NPC Issuance Wiki

CID CDO 22-001: CID vs. PH-Check.com

Issued Resolution

Resolution Text

COMPLAINTS AND INVESTIGATION DIVISION – NATIONAL PRIVACY COMMISSION,

Complainant,

-versus-

PH-CHECK.COM,

Respondent.

x----------------------------------------------------x

Before the Commission is the Application for Issuance of Cease and Desist Order dated 16 August 2022 (CDO Application) of the Complaints and Investigation Division (CID) of the National Privacy Commission (NPC). The CDO Application is against PH-Check.com (https://ph-check.com) for violation of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA). The PH-Check.com website contains personal data and other information found in the Business Name Registration System (BNRS) website of the Department of Trade and Industry (DTI).

Facts

On 19 January 2022, the DTI endorsed to the CID an e-mail from ASA dated 14 January 2022.1 The endorsement stated that ASA reported a website with address https://ph-check.com/ to the DTI and requested that a demand letter be sent to the web site in order for it “to stop scraping information” from DTI’s website.2

According to ASA, if he searches his full name on Google, then his DTI business details would appear at the top of the search under PH-Check.com.3 ASA further stated that his data should only be available on DTI’s portal and repository and thus, requested that the DTI developers “stop web scraping from [third] party sites.”4

The CID issued its Initial Report dated 21 January 2022 (Initial Report). As explained by the CID:

The [DTI] is a government agency established to address local industry and foreign trade growth. In compliance with Republic Act 38831 as amended, and its Implementing Rules and Regulations, and to facilitate ease of registration, DTI established the online Business Name Registration System (BNRS).[.]

The BNRS Next Gen is a web-based portal that allows end-to-end registration of business name (BN) for sole proprietors. To make BN registration more convenient, applicants may submit applications, pay fees and download their Certificate of BN registration through the BNRS Next Gen. It also contains publicly available information about DTI-registered BNs that will help both the public and other government agencies check the validity of a particular BN.5

The CID also provided the following observations in the Initial Report:

  1. A google search of the name ‘ASA’ will show a result that links his name to ‘STI’ [ANNEX C].

  2. The CID QRSC team investigated the website ‘https://ph-check.com/’ and found out that in the homepage of the website, a total of 30 Business Names were listed. [ANNEX D]. Using the website search engine, it will also generate business names not initially listed on its home page.

  3. A search for the business name ‘STI’ will show that it is listed in the website [ANNEX E] and upon clicking the name, will reveal the following business name information: [ANNEX F] a. Name b. Status c. Type of Entity d. Business Scope e. Business Territory f. Certificate No./BNN g. Registration Date h. Owners/Directors Name and Designation i. Additional info: Since Registration

  4. A search for the word ‘ABC’ would display all the business names that starts with the word ‘ABC’ [ANNEX G]. When the listed business name is clicked, such as the displayed business name ‘ABC - ABCFP’, the website will redirect to a page where it displays more information like: [ANNEX H] a. Name b. Status c. Type of Entity d. Business Scope e. Business Territory f. Certificate No./BNN g. Registration Date h. Owners/Directors Name and Designation i. Additional info: Since Registration

  5. In both searches, the pages has a Contact Details Table that is editable. When the team tried to input a dummy contact detail and then click submit, the website replies with a message ‘Thank you! Your information will appear after being reviewed by a moderator’. [ANNEX I]

  6. The website https://ph-check.com/ is devoid of any information pertaining to the company or its owner and has no privacy notice. [ANNEX J]

  7. The CID QRSC team also visited the DTI BNRS website and tried to search the Business Name ‘STI’ and found out that it displays the same information as found in the website https://ph-check.com/.[.]

xxx

  1. The business name ‘ABC -ABCFP was also checked and similarly, it displays the same information [.]

xxx

Based on the foregoing, it shows that the website https://ph-check.com/ is scraping business name information which is made publicly available by DTI through its website https://bnrs.dti.gov.ph/.[^6]

