NPC Issuance Wiki

NPC 21-085: JAA v. RB

Issued Resolution

Resolution Text

JAA,

Complainant,

-versus-

RB,

Respondent.

x----------------------------------------------------x

NAGA, P.C.;

Before the Commission is the Motion for Reconsideration (MR) dated 08 July 2024 filed by RB (Respondent).

Facts

On 08 February 2024, the Commission issued a Decision with the following dispositive portion:

WHEREFORE, premises considered, this Commission hereby:

  1. HOLDS Respondent RB liable for Unauthorized Disclosure, violating Section 32 of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA);

  2. AWARDS the Complainant JAA with nominal damages in the amount of ₱20,000.00 for Respondent’s unauthorized disclosure of his personal information and sensitive personal information, pursuant to Section 16 (f) of the DPA; and

  3. FORWARDS this Decision and a copy of the pertinent case records to the Secretary of Justice, recommending the prosecution of RB for Unauthorized Disclosure under Section 32 of the DPA.

SO ORDERED.1

On 26 June 2024, Respondent received a copy of the abovementioned Decision through electronic mail.2 Under the 2021 Rules of Procedure of the National Privacy Commission (2021 ROP), as amended, the Decision of the Commission shall become final and executory fifteen (15) calendar days from notice thereof with proof of service to the adverse party.3 Hence, Respondent had until 11 July 2024 to file his MR.

On 09 July 2024, Respondent, through counsel, filed his MR without paying the corresponding fees, wherein he assailed the Decision finding him liable for Unauthorized Disclosure under Section 32 of Republic Act 10173 or the Data Privacy Act of 2012 (DPA) and recommending his prosecution therein.4 The arguments in his MR were anchored on the following:

First, Respondent alleged that the right to privacy must be balanced with the exercise of the Police Power of the State.5

Respondent stated that the right to privacy is not absolute and is still subject to exceptions such as carrying out the State’s Police Power to maintain peace and order for the greater good of the public.6

To support said claim, Respondent cited Office of the Court Administrator vs. Judge Edralin C. Reyes wherein the Supreme Court upheld the government’s intrusion against an individual’s reasonable expectation of privacy as it is justified by the exercise of the Police Power of the State.7

In times of national crisis and emergency, Respondent believed that the government may employ measures that could intrude upon individual privacy and during this COVID-19 pandemic, quarantine and contact tracing efforts were utilized, involving some degree of intrusion into personal privacy, resulting in a reduced expectation of privacy.8

Respondent, as Barangay Captain, is charged with maintaining the peace, order, and safety in the Barangay, including the implementation of COVID-19 protocols and regulations passed by various government agencies.9 In the exercise of these laws, Respondent is purportedly exercising the Police Power of the State.10

Second, Respondent contended that not all elements of Unauthorized Disclosure were present because the disclosure is lawful and justified under Sections 12 and 13 of the DPA, it is neither malicious nor in bad faith, and the information disclosed was not unwarranted or false.11 Respondent is of the opinion that:

As one of the government officials being in charge of safeguarding and protecting the public, and likewise implementing the rules, guidelines and regulations of Covid-19 guidelines, it is part and parcel of the duties of the respondent as a Barangay Chairman to identify the names of the patients inflicted with the Covid-19 Pandemic. This is part of the contract tracing being done by the respondent, which involves identification of individuals residing in a community.

In safeguarding the public from the Covid-19 pandemic, the individual afflicted by the Covid-19 must necessarily be identified to warn other residents of the village what street to avoid, and to take precautions when it is unavoidable to go through that place. The purpose of keeping the public from Covid-19 infection would be defeated if the public are not aware of the individuals or at least the places to avoid. Especially that it is common knowledge that Covid-19 is very contagious.12

Respondent posited that at the height of the COVID-19 pandemic, all citizens within a community has a reduced expectation of privacy because they are subjected to contract tracing and other monitoring programs of the government.13 For this reason, Complainant cannot claim an unreasonable invasion of his right to privacy as he is aware that individuals are being strictly monitored, particularly those of suspect or positive cases.14

