NPC Issuance Wiki

NPC 23-036: Spouses JG and AG v. Spouses CKP and CJC

Issued Resolution

Resolution Text

SPOUSES JG and AG,

Complainant,

-versus-

SPOUSES CKP and CJC,

Respondent.

x----------------------------------------------------x

NAGA, P.C.;

Before this Commission is the Motion for Reconsideration (MR) dated 04 March 2024 filed by Spouses CKP and CJC (Spouses C).

Facts

On 13 November 2023, the Commission issued a Decision with the following dispositive portion:

WHEREFORE, premises considered, this Commission hereby:

  1. HOLDS Respondent Spouses CKP and CJC liable for violating Section 25 of the Data Privacy Act of 2012; and

  2. FORWARDS this Decision and a copy of the pertinent case records to the Secretary of Justice and recommends the prosecution of Spouses CKP and CJC for Unauthorized Processing of Personal Information and Sensitive Personal Information under Section 25 of the DPA.

SO ORDERED.1

On 22 February 2024, Spouses C received a copy of the Decision dated 13 November 2023 through electronic mail.2 Under the 2021 Rules of Procedure of the National Privacy Commission (2021 ROP), as amended, the Decision of the Commission shall become final and executory fifteen (15) calendar days from notice thereof with proof of service to the adverse party.3 Hence, Spouses C have until 08 March 2024 to file their MR.

On 04 March 2024, Spouses C filed their MR, assailing the abovementioned Decision finding them liable for Unauthorized Processing of Personal Information and Sensitive Personal Information under Section 25 of Republic Act 10173 or the Data Privacy Act of 2012 (DPA) and recommending their prosecution therein.4

In addition to the defenses raised by Spouses C in their Verified Comment5 and Memorandum,6 the arguments in their MR were anchored on the following:

First, Spouses C maintained that the Commission should not have waived the requirement for exhaustion of administrative remedies.7

The Spouses C alleged that the Principle of Accountability under Section 21 of the DPA provides that it is the personal information controller (PIC), which in this case is the National Bureau of Investigation (NBI), who shall be responsible for any unauthorized disclosure.8

Also, Spouses C contended that the method by which they were informed by the Complainants of a possible violation of the DPA is inadequate because they are laymen who cannot be reasonably expected “to understand the ramifications of the allegations made by the Complainants” in their Joint Rejoinder Affidavit.9

Further, as laymen, Spouses C alleged that they could not likely provide any plain, speedy, and adequate remedy because they are not the PIC concerned.10 Spouses C believed that it is the NBI who should have been notified by the Complainants, as the PIC responsible and accountable for “personal information under its control or custody, including information transferred to a third party for processing.”11

Spouses C additionally posited that while it is true that the NPC may waive the requirement of exhaustion of administrative remedies, the Complainants failed to show that they were ever exposed to the risk complained of or that they could have or actually suffered any grave or irreparable damage which can only be prevented or mitigated by the NPC.12

More so, Complainants could never be purportedly exposed to any risk or any grave or irreparable damage because the disclosure was made only to the Investigating Prosecutor in NPS Docket No. INV-20B-01419 and not to the public at large.13 “No third parties, other than those who were parties in NPS Docket No. INV-20B-01419 received the disclosures, as Complainants themselves were aware and privy to said documents.”14

Second, Spouses C argued that they had a basis to process the information under Section 12 (f) or Section 13 (f) of the DPA.15

To support such claims, Spouses C alleged that the disclosures were made to strengthen their accusations against the Complainants for Estafa under Article 315 (2) (a) of the Revised Penal Code and to protect their rights and interests as Complainants in NPS Docket No. INV-20B-01419.16

The disclosure was for the supposed purpose of showing to the Investigating Prosecutor that the Complainants had formerly engaged in similar criminal conduct, contrary to their claims of innocence.17

Thus, Spouses C insist that “this, by any stretch of the imagination, cannot be called anything but a legitimate interest.”18

Also, Spouses C stressed on the previous Decisions of the Commission where documents containing personal data were processed in relation to complaints filed against the Complainants.19 Spouses C cited these to emphasize that the Commission, in such instances, upheld the processing as valid on the basis of Section 13(f) of the DPA.20

