NPC Issuance Wiki

NPC SS 21-008: In Re: Populus Lending Corporation (Pesopop) and its Responsible Officers

Issued Resolution

Resolution Text

IN RE: POPULUS LENDING CORPORATION (PESOPOP) AND ITS RESPONSIBLE OFFICERS

INITIATED AS A SUA SPONTE NPC INVESTIGATION INTO THE POSSIBLE DATA PRIVACY VIOLATIONS COMMITTED BY POPULUS LENDING CORPORATION (PESOPOP)

x----------------------------------------------------x

AGUIRRE, D.P.C.;

This refers to the Temporary Ban on the processing of personal data issued against Populus Lending Corporation, the owners and operator of the online lending application, Pesopop, and its responsible officers (Pesopop) in an Order dated 12 August 2021.

Facts

On 12 August 2021, the Commission issued an Order imposing a Temporary Ban on the processing of personal data against Pesopop in relation to its online lending application:

WHEREFORE, all these premises considered, this Commission

GRANTS the Application for Temporary Ban on the processing of personal data filed by the Complaints and Investigation Division (CID) of the National Privacy Commission. A

TEMPORARY BAN ON PROCESSING OF PERSONAL DATA

is hereby issued against Respondent Populus Lending Corporation, as the operator of the online lending application, Pesopop.

Further, pursuant to the TEMPORARY BAN, Respondent Populus Lending Corporation shall:

  1. Immediately take down its online lending application, Pesopop, to ensure that it is no longer available for download, installation or use by data subjects; and

  2. Stop personal data processing activities, including those activities outsourced to third parties, where the processing operations involves use of information from the phonebook, directory, and contact list of data subjects, disclosure of false or unwarranted information, and other unduly intrusive personal data processing methods.

The TEMPORARY BAN ON PROCESSING OF PERSONAL DATA shall remain in effect until the final resolution of the sua sponte investigation against Respondent and its responsible officers.

Let copies of this Order be furnished to the National Telecommunications Commission for their appropriate action, and Google LLC, which operates the Google Play Store for its compliance in accordance with the terms and conditions of its platform.

Furthermore, Respondent Populus Lending Corporation and its responsible officers are ORDERED, within ten (10) days from receipt of this Order, to file a COMMENT on the allegations in the attached Fact-Finding Report, pursuant to Section 6 of Rule X of NPC Circular No. 2021-01 (2021 NPC Rules of Procedure).

In case of failure by the Respondent and its responsible officers to file a Comment, this case shall be deemed submitted for resolution based on the evidence on record.

The proceedings before the Commission based on the Fact-Finding Report of the CID, which serves as the Complaint against Respondent Populus Lending Corporation and its responsible officers, will now resume, pursuant to Section 2, Rule IX of the 2021 NPC Rules of Procedure.

SO ORDERED.1

On 03 September 2021, Pesopop, through its counsel Zosa & Quijano Law Offices, filed a Notice of Entry of Appearance with Motion for Reconsideration.2

In its Motion for Reconsideration, Pesopop manifested that it shall be deemed as its Comment on the allegation in the Fact-Finding Report in compliance with the Order dated 12 August 2021.3 Pesopop prayed:

WHEREFORE, premises considered, the respondents respectfully prays that this Honorable Commission to:

  1. Note the entry of appearance of the undersigned counsel;

  2. GRANT the instant motion RECONSIDER AND SET-ASIDE the order dated 12 August 2021; and

  3. ISSUE a new order cancelling the temporary ban for being void ab initio;

  4. DISMISS the complaint as regards the individual respondents for lack of participation and evidence of direct participation;

  5. ALLOW respondent Pesopop reasonable time to comply and amend its data privacy terms and conditions to conform to the Data Privacy Act of 2021, rules and regulations and all issuance of this Honorable Commission.

