Resolution Text
JRC,
Complainant,
-versus-
BANK OF THE PHILIPPINES ISLANDS
Respondent.
x----------------------------------------------------x
Before this Commission is the Mediated Settlement Agreement between JRC (Complainant) and Bank of the Philippines Islands (Respondent).
Facts
On 03 September 2021, the instant complaint1 was filed with the NPC Complaints and Investigation Division based on the following facts:
Last July 1, 2021 at 2:15PM, I was a victim of [ph]ishing scam. I received a call form MM with CP number XXX who introduces herself as an employee of BPI Head Office wherein she offered me to waive my credit card annual fee for lifetime because I have a good credit standing. She asked my last 4 digit credit card number, confirmed the expiration, asked the batch number which is the CVV for verification purposes so that I can avail the offer. I solely entrusted to this person that she was a BPI legit employee because all I know, only BPI known my Credit Card Information. My credit card issued only last March, 2021. I never used my credit card online. They can check my past purchases which is only limited. So how come that this scammer had known my Credit Card Account Information? There were a leakage of my personal information. I entrusted BPI to collect it because I know it is confidential. They cannot protect their client information. It is unfair that I shouldered payment for this fraudulent transaction because of their negligence. They must do an urgent action to help their client about this kind of incident so that as a cardholder felt secured to this reputable bank since I reported it immediately. I am hoping for your consideration and resolution on this matter. Thank you!”2
On 14 April 20223 and 20 April 2022,4 Complainant and Respondent filed their Application for Mediation, respectively, and the mediation conferences were conducted on the following dates: 10 May 2022;5 07 June 2022;6 28 June 2022;7 12 July 2022;8 25 July 2022;9 01 August 2022;10 and 08 August 2022.11
Despite the Order to Mediate dated 01 August 202212 to further conduct mediation conference on 08 August 2022, through the sincere effort of the parties to arrive at an amicable resolution of their dispute, they were able to execute a Mediated Settlement Agreement (MSA) on 05 August 2022.13 In the MSA, the parties agreed, among others, that:
-
The Complainant undertakes to pay Respondent the amount of Php 31,250.03. Complainant shall remit to Respondent ONE THOUSAND THREE HUNDRED TWO PESOS AND EIGHT CENTS (Php 1,302.08) per month for twenty-four (24) months starting September 2022 up to August 2024. The payment shall follow the usual process of paying the bank’s credit card transactions.
-
The Respondent undertakes (1) to furnish the Commission a copy of Complainant’s monthly statement of account as proof of compliance within ten (10) days from the billing’s due date, and (2) within ten (10) days after the end of the 24-month period, to issue a completion certificate or acknowledgement stating the payment of the full amount herein stated.14
Discussion
Rule III, Section (e)(3) of the Implementing Rules and Regulations of the Data Privacy Act of 2012 provides:
The Commission shall adjudicate on complaints and investigations on matters affecting personal data: Provided, that in resolving any complaint or investigation, except where amicable settlement is reached by the parties, the Commission shall act as collegial body. This includes:
xxx
- Facilitating or enabling settlement of complaints through the use of alternative dispute resolution processes, and adjudicating on matters affecting any personal data.15
(Emphasis Supplied)
The parties formally expressed their intention to mediate the case by filing their Application for Mediation dated 14 April 202216 and 20 April 2022,17 respectively. Pursuant to the Commission’s power to facilitate or to enable settlement of complaints through alternative dispute resolution processes,18 the parties were invited to a Mediation Conferences on 10 May 2022;19 07 June 2022;20 28 June 2022;21 12 July 2022;22 25 July 2022;23 01 August 2022;24 and 08 August 2022.25
Before the scheduled Mediation Conference on 08 August 2022,26 the parties agreed to settle their differences through the execution of an MSA dated 05 August 2022. The contents of the MSA were thoroughly explained to and understood by the parties.
After a thorough study and adjudication of the case, the Commission finds that the MSA dated 05 August 2022, executed by and between Complainant and Respondent is not contrary to law, public policy, morals, or good customs.
Thus, this Commission finds the executed MSA dated 05 August 2022, executed by and between Complainant and Respondent, as valid and enforceable. The parties are reminded to strictly observe its terms and conditions.
WHEREFORE, premises considered, this Commission resolves to CONFIRM the Mediated Settlement Agreement dated 05 August 2022 executed by and between the Complainant, JRC and Respondent, Bank of the Philippines Islands.
IN VIEW OF THE FOREGOING, the Enforcement Division (EnD) is enjoined to monitor the permanent deletion of personal information in relation to the remittances after the lapse of the data retention period.
Further, the EnD is directed to require Respondent to submit within ten (10) days from receipt of the Resolution the monthly due date of Complainant’s credit card.
SO ORDERED.
City of Pasay, Philippines. 19 August 2022.
JOHN HENRY D. NAGA Privacy Commissioner
WE CONCUR:
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
DUG CHRISTOPER B. MAH Deputy Privacy Commissioner
Copy furnished:
JRC Complainant
BPI LEGAL AFFAIRS AND DISPUTE RESOLUTION DIVISION Counsel for Respondent Attn: BDN
LEGAL DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT
Footnotes
-
Complaints Assisted Form dated 02 September 2021. ↩
-
Id. ↩
-
Application for Mediation of Complainant dated 14 April 2022. ↩
-
Application for Mediation of Respondent dated 20 April 2022. ↩
-
Order to Mediate dated 25 April 2022. ↩
-
Order to Mediate dated 31 May 2022. ↩
-
Order to Mediate dated 07 June 2022. ↩
-
Order to Mediate dated 28 June 2022. ↩
-
Order to Mediate dated 12 July 2022. ↩
-
Order to Mediate dated 25 July 2022. ↩
-
Order to Mediate dated 01 August 2022. ↩
-
Supra Note 10. ↩
-
Mediated Settlement Agreement dated 05 August 2022. ↩
-
Id. at pages 1–2. ↩
-
Rule III, Section (e)(3) of the Implementing Rules and Regulations of the Data Privacy Act of 2012. ↩
-
Application for Mediation of Complainant dated 14 April 2022. ↩
-
Application for Mediation of Respondent dated 20 April 2022. ↩
-
Supra Note 8. ↩
-
Supra Note 5. ↩
-
Supra Note 6. ↩
-
Supra Note 7. ↩
-
Supra Note 8. ↩
-
Supra Note 9. ↩
-
Supra Note 10. ↩
-
Supra Note 11. ↩
-
Id. ↩