NPC Issuance Wiki

NPC 22-012: RJC v. DL

Issued Resolution

Resolution Text

RJC,

Complainant,

-versus-

DL,

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before the Commission is the Motion for Reconsideration dated 03 January 2023 filed by RJC.

Facts

On 10 November 2022, the Commission issued a Decision dismissing the Complaint against Respondent DL on the ground that the processing of RJC’s personal data has lawful basis under Section 13 (f) of the Data Privacy Act of 2012 (DPA):

WHEREFORE, premises considered, the Commission resolves that the Complaint filed by RJC against DL is hereby DISMISSED for lack of merit.

SO ORDERED.1

On 03 January 2023, RJC filed his Motion for Reconsideration alleging that the Commission erred in dismissing the Complaint against DL.2 RJC asserted that the case must not be dismissed because DL was “not able to present evidence that he is innocent.”3 He claimed that “DL should have provided the evidence that the Ombudsman ordered him to use private data of the complainant without his consent.”4 He averred that DL, however, was “not able to present evidence in support of his claim that he is allowed to use private data without consent from the owner based on Section 13 (f) [of the DPA].”5

RJC stated that the transcript of records that DL previously presented in his counter-affidavit before the Ombudsman is “not an official grade released by the University and since it is not official then it defeats the purpose of rebuking the claims of the complainant that he has a solid background in computer science.”6 He argued, however, that the transcript “can still profile” him and thus falls within the scope of the DPA.7

RJC also questioned how DL obtained a copy of his grades since DL denied having access to the university records of the students during the Second Preliminary Conference before this Commission.8

RJC claimed that “the statements presented in the decision of the Commission are contradicting, which is a very strong argument for reconsideration of the decision.”9 To support his argument, RJC questioned the Commission’s statement:

When determining whether there is lawful processing under Section 13 (f) of the DPA, the Commission clarifies that it cannot rule on the admissibility of evidence or its probative value to a particular case outside its jurisdiction.10

…

In this case, however, it is Complainant, RJC, who raised his academic records as an issue in the Ombudsman case. The Commission stresses that DL would not have to present RJC’s transcript of records if it were not for RJC’s presentation of the issue on his academic records. Thus, it was RJC who opened the door for the submission of these types of evidence.11

RJC argued that he could not have raised the submission of these types of evidence because “there is no proof that it was [him] who raised his academic records as an issue [before] the Ombudsman.”12

RJC also averred that DL disclosed his grades “without his consent and without informing him about the process of his personal sensitive information [sic]”.13 He claimed that DL “has no legal obligation to provide the Ombudsman [with] a copy of [his] grades” absent a subpoena or order from the Ombudsman.14

RJC also stated that DL did not present “any measures or guidelines for the lawful processing of [RJC’s] school records or that the same was in adherence to the principles of transparency, legitimate purpose[,] and proportionality when the disclosure was made before the Office of the Ombudsman.”15 RJC argued that the Commission must adhere to the principles of legitimate purpose and proportionality since it discussed in its Decision the importance of the qualifier ‘necessary’ in Section 13 (f) of the DPA:

[C]onsidering that it is almost impossible for Congress to determine beforehand what specific data is ‘necessary’ or may or may not be collected by lawyers for purposes of building a case, applying the qualifier ‘necessary’ to the second instance of Section 13 (f) therefore [sic], serves to limit the potentially broad concept of ‘establishment of legal claims’ consistent with the general principles of legitimate purpose and proportionality.16

RJC also claimed that the transcript of records was marked “for advising purposes only”17 and “the act of disclosure of an unofficial copy of school records … is malicious and unwarranted.”18 He reiterated his argument that DL processed his transcript of records without his consent, and thus a “direct violation [of] the law.”19

RJC prayed that the Commission set aside the Decision dated 10 November 2022, prosecute DL for violation of the DPA, and award damages.20

On 11 January 2023, Respondent DL submitted his Comment/Opposition to the Motion for Reconsideration.21