Other reliefs, just and equitable under the premises are likewise prayed for.4

On 17 September 2021, the Commission issued an Order directing Pesopop to appear in a Clarificatory Hearing scheduled on 28 September 2021.5 During the Clarificatory Hearing, the Commission ordered Pesopop to submit the following compliance documents:

  1. Revised Privacy Policy of Pesopop;

  2. Revised Terms and Conditions or Terms of Service of Pesopop;

  3. Revised Pesopop application;

  4. Company Profile and a discussion of the business model of the Corporation;

  5. An explanation of the discrepancy between Counsel’s representations in the Motion for Reconsideration on the access to the phone contact list and the Privacy Policy dated 10 September 2021;

  6. A technical explanation on the purpose of the code “android.permission.READ_CONTACTS”, which if enabled, gives the application permission to read the user’s contacts data;

  7. Collection Policy of the corporation;

  8. An Agreement between the corporation and its third party collection partners or agents;

  9. An Agreement between the corporation and its third-party payment partners;

  10. An explanation behind the drafting process of the Privacy Policy dated 10 September 2021;

  11. Privacy Manual; and

  12. Employee Manual, particularly on the provisions governing its employees’ conduct of collecting debt and collection and usage of personal information.6

The counsel of Pesopop manifested that he requires fifteen (15) days from 28 September 2020 to submit the compliance documents.7 Based on the counsel’s representations, the Commission issued an Order directing Pesopop to submit the compliance documents within a non-extendible period of fifteen (15) days from receipt of the Order.8

On 20 October 2021, Pesopop filed a Motion to Admit With Compliance (to the Order dated 28 September 2021).9 It manifested that it received the Order dated 28 September 2020 on 01 October 2021.10 It stated that the fifteen-day period was insufficient and that it needed more time to collate the compliance documents.11 It also submitted some of its compliance documents pursuant to the Order dated 28 September 2020.12

On 29 October 2021, the Enforcement Division (EnD) of the National Privacy Commission (NPC) determined that version 1.5.4 of the online lending application was available for download from Google Play, and download links to the online lending application were available on its official Facebook page though the “Use App” button, its website through the “Get it on Google Play” and “Download Pesopop now” buttons, and a QR Code.13

On 08 November 2021, the EnD sent a letter to Pesopop in relation to the availability of the online lending application despite the pendency of the Temporary Ban.14 The letter required Pesopop to explain within ten (10) days from its receipt of the letter the availability of the online lending application, and ordered it to immediately ensure that the online lending application is no longer available for download, installation, or use by the data subjects in any manner until the Temporary Ban is lifted.15

On 15 November 2021, Pesopop, through counsel, replied to the EnD.16

It informed the EnD that it filed its Motion for Reconsideration to the Order dated 12 August 2021, and that its Motion for Reconsideration shall be treated as its Motion to Lift the Temporary Ban.17 It also reiterated that the Temporary Ban is void ab initio since “it was filed motu proprio and that the same was issued without the required bond.”18

On 25 November 2021, the EnD issued a second letter to Pesopop pointing out that the online lending application was once again available on Google Play and ordered Pesopop to immediately ensure that the online lending application is no longer available for download.19 It also explained that the filing of the Motion of Reconsideration does not in any way lift or suspend the effectivity of the Temporary Ban.20

On 26 November 2021, the EnD verified that the online lending application was taken down from Google Play.21

On 06 December 2021, the EnD determined that version 1.5.5 of the online lending application was once again available for download from Google Play Store.22

On 28 December 2021, the EnD issued a third letter to Pesopop, which stated that version 1.5.5 of the online lending application was once again available for download on Google Play Store.23 Again, the EnD ordered Pesopop to immediately take down the online lending application from Google Play and ensure that it is no longer available for download, installation, or use by the data subjects.24

On 02 January 2022, Pesopop replied to the EnD and informed the EnD that it already removed the online lending application from Google Play.25 It explained that it had no intention to violate the Order dated 12 August 2021.26 It reiterated that the Temporary Ban is void ab initio and claimed that it exposes the Commission to liability for damages if the Temporary Ban is not lifted.27 It also prayed for the resolution of the pending Motion for Reconsideration.28

Discussion

The Commission recognizes that the Motion for Reconsideration shall serve as Pesopop’s Comment to the Fact-Finding Report in compliance with the Order dated 12 August 2021, and its Motion to Lift the Temporary Ban.

