NPC Issuance Wiki

NPC 21-095: In re: Spouses LTG and CIG vs LSR

Issued Resolution

Resolution Text

SPOUSES LTG and CIG,

Complainant,

-versus-

LSR,

Respondent.

x-----------------------------------------------x

NAGA, P.C.:

Before this Commission is the Motion for Reconsideration dated 25 October 2022 filed by Spouses LTG and CIG (Complainants) on the Decision dated 28 July 2022 which dismissed their Complaint against LSR (Respondent) for lack of merit.

Facts

The Commission issued a Decision dated 28 July 2022, dismissing the Complaint filed by the Complainants, with the following dispositive portion:

WHEREFORE, premises considered, the Complainants filed by SPOUSES LTG and CIG against LSR is hereby DISMISSED for lack of merit.

SO ORDERED.1

On 13 October 2022, Complainants received the Decision through electronic mail.2 Subsequently, Complainants filed their Motion for Reconsideration (MR) dated 25 October 2022.3

In their MR, Complainants stated that the Respondent’s act of issuing the subject certification does not fall under the exception of Section 13(f) of Data Privacy Act of 2012 (DPA).4 According to Complainants, Respondent has the burden of proof to show that her act of issuing the subject certification to JMB (JMB) is an exception to the strict provision, which Respondent failed to do.5

Complainants emphasized that to fall under the exception in Section 13(f) of DPA, there must be an ongoing court proceeding at the time the processing of the sensitive personal information was done.6 With this, Complainants argued that there was no ongoing court proceeding when the Respondent issued the subject certification to JMB.7

Moreover, Complainants cited Section 38 of DPA which provides that when there is doubt in the interpretation thereof shall be “liberally interpreted in a manner mindful of the rights and interests of the individual about whom personal information is processed.”8

Complainants also alleged that Respondent cannot hide behind the presumption of regularity in the exercise of her function.9 Since Respondent is the “keeper of records containing people’s sensitive personal information, x x x [R]espondent should have been mindful of the rights and interests of complainants whose personal information shall be processed.”10

Lastly, Complainants stated that if sensitive personal information shall be used in a court proceeding, “a proper subpoena duces tecum shall have been issued by a proper Court.”11

Thus, Complainants prayed that the Commission reconsider and set aside its Decision dated 28 July 2022 dismissing the instant complaint, and to find Respondent guilty of having violated the provisions of R.A. 10173 or the DPA.12 Complainants also prayed for the imposition of appropriate penalty and order Respondent to indemnify them for damages as may be provided for by the DPA.13

On 10 November 2022, the Commission issued an Order requiring Respondent to comment on the MR filed by the Complainants.14

On 29 December 2022, Respondent filed its Comment/Opposition to the Complainant’s Motion for Reconsideration.15

In its Comment, Respondent argued that the grounds in Complainants’ MR is a mere rehash of their arguments and that the “Complainants failed to raise new matters substantially plausible or compellingly persuasive to warrant its desired course of action.”16

Respondent countered that the case falls under the exception set forth by the DPA where consent of the Complainants is not necessary.17 Respondent cited the case of EA and TA v. EJ, EE and HC, where this Commission ruled that “processing, as necessary for the establishment of legal claims” does not require an existing court proceeding.18

In addition, Respondent did not agree with the Complainants’ argument that the former cannot hide behind the presumption of regularity in the exercise of her function.19 Respondent added that this argument of Complainant was already discussed in the Decision of the Commission dated 28 July 2022.20

Lastly, Respondent argued that her action does not exhibit irregularities that would overthrow the presumption of regularity, and the Complainants failed to provide clear and convincing evidence to overcome this presumption.21

Thus, Respondent prayed that the Commission deny Complainants’ MR.22

Issue

Whether the Motion for Reconsideration filed by the Complainants should be granted.

Discussion

The Commission resolves to deny the Motion for Reconsideration filed by the Complainants.