The CID wrote a letter dated 21 January 2022 to the DTI detailing that based on its initial investigation, PH-Check.com scrapes data from the BNRS website.6

On 07 February 2022, a complaint by KGU was received by the DTI against PH-Check.com, who also requested for the removal of her information from the website.7 In her complaint, KGU stated that the website “contains information about Philippine companies (Name, Status, Business Scope, Business Territory, Certificate Number/BNN, Registration Date and Time, as well as the Full Name of the Owner).”8 KGU also stated that “when [her] full name is searched on Google, all [her] business details appear together with [her] full name on PH-Check.com.”9

To prove her claims, KGU provided screenshots of: 1) her information found in the BNRS website, 2) the Google search results, and 3) her information found in PH-Check.com.10

KGU also noted that PH-Check.com does not contain any contact or owner information, and indicated her lack of consent to the sharing of her information:

PH-Check.com does not contain contact nor owner information.

I also did not give permission for my information to be shared to third party websites and to be made available elsewhere. DTI’s data privacy notice reads:

xxx

The reproduction of my information in PH-Check.com are not warranted by the conditions above, unless the DTI has a data sharing agreement with this website. It is not even a licensing agency nor an entity which facilitates business registration-related transactions.11

In this regard, I would like to: (1) complain against the proprietor of PH-Check.com for replicating my personal information without my consent and (2) request for the removal of my personal data from this website.11

The DTI replied to KGU in a letter dated 08 February 2022.12 In the letter, the DTI informed KGU that it has endorsed her complaint to the NPC.13 Further, the DTI stated:

We have taken note of your request the removal of your information on the site PH.check.com. We wish to note however that this is a third-party site and not affiliated with the DTI.

xxx

We wish to likewise note your observation that data from PH-check.com is similar with the information displayed in the public domain of the DTI Business Name Search database. Please be informed however that the DTI does not have an existing partnership or agreement with PH-Check.com, nor has DTI given permission to publish information such as Name, Status, Business Scope, Business Territory, etc. as well as the full name of the owner.14

Subsequently, in a Notice to Explain dated 16 February 2022, the CID required the Owner/Administrator of PH-check.com to submit an explanation as to why it should not be liable for violating the DPA15 since it had received complaints against the website for disclosing “public [personal] information and sensitive personal information.”16 The Notice to Explain was sent to the following emails: ph-check.com-owner-zjoj@customers.whoisprivacycorp.com, ph-check.com-admin-tl17@customers.whoisprivacycorp.com, and ph-check.com-tech-3ysl@customers.whoisprivacycorp.com.17 The said e-mails were obtained after accessing the website https://who.is/whois/ph-check.com where the Registrar Data provided the contact information since the website PH-check.com had no information pertaining to the website’s owner.18

However, as of date, PH-Check.com failed to respond to the Notice to Explain issued by the Commission.

In a Supplemental Report dated 05 July 2022 (Supplemental Report), the CID further alleged:

Based on the investigation, it shows that the disclosure of DTI of personal information in its website is pursuant to Act No. 38883 and DAO 18-07, with an undertaking and consent from the data subject to make such information publicly available.

As for the website https://ph-check.com/, it has not complied with the [Notice to Explain]. A perusal of the website would show that it does not contain any Privacy Policy or any statement as to the purpose of the website, in violation of the general data privacy principles of transparency, legitimate purpose, and proportionality.

xxx

Moreover, the owners/administrators took means to hide their identity and did not provide any contact details, making it difficult for data subjects to exercise their rights to their personal information, contrary to the requirements set forth in Section 16 of the DPA[.]

xxx

The data scraping activity of the website https://ph-check.com and its deliberate intent to hide the identity of its owner or contact details of its administrators is a clear violation of Sections 11 and 16 of the DPA, which is detrimental to public interest and unless restrained, will cause grave and irreparable injury to a data subject. It is worth noting that as of date, two (2) individuals have already complained regarding this matter.19

The Supplemental Report recommended that an Application for Cease and Desist Order (CDO) be filed against PH-Check.com.20

Subsequently, in a Technical Report dated 26 July 2022 (Technical Report), the CID stated that based on its examination, “the data is not directly being harvested by the website from the API of bnrs.dti.gov.ph and did not find any website link of the DTI during this interception.”21 However, the CID noted that it was possible that “a separate web crawler is being used by the [PH-Check.com] website to populate its database causing the data mining to be hidden even when intercepting data from the main website.”22

Thereafter, the CID filed its CDO Application, praying that a CDO be issued against PH-Check.com “in order to preserve and protect public interest and the right of the data subjects.”23

Issue

Whether to grant the CDO Application of the CID.