Be as it may, the Commission denies the Motion to Lift and maintains the Temporary Ban on Pesopop’s processing of personal data.

At the onset, the Commission notes that the period to submit the compliance documents lapsed on 15 October 2021. The Commission stresses that counsel himself requested a fifteen-day period counted from the Clarificatory Hearing on 28 September 2021 to submit the necessary compliance documents. In fact, the Commission already gave Pesopop significant time to submit the compliance documents by 15 October 2021 or fifteen (15) days from 01 October 2021, which is the date of Pesopop’s receipt of the Order dated 28 September 2021. Despite the additional period given to Pesopop, it still belatedly submitted its compliance documents on 20 October 2021 when the period to submit had already lapsed.29

Nevertheless, in the interest of fully assessing the issue at hand, the Commission admits and considered Pesopop’s compliance documents in its resolution to lift or maintain the Temporary Ban imposed in the Order dated 12 August 2021.

The Temporary Ban imposed on Pesopop is valid.

Contrary to Pesopop’s assertions in its Motion for Reconsideration and its 02 January 2022 letter, the Temporary Ban is not void ab initio. Pesopop maintains that the Temporary Ban is unwarranted because the Commission failed to satisfy the second and third requisites enumerated in Rule IX Section 3 of NPC Circular No. 20-01 or the 2021 NPC Rules of Procedure. For reference, the requisites are:

Section 3. Requisites for temporary ban. – A temporary ban on processing of personal data may be granted only when:

  1. it is necessary in order to preserve the rights of the complainant or to protect national security or public interest, or if it is necessary to preserve and protect the rights of data subjects;
  2. the motion shows facts entitling the complainant to the relief demanded;
  3. unless exempted from the payment of filing fees as provided for in these Rules, the complainant shall file with the NPC a bond in an amount to be fixed by the investigating officer executed in favor of the party or person so banned from processing personal data; and
  4. the parties are heard in a summary hearing.30

The requisites have been explained in the Order dated 12 August 2021. In response to Pesopop’s assertions in the Motion for Reconsideration, the Commission shall recapitulate why the second and third requisites have been satisfied.

As discussed in the Order dated 12 August 2021, the Fact-Finding Report with Application for the Issuance of a Temporary Ban (FFR) filed by the Complaints and Investigation Division (CID) of the NPC prayed for the imposition of a Temporary Ban against Pesopop.31 It alleged that undisclosed permissions that violate the right of the data subjects to be informed exist and merit the issuance of a temporary ban.32 Thus, the second requisite is satisfied.

Further, the Commission reiterates that the CID of the NPC initiated the Complaint through a sua sponte investigation under Rule X of the 2021 NPC Rules of Procedure.33 As such, the NPC, as a government agency, is exempt from filing fees and consequently, the bond for the application of Temporary Ban as stated in Rule II Section 4 (a) of the 2021 NPC Rules of Procedure.34 Thus, the third requisite is also satisfied.

Pesopop’s claim that the Order imposing the Temporary Ban was issued without authority is patently wrong. The Temporary Ban imposed on Pesopop’s processing of personal data is valid.

Pesopop has not sufficiently addressed the reasons for the issuance of the Temporary Ban.

Considering that the Order dated 12 August 2021 already discussed the existence of facts and circumstances necessitating the issuance of a Temporary Ban, Pesopop now has the burden to prove that the Temporary Ban imposed on the processing of personal data is no longer necessary. As such, it must show that the reasons behind the imposition of the Temporary Ban as stated in the Order dated 12 August 2021 no longer exist. This is determined based on its actions and submissions to the Commission.