Complainants alleged that in order for the processing should be necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, as provided in Section 13(f) of DPA, there must be an ongoing court proceeding at the time processing of the sensitive personal information was done.23 Section 13(f) of DPA provides:

SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

xxx

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.24

Complainants stated that when JMB requested the subject certification there was no case filed.25 Hence, Complainants believe that the instant case does not fall under the exception provided in Section 13(f) of the DPA.26

In the case of EA and TA vs. EJ et. al, this Commission ruled that the application of Section 13(f) of the DPA does not require existing court proceedings.27 This Commission held that:

On this matter, it must be clarified that the Data Privacy Act makes a distinction between the three instances where Section 13(f) is applicable, namely: (a) The processing is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings; (b) The processing is necessary for the establishment, exercise or defense of legal claims; or (c) The processing concerns personal information that is provided to government or public authority.

xxx

After all, the very idea of “establishment … of legal claims” presupposes that there is still no pending case since a case will only be filed once the required legal claims have already been established.

In addition, the use of the qualifier “necessary” in the law should be understood to apply not just to the “protection of lawful rights and interests of…persons in court proceedings” but also to the “establishment… of legal claims.”

The DPA should not be seen as curtailing the practice of law in litigation. Considering that it is almost impossible for Congress to determine beforehand what specific data is “necessary” or may or may not be collected by lawyers for purposes of building a case, applying the qualifier “necessary” to the second instance in Section 13(f) therefore, serves to limit the potentially broad concept of “establishment of legal claims” consistent with the general principles of legitimate purpose and proportionality.

As regards legitimate purpose, the Implementing Rules and Regulations (IRR) of the Data Privacy Act provides that the processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy. This means that the processing done for the establishment of a legal claim should not in any manner be outside the limitations provided by law. The DPA is neither a tool to prevent the discovery of a crime nor a means to hinder legitimate proceedings.28

Based on the foregoing, the Respondent’s act of issuing the subject certification is within the ambit of Section 13(f) of DPA.

To reiterate, JMB’s purpose for requesting the subject Certification is to attach the same to the civil case he filed against the Complainants. The issuance of a Certification containing the marriage details of the Complainants is necessary for the establishment, exercise, or defense of legal claims in the civil case against them. Thus, such issuance of the Certification by the Respondent is considered valid processing even though a court proceeding has yet to be filed by JMB.

Moreover, Complainants noted that the crux of the DPA is for the protection and safeguarding of a person’s sensitive personal information.29 With this, they stated that when there is doubt in the interpretation of the provisions of DPA, it shall be liberally interpreted in favor of the data subject.30 Complainant cited Section 38 of DPA which provides:

SEC. 38. Interpretation. – Any doubt in the interpretation of any provision of this Act shall be liberally interpreted in a manner mindful of the rights and interests of the individual about whom personal information is processed.31

The Supreme Court held that the cardinal rule in statutory construction is that when the law is clear and free from any doubt or ambiguity, there is no room for construction or interpretation.32 There is only room for application.33

Complainants argued that Respondent cannot hide behind the presumption of regularity in the exercise of her functions.34 Further, Complainants alleged that as keeper of the records containing sensitive personal information of data subjects, Respondent should have been mindful of the rights and interests of the former whose personal information shall be processed.35 They added that Respondent may only issue the subject Certification when there is a proper subpoena duces tecum.36

To reiterate the previous discussion of this Commission in the Decision dated 28 July 2022:

Respondent’s actions do not exhibit irregularities that would overthrow the presumption of regularity and Complainants failed to provide clear and convincing evidence to overcome this presumption. Thus, the presumption of regularity of official acts must stand. Respondent cannot be faulted for issuing the Certification.37

In the instant case, the Complainants failed to provide clear and convincing evidence in its Motion for Reconsideration that would overthrow the presumption of regularity.

Moreover, the Complainants’ argument that the subject Certification may only be issued when there is a proper subpoena duces tecum does not hold water.