Moreover, Respondent asserted that Complainant’s failure to comply with COVID-19 protocols forced him to necessarily disclose the same.15 If only the Complainant had abided with these, the disclosure would have apparently been avoided.16

However, there is supposedly no unnecessary disclosure by the Respondent because he only posted Complainant’s information in the group chat limited to the legitimate residents and homeowners of XXX and not for the general public.17

Lastly, Respondent argued that Complainant is not entitled to nominal damages under Section 16 (f) of the DPA since there was no violation of his right to privacy due to substantial State interest.18 Furthermore, Respondent averred:

The National Privacy Commission is only authorized to award indemnity to the person whose right to privacy was invaded under Section 16 (f) of the DPA. However, the office is not authorized to determine the existence of damages under the Civil Code, nor should the Civil Code be applied suppletorily in its determination of awarding its indemnities.19

Thus, Respondent prayed that the Commission reconsider its Decision dated 08 February 2024 and to consequently rule in his favor.20

On 15 July 2024, by reason of Respondent’s non-payment of the required fees, the Commission, through its Enforcement Division (EnD), furnished the parties with the Entry of Judgment dated 12 July 2024.21

On 16 July 2024, the EnD ordered Respondent to submit proof of payment and/or receipt of the nominal damages for the Complainant within ten (10) days from receipt of the letter.22 The EnD stated that the 08 February 2024 Decision became final and executory on 11 July 2024 as it appears that Respondent failed to pay the necessary filing fee for his MR, in accordance with NPC Circular 2023-01 (Schedule of Fees and Charges of the NPC).23

On 19 July 2024, Complainant submitted his Comment and Opposition to the MR filed by the Respondent, stating that the Commission did not err in finding him liable for Unauthorized Disclosure under Section 32 of the DPA:

We disagree with the position of the Respondent that he was allegedly justified to disclose the personal and health information of the Complainant and that said act was lawful, the truth of the matter he is not justified nor was legal to do so;

The acts of the respondent is in direct contravention of the safeguards provided for by Section 12 and 13 of the Data Privacy Act of 2012 or Republic Act No. 10173;

It is true that the Respondent was charge to do safeguarding and protecting the public, and likewise implementing the rules, guidelines and regulations of COVID-19;

It is also true that he was given access to personal and health information of individuals afflicted by COVID-19;

But this does not authorize him to freely disclose the said information to the public;

From the statement of the Respondent in his Motion for Reconsideration, he is charged in implementing the rules, guidelines and regulations of COVID-19, but implementing is very much different from enacting additional guidelines nor creating authorization or a law for him to disclose such personal and health information;

Implementing the rules, guidelines and regulations of COVID-19 would necessarily entail that a set of rules has already been created and what is left is to enforce them;

Nothing in the Implementing rules, guidelines and regulations of COVID-19 show or authorize any official of government to disclose such information in excess of such guidelines;

In this case, the Respondent went out of bounce and impliedely created and/or added guidelines to this already created guidelines for actioning to stop the spread and control COVID-19;

He went out of his authority when he divulged the personal and health information of the Complainant;

In fact, the records would show that he divulged such personal and health information when it was solicitated by a member of the BAA Facebook Group.24

Complainant maintained that Respondent exhibited malice, wanton, capricious, and illegal actions as there was no consent to divulge, use, or disseminate his personal information to the XXX community through the group chat.25 Complainant averred that Respondent, as an elected public official, should have respected his privacy rights.26

Also, Complainant asserted that Respondent’s propositions are attacking the very fundamentals of the 1987 Constitution:

There is nothing in the 1987 Philippine Constitution, Philippine laws, jurisprudence, procedures, circulars, memoranda, nor bulletins that authorize an elected barangay official to disclose any and all personal information to the public or unauthorized third parties personal health information without the consent of the data subject;

It cannot also be held that his process was lawful since there was no necessity to disclose his information to the BAA, the means employed is not a lawful processing of Personal Information;

