NPC Issuance Wiki

NPC 18-G-077: TGM v. EDM, EAS, and MCN

Issued Resolution

Resolution Text

TGM,

Complainant,

-versus-

EDM, EAS,

and MCN,

Respondents.

x----------------------------------------------------x

NAGA, P.C.;

Before the Commission is a Motion for Reconsideration dated 10 June 2021 (Motion) filed by TGM (TGM).1

Facts

The Commission issued a Decision dated 15 April 2021 dismissing the Complaint filed by TGM against EDM, EAS, and MCN (Respondents).2 The said Decision disposed of as follows:

WHEREFORE, all the above premises considered, the Complaint is hereby DISMISSED for lack of merit.

This is without prejudice to the filing of appropriate civil, criminal, or administrative cases against Respondent before any other forum or tribunal, if any.3

TGM filed her Motion dated 10 June 2021, reiterating the arguments alleged in her Complaint. In her Motion, TGM argued that “[t]he share capital account is classified as sensitive personal information” hence, “[l]egitimate [r]easons” rule does not apply.4 TGM stated that Section 3(l) of the Data Privacy Act of 2012 (DPA) is not exclusive, emphasizing on the phrase “but not limited to,” under paragraph 3 of the said provision.5

TGM further argued that the Commission “extended the meaning of “health records” to medical records kept by publicly-listed corporation notwithstanding the original tenor of Section 3(l) referring to health records issued by “government agencies” citing Advisory Opinion No. 2019-010.6

Moreover, TGM stated that the parties sufficiently established in their pleadings that shared capital accounts are sensitive personal information.7 According to TGM, the pleadings submitted to the Commission stated that the share capital account contains sensitive personal information, including deposits, withdrawals, and other loan details.8 Thus, she argued that the share capital account should be considered as a financial record that is confidential and sensitive information.9

TGM concluded that the “legitimate interests” rule is not applicable in this case as its applicability is limited to the processing of personal information pursuant to Section 12 of the DPA.10

Lastly, TGM stated in her Motion that Respondents violated her right to be informed of the processing of her information, which is tantamount to unauthorized processing of information under Section 25 of the DPA.11

Therefore, TGM prayed for the Commission to reverse and set aside the Decision dated 15 April 2021, and to issue a new one recommending the case for prosecution for violating Section 25 (b) of the DPA.12

On 17 January 2023, TGM filed an Urgent Motion for Reconsideration with a prayer that the “Certification (of Finality) dated 22 June 2022 be recalled” and that the “Motion for Reconsideration” be granted.13

Issue

Whether the Motion for Reconsideration dated 10 June 2021 filed by TGM be granted.

Discussion

The Commission resolves to deny the Motion.

I. Share capital account is not sensitive personal information as defined under the DPA.

Personal information is considered sensitive personal information if it falls under the exclusive enumeration set forth by Section 3(l) of the DPA.

In this case, TGM alleged that the enumerations under Section 3(l) of the DPA is not exclusive emphasizing that par. 3 of the said provision contains the phrase “but not limited to.”14

Section 3(l) par. 3 states that-

(l) Sensitive personal information refers to personal information:

x x x

(3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns.”15 (Emphasis supplied)

x x x

As defined, a “share capital account” shall refer to “the money paid or required to be paid by the members for the conduct of the operations of the cooperative.”16

Based on the above definition, “share capital account” is not among the enumeration of sensitive personal information under Section 3 (l) (3) of the DPA.17 The said provision, if read in its entirety, is interpreted to only include sensitive personal information issued by government agencies. In this case of MC v. VP, the Supreme Court held that:

It is an elementary rule of statutory construction that the express mention of one person, thing, act, or consequence excludes all others. This rule is expressed in the familiar maxim “expressio unius est exclusio alterius.” Where a statute, by its terms, is expressly limited to certain matters, it may not, by interpretation or construction, be extended to others. The rule proceeds from the premise that the legislature would not have made specified enumerations in a statute had the intention been not to restrict its meaning and to confine its terms to those expressly mentioned.18 (Emphasis supplied)

Moreover, the phrase “but not limited to” specifically refers only to sensitive personal information issued by government agencies which are peculiar to an individual under Section 3 (l) (3) of the DPA. In another case, the Supreme Court explained the maxim noscitur a sociis, to wit:

Moreover, the maxim noscitur a sociis, where a particular word or phrase is ambiguous in itself or is equally susceptible of various meanings, its correct construction may be made clear and specific by considering the company of words in which it is founded or with which it is associated. This is because a word or phrase in a statute is always used in association with other words or phrases, and its meaning may, thus, be modified or restricted by the latter.19 (Emphasis supplied)

Applying the maxim noscitur a sociis, reference should be made to the words associated to the phrase “but not limited to” which shall refer to sensitive personal information issued by government agencies which are peculiar to an individual such as social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns.20 Thus, the “share capital account” as claimed by TGM to be sensitive personal information, is not covered by Section 3(l)(3) of the DPA since it is not among the enumerated government-issue personal information peculiar to an individual.

Further, TGM cited in her Motion the Commission’s Advisory Opinion 2019-010 which extends the meaning of “health records”to medical records kept by a publicly-listed corporation.21 However, advisory opinions, like herein alleged, only serves as guidance to a requesting party and the general public, “but shall not be used in the nature of a standing rule binding on the [Commission] when evaluating other cases regardless of the similarity of the facts and circumstances.”22 In other words, advisory opinions issued by the Commission is merely an explanation of certain provisions, and not an extension of the DPA.

II. Respondents did not violate Section 25 of the DPA for Unauthorized Processing of Personal and Sensitive Personal Information. The processing of share capital account has lawful basis.