As defined by the Rules of Court, [s]ubpoena duces tecum is a court process directed to a person requiring him or her “to bring with him or her any books, documents, or other things under his or her control.”38

The processing of sensitive personal information is lawful for the establishment, exercise or defense of legal claims which does not require court proceedings under Section 13(f) of the DPA. Thus, given that an existing case is not required, then the issuance of a subpoena duces tecum by the proper court is likewise not required to process sensitive personal information under Section 13(f) of the DPA for the same reasons.

Overall, an examination of the issues raised in the Motion for Reconsideration reveals that the same are a mere rehash of the issues raised in the Complaint and Memorandum of the Complainants and which were already exhaustively passed upon, duly considered, and resolved by this Commission in its Decision dated 28 July 2022.

WHEREFORE, premises considered, this Commission resolves to DENY the Motion for Reconsideration dated 25 October 2022 filed by Complainants Spouses LTG and CIG. The Decision dated 28 July 2022 is hereby AFFIRMED.

SO ORDERED.

City of Pasay, Philippines. 19 January 2023.

JOHN HENRY D. NAGA

Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

NERISSA N. DE JESUS

Deputy Privacy Commissioner

Copy furnished:

SPOUSES LTG and CIG

Complainant

ACF

Counsel for Complainants

LSR

Respondent

DMP

Counsel for Respondent

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Spouses LTG and CIG v. LSR, NPC 21-095, Decision dated 28 July 2022 at p. 22. ↩

  2. Motion for Reconsideration dated 25 October 2022 of Spouses LTG and CIG, ¶1. ↩

  3. Motion for Reconsideration dated 25 October 2022 of Spouses LTG and CIG. ↩

  4. Id., at p. 2 ↩

  5. Id., at p. 2 ↩

  6. Id., at p. 2 ↩

  7. Motion for Reconsideration dated 25 October 2022 of Spouses LTG and CIG, ¶5. ↩

  8. Id., ¶6. ↩

  9. Id., ¶7. ↩

  10. Id. ↩

  11. Motion for Reconsideration dated 25 October 2022 of Spouses LTG and CIG, ¶7. ↩

  12. Id., at pp. 4-5. ↩

  13. Id., at p. 5. ↩

  14. Spouses LTG and CIG v. LSR, NPC 21-095, Order dated 10 November 2022 at p. 3. ↩

  15. Comment/Opposition dated 29 December 2022 of LSR. ↩

  16. Id., at p. 2. ↩

  17. Id., at p. 3. ↩

  18. EA and TA v. EJ, EE and HC, Resolution dated 15 July 2019. ↩

  19. Comment/Opposition dated 29 December 2022, at p. 6. ↩

  20. Id., at p. 6. ↩

  21. Id., at p. 6. ↩

  22. Id., at p. 7. ↩

  23. Motion for Reconsideration dated 25 October 2022 of Spouses LTG and CIG, at p. 2. ↩

  24. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter III, § 13(f) (2012). ↩

  25. Motion for Reconsideration dated 25 October 2022 of Spouses LTG and CIG, at p. 3. ↩

  26. Id., at p. 2. ↩

  27. EA and TA vs. EJ, EE, and HC, NPC 17-018, Decision dated 15 July 2019, at p. 8. ↩

  28. Id., at p. 7. ↩

  29. Motion for Reconsideration dated 25 October 2022 of Spouses LTG and CIG, at p. 3. ↩

  30. Id. ↩

  31. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter IX, § 38 (2012). ↩

  32. CSB vs. DTB, G.R. No. 186400, 20 October 2010. ↩

  33. Id. ↩

  34. Motion for Reconsideration dated 25 October 2022 of Spouses LTG and CIG, at p. 4. ↩

  35. Id. ↩

  36. Id. ↩

  37. Spouses LTG and CIG v. LSR, NPC 21-095, Decision dated 28 July 2022, at p. 17. ↩

  38. Amendments to the 1997 Rules of Civil Procedure [Rules of Court], A.M. No. 19-10-20-SC 2019, Rule 21, § 1 (2019). ↩

Backlinks