Discussion

The Commission finds that there are sufficient grounds for the issuance of a CDO against PH-Check.com.

First, the Commission has jurisdiction over the activities of PH-Check.com in relation to privacy matters. PH-Check.com is considered a personal information controller (PIC) that processes personal data.

Under the DPA, personal information is defined as “any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.”24 Sensitive personal information is a subset of personal information which includes information “[i]ssued by government agencies peculiar to an individual.”25

Here, the information displayed on the website include the first name, middle name, and last name of the owner or director who is registered in the DTI’s BNRS.26 Other details found in the website include the DTI Certificate Number or Business Name Number (BNN), status, type of entity, business scope, business territory, and registration date.27 There are also fields in the website which allow anyone to provide the address, phone number, and website or email address of the business.28

Thus, there are personal data displayed on PH-Check.com that can be classified as personal information.

Next, processing is defined in the DPA as “any operation or any set of operations performed upon personal information including, but not limited to, collection, recording, organization, storage…use [and] consolidation” of personal data.29 Meanwhile, a PIC “refers to a person or organization who controls the collection, holding, processing or use of personal information.”30

In its CDO Application, the CID alleged that PH-Check.com collected “data from [the] DTI[‘s] BNRS [website] and displayed it in its website.”31 These actions thus fall under the definition of processing defined in the DPA.

PH-Check.com is also a PIC given that it is the one that has control over the collection of the personal data displayed. Control is present when a “natural or juridical person or any other body decides on what information is collected, or the purpose or extent of its processing.”32

Given that PH-Check.com is a PIC, it is responsible for personal data under its custody or control. Indeed, its “About Us” page states that “PH-Check provides information about Philippines companies. The information is gathered from Philippines public records and Government Data. We try to keep all information up to date.”33

Given these circumstances, PH-Check.com, as a PIC, has obligations under the DPA, its Implementing Rules and Regulations (IRR), and related NPC issuances.

The Commission also has the correlative duty to ensure that PICs, like PH-Check.com, comply with the law. This duty includes taking necessary steps to protect and uphold the rights of data subjects, such as the issuance of a CDO when needed.

Section 7(c) of the DPA provides for the power of the Commission to issue CDOs:

Section 7. Functions of the National Privacy Commission. – To administer and implement the provisions of this Act, and to monitor and ensure compliance of the country with international standards set for data protection, there is hereby created an independent body to be known as the National Privacy Commission, which shall have the following functions:

xxx

(c) Issue cease and desist orders, impose a temporary or permanent ban on the processing personal information, upon finding that the processing will be detrimental to national security and public interest.34

As part of its rule-making power and to flesh out its power to issue CDOs, the Commission issued NPC Circular No. 2020-02, also known as the Rules on the Issuance of Cease and Desist Orders (NPC Circular No. 20-02).

Rule II, Section 5 of the same Circular provides for the filing of a CDO Application:

Section 5. Filing of Application. – An action for the issuance of a CDO may be commenced upon the filing with the Commission of an application in writing, verified and under oath, by any of the following applicants:

A. the CID, through its sua sponte investigation or the CMD through its conduct of compliance checks and handling of breach notifications, if there is a finding that the grounds for the issuance of the CDO are present; or

B. the Aggrieved Party, either attached to a complaint or as an independent action, with payment of filing fees in accordance with the Rules of Procedure of the NPC, and upon recommendation by the CID after its assessment that the application is sufficient in form and substance.35

The Commission finds that the CID is the proper party to file the CDO application since it conducted a sua sponte investigation in relation to PH-Check.com after receiving complaints endorsed by the DTI. The results of the investigation are documented in the CID’s Initial Report, Supplemental Report, and Technical Report.