The unwarranted, prejudicial, disrespectful and illegal disclosure by the said public official, as shown by the evidence presented before this Honorable Office, is a clear manifestation of his violation of the Privacy rights of the Complainant.27

Complainant likewise pointed that the COVID-19 pandemic did not suspend the operation of the DPA because the government saw that their efforts in contact tracing and patient management can be harmonized with it.28

As to the balancing of the right to privacy with the Police Power of the State, Complainant believed that he has an actual expectation of privacy that the health information he gave to the government will be kept private.29 In addition, he declared that no consent was ever given to the Respondent for him to divulge the same to the general public.30

Lastly, the Complainant affirmed his entitlement to damages under Section 16 (f) of the DPA because his personal and health information were disclosed to unauthorized third parties and that “Respondent has no justifiable basis in law and in fact his actions exceeded the authority reposed in him by law.”31

Hence, Complainant prayed that the 08 February 2024 Decision be reaffirmed, the Respondent’s MR be denied for lack of merit, and that the case be referred to the Secretary of Justice for proper case handling of the criminal case to be filed against the Respondent.32

On 25 July 2024, Respondent filed his Motion to Reconsider Entry of Judgment.33 Respondent averred that he paid the appropriate fees in the amount of XXX as filing fee for the MR and XXX for the legal research fee, through the LANDBANK Link.BizPortal on 11 July 2024.34

Respondent claimed that under Section 4 of NPC Circular 23-01, online payment is allowed and may be coursed through the NPC’s official online payment partner.35 Respondent therefore prays that the Commission consider his payment as substantial compliance to the abovementioned Circular and that the instant case be decided on the merits rather than on technicalities.36

On 05 August 2024, Complainant filed his Comment and Opposition to the Motion to Reconsider Entry of Judgment Filed by Respondent on the ground that the filing fee for his MR was not paid and received on 11 July 2024.37

Aside from faulting Respondent for his failure to attach proof of payment to his MR, Complainant also indicated that the screenshot of the transaction still shows “pending” and that payment was made at 9:32pm on 11 July 2024, which is beyond the business hours of the NPC at 8:00am to 5:00pm.38

Accordingly, Complainant reiterated the prayer in his Comment and Opposition to Respondent’s MR and further requested that the latter’s Motion to Reconsider Entry of Judgment be denied for lack of merit.39

On 16 August 2024, Respondent submitted his Urgent Manifestation and Compliance dated 15 August 2024.40

Respondent declared that his Motion to Reconsider Entry of Judgment was filed personally to the NPC but upon payment of the required fees, his staff was informed that such fees are not necessary, which then prompted him to proceed through online payment.41

As to the payment of nominal damages, Respondent contended that although he is able and willing to pay, it worried him that in paying said damages, it might be deemed as an abandonment of the two MRs he filed with the NPC.42

Issue

Whether the Motion for Reconsideration filed by RB should be granted.

Discussion

The Commission resolves to deny Respondent’s Motion for Reconsideration.

Respondent has timely paid the appropriate filing fees.

Sections 7 and 8, Rule VIII of the 2021 ROP, as amended, provides:

SECTION 7. Motion for reconsideration on the decision issued by the Commission. – The decision of the Commission shall become final and executory fifteen (15) calendar days from notice thereof with proof of service to the adverse party. One motion for reconsideration may be filed, which shall suspend the running of the period. Any appeal from the decision shall be to the proper courts, in accordance with law and the rules.43

SECTION 8. Entry of judgments and final orders. — If no appeal or motion for reconsideration is filed within the time provided in these Rules, the judgment shall attain finality, and an entry of judgment shall be issued to the parties. The date when the judgment becomes executory shall be deemed as the date of its entry. The entry of judgment shall contain the dispositive portion of the judgment with a certificate that such judgment has become final and executory.44

In this case, Respondent received a copy of the Decision through electronic mail on 26 June 2024.45 Following the abovementioned provisions, Respondent has fifteen (15) calendar days from 26 June 2024 or until 11 July 2024 to file his MR before the judgment becomes final and executory.