DL opposed the claims of RJC stating that, “the duty to meet the burden and [to] substantiate his allegations is on the [Complainant], not on the Respondent.”22

DL also raised that “it is not within the province of the Ombudsman to authorize or order [DL] in said case what specific evidence he is allowed to present.”23 He explained that the Ombudsman, nevertheless, ordered him “to file his answer to the complaint by way of Counter-Affidavit and other relevant controverting evidence that he may present in his defense.”24

Further, DL reiterated his argument in his Verified Comment dated 08 March 2022 that:

To reiterate, attaching as evidence during the Ombudsman administrative and criminal proceedings a copy of the student’s scholastic record comprises a different context as compared to releasing such record to any third party or publicizing it in a social media platform or website. The former is necessary and proportional to the exercise or defense of legal claims, while the latter is unnecessary and disproportional for any purpose.25

Following this, DL prayed that the Motion for Reconsideration filed by RJC be denied for lack of merit.26

On 13 January 2023, RJC submitted his Reply to Respondent’s Comment/Opposition27 reiterating the arguments in his Motion for Reconsideration. He again argued that “it is very clear that [R]espondent DL used the [C]omplainant’s private data without any consent”28 and that “DL did not provide evidence to prove that he is innocent.”29 Further, he stressed DL’s supposed admission in his Comment that there was no legal order from the Ombudsman directing DL to present the school records of RJC.30

Issue

Whether the Motion for Reconsideration dated 03 January 2023 should be granted.

Discussion

It is a basic rule of evidence that each party must prove his affirmative allegation.31 If he claims a right granted by law, he must prove his claim by competent evidence, relying on the strength of his own evidence and not upon the weakness of that of his opponent.32

In his Motion for Reconsideration, RJC stressed that his complaint against DL for violation of the DPA should not have been dismissed because “in totality, there is no evidence presented by Respondent DL to prove that he is innocent.”33

Contrary to what RJC believes, however, it is not for DL to prove that he is innocent. RJC cannot simply wait for the other party to present evidence proving DL’s innocence. As the complainant, RJC must prove his allegation that DL violated the DPA. This, he failed to do.

For this reason, the Commission denies RJC’s Motion for Reconsideration dated 03 January 2023.

RJC argued that DL violated the DPA because DL disclosed his grades “without his consent and without informing him about the process of his personal sensitive information [sic].”34

RJC asserted that “the law is very clear that there must be consent from the owner and that the owner must be informed when his data is being processed.”35

Based on his arguments, RJC seems to be of the impression that only consent from the data subject can be used to justify the processing of personal information or that consent is the default and the other lawful criteria for processing under the DPA are mere exceptions. To allow this misinterpretation will result in ignoring clear provisions of the DPA that provide for other lawful criteria to process personal information and sensitive personal information.

The Commission has repeatedly held that consent is not the only lawful criteria to process sensitive personal information:

[C]onsent is not the only lawful basis to process personal or sensitive personal information under the DPA. Even a cursory look at Sections 12 and 13 of the DPA will show that there are other lawful criteria to process personal information and sensitive personal information aside from consent.36

As discussed in the Decision dated 10 November 2022, the school records of RJC subject of this case are sensitive personal information and they may be lawfully processed for the establishment, exercise, or defense of legal claims.37

In this case, DL included RJC’s transcript of records in his counter-affidavit filed before the Ombudsman. According to DL, this was a part of his defense against the claims of RJC and necessary for the

protection of his lawful rights and interests in the proceedings before the Ombudsman.