The CID provided the following arguments in its CDO Application: 1) PH-Check.com is doing some act or practice that is in violation of the DPA and its IRR,36 2) PH-Check.com is considered an “unknown [(PIC)]”,37 3) PH-Check.com’s act is detrimental to the public interest which would warrant a CDO to protect and preserve the data subjects’ rights,38 4) unless restrained, PH-Check.com’s existence “will cause grave and irreparable injury to the data subjects”,39 and 5) substantial evidence exists for the concurrence of all the grounds to issue a CDO.40

The CID in its Application alleged that the quantum of proof to warrant the issuance of a CDO is substantial evidence,41 or “that amount of relevant evidence that a reasonable mind might accept as adequate to support a conclusion.”42

Rule II, Section 4 of NPC Circular No. 20-02 provides for the grounds for the issuance of CDO:

Section 4. Grounds for the Issuance of Cease and Desist Order. – No CDO shall be issued unless it is established by substantial evidence that all of the following concur:

A. the Adverse Party is doing, threatening or is about to do, is procuring to be done, some act or practice in violation of the DPA, its IRR, or other related issuances;

B. such act or practice is detrimental to national security or public interest, or the CDO is necessary to preserve and protect the rights of a data subject; and

C. the commission or continuance of such act or practice, unless restrained, will cause grave and irreparable injury to a data subject.43

The Commission finds that the CDO against PH-Check.com be issued since the grounds provided in NPC Circular No. 2020-02 have been met.

I. PH-Check.com is doing some act or practice in violation of Section 11 (General Data Privacy Principles) and Section 16 (Rights of the Data Subject) of the DPA.

The CID argued that PH-Check.com does not adhere to the general data privacy principles in the DPA:

One of the means to show that a PIC complies with the data privacy principles is through the posting of a Privacy Notice that apprises the data subject on the collection, use, purpose, retention, disclosure, and disposal of personal data. The use of a [P]rivacy [N]otice is pursuant to the transparency principle of the DPA in the processing of personal data, which demands that data subjects are afforded a reasonable amount of information about the data processing system of a PIC in possession of their personal information. This is absent in this case.

It also appears that the purpose of Ph-Check.com for processing the scraped personal information is not clear. ‘The processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy.’ This requirement on legitimate purpose is thus not met.

On the matter regarding proportionality, ‘the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not be reasonably be fulfilled by other means.’ As discussed, there is nothing in the website to show the purposes in processing the scraped personal data. Hence, it could not be determined if the processing done by Ph-Check.com is proportionate to its purpose.

Based on the foregoing, it is apparent that Ph-check.com scrapes publicly available information from DTI BNRS, has no privacy policy sufficient to inform the data subjects of the processing of their personal information, has hidden the identity of its owners or administrators, and has no means for data subjects to exercise their rights under the DPA. As such, it is evident that Ph-check.com is violating the general data privacy principles of transparency, legitimate purpose, and proportionality under Section 11 [of the DPA.]44

The CID also claimed that the rights of data subjects in Section 16 of the DPA are being violated, particularly the right to erasure:

As already complained by at least two affected data subjects, there is no means in the website for a data subject to request for removal of personal data or exercise any of the data subject rights. This is a patent disregard of Section 16 of the DPA.45

A PIC has the obligation to adhere to the DPA’s general data privacy principles of transparency, legitimate purpose and proportionality.46

Under Section 18 of the IRR of the DPA:

Section 18. Principles of Transparency, Legitimate Purpose and Proportionality. The processing of personal data shall be allowed subject to adherence to the principles of transparency, legitimate purpose, and proportionality.

a. Transparency. The data subject must be aware of the nature, purpose, and extent of the processing of his or her personal data, including the risks and safeguards involved, the identity of personal information controller, his or her rights as a data subject, and how these can be exercised. Any information and communication relating to the processing of personal data should be easy to access and understand, using clear and plain language.

b. Legitimate purpose. The processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy.

c. Proportionality. The processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.47

The CID’s investigation revealed that there is no privacy notice on the website, and no other mechanism by which data subjects may be informed on how they will be able to exercise their data privacy rights.