Section 4, Rule II of the 2021 ROP provides for the general rule that no further action on a complaint shall be made unless the appropriate filing fees have been paid.46 In relation to this, Sections 3 and 4 of NPC Circular 23-01 state:

Section 3. Date of Payment – Fees shall be considered to have been paid as follows:

a. For Cash Payment: The date of receipt in cash of the amount due in full.

b. For Check Payments: The manager’s check shall be payable to the National Privacy Commission. The date of receipt is honored upon first presentment and provided that the payment covers the amount due in full.

c. For Online Payment: The date of proof of online transfer or payment.47

Section 4. Time and Place of Payment – Payment transactions shall be made during regular working days and business hours, from Monday to Friday 8:00 a.m. to 5:00 p.m. to the NPC Cashier.

Online payments, if applicable, shall be coursed through an official online payment partner of the NPC.48

Complainant believed that the filing fees for Respondent’s MR were not timely paid because despite confirming in the screenshot of payment that it was made on 11 July 2024, the time reflected was 9:32pm, beyond the 8:00am to 5:00pm business hours of the NPC.49

However, the Commission does not share Complainant’s interpretation. The payment transactions pertained to in the first paragraph of Section 4 of NPC Circular 23-01 only refers to cash and check payments made at the NPC Cashier, for which reason that they shall be accomplished within business hours. Thus, online payments should not be construed as covered by the 8:00am to 5:00pm requirement because they can be paid at any time, provided that it is still within the fifteen-day period.

Respondent has therefore timely paid the appropriate filing fees, following Section 3 of NPC Circular 23-01, stating that for online payment, fees shall be considered paid on the date of proof of online transfer or payment, which in this case was shown to be on 11 July 2024 at 09:32pm.

As it is clearly established that Respondent’s payment was made within the reglementary period to file his MR, the Commission proceeds to discuss the merits of the case.

Respondent’s disclosure of Complainant’s personal data does not find lawful basis under the DPA or any existing law.

Respondent insists that the disclosure of Complainant’s personal and sensitive personal information is lawful and justified under Sections 12 and 13 of the DPA.50 As Barangay Captain, Respondent supports his argument by reiterating his involvement in the implementation of rules and regulations of the COVID-19 guidelines, such as contact tracing, which mandates him to identify the names of the patients inflicted with the virus.51

This contention does not hold water. Section 13 (b) of the DPA provides for one of the lawful criteria for processing sensitive personal information, to wit:

SEC. 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

xxx

(b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;52

There is no dispute that it is Respondent’s obligation as Barangay Chairman to maintain the peace, order, and safety in their Barangay, which includes the implementation of COVID-19 protocols and regulations. However, this duty is not without boundaries in the same way that the processing under Section 13 (b) is not absolute, as such regulatory enactments should still guarantee the protection of sensitive personal information.53

On this note, Section 5 (A) of NPC Circular 2021-02 (Guidelines on the Processing of Personal Data During Public Health Emergencies for Public Health Measures) states:

SECTION 5. Further processing; limitation. — Further processing of personal data may be allowed in instances which are compatible or consistent with the response to public health emergencies as part of public health measures, such as but not limited to historical, statistical, or scientific purposes.

A. The further processing is considered incompatible when:

  1. It would be very different from the original purpose of responding to public health emergencies as part of public health measures or there is no clear and reasonable link between such original purpose and the purposes of the intended further processing;

  2. It would result in an unjustified consequence on the rights and freedoms of the data subject; or

  3. It would not be reasonably expected by the data subject considering the context in which the personal data has been collected.

Further processing shall only be allowed when upon examination, it is determined to be compatible with the original purpose communicated to the data subject and not beyond what the data subject may reasonably expect as to the purpose, scope, manner, and extent of the processing of their personal data.54

Here, the first processing happened when Complainant’s personal data was collected from him, while the further processing occurred when Respondent disclosed the same. Contrary to Complainant’s belief that the health information he gave to the government would be kept private,55 Respondent went beyond what the Complainant reasonably expected as to the extent of the processing of his personal data when he published his name, address, and health status in the XXX Facebook page with over seven thousand (7,000) members.