Furthermore, Spouses C asserted that the Complainants have given their consent to the disclosure of their information.21 They hinged said argument on the fact that the Complainants did not complain to the NBI but resorted to filing their Joint Rejoinder Affidavit to counter the Spouses C’s Joint Reply Affidavit.22

Lastly, Spouses C stated that instead of complaining to the Investigating Prosecutor, the Complainants revealed more information related to the Affidavit of Desistance, as originally disclosed by the Spouses C in their Joint Reply Affidavit.23 Spouses C thereafter concluded that the Complainants “actually consented, if not tacitly consented, to the disclosure of the Affidavit of Desistance.”24

Thus, the Spouses C prayed that the Commission’s Decision dated 13 November 2023 be reversed and a new one be issued dismissing the case against them.25

Issue

Whether the Motion for Reconsideration filed by Spouses CKP and CJC should be granted.

Discussion

The Commission resolves to deny the MR filed by Spouses CKP and CJC.

I. The Commission validly exercised its authority to resolve the case on the merits.

Section 2, Rule II of the 2021 ROP, as amended, states:

SECTION 2. Exhaustion of remedies. – No complaint shall be given due course unless it has been sufficiently established and proven that:

  1. the complainant has informed, in writing, the personal information controller (PIC), personal information processor (PIP), or concerned entity of the privacy violation or personal data breach to allow for appropriate action on the same; and

  2. the PIC, PIP, or concerned entity did not take timely or appropriate action on the claimed privacy violation or personal data breach, or there is no response from the PIC, PIP, or concerned entity within fifteen (15) calendar days from receipt of written information from the complainant.

The NPC may waive any or all of the requirements of this Section at its discretion upon (a) good cause shown, properly alleged and proved by the complainant; or (b) if the allegations in the complaint involve a serious violation or breach of the Data Privacy Act of 2012, taking into account the risk of harm to the affected data subject, including but not limited to:

i. when there is grave and irreparable damage which can only be prevented or mitigated by action of the NPC;

ii. when the respondent cannot provide any plain, speedy or adequate remedy to the alleged violation; or

iii. the action of the respondent is patently illegal.26

In this case, Spouses C contended that the method by which they were informed by the Complainants of a possible violation of the DPA is inadequate because they are mere laymen.27

In the Decision dated 13 November 2023, the Commission held that:

In this case, Complainants’ statement in their Joint Rejoinder Affidavit is sufficient to inform and alert the Respondents that attaching their Affidavit of Desistance constitutes a possible violation of the DPA because of the alleged unauthorized processing of the Affidavit of Desistance which contains personal information and sensitive personal information.28

In this regard, Spouses C cannot insist that they are laymen who cannot be reasonably expected “to understand the ramifications of the allegations made by the Complainants”29 in their Joint Rejoinder Affidavit. Basic is the principle that “ignorance of the law excuses no one from compliance therewith.”30

In addition, Complainants’ allegations, if substantially proven, may lead the Commission to conclude that there was a serious violation of the DPA, more so that the processing involved sensitive personal information, specifically because the Affidavit of Desistance contains information relating to “any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings.”31

Spouses C also asserted that the Complainants would not be exposed to any risk given that the disclosure was only made to the Investigating Prosecutor in NPS Docket No. INV-20B-01419 and not to the public at large.32

This contention does not hold water. It should be emphasized that Spouses C themselves were already unauthorized persons as to the previous Syndicated Estafa case as they were not parties therein. As such, there arises a risk of serious harm to the Complainants given that persons not privy to said case were able to access documents relating to it.

Moreover, the Spouses C attempted to establish their innocence by shifting the blame on the NBI, as they were allegedly the PIC.33 The Spouses C supported such claim by the Principle of Accountability under Section 21 of the DPA.34

The Spouses C are wrong. A PIC is “a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.”35

Notwithstanding the NBI’s supposed liability, Spouses C cannot free themselves from accountability as they also became a PIC when they processed the personal data of the Complainants by acquiring a copy of their Affidavit of Desistance with Mutual Release and Quitclaim containing their names, address, marital status, and information relating to the Syndicated Estafa case.

Thus, the Commission finds it appropriate to exercise its authority to resolve the case on the merits.