The website does not also provide who the owner, administrator, or Data Protection Officer is.48 The CID attached in its Initial Report, a screenshot of the website https://who.is/whois/ph-check.com showing that PH-Check.com does not provide the contact information of the company or its owner and that the website does not contain any privacy notice.49 These circumstances provide adequate bases to find that there is a violation of the transparency principle.

The purpose for gathering personal data from the DTI BNRS website is also unclear. To adhere to the legitimate purpose principle, it is required that the PIC actually declares and specifies its purpose which should not be contrary to law, morals or public policy.50 Here, PH-Check.com provides no declared purpose other than merely stating that it provides information to the public about Philippine companies.51 After a review of the evidence presented, the Commission finds that there is substantial evidence to issue the CDO.

It has been established from the submissions that PH-Check.com scrapes the personal information from DTI BNRS52 and no purpose for the same has been established in the website.53 Moreover, it has been found that no available information as to the owner or administrator can be seen on the website based on the Initial Report of the CID.54

Other than the website itself and the fact that it contained scraped information from the DTI’s website, the CID did not find any other information. The Commission is constrained to find that there is insufficient evidence to determine whether the processing done was proportionate to any purpose of PH-Check.com.

There is also substantial evidence to find that the rights of the data subjects to be informed and erasure are being violated. The NPC, through the DTI, received complaints against PH-Check.com, requesting the latter to stop scraping the personal information and remove the personal data from the website.55 Indeed, the data subjects’ right to information and the right to erasure are not being upheld since there is no privacy notice or available mechanism for data subjects to interact with the PIC for the effective exercise of their rights.

As to the right to information, it has already been established that PH-Check.com scrapes its information from the DTI website.56 The data subjects were not informed that their personal information would be displayed and available on PH-Check’s website. The right to information of the data subject was not sustained by PH-Check.com for failure to post privacy notice and to furnish the data subjects with necessary information before the processing or at the next practical opportunity. As to the right to erasure, PH-Check’s website failed to provide the contact information of the owners/administrators in order for the data subject to request erasure of its data. Thus, the data subjects has no means to raise and request their right to erasure.

The non-adherence to the data subject’s right to information and erasure were expressed by KGU in her complaint before DTI when she stated that she “did not give permission for [her] information to be shared to third party websites and to be made available elsewhere.”57 KGU also had to request the DTI for the removal of her personal data from PH-Check.com. This meant that PH-Check.com could not effectively facilitate her right to erasure.

Thus, the CDO Application provides substantial evidence for the existence of the first ground in that PH-Check.com is doing some act or practice in violation of the DPA, its IRR, and other related issuances.

II. PH-Check.com’s act or practice is detrimental to the public interest, and a CDO is necessary to preserve and protect the rights of the data subjects.

The second ground is likewise present since the processing is detrimental to the public’s interests, and a CDO is required for the preservation and protection of the rights of the data subjects.

There does not seem to be any public benefit in the duplication and disclosure of information, including personal data, in PH-Check.com. These information are already found in the DTI’s BNRS website.

On the contrary, there are concrete harms that warrant the protection of the data subject. PH-Check.com allows anyone from the public to “edit” the information on the site. From the CID’s investigation, the website contains blank fields pertaining to the address, phone number, and website or email.58 Thus, anyone can enter information regarding these information without any security measure or verification on their accuracy. This may lead to either unauthorized, or even false, disclosure of details linked to the sole proprietor registered with the DTI through the BNRS.

The existence of a website that scrapes the data of sole proprietors and allows for an opportunity to provide false information does not serve the public’s interest. There is substantial evidence to find that a CDO must be issued to preserve the rights of data subjects.

