 10 November 2022.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

I CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

Copy furnished:

DVL Complainant

LAE Complainant

ALAMAT CREWSERS MOTORCYCLE CLUB Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Complaints-Assisted Form, 19 August 2022, at 3, in DVL v. Alamat Crewsers Motorcycle Club, NPC Case 22-180 (NPC 2022); Complaints-Assisted Form, 19 August 2022, at 3, in LAE v. Alamat Crewsers Motorcycle Club, NPC Case 22-181 (NPC 2022). ↩

  2. Id. Annex C; Id. Annex C. ↩

  3. Id. at 4; Id. at 4. ↩

  4. Id. at 4; Id. at 4. ↩

  5. Id. at 3-4; Id. at 3-4. ↩

  6. NPC 22-180, 22 September 2022 (NPC 2022) (unreported); NPC 22-181, 22 September 2022 (NPC 2022) (unreported). ↩

  7. Id. at 1-2; Id. at 1-2. ↩

  8. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, § 12 (f) (2012). ↩

  9. NPC 20-317 and NPC 20-318, 13 October 2022, at 7 (NPC 2022) (unreported). ↩

  10. Id. at 1-2; Id. at 1-2. ↩

  11. Id. at 3-4; Id. at 3-4. ↩

  12. Motion for Reconsideration, 07 October 2022, in DVL v. Alamat Crewsers Motorcycle Club, NPC Case 22-180 (NPC 2022) and LAE v. Alamat Crewsers Motorcycle Club, NPC Case 22-181 (NPC 2022). ↩

  13. Id. at 8-9. ↩

  14. Id. at 10. ↩

  15. Id. ↩

  16. Complaints-Assisted Form, 19 August 2022, Annex C, in DVL v. Alamat Crewsers Motorcycle Club, NPC Case 22-180 (NPC 2022); Complaints-Assisted Form, 19 August 2022, Annex C, in LAE v. Alamat Crewsers Motorcycle Club, NPC Case 22-181 (NPC 2022). ↩

  17. See Id; Id. ↩

  18. See Id; Id. ↩

  19. Complaints-Assisted Form, 19 August 2022, Annex C, in DVL v. Alamat Crewsers Motorcycle Club, NPC Case 22-180 (NPC 2022); Complaints-Assisted Form, 19 August 2022, Annex C, in LAE v. Alamat Crewsers Motorcycle Club, NPC Case 22-181 (NPC 2022). ↩

  20. Id. at 11-13. Emphasis supplied. ↩

  21. Id. at 13-14. ↩

  22. Data Privacy Act of 2012, § 3 (h). Emphasis supplied. ↩

  23. NPC 22-180, 22 September 2022 (NPC 2022) (unreported); NPC 22-181, 22 September 2022 (NPC 2022) (unreported). ↩

  24. National Privacy Commission, [[issuances/2021/2021-rules-of-procedure-of-the-national-privacy-commission#rule-viii-decision|2021 Rules of Procedure of the National Privacy Commission [NPC 2021 Rules of Procedure], Rule VIII, Section 4]] (28 January 2021). Emphasis supplied. ↩

  25. Motion for Reconsideration, 07 October 2022 in DVL v. Alamat Crewsers Motorcycle Club, NPC Case 22-180 (NPC 2022) and LAE v. Alamat Crewsers Motorcycle Club, NPC Case 22-181 (NPC 2022). ↩

  26. National Privacy Commission, [[issuances/2021/2021-rules-of-procedure-of-the-national-privacy-commission#rule-viii-decision|2021 Rules of Procedure of the National Privacy Commission [NPC 2021 Rules of Procedure], Rule VIII, Section 4]] (28 January 2021). Emphasis supplied. ↩

  27. Motion for Reconsideration, 07 October 2022 in DVL v. Alamat Crewsers Motorcycle Club, NPC Case 22-180 (NPC 2022) and LAE v. Alamat Crewsers Motorcycle Club, NPC Case 22-181 (NPC 2022). ↩

Backlinks

  • No backlinks found