In his MR, Respondent averred that during the COVID-19 pandemic, Complainant has a reduced expectation of privacy and he cannot assert an unreasonable invasion of this right as he is aware that individuals are being strictly monitored, particularly suspect or positive cases.56

For this reason, Respondent declared that individuals afflicted by COVID-19 must necessarily be identified to warn the other residents of XXX as to what street to avoid because otherwise, the purpose of safekeeping the public from the virus would be defeated if they are not aware of the individuals or the places to steer clear of.57

Although the DPA has never been a hindrance to contact tracing activities of the government as the law does not prevent government institutions from processing personal data when necessary to fulfill their mandates,58 the Commission emphasizes that the rules on patient privacy and data subjects’ rights remain in effect even in times of public health emergencies:

A public health emergency such as the COVID-19 pandemic does not render our laws inoperable. Quite the contrary, these crises toughen our laws in safeguarding our rights and freedoms, specifically the right to data privacy, to ensure that such occurrence does not become excuses for these rights to be trampled upon.

At the time of the incident, proper procedures, as enunciated above, were already in place to balance the demands of the pandemic and protecting every individual’s data privacy rights. As a PIC and a public health authority, Respondent should have strictly observed the requirements of the law and employed strategies that are least intrusive to the rights and freedoms of the data subjects.59

To address the growing privacy concerns during the COVID-19 pandemic, and to carry out the provisions of the DPA and Republic Act 11332 (Mandatory Reporting of Notifiable Diseases and Health Events of Public Health Concern Act), the Department of Health and the NPC issued Joint Memorandum Circular 2020-0002 (Privacy Guidelines on the Processing and Disclosure of COVID-19 Related Data for Disease Surveillance and Response) for the application of data protection and privacy principles in the collection, processing, and disclosure of COVID-19-related data.

Under the abovementioned Joint Memorandum Circular, aggregate health information, or pseudonymized or anonymized detailed health information may be disclosed for a legitimate purpose, consistent with the DOH Updated Guidelines on Contact Tracing provisions on Protecting Data Privacy of COVID-19 Cases and Close Contacts,60 which provides that disclosure of patient identifiers or patient data shall be limited to authorized entities, officers, personnel and concerned individuals only.61

To reiterate, the members of the XXX Facebook group are in no way privy to the information that the Respondent was able to access in his capacity as a PIC.62 The name, address, and health status of the Complainant, as a data subject, should have remained between him and the Respondent, absent any of the lawful basis for processing.63

More so, while disclosure per se is not prohibited, proper safeguards were in place to ensure that the right to data privacy will not be compromised when protecting one’s self from the virus since aggregate, pseudonymized, or anonymized data may still be made available in order that the public will not be kept in the dark as to the government’s contact tracing efforts:

This may include details on a patient’s sex, age, barangay, travel history, etc., taking caution that a COVID-19 suspected, probable, or confirmed case should not be capable of being identified from the data that is released following the DOH guidelines. These pseudonymized data may thus allow the public to assess their own risks without necessarily compromising the COVID-19 patients’ privacy rights.64

As Respondent’s intention in disclosing Complainant’s name, address, and health status is to warn the other residents of BAA as to what street to avoid so as to keep them safe from the virus,65 he could have done the same using the least intrusive means and without necessarily compromising a COVID-19 patient’s privacy rights had he just observed the abovementioned guidelines.

In this regard, Respondent cannot hide behind the guise of implementing COVID-19 protocols to justify his disregard of Complainant’s right to privacy when he specifically identified him as a confirmed case on the BAA Facebook page.

The Commission stresses that the right to privacy of health information shall be protected at all times. Those involved in the processing of personal health information of COVID-19 cases and identified close contacts shall adhere to the DPA, the NPC’s other issuances, and the general privacy principles, implement safeguards to protect personal data, and uphold data subjects’ rights at all times.66

The New Civil Code applies suppletorily to the NPC’s power to award indemnity on matters affecting personal data.