The Decision recognized DL’s supposed purpose in using RJC’s transcript of records:

RJC filed the Ombudsman case claiming that the respondents in that case, including DL, ‘were deliberately and/or negligently delaying his graduation for no valid reason’. [DL] claimed that RJC made material allegations in the case, ‘which if not controverted by documentary evidence, may lead to the erroneous conclusion that [the] respondents in said Ombudsman cases [sic] abused their authority and committed grave misconduct in allegedly delaying the graduation of [RJC].’38

Following this, the Commission held that the processing of RJC’s personal data had lawful basis under Section 13 (f) of the DPA:

DL alleged that his purpose in using RJC’s transcript of records in his counter-affidavit was to disprove RJC’s ‘false material claims.’ Such purpose may be deemed for the ‘establishment, exercise or defense of legal claims’ under Section 13 (f) of the DPA.39

In its Decision, the Commission explained that “DL would not have to present RJC’s transcript of records if it were not for RJC’s presentation of the issue on his academic records.”40 It was RJC who raised his academic records as an issue in the Ombudsman case thus “it was RJC who opened the door for the submission of these types of evidence.”41

RJC argued that “if this [Motion for Reconsideration] can be easily dismissed because of the allegation that it was the complainant who opened the door for the submission of his private personal data, then the statement strongly argues that it is legal to use personal private data without consent from the owner simply because it is open.”42

RJC again misinterpreted the statements in the Decision. In its Decision, the Commission explained that the submission of RJC’s

transcript of records as part of DL’s defense was necessitated by the issues relating to the academic records of RJC and the supposed reasons for the delay in his graduation. It was RJC who made his academic standing an issue in the Ombudsman case when he claimed that respondents “were deliberately and/or negligently delaying his graduation for no valid reason.”43 In response, DL presented RJC’s transcript of grades to disprove RJC’s false claims. Given these allegations, RJC cannot now fault DL for presenting evidence to contradict the claims against him.

RJC further asserted that DL, in proving his innocence, should have shown that the “Ombudsman ordered him to use private data of the complainant without his consent.”44 He argued that “[DL] has no obligation to provide the Ombudsman a copy of the complainant[‘s] grades because [DL] failed to present evidence that the Ombudsman issued a subpoena or order [to DL] to release the [his] grades.”45

RJC maintained that if Section 13 (f) of the DPA will be relied on, then there must be authority to use his grades in the form of an “order from the Ombudsman [which] allowed [DL] to use private data without consent of the owner”.46

RJC’s argument is untenable. There is nothing in Section 13 (f) of the DPA that requires the personal information controller (PIC) to present a specific order before lawfully processing sensitive personal information. In fact, the Commission has previously held that an existing court proceeding is not even required before Section 13 (f) can apply.47

Since a court proceeding is not required in invoking Section 13 (f) as a lawful criterion for the processing of sensitive personal information, there is less reason to require a specific order before sensitive personal information can be processed for the protection of lawful rights and interests of persons in court proceedings, or the establishment, exercise, or defense of a legal claim.

In his Motion for Reconsideration, RJC also questioned the application of the principles of transparency and proportionality in the use of his transcript of records as evidence.48 He alleged that the principle of transparency was not adhered to when he was neither informed nor made aware that DL would disclose his school records to the Office of the Ombudsman.49

Section 16 (a) of the DPA requires that the data subject “[b]e informed whether personal information pertaining to him or her shall be, are being or have been processed.”50 The Implementing Rules and Regulations of the DPA further provides that the data subject be informed of the processing before the information is processed or at the next practical opportunity.51 The “next practical opportunity” depends on the surrounding circumstance of each case. It, however, must always be within a reasonable period to give effect to the data subject’s right to be informed.52

In cases where Section 13 (f) is used as basis to process personal information, for practical considerations including the prevention of tampering with evidence, the “next practical opportunity” to inform the data subject can be when the party is furnished or served with a copy of the pleading containing personal data.

The Supreme Court explained that:

Service means the delivery or communication of a pleading, notice or some other paper in a case, to the opposite party so as to charge him with receipt of it and subject him to its legal effect. The purpose of the rules on service is to make sure that the party being served with the pleading, order or judgment is duly

informed of the same so that he can take steps to protect his interests.53

Thus, it is during service to the opposing party that a party is provided a practical opportunity to inform the former that the personal data made part of the pleadings and other court submissions was used for the protection of lawful rights and interests, or the establishment, exercise, or defense of legal claims.