In the Order dated 12 August 2021, the Commission directed Pesopop to immediately take down its online lending application to ensure that it is no longer available for download, installation, or use by its data subjects and to stop personal data processing activities.35 Pesopop, however, violated the Temporary Ban when it made versions 1.5.4 and 1.5.5 of its online lending application available several times on Google Play, its official Facebook page, its website, and through a QR Code. By making the online lending application available for download, it appears that Pesopop continued personal data processing activities while the Temporary Ban issued by the Commission was in effect.

Pesopop indeed removed its online lending application from Google Play following the Order dated 12 August 2021. It, however, disregarded the Temporary Ban when it made the online lending application available for download three separate instances. It only took down the online lending application from Google Play whenever it would receive orders from the EnD to do so.

In effect, Pesopop never complied with the Order dated 12 August 2021, as verified by the EnD.36 Even if Pesopop took down the online lending application whenever it received an order to do so from the EnD, the fact remains that the online lending application should not have been available for download, to begin with. Aside from the fact that Pesopop never presented any evidence to show their compliance with the Order dated 12 August 2021, the fact that it made the application available several times shows that it violated the Temporary Ban.

Further, in its Motion for Reconsideration, Pesopop represented that it “undertakes to immediately make a complete and thorough review and amendment of its existing data privacy terms and conditions and will revise the same to conform to the [DPA].”37 It, however, appears from Pesopop’s submissions that it does not intend to abide by its statements.

Despite the additional time given by the Commission and the delay in Pesopop’s submission of its compliance documents, the EnD determined that Pesopop did not submit all the documents and information required upon it following the Order dated 28 September 2021.

As verified by the EnD, Pesopop did not submit the following:

  1. An explanation of the discrepancy between Counsel’s representations in the Motion for Reconsideration on the access to the phone contact list and the Privacy Policy dated 10 September 2021;

  2. A technical explanation on the purpose of the code “android.permission.READ_CONTACTS”, which if enabled, gives the application permission to read the user’s contacts data; and

  3. An Agreement between the corporation and its third party collection partners or agents;

In its Motion for Reconsideration, Pesopop, through its Counsel, claimed that the “inclusion of requesting for the phone contact list as part of the registration to apply for loan in PesosPop was purely unintentional and a result of an inadvertent and honest mistakes.”38

Instead of explaining the discrepancy between Counsel’s representations in the Motion for Reconsideration on the access to the phone contact list and what its Privacy Policy dated 10 September 2021 states, Pesopop explained the necessity of the online lending application’s access to its users’ contact lists.39 Suffice to say, Pesopop’s explanation was unresponsive.

The EnD also raised the glaring deficiencies in Pesopop’s Revised Privacy Policy. It observed that the Revised Privacy Policy does not fully abide by Section 16 of the DPA. For reference, Section 16 of the DPA states:

Section 16. Rights of the Data Subject. – The data subject is entitled to:

(a) Be informed whether personal information pertaining to him or her shall be, are being or have been processed;

(b) Be furnished the information indicated hereunder before the entry of his or her personal information into the processing system of the personal information controller, or at the next practical opportunity:

(1) Description of the personal information to be entered into the system;

(2) Purposes for which they are being or are to be processed;

(3) Scope and method of the personal information processing;

(4) The recipients or classes of recipients to whom they are or may be disclosed;

(5) Methods utilized for automated access, if the same is allowed by the data subject, and the extent to which such access is authorized;

(6) The identity and contact details of the personal information controller or its representative;

(7) The period for which the information will be stored; and

(8) The existence of their rights, i.e., to access, correction, as well as the right to lodge a complaint before the Commission. 40

The EnD determined the following:

[T]he revised Privacy Policy failed to:

  1. discuss any methods utilized for automated access and the logic involved;

  2. provide its contact details for except for an e-mail address: pesopop.cs@cashrocket.com.ph, which the users can use if they want to request for an update of information;

  3. specify the retention period for data collected, except for generic terms stated like:

40 An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 § 16 (2012).

a. “Storage time will not exceed your usage time.” and

b. “We will only keep your information for as long as we are either required to by law or as is relevant and material for the purposes for which it was collected.”; and

  1. discuss the existence of rights of data subjects, except the right to update their personal data or the right to rectify.

