NPC Issuance Wiki

NPC 24-005: RVB v. JTL

Issued Resolution

Resolution Text

RVB,

Complainant,

-versus-

JTL,

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before the Commission is a Complaint filed by RVB against JTL for an alleged violation of Section 26 (Accessing Personal Information and Sensitive Personal Information Due to Negligence) of the Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).

Facts

On 24 January 2024, RVB filed a complaint against JTL for violating Section 26 (Access Due to Negligence) of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).1

RVB and JTL were employees of KMC Solutions, Inc. (KMC).2 RVB alleged that they were “engaged in private conversations through a messaging platform where [they] exchanged sensitive and confidential information.”3 He further claimed that without obtaining his “explicit consent,” JTL shared screenshots of their conversations, which displayed his registered mobile number, with individuals who were not part of their original conversation.4 According to RVB, the “action resulted in the unauthorized disclosure of [his] personal data, violating [his] right to privacy and significantly impacting his mental health.”5

RVB stated that on 22 September 2023, he received a Notice of Preventive Suspension from KMC’s Human Resource Business Partner effective from 23 September 2023 to 22 October 2023.6 RVB explained that the Notice did not include the company violation he allegedly committed nor the complainant’s identity.7

JTL submitted an Administrative Case Report dated 02 October 2023 to KMC detailing his allegations against Complainant.8 In the case report, JTL accused RVB of sexual harassment and misuse of authority in the workplace.9 JTL described situations where RVB intruded into his private life, including making him stay at RVB’s residence and engaging in inappropriate and unwanted behavior, such as demanding constant communication, including calls and selfies, and requesting to see JTL’s teeth and armpits during video calls.10 To substantiate his claims, JTL included numerous screenshots of their conversations as evidence and expressed concern about the potential impact on his mental health, which had already required psychiatric consultation.11

On 04 October 2023, RVB received a copy of a Notice to Explain (NTE) from KMC, which reiterated the allegations in the Administrative Case Report submitted by Respondent.12 KMC also attached the screenshots that were previously attached to the Administrative Case Report which included his mobile number.13 In addition, RVB mentioned that the NTE referenced an audio recording submitted by JTL’s father which he claims to be violative of Republic Act No. 4200 or the Anti-Wiretapping Act.14

On 22 October 2023, KMC issued a Memorandum (Notice of Decision) absolving RVB and clearing him of any wrongdoing.15 The Memorandum also states that the evidence that JTL provided did not substantiate the allegations of sexual or workplace harassment.16 Subsequently, KMC reinstated RVB after his suspension.17

Following rigorous examination of your written explanation, statements, examination of all relevant testimonies, and assessment of the case’s gravity of the violations charged against you, the investigation has determined that the evidence presented does not justify the imposition of a sanction.

Based on the documents/screenshots presented by Mr. JTL, it can be inferred that there was a mutual understanding between him and Mr. RVB, taking into consideration the manner how Mr. JTL responds to the messages of Mr. RVB.

…

Considering the foregoing, the Panelists cannot rule in favor of the Complainant, as the evidence/documents presented do not support the claims of an alleged Sexual Harassment/Workplace Harassment.

Therefore, the Management has decided to grant Absolution of Penalty for the alleged violation of the Company’s Code of Conduct, specifically, 12.3.2 Sexual Harassment and for 12.3.4 Workplace Harassment.18

Thus, RVB alleged that JTL should be held liable under Section 26 of the DPA (Access Due to Negligence).19 RVB prayed for a fine and reprimand against JTL together with a formal written apology for unauthorized disclosure and any other appropriate remedies deemed fit by the NPC.20

On 08 March 2024, the NPC, through its Legal and Enforcement Office (LEO), issued a Decision dismissing the complaint outright on the basis that “it does not pertain to a violation of the Data Privacy Act of 2012 or does not involve a privacy violation or personal data breach.”21 In its Decision, the LEO held that the complaint “does not involve a privacy violation” because JTL supposedly had lawful basis under Section 13 (f) in relation to Section 12 (f) of the DPA when it processed RVB’s personal data.22

In response to the LEO’s Decision, RVB filed a Motion for Reconsideration (MR) dated 26 March 2024.23 In the MR, RVB emphasized that the conversation between him and JTL had “a reasonable expectation of privacy, as [they] are the only parties involved in that conversation.”24

RVB further contended that there was “no pari delicto” since the evidence he submitted did not constitute private conversations but instead consisted of notices, reports, and memoranda shared with multiple individuals, including JTL.25 He argued that JTL had no reasonable expectation of privacy in this context and that including these materials as evidence was inappropriate.26

RVB alleged that since the allegation was dismissed due to failure to prosecute and/or lack of evidence, “[t]he element of legal interest pursued by the personal information controller or by a third party or parties to whom the data is disclosed is not established.”27

On 18 April 2024, the Commission En Banc issued an Order granting Complainant’s MR:

WHEREFORE, premises considered, the Commission resolves to GRANT the Motion for Reconsideration dated 26 March 2024 filed by Complainant RVB.

Respondent JTL is ORDERED, within fifteen (15) days from receipt of this Order, to file his COMMENT on the allegations in the complaint.

Complainant may, in his discretion, submit his REPLY within five (5) days from receipt of Respondent’s Comment.

Respondent may, in his discretion, submit his REJOINDER to the Reply within five (5) days from receipt of Complainant’s Reply.28

On 14 June 2024, JTL filed his Comment dated 04 June 2024.29 In his Comment, he alleged that he chose not to pursue the administrative complaint that he filed against RVB because he no longer wants to be reminded of the abuse he suffered.30 He also claimed that RVB no longer wants to participate in the investigation because “he risks facing Data Privacy complaints by the complainant who abuses the law to escape liability.”31

JTL argued that there was no violation of the DPA.32 He contended that the information shared did not qualify as personal information or sensitive personal information.33 He pointed out that RVB’s allegations of unauthorized processing of personal information were unfounded because the screenshots provided did not contain any information that could reasonably and directly identify RVB.34 He further noted that there was no mention of RVB’s name, nor was there any other information that could link the messages to RVB specifically.35

JTL emphasized that the mere claim by RVB that the mobile number in the screenshots was his does not establish a violation, especially since KMC had no record of the number.36 He also argued that RVB could have easily denied ownership of the number but instead