The DPA provides that every data subject has the right to be indemnified for “any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information.”67 Indeed, it is part of the Commission’s mandate to award indemnity on matters affecting personal data as provided in Section 7 (b) of the DPA.68

However, Respondent posits that the NPC is not authorized to determine the existence of damages under the Civil Code, nor should it be applied suppletorily in the determination of awarding indemnities.69

Respondent is wrong. Section 37 of the DPA is clear that restitution for any aggrieved party shall be governed by the provisions of the New Civil Code.70 The relevant article reads:

Art. 2221. Nominal damages are adjudicated in order that a right of the plaintiff, which has been violated or invaded by the defendant, may be vindicated or recognized, and not for the purpose of indemnifying the plaintiff for any loss suffered by him.71

The DPA gives individuals the right to receive indemnification from PICs and personal information processors for damages sustained in the processing of their personal data.

The Commission has previously held that since there is an obligation on the part of a PIC to implement measures to protect the personal information that it processes, there is also a correlative right on the part of data subjects to expect that their personal information is being protected.72 Hence, as a recognition of this right, the Commission rightfully awarded nominal damages in favor of the Complainant following Section 16 (f) of the DPA.

In view of the foregoing, the Commission finds that the Respondent has not presented additional arguments supported by substantial evidence that would warrant the reversal of the Decision dated 08 February 2024.

WHEREFORE, premises considered, the Commission resolves to DENY the Motion for Reconsideration filed by RB. The Decision dated 08 February 2024 is hereby AFFIRMED.

SO ORDERED.

City of Pasay, Philippines. 04 September 2024.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

JAA Complainant

RB Respondent

RBS Counsel for Complainant

YSF Counsel for Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. JA vs. RB, NPC 21-085, Decision dated 08 February 2024, at pp. 22-23. ↩

  2. Motion for Reconsideration dated 09 July 2024 of RB, at p. 1. ↩

  3. National Privacy Commission, Amendments to Certain Provisions of the 2021 Rules of Procedure of the National Privacy Commission, NPC Circular 2024-01, rule VIII, § 7 (26 January 2024) (2024 Amendments to the 2021 NPC Rules of Procedure). ↩

  4. Motion for Reconsideration dated 09 July 2024 of RB, at p. 1. ↩

  5. Id., at p. 2. ↩

  6. Id. ↩

  7. Id., at p. 3. ↩

  8. Motion for Reconsideration dated 09 July 2024 of RB, at p. 4. ↩

  9. Id. ↩

  10. Id. ↩

  11. Id. ↩

  12. Motion for Reconsideration dated 09 July 2024 of RB, at pp. 6-7. ↩

  13. Id., at p. 7. ↩

  14. Id. ↩

  15. Id. ↩

  16. Motion for Reconsideration dated 09 July 2024 of RB, at p. 7. ↩

  17. Id. ↩

  18. Id., at p. 8. ↩

  19. Id. ↩

  20. Motion for Reconsideration dated 09 July 2024 of RB, at p. 8. ↩

  21. Id., Annex 2. ↩

  22. Letter from Enforcement Division, Re: Compliance with NPC En Banc Decision dated 08 February 2024 (NPC 21-085 “JAA v. RB”) dated 16 July 2024. ↩

  23. Id. ↩

  24. Comment and Opposition to the Motion for Reconsideration Filed by the Respondent dated 19 July 2024 of JAA, at pp. 21-22. ↩

  25. Id., at p. 11. ↩

  26. Id. ↩

  27. Id., at pp. 11-12. ↩

  28. Comment and Opposition to the Motion for Reconsideration Filed by the Respondent dated 19 July 2024 of JAA, at p. 13. ↩

  29. Id., at p. 15. ↩

  30. Id. ↩

  31. Id., at p. 23. ↩

  32. Comment and Opposition to the Motion for Reconsideration Filed by the Respondent dated 19 July 2024 of JAA, at pp. 24-25. ↩