Upon comparison of the Privacy Policies in the different versions of the app, it can be observed that the respondent made several changes from the Privacy Policy in the 1.5.1 version (the one investigated by CID) and Policies in the later versions, which are all the same. Despite the changes, however, the revised Privacy Policy still lacks the required information mandated by the DPA and its IRR.

Further, the policy also failed to provide details on its use of profiling, automated processing, automated decision-making, or credit rating or scoring, and the categories of data considered in deciding whether to approve or disapprove a loan application.17 Despite informing its users that it will use the information it collects to prevent fraud, credit risk evaluation management, debt collection, identity verification, and anti-money laundering, activities that obviously involves profiling, credit rating or scoring.40

Based on the EnD’s assessment, Pesopop also does not comply with the provisions of NPC Circular No. 20-01 (Guidelines on the Processing of Personal Data for Loan-Related Transactions), particularly Section 3 of NPC Circular No. 20-01, which states:

Section 3. Guidelines. The processing of personal data for evaluating loan applications, granting loans, collection of loans, and closure of loan accounts shall be subject to the following general guidelines:

A. Borrowers shall be provided all the details required under Section 16 (b) of the DPA and Section 34 (a)(2) of its IRR, in a clear language and in the most appropriate format.

…

D. Where online apps are used for loan processing activities, LCs, FCs, and other persons acting as such shall be prohibited from requiring unnecessary permissions that involve personal and sensitive personal information.

  1. Application permissions shall only be allowed when suitable, necessary, and not excessive for the purpose of KYC, determining creditworthiness, preventing fraud, and collecting the debt in accordance with applicable provisions of law.
  2. When such purpose has already been achieved, such online apps shall prompt the data subject to turn off or disallow these permissions.
  3. Where an online app requires access to the borrower’s phone camera to take a photo of the borrower and/or the photo gallery to choose a photo for the exclusive purpose of KYC and preventing fraud at the beginning of the loan application, permission for such access may be allowed at that stage in the loan application process.

Where the photo has already been taken and saved in the application, the application should already turn off such permission by default, or at the very least, prompt the borrowers through appropriate means, i.e. just-in-time, pop-up notices, etc. that they may already turn off or disallow such permission as the same is no longer necessary for the operation of the application. In no way shall the borrower’s photo be used to harass or embarrass the borrower in order to collect a delinquent loan.

  1. Access to contact details in whatever form, such as but not limited to phone contact list or e-mail lists, the harvesting of social media contacts, and/or copying or otherwise saving these contacts for use in debt collection or to harass in any way the borrower or his/her contacts, are prohibited. In all instances, online lending apps must have a separate interface where borrowers can provide character references and/or co-makers of their own choosing.41

The EnD determined that Pesopop’s submissions show that the online lending application still contains the undisclosed permissions identified in the FFR:

Based on the screenshots of the revised application submitted by Populus Lending Corporation, it can be deduced that the same dangerous permissions (Phone, Location, Storage and Camera) are still present.

The ‘Notice’ found in the application shows that the Contact list is one of the permissions needed to start the loan application. However, it was not shown in the screenshots the specific part where the application asks for the Contacts permission during the collection of information or loan application process.

It can also be seen that Step 4, where the app asks for contact references based on the simulation of other versions, is missing in the attached screenshots as Step 5 is shown after Step 3. Thus, it cannot be verified whether the revised app offered a separate interface where borrowers can provide character references and/or co-makers of their own choosing as required by the NPC Circular 20-01.

Further, the Division cannot verify if the revised application, which requires access to camera, turn off such permission by default, or at the very least, prompt the borrowers through appropriate means, i.e. just-in-time, pop-up notices, etc. that they may already turn off or disallow such permission as the same is no longer necessary for the operation of the application, after use during loan application or account creation.42

The EnD also elaborated on the online lending application’s access to the users’ contacts list:

Consequently, it can be assessed, based on the statement made in their revised Privacy Policy, that the Revised Application indeed still have access to the contacts of the user’s phone, as stated:

We will request you to ‘Read Contacts’ permission. If you agree to the authorization, we will scan and upload the contact list information to https://api.pesopop.com:18062 using the most secured data transfer protocol (HTTPS). We will store your personal information through DES and AES encryption.