In this case, RJC was informed of the use of his sensitive personal information when he received a copy of DL’s counter-affidavit in the Ombudsman case along with a copy of his transcript of records in March 2018.54

RJC alleged that the principle of proportionality was also not adhered to because “DL failed to explain… why would the entire and complete grades of [RJC is] relevant to his [Maximum Residency Rule] status for his [Master of Science in Computer Science] program.”55 RJC also argued that the copy of Transcript of Records attached by DL is “not an official grade released by the University and since it is not official, then it defeats the purpose of rebuking the claims of the complainant that he has a solid background in computer science.”56

In its Decision, the Commission already ruled on this argument stating that “when determining whether there is lawful processing under Section 13 (f) of the DPA, … it cannot rule on the admissibility of evidence or its probative value to a particular case outside its jurisdiction.”57

The Commission is mandated to administer and implement the DPA,58 part of this is ensuring the compliance of PICs with the provisions of the DPA.59 As such, it is within the Commission’s mandate to decide if personal or sensitive personal information is processed in accordance with a lawful criterion under the DPA. But in doing so, the Commission is limited to ruling only on the lawfulness of the

processing based on the DPA, its IRR, and its other issuances. It cannot rule on the admissibility of evidence submitted to another tribunal outside of its jurisdiction or the propriety of the legal strategy employed by parties in legal proceedings.

Further, the first part of Section 13(f) of the DPA requires that the information is “necessary for the protection of lawful rights and interests of persons in court proceedings.” In ruling that it was RJC who “opened that door” for the presentation of his grades, which prompted DL to present evidence to discredit the RJC’s claims, the Commission already ruled on this issue in its Decision.

Nevertheless, considering that the Commission does not rule on the admissibility of evidence and considering that all the factual circumstances of a proceeding in another tribunal will not and should not be presented before this Commission, the burden was on RJC to prove that the personal data used by DL in his defense was not necessary. While RJC voiced all manner of objections in his Motion for Reconsideration saying that other pieces of evidence such as a certification from the Office of the Registrar could have sufficed,60 he still failed to show that it was unnecessary.

In assessing what is necessary for the protection of lawful rights and interests of a person in court proceeding, it is not for the complainant to dictate what pieces of evidence are necessary and can be used by the respondent in their defense.

Given the foregoing, the Motion for Reconsideration dated 03 January 2023 failed to present any argument which would warrant a reversal of the Decision dated 10 November 2022.

WHEREFORE, premises considered, the Commission resolves to DENY the Motion for Reconsideration dated 03 January 2023 filed by RJC. The Decision dated 10 November 2022 is hereby AFFIRMED.

SO ORDERED.

City of Pasay, Philippines. 26 January 2023.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

RJC Complainant

DL Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Decision, 10 November 2022, at 9, in RJC v. DL, NPC 22-012 (NPC 2022). ↩