Section 13 of the DPA provides that the processing of sensitive personal information and privileged information shall be prohibited, except when:

(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.36

Disclosing Complainants personal and sensitive personal information is an act of processing under the DPA. As defined, processing refers to “any operation or any set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure, or destruction of data.”37

There is no dispute that Spouses C processed Complainants’ personal and sensitive personal information. As expressly admitted in their MR, Spouses C disclosed the said information to the Investigating Prosecutor in NPS Docket No. INV-20B-01419 to further their claims that Complainants were already parties to a previous Estafa case.38

Nonetheless, even assuming arguendo that Spouses C’s acquisition of Complainant’s Affidavit of Desistance with Mutual Release and Quitclaim falls within the processing that is necessary for the establishment, exercise, or defense of legal claims, they were still unable to show that the information was acquired legally or through authorized personnel of the NBI.

To reiterate from the Decision dated 13 November 2023:

The Commission has previously held that “processing done for the establishment of a legal claim should not in any manner be outside the limitations provided by law. The DPA is neither a tool to prevent the discovery of a crime nor a means to hinder legitimate proceedings.”

In this case, the personal information and sensitive personal information obtained were secured through unauthorized means as can be clearly inferred from Respondents’ admission that the subject documents were received from “good minded persons with access to NBI records.”

As to the identity of these “good minded persons,” the evidence presented by the Respondents are bereft of any showing regarding their authority to acquire and release these records. Hence, Respondents’ processing of Complainants’ personal and sensitive personal information failed to comply with the General Data Privacy Principle of Legitimate Purpose as it is incompatible with a declared and specified purpose not contrary to law, morals, or public policy.39

Unlike the previous Decisions cited in the MR where in the acquisition of personal data was gained through lawful means,40 Spouses C simply obtained the Complainants’ Affidavit of Desistance with Mutual Release and Quitclaim through “good minded persons” from the NBI, negating any indication that they secured Complainants’ information legally.41

The Commission has previously ruled that the processing of personal and sensitive personal information relying on Section 13 (f) must still adhere with Section 11 of the DPA or the General Data Privacy Principles.42

It bears stressing that Section 13 (f) requires that the processing shall be within the limits of the law,43 contrary to the unauthorized method the Spouses C devised to attain Complainants’ Affidavit of Desistance with Mutual Release and Quitclaim. Thus, Spouses C cannot thereafter use the DPA as a protective blanket to further interests obtained through underhanded means.

Anent their last argument, Spouses C averred that the Complainants had actually consented, if not tacitly consented, to the disclosure of the Affidavit of Desistance.44

It is beyond cavil that the Complainants did not consent to such disclosure, whether expressly or impliedly. Under the DPA, the consent of the data subject is any “freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her.”45

In their Memorandum, Complainants explicitly stated that Spouses C are liable for violating Sections 25, 28, 31, and 32 of the DPA for disclosing their personal information and sensitive personal information with the OCP-QC without their consent, or without being authorized under Sections 12 and 13 of the DPA.46 This express declaration from the Complainants clearly shows the absence of all the elements of consent as abovementioned.

Furthermore, Spouses C’s position that instead of complaining to the NBI or the Investigating Prosecutor regarding the supposed disclosure, Complainants chose to meet their allegations by filing a Joint Rejoinder Affidavit which revealed more information related to the Affidavit of Desistance, cannot be interpreted as consent, even impliedly.47

Section 10 (A) of NPC Circular 2023-04 (Guidelines on Consent) states that consent can never be assumed, and non-response does not constitute valid consent.48 Therefore, the DPA and the other issuances of the NPC do not recognize implied or tacit consent, as the Spouses C would like to believe.

In view of the foregoing, the Commission finds that Spouses C have not presented additional arguments supported by substantial evidence that would warrant the reversal of the Decision dated 13 November 2023.

WHEREFORE, premises considered, this Commission resolves to DENY the Motion for Reconsideration filed by Spouses CKP and CJC.

The Decision dated 13 November 2023 is hereby AFFIRMED.

SO ORDERED.