It has been established in the CID’s Initial Report59 and Supplemental Report60 that PH-Check.com was scraping information from DTI’s BNRS website.61 Further, the website is not adherent to the data privacy principles since it does not contain any information as to its purpose in the processing of personal information, nor does it have any privacy notice to apprise the data subjects of their rights.62 Lastly, since anyone can “edit” the information on the site, the public can be deceived as to the available information on PH-check.com’s website.63

The continued processing of PH-check.com is detrimental to the public interest since making the personal information publicly available on its website without compliance with the DPA may be harmful to the data subjects.

III. The commission or continuance of PH-Check.com’s acts, unless restrained, will cause grave and irreparable injury to data subjects.

On the third ground, the CID argued:

The Ph-Check.com website is still active as of this date and its continued existence poses a threat to the personal data collected that can be used for fraudulent means like identity theft, phishing, text blasting, marketing, or other unlawful purposes.

The fact that the website failed to disclose its identity and does not provide data subjects a means to exercise their rights provided under the DPA is proof that the collected personal information is exposed to acts beyond the knowledge and consent of the data subject.

To make matters worse, there is practically no means to hold anyone accountable for any damage done arising from Ph-Check.com’s processing of personal information. Ph-Check.com does not even reply to a Notice to Explain (NTE) issued by this Commission; how much more when it is to be held accountable for damages caused upon an affected data subject?

Allowing Ph-Check.com to continue its operations increases the risk of exposing the personal data to other grave and irreparable damage and/or injury.64

The Commission notes that the owner or administrator of PH-Check.com did not reply to the CID’s Notice to Explain. There is also substantial evidence, as discussed, to show that the website’s existence may be a vehicle for unlawful purposes, such as false information and identity theft.

It should be emphasized that even DTI itself disclaimed any connection or affiliation with the website. It “does not have an existing partnership or agreement with PH-Check.com, nor has DTI given permission to publish information such as Name, Status, Business Scope, Business Territory, etc. as well as the full name of the owner.”65

Based on the evidence provided, there are several risks that may cause grave and irreparable injury to data subjects. First, as discussed, there is no apparent purpose for the collection of personal data. Second, there is no contact information of the website’s data protection officer (DPO) or owner. Third, PH-Check.com was given an opportunity to explain why the person or entities should not be held liable for violating the DPA, but nevertheless failed to respond to the Notice to Explain by the Commission. Fourth, as discussed, the Commission cannot determine whether the processing complies with the general data privacy principles.

The circumstances point to a possible violation of the DPA, compounded with the fact that data subjects have no proper recourse to the PIC. Thus, the Commission must issue a CDO.

An essential purpose of the DPA is to protect and uphold the rights of the data subjects. Therefore, to avoid grave or irreparable injury to the affected data subjects, PH-Check.com should cease and desist from processing personal data on its website.

WHEREFORE, premises considered, PH-Check.com (https://ph-check.com) is hereby ordered to:

  1. CEASE AND DESIST from the processing of personal data on its website, including the collection and display of personal data on its website, pursuant to Section 8 of NPC Circular No. 2020-02; and

  2. SUBMIT its COMMENT, within ten (10) days from receipt of this Order, on the allegations in the attached Application for Issuances of Cease and Desist Order dated 16 August 2022, pursuant to Section 9 of NPC Circular No. 2020-02.

The National Telecommunications Commission is hereby instructed to take down the website of PH-Check.com immediately upon receipt of this Order.

The Cease and Desist Order shall be immediately executory and enforceable upon the receipt of this Order, through email, by PH-Check.com.

SO ORDERED.

City of Pasay, Philippines. 22 September 2022.