  2. Motion for Reconsideration, 03 January 2023, at 1, in RJC v. DL, NPC 22-012 (NPC 2023). ↩

  3. Motion for Reconsideration, 03 January 2023, at 2 & 14, in RJC v. DL, NPC 22-012 (NPC 2023). ↩

  4. Id. at 3 & 7. ↩

  5. Id. at 3. ↩

  6. Id. ↩

  7. Id. ↩

  8. Id. at 4. ↩

  9. Motion for Reconsideration, 03 January 2023, at 4, in RJC v. DL, NPC 22-012 (NPC 2023). ↩

  10. Decision, 10 November 2022, at 8, in RJC v. DL, NPC 22-012 (NPC 2022). ↩

  11. Decision, 10 November 2022, at 9, in RJC v. DL, NPC 22-012 (NPC 2022). ↩

  12. Motion for Reconsideration, 03 January 2023, at 5, in RJC v. DL, NPC 22-012 (NPC 2023). ↩

  13. Id. ↩

  14. Id. at 7. ↩

  15. Id. ↩

  16. Id. at 4. ↩

  17. Id. at 9. ↩

  18. Motion for Reconsideration, 03 January 2023, at 9, in RJC v. DL, NPC 22-012 (NPC 2023). ↩

  19. Id. at 10. ↩

  20. Id. at 15. ↩

  21. Comment/Opposition to Motion for Reconsideration, 11 January 2023, at 1, in RJC v. DL, NPC 22-012 (NPC 2023). ↩

  22. Id. ↩

  23. Id. at 2. ↩

  24. Id. ↩

  25. Comment/Opposition to Motion for Reconsideration, 11 January 2023, at 4, in RJC v. DL, NPC 22-012 (NPC 2023). ↩

  26. Id. ↩

  27. Reply to Respondent’s Comment/Opposition, 13 January 2023, at 1, in RJC v. DL, NPC 22-012 (NPC 2023). ↩

  28. Id. ↩

  29. Id. at 2. ↩

  30. Id. ↩

  31. Reyes v. Glaucoma Research Foundation, Inc., G.R. No. 189255 (2015). ↩

  32. Id. ↩

  33. Motion for Reconsideration, 03 January 2023, at 15, in RJC v. DL, NPC 22-012 (NPC 2023). ↩

  34. Id. at 5. ↩

  35. Id. at 15. ↩

  36. ACN v. DT, NPC 18-109, 01 June 2021, at 10, available at https://www.privacy.gov.ph/wp-content/uploads/2022/01/Decision-NPC-18-109-ACN-v.-DT.pdf (last accessed 10 February 2023). ↩

  37. Decision, 10 November 2022, at 8, in RJC v. DL, NPC 22-012 (NPC 2022). ↩

  38. Id. at 2. ↩

  39. Id. at 8. ↩

  40. Decision, 10 November 2022, at 9, in RJC v. DL, NPC 22-012 (NPC 2022). ↩

  41. Id. ↩

  42. Motion for Reconsideration, 03 January 2023, at 12, in RJC v. DL, NPC 22-012 (NPC 2023). ↩

  43. Decision, 10 November 2022, at 2, in RJC v. DL, NPC 22-012 (NPC 2022). ↩

  44. Motion for Reconsideration, 03 January 2023, at 3, in RJC v. DL, NPC 22-012 (NPC 2023). ↩

  45. Id. at 7. ↩

  46. Id. at 5. ↩

  47. EA & TA v. EJ, EE, & HC, NPC 17-018, 15 July 2019, at 8, available at https://www.privacy.gov.ph/wp-content/uploads/2022/04/NPC-17-018-EA-and-TA-v-EJ-Decision-2019.07.15-.pdf (last accessed 02 March 2023). ↩

  48. Motion for Reconsideration, 03 January 2023, at 7, in RJC v. DL, NPC 22-012 (NPC 2023). ↩

  49. Id. at 8. ↩

  50. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, § 16 (a) (2012). ↩

  51. National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, Rule VIII, § 34(a)(2) (2016). ↩

  52. ECA v. XXX, NPC 18-103, 23 July 2020, at 5, available at https://www.privacy.gov.ph/wp-content/uploads/2020/12/NPC-18-103-ECA-v-XXX-Decision-ADJU1.pdf (last accessed 27 April 2023). ↩

  53. Raoul C. Villarete v. Commission on Audit, G.R. No. 243818 (2022). ↩

  54. Memorandum for Complainant, 04 August 2022, at 3, in RJC v. DL, NPC 22-012 (NPC 2022). ↩

  55. Motion for Reconsideration, 03 January 2023, at 9, in RJC v. DL, NPC 22-012 (NPC 2023). ↩

  56. Id. at 3. ↩

  57. Decision, 10 November 2022, at 8, in RJC v. DL, NPC 22-012 (NPC 2022). ↩

  58. Data Privacy Act of 2012, § 7. ↩

  59. Id. § 7 (a). ↩

  60. Motion for Reconsideration, 03 January 2023, at 9, in RJC v. DL, NPC 22-012 (NPC 2023). ↩

Backlinks