City of Pasay, Philippines. 04 March 2024.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

SPOUSES JG AND AG Complainants

SPOUSES CKP AND CJC Respondents

CRC Counsel for Complainants

BMV

JPO Counsel for Respondents

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Spouses JG and AG vs. Spouses CKP and CJC, NPC 23-036, Decision dated 13 November 2023, at p. 13. ↩

  2. Motion for Reconsideration dated 04 March 2024 of Spouses CKP and CJC, at p. 1. ↩

  3. National Privacy Commission, Amendments to Certain Provisions of the 2021 Rules of Procedure of the National Privacy Commission, NPC Circular 2024-01, rule VIII, § 7 (26 January 2024) (NPC Circular 24-01). ↩

  4. Motion for Reconsideration dated 04 March 2024 of Spouses CKP and CJC, at p. 1. ↩

  5. Verified Comment dated 02 May 2023 of Spouses CKP and CJC. ↩

  6. Memorandum dated 12 June 2023 of Spouses CKP and CJC. ↩

  7. Motion for Reconsideration dated 04 March 2024 of Spouses CKP and CJC, at p. 1. ↩

  8. Id., at p. 3. ↩

  9. Id., at p. 3. ↩

  10. Id., at p. 4. ↩

  11. Id. ↩

  12. Motion for Reconsideration dated 04 March 2024 of Spouses CKP and CJC, at p. 5. ↩

  13. Id. ↩

  14. Id. ↩

  15. Id. ↩

  16. Motion for Reconsideration dated 04 March 2024 of Spouses CKP and CJC, at p. 7. ↩

  17. Id. ↩

  18. Id. ↩

  19. Id., at pp. 9-13. ↩

  20. Motion for Reconsideration dated 04 March 2024 of Spouses CKP and CJC, at pp. 9-13. ↩

  21. Id., at p. 14. ↩

  22. Id. ↩

  23. Id. ↩

  24. Motion for Reconsideration dated 04 March 2024 of Spouses CKP and CJC, at p. 14. ↩

  25. Id., at p. 15. ↩

  26. NPC Circular 24-01, rule II, § 2. ↩

  27. Motion for Reconsideration dated 04 March 2024 of Spouses CKP and CJC, at p. 3. ↩

  28. Spouses JG and AG vs. Spouses CKP and CJC, NPC 23-036, Decision dated 13 November 2023, at p. 13. ↩

  29. Motion for Reconsideration dated 04 March 2024 of Spouses CKP and CJC, at p. 3. ↩

  30. An Act to Ordain and Institute the Civil Code of the Philippines [Civil Code of the Philippines], Republic Act No. 386, chapter 1, Art. 3 (1949). ↩

  31. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter I, § 3 (l) (2012). ↩

  32. Motion for Reconsideration dated 04 March 2024 of Spouses CKP and CJC, at p. 5. ↩

  33. Id., at p. 4. ↩

  34. Id. ↩

  35. Data Privacy Act of 2012, chapter I, § 3 (h). ↩

  36. Id., chapter III, § 13 (f). ↩

  37. Id., chapter I, § 3 (j). ↩

  38. Motion for Reconsideration dated 04 March 2024 of Spouses CKP and CJC, at p. 7. ↩

  39. Spouses JG and AG vs. Spouses CKP and CJC, NPC 23-036, Decision dated 13 November 2023, at pp. 7-8. ↩

  40. Motion for Reconsideration dated 04 March 2024 of Spouses CKP and CJC, at pp. 9-13. ↩

  41. Complaints-Assisted Form dated 14 March 2023 of Spouses JG and AG, at p. 7. ↩

  42. CL vs. DDZ and DM vs. DDZ, NPC 19-030 and NPC 19-132, Resolution dated 10 June 2021, at p. 6. ↩

  43. Id. ↩

  44. Motion for Reconsideration dated 04 March 2024 of Spouses CKP and CJC, at p. 14. ↩

  45. Data Privacy Act of 2012, chapter I, § 3 (b). ↩

  46. Memorandum dated 12 June 2023 of Spouses CKP and CJC, at p. 19. ↩

  47. Motion for Reconsideration dated 04 March 2024 of Spouses CKP and CJC, at p. 14. ↩

  48. National Privacy Commission, Guidelines on Consent, NPC Circular 2023-04, § 10 (A) (07 November 2023) (NPC Circular 23-04). ↩

Backlinks

  • No backlinks found