JOHN HENRY D. NAGA Privacy Commissioner

I CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

Copy furnished:

THE OWNER/ADMINISTRATOR Respondent

PH-check.com

ph-check.com-owner-zjoj@customers.whoisprivacycorp.com

ph-check.com-admin-tl17@customers.whoisprivacycorp.com

ph-check.com-tech-3ysl@customers.whoisprivacycorp.com

PMA Data Protection Officer

Department of Trade and Industry

NATIONAL TELECOMMUNICATIONS COMMISSION BIR Road, East Triangle, Diliman, Quezon City, Metro Manila, Philippines

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Department of Trade and Industry (DTI) Endorsement Letter dated 19 January 2022; Initial Report dated 21 January 2022 of the Complaints and Investigation Division, Annex “A”. ↩

  2. Department of Trade and Industry (DTI) Endorsement Letter dated 19 January 2022; Initial Report dated 21 January 2022 of the Complaints and Investigation Division, Annex “A”. ↩

  3. Electronic mail dated 14 January 2022 of ASA; Initial Report dated 21 January 2022 of the Complaints and Investigation Division, Annex “B”. ↩

  4. Electronic mail dated 14 January 2022 of ASA; Initial Report dated 21 January 2022 of the Complaints and Investigation Division, Annex “B”. ↩

  5. Complaints and Investigation Division (CID) Initial Report dated 21 January 2022, at pp. 2-3. ↩

  6. Letter dated 21 January 2022 of the Complaints and Investigation Division, at p. 1. ↩

  7. Letter dated 07 February 2022 of KGU, at p. 3. ↩

  8. Letter dated 07 February 2022 of KGU, at p. 1. ↩

  9. Letter dated 07 February 2022 of KGU, at p. 2. ↩

  10. Letter dated 07 February 2022 of KGU, at pp. 1-3. ↩

  11. Letter dated 07 February 2022 of KGU, at p. 3. ↩ ↩2

  12. Letter dated 08 February 2022 of the Department of Trade and Industry. ↩

  13. Letter dated 08 February 2022 of the Department of Trade and Industry. ↩

  14. Letter dated 08 February 2022 of the Department of Trade and Industry. ↩

  15. Notice to Explain dated 16 February 2022 of the Complaints and Investigation Division. ↩

  16. Notice to Explain dated 16 February 2022 of the Complaints and Investigation Division. ↩

  17. Notice to Explain dated 16 February 2022 of the Complaints and Investigation Division. ↩

  18. Complaints and Investigation Division (CID) Initial Report dated 21 January 2022, at p. 2; See: Annex “J”. ↩

  19. Supplemental Report dated 05 July 2022 of the Complaints and Investigation Division, at pp. 2-4. ↩

  20. Supplemental Report dated 05 July 2022 of the Complaints and Investigation Division, at p. 4. ↩

  21. Technical Report dated 26 July 2022 of the Complaints and Investigation Division, at p. 1. ↩

  22. Technical Report dated 26 July 2022 of the Complaints and Investigation Division, at p. 1. ↩

  23. Application for Issuance of Cease and Desist Order dated 16 August 2022 of the Complaints and Investigation Division, at p. 8. ↩

  24. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes (Data Privacy Act of 2012), Republic Act No. 10173, chapter I, § 3 (g) (2012) (Data Privacy Act of 2012). ↩

  25. Data Privacy Act of 2012, chapter I, § 3 (l) (2012). ↩

  26. Complaints and Investigation Division, Application for Issuance of Cease and Desist Order dated 16 August 2022, at p. 1; See Initial Report dated 21 January 2022, Annex “F”. ↩

  27. Initial Report dated 21 January 2022 of the Complaints and Investigation Division, Annex “F”. ↩

  28. Initial Report dated 21 January 2022 of the Complaints and Investigation Division, Annex “F”. ↩

  29. Data Privacy Act of 2012, chapter I, § 3 (j) (2012). ↩

  30. Data Privacy Act of 2012, chapter I, § 3 (h) (2012). ↩

  31. Application for Issuance of Cease and Desist Order dated 16 August 2022 of the Complaints and Investigation Division, at p. 3. ↩

  32. National Privacy Commission, Implementing Rules and Regulations of the Data Privacy Act of 2012, rule I, § 3 (m) (2016) (IRR of the DPA). ↩

  33. Application for Issuance of Cease and Desist Order dated 16 August 2022 of the Complaints and Investigation Division, at p. 3. ↩