Storage time will not exceed your usage time.

We will request contact list limited to five (5) phone contacts for character reference purpose and identity verification. By giving us your home and/or mobile phone number, we have your permission to contact you or the phone contacts you provided us. This shall allow us to use text messaging, artificial or prerecorded voice messages, and automatic dialing technology, for all purposes not prohibited by applicable law. We may also send an email to any address where we reasonably believe we can contact you (include the contact list). Some of the purposes for calls and messages include suspected fraud or identity theft; obtaining information; transactions on or servicing of your account; and collecting on your account or collecting the delinquent account.

However, it was not shown in the Revised Application screenshots submitted, the supposed ‘Step 4’ where users will choose character reference from their phone contact list.

But, it should be noted that the app versions 1.5.4 and the 1.5.5. currently available in Google Play Store, have these features.

…

Clearly, the app’s access to the phone contacts, though limited to five (5) contacts for character reference is a violation of the said circular, especially that the contact lists are not only for purpose of character verification but will also be used to contact them for debt collection as stated in the revised Privacy Policy:

By giving us your home and/or mobile phone number, we have your permission to contact you or the phone contacts you provided us. This shall allow us to use text messaging, artificial or prerecorded voice messages, and automatic dialing technology, for all purposes not prohibited by applicable law. We may also send an email to any address where we reasonably believe we can contact you (include the contact list). Some of the purposes for calls and messages include suspected fraud or identity theft; obtaining information; transactions on or servicing of your account; and collecting on your account or collecting the delinquent account.43

In its Motion for Reconsideration, Pesopop represented that it “do[es] not have any intention to violate any data privacy law, rules and regulations, issuances and will always consider the privacy rights of its customer supreme.”44 Pesopop, however, continued to make the online lending application available for download during the Temporary Ban and it has not rectified its operations to comply with the DPA, its IRR, and the issuances of the Commission. As such, it has not sufficiently shown to satisfaction of the Commission that lifting the Temporary Ban imposed in the Order dated 12 August 2021 is warranted. It also appears from Pesopop’s actions that it had no intention to comply with the Order dated 12 August 2021 to justify the lifting of the Temporary Ban imposed on its processing of personal data.

Given all these, the Commission finds that Pesopop violated the Temporary Ban imposed in the Order dated 12 August 2021. Rule IX Section 8 of NPC Circular No. 21-01 or the 2021 Rules of Procedure states:

Section 8. Duration of temporary ban. – When issued, the temporary ban on processing of personal data shall remain in effect until the final resolution of the main case, or upon further orders by the Commission or other lawful authority.45

Considering the foregoing, the Commission finds no reason to lift the Temporary Ban.

WHEREFORE, premises considered, the Commission ADMITS the compliance documents submitted by Populus Lending Corporation and its responsible officers.

The Commission DENIES the Motion for Reconsideration, and MAINTAINS the Temporary Ban on the processing of personal data issued against Populus Lending Corporation and its responsible officers.

Further, the Commission orders Populus Lending Corporation and its responsible officers and the Complaints and Investigation Division of the National Privacy Commission to SUBMIT within ten (10) days from the receipt of this Order their respective Memoranda on their respective arguments on the facts and issues for the resolution of this Commission.

SO ORDERED.

City of Pasay, Philippines.