  33. Motion to Reconsider Entry of Judgment dated 25 July 2024 of RB, at p. 1. ↩

  34. Id. ↩

  35. Id., at p. 2. ↩

  36. Id. ↩

  37. Comment and Opposition to the Motion to Reconsider Entry of Judgment Filed by Respondent dated 05 August 2024 of JAA, at p. 1. ↩

  38. Id., at p. 3. ↩

  39. Id., at p. 4. ↩

  40. Urgent Manifestation and Compliance dated 15 August 2024 of RB. ↩

  41. Id., at p.1. ↩

  42. Id., at pp.1-2. ↩

  43. 2024 Amendments to the 2021 NPC Rules of Procedure, rule VIII, § 7. ↩

  44. 2024 Amendments to the 2021 NPC Rules of Procedure, rule VIII, § 8. ↩

  45. Motion for Reconsideration dated 09 July 2024 of RB, at p. 1. ↩

  46. 2024 Amendments to the 2021 NPC Rules of Procedure, rule II, § 4. ↩

  47. National Privacy Commission, Schedule of Fees and Charges of the National Privacy Commission, NPC Circular 2023-01, § 3 (17 May 2023) (NPC Circular 23-01). ↩

  48. NPC Circular 23-01, § 4. ↩

  49. Comment and Opposition to the Motion to Reconsider Entry of Judgment Filed by Respondent dated 05 August 2024 of JAA, at p. 3. ↩

  50. Motion for Reconsideration dated 09 July 2024 of RB, at p. 4. ↩

  51. Id., at p. 4. ↩

  52. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter III, § 13 (b) (2012). ↩

  53. Id. ↩

  54. National Privacy Commission, Guidelines on the Processing of Personal Data During Public Health Emergencies for Public Health Measures, NPC Circular 2021-02, § 5 (A), (08 November 2021) (NPC Circular 2021-02). ↩

  55. Comment and Opposition to the Motion for Reconsideration Filed by the Respondent dated 19 July 2024 of JAA, at p. 15. ↩

  56. Motion for Reconsideration dated 09 July 2024 of RB, at p. 7. ↩

  57. Id. ↩

  58. Public Disclosure of Identities of COVID Patients for Contact Tracing, NPC Advisory Opinion No. 2020-022, 08 June 2020, at p. 3. ↩

  59. JA vs. RB, NPC 21-085, Decision dated 08 February 2024, at pp. 20-21. ↩

  60. Department of Health, Updated Guidelines on Contact Tracing of Close Contacts of Confirmed Coronavirus Disease Cases, Department Memorandum 2020-0189 (2020). ↩

  61. Department of Health and National Privacy Commission, Privacy Guidelines on the Processing and Disclosure of COVID-19 Related Data for Disease Surveillance and Response, Joint Memorandum Circular No. 2020-0002, VI (F) (2020). ↩

  62. JA vs. RB, NPC 21-085, Decision dated 08 February 2024, at pp. 18-19. ↩

  63. Id. ↩

  64. Public Disclosure of Identities of COVID Patients for Contact Tracing, NPC Advisory Opinion No. 2020-022, 08 June 2020, at pp. 3-4. ↩

  65. Motion for Reconsideration dated 08 July 2024 of RB, at p. 7. ↩

  66. Public Disclosure of Identities of COVID Patients for Contact Tracing, NPC Advisory Opinion No. 2020-022, 08 June 2020, at p. 3. ↩

  67. Data Privacy Act of 2012, chapter IV, § 16 (f). ↩

  68. Data Privacy Act of 2012, chapter II, § 7 (b). ↩

  69. Motion for Reconsideration dated 09 July 2024 of RB, at p. 8. ↩

  70. Data Privacy Act of 2012, chapter VIII, § 37. ↩

  71. An Act to Ordain and Institute the Civil Code of the Philippines [Civil Code of the Philippines], Republic Act No. 386, book IV, chapter 3, § 3, Art. 2221 (1949). ↩

  72. NFM vs. Bank of the Philippine Islands Family – Credit Card Division, NPC 19-1273, Decision dated 19 January 2023, at p. 13. ↩

Backlinks

  • No backlinks found