  34. Data Privacy Act of 2012, chapter II, § 7 (C) (2012). ↩

  35. Rules on the Issuance of Cease and Desist Order, rule II, § 5. ↩

  36. Application for Issuance of Cease and Desist Order dated 16 August 2022 of the Complaints and Investigation Division, at p. 3. ↩

  37. Application for Issuance of Cease and Desist Order dated 16 August 2022 of the Complaints and Investigation Division, at p. 3. ↩

  38. Application for Issuance of Cease and Desist Order dated 16 August 2022 of the Complaints and Investigation Division, at p. 6. ↩

  39. Application for Issuance of Cease and Desist Order dated 16 August 2022 of the Complaints and Investigation Division, at p. 7. ↩

  40. Application for Issuance of Cease and Desist Order dated 16 August 2022 of the Complaints and Investigation Division, at pp. 7-8. ↩

  41. Application for Issuance of Cease and Desist Order dated 16 August 2022 of the Complaints and Investigation Division, at p. 6. ↩

  42. De Jesus v. Guerrero III, G.R. No. 171491, 04 September 2009. ↩

  43. National Privacy Commission, Rules on the Issuance of Cease and Desist Orders of the National Privacy Commission, NPC Circular No. 2020-02, rule II, § 4 (06 October 2020) (Rules on the Issuance of Cease and Desist Order). ↩

  44. Application for Issuance of Cease and Desist Order dated 16 August 2022 of the Complaints and Investigation Division, at pp. 4-5. ↩

  45. Application for Issuance of Cease and Desist Order dated 16 August 2022 of the Complaints and Investigation Division, at p. 6. ↩

  46. Data Privacy Act of 2012, chapter III, § 11. ↩

  47. IRR of the DPA, rule IV, § 18. ↩

  48. Application for Issuance of Cease and Desist Order dated 16 August 2022 of the Complaints and Investigation Division, at p. 5. ↩

  49. Complaints and Investigation Division (CID) Initial Report dated 21 January 2022, Annex “J”. ↩

  50. IRR of the DPA, rule IV, § 18 (b). ↩

  51. Application for Issuance of Cease and Desist Order dated 16 August 2022 of the Complaints and Investigation Division, at p. 3. ↩

  52. Application for Issuance of Cease and Desist Order dated 16 August 2022 of the Complaints and Investigation Division, at p. 3. ↩

  53. Application for Issuance of Cease and Desist Order dated 16 August 2022 of the Complaints and Investigation Division, at p. 5. ↩

  54. Complaints and Investigation Division (CID) Initial Report dated 21 January 2022, Annex “J”. ↩

  55. Electronic mail dated 14 January 2022 of ASA; See Initial Report dated 21 January 2022 of the Complaints and Investigation Division, Annex “B”; Letter dated 07 February 2022 of KGU. ↩

  56. Application for Issuance of Cease and Desist Order dated 16 August 2022 of the Complaints and Investigation Division, at p. 3. ↩

  57. Letter dated 07 February 2022 of KGU, at p. 3. ↩

  58. Application for Issuance of Cease and Desist Order dated 16 August 2022 of the Complaints and Investigation Division, at p. 3. ↩

  59. Complaints and Investigation Division (CID) Initial Report dated 21 January 2022. ↩

  60. Supplemental Report dated 05 July 2022 of the Complaints and Investigation Division. ↩

  61. Supplemental Report dated 05 July 2022 of the Complaints and Investigation Division, at p. 1. ↩

  62. Complaints and Investigation Division (CID) Initial Report dated 21 January 2022, See: Annex “J”. ↩

  63. Application for Issuance of Cease and Desist Order dated 16 August 2022 of the Complaints and Investigation Division, at p. 3. ↩

  64. Application for Issuance of Cease and Desist Order dated 16 August 2022 of the Complaints and Investigation Division, at p. 7. ↩

  65. Letter dated 08 February 2022 of the Department of Trade and Industry. ↩

Backlinks

  • No backlinks found