TGM stated that Respondents violated her right to be informed of the processing of her information under Section 16(a) of the DPA which is a violation of Section 25 for Unauthorized Processing of Personal and Sensitive Personal Information.23

In establishing whether there is a violation of Section 25 of the DPA, the following requisites must be present:

  1. The accused processed information of the data subject;
  2. The information processed is classified as personal or sensitive personal information.
  3. The processing of personal information or sensitive personal information was without the consent of the data subject, or not authorized under the DPA or any existing law.

The first requisite is present in this case since there was processing of personal information in this case when the Respondents attached the share capital account to the letter submitted to the Philippine Long Distance Telephone (PLDT) Employees Credit Cooperative (PECCI) Chairperson to defer TGM in the general election. The act of attaching the share capital account is considered processing under the DPA.

The second requisite is also present considering that the share capital account contained Complainant’s name,24 which under the DPA is a personal information.

However, the third requisite is lacking in this case.

TGM stated that the Respondents processed her personal information without her consent.25 Under Section 12 of the DPA, the processing of personal information is permitted whenever there is lawful basis, and when at least one of the criteria for lawful processing is present.26 Among the conditions is when the data subject has given his or her consent. However, the Commission emphasizes that under the DPA, consent is not the only lawful basis for processing personal information.

In this case, the processing of the share capital account is valid as there exists legitimate interest pursuant to Section 12(f) of the DPA, which provides:

(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.27

The Commission has laid down the following conditions to determine whether the processing is based on legitimate interest:

  1. The legitimate interest is established;
  2. The processing is necessary to fulfill the legitimate interest that is established; and,
  3. The interest is legitimate or lawful and it does not override fundamental rights and freedoms of data subjects.28

In this case, Respondents had legitimate interest in sharing TGM’s share capital account to the PECCI Chairperson in order to dispute the accuracy of TGM’s records in relation to her deferment in the general election.29 In order to fulfill this purpose, the Respondents attached to the letter-request forwarded to PECCI the deferred share capital account of TGM to disregard the good standing status granted to her, which may have been done erroneously.30 Unfortunately, the letter-request was not acted upon, enabling TGM to run for the Director position.31

Thus, it cannot be denied that the Respondents’ processing of the share capital account was done with legitimate interest, which is to challenge the veracity of TGM’s records given the possibility that the same was granted erroneously.

Further, considering that the interest is legitimate herein, the processing of TGM’s personal information does not override her rights as a data subject. TGM failed to prove that her rights as data subject have been violated by the Respondents.

Lastly, TGM did not provide any new or material allegations in her Motion to warrant the reversal of the Commission’s Decision dated 15 April 2021. Hence, Respondents should not be held liable for violating Section 25 of the DPA.

Thus, the Commission deems it proper to deny the Motion filed by TGM for failure to establish by substantial evidence her allegations against the Respondents.

WHEREFORE, all the above premises considered, this Commission hereby resolves to DENY the Motion for Reconsideration filed by TGM. The Decision of the Commission dated 15 April 2021 is hereby AFFIRMED.

SO ORDERED.

City of Pasay, Philippines. 22 February 2023.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

TGM Complainant

MMBZ LAW FIRM Complainant’s Counsel

EDM Respondent

EAS Respondent

MCN Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Motion for Reconsideration dated 10 June 2021 of TGM. ↩

  2. NPC 18-077 (unreported), Decision dated 15 April 2021. ↩

  3. Id., at p. 11. ↩

  4. Motion for Reconsideration dated 10 June 2021 of TGM, at p. 2. ↩

  5. Id., at p. 3. ↩

  6. Id. ↩

  7. Id. ↩

  8. Motion for Reconsideration dated 10 June 2021 of TGM, at pp. 3-4. ↩

  9. Id., at p. 4. ↩

  10. Id. ↩

  11. Id., at p. 5. ↩

  12. Motion for Reconsideration dated 10 June 2021 of TGM. ↩

  13. Urgent Motion to Resolve Motion for Reconsideration dated 10 June 2021 and To Recall Certificate of Finality dated 17 January 2023 of TGM. ↩

  14. NPC 18-077 (unreported), Decision dated 15 April 2021, at p. 9. ↩

  15. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter I, § 3 (2012). ↩

  16. Rules and Regulation Implementing Certain Provisions of the Philippine Cooperative Code of 2008, Republic Act No. 9520, § 2(m) (2015). ↩

  17. NPC 18-077 (unreported), Decision dated 15 April 2021, at p. 9. ↩

  18. Martin Centeno v. Hon. Victoria Villalon-Pornillos, G.R. No. 113092, 01 September 1994. ↩

  19. Francisco I. Chavez v. Judicial and Bar Council, G.R. No. 202242, 17 July 2012. ↩

  20. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter I, § 3 (2012). ↩

  21. Motion for Reconsideration dated 10 June 2021 of TGM, at p. 3. ↩

  22. National Privacy Commission, Rules of procedure on requests for Advisory Opinions, NPC Circular 18-01, rule I, § 2 (10 September 2018) (NPC Circular 18-01). ↩

  23. Motion for Reconsideration dated 10 June 2021 of TGM, at p. 5. ↩

  24. Complaint-Affidavit dated 25 July 2018 of TGM, referred to as Annex “A-1” ↩

  25. Motion for Reconsideration dated 10 June 2021 of TGM, at p. 5. ↩

  26. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter III, § 12 (2012). ↩

  27. Id., § 12(f). ↩

  28. MAF v. Shopee Philippines, Inc., Decision dated 22 September 2022. ↩

  29. NPC 18-077 (unreported), Decision dated 15 April 2021, at p. 10. ↩

  30. Id. ↩

  31. Id., at p. 2. ↩

Backlinks

  • No backlinks found