27 January 2022.

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

I CONCUR:

JOHN HENRY D. NAGA

Privacy Commissioner

Copy furnished:

ZOSA & QUIJANO LAW OFFICES

Counsel for Populus Lending Corporation

and its Responsible Officers

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Order, 12 August 2021, at 11, in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2021). ↩

  2. Notice of Appearance with Motion for Reconsideration, 03 September 2021, in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2021). ↩

  3. Id. at 6. ↩

  4. Id. at 7. ↩

  5. Order, 17 September 2021, at 5, in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2021). ↩

  6. Order, 28 September 2021, in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2021). ↩

  7. T.S.N., in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2021) (pending). ↩

  8. Order, 28 September 2021, at 2, in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2021). ↩

  9. Motion to Admit with Compliance, 20 October 2021, in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2021). ↩

  10. Id. at 1. ↩

  11. Id. at 1. ↩

  12. Id. at 1. ↩

  13. Enforcement Division Memorandum, 03 November 2021, in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2021). ↩

  14. Letter from Enforcement Division, National Privacy Commission, Compliance With Order dated 12 August 2021 in NPC SS 21-008 entitled “In re: Populus Lending Corporation (Pesopop) and its Responsible Officers” to Zosa & Quijano Law Offices (08 November 2021). ↩

  15. Id. at 2. ↩

  16. Letter from Zosa & Quijano Law Offices, Reply to letter dated 8 November 2021 to Enforcement Division, National Privacy Commission (15 November 2021). ↩

  17. Id. ↩ ↩2

  18. Id. ↩

  19. Letter from Enforcement Division, National Privacy Commission, Compliance With Order dated 12 August 2021 in NPC SS 21-008 entitled “In re: Populus Lending Corporation (Pesopop) and its Responsible Officers” to Zosa & Quijano Law Offices (25 November 2021). ↩

  20. Id. ↩

  21. Enforcement Division Memorandum, 26 November 2021, in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2021). ↩

  22. Id. ↩

  23. Letter from Enforcement Division, National Privacy Commission, Compliance With Order dated 12 August 2021 in NPC SS 21-008 entitled “In re: Populus Lending Corporation (Pesopop) and its Responsible Officers” to Zosa & Quijano Law Offices (28 December 2021). ↩

  24. Id. at 2. ↩

  25. Letter from Zosa & Quijano Law Offices, Compliance to letter dated 28 December 2021 to Enforcement Division, National Privacy Commission (02 January 2022). ↩

  26. Id. ↩

  27. Id. ↩

  28. Id. ↩

  29. Motion to Admit with Compliance, 20 October 2021, in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2021). ↩

  30. National Privacy Commission, 2021 Rules of Procedure of the National Privacy Commission [NPC 2021 Rules of Procedure], rule IX, § 3 (28 January 2021). ↩

  31. Order, 12 August 2021, at 11, in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2021). ↩

  32. Order, 12 August 2021, at 6–9, in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2021). ↩

  33. NPC 2021 Rules of Procedure, rule X. ↩

  34. NPC 2021 Rules of Procedure, rule II § 4 (a). ↩

  35. Order, 12 August 2021, at 11, in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2021). ↩

  36. Enforcement Division Memorandum, 26 November 2021, in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2021). ↩

  37. Notice of Appearance with Motion for Reconsideration, 03 September 2021, at 5, in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2021). ↩

  38. Notice of Appearance with Motion for Reconsideration, 03 September 2021, at 3, in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2021). ↩

  39. Enforcement Division Memorandum, 12 January 2022, at 5, in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2022). ↩

  40. Enforcement Division Memorandum, 12 January 2022, at 3–4, in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2022) (pending). ↩

  41. National Privacy Commission, Guidelines on the Processing of Personal Data for Loan-Related Transactions, Circular No. 01, Series of 2020 [NPC Circ. No. 20-01], § 3 (A), (D) (28 January 2021). ↩

  42. Enforcement Division Memorandum, 12 January 2022, at 5, in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2022) (pending). ↩

  43. Enforcement Division Memorandum, 12 January 2022, at 6–7, in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2022). Emphasis supplied. ↩

  44. Notice of Appearance with Motion for Reconsideration, 03 September 2021, at 5, in In re: Populus Lending Corporation and its Responsible Officers, NPC SS 21-008 (NPC 2021). ↩

  45. NPC 2021 Rules of Procedure, rule IX § 8 (28 January 2021). ↩

Backlinks

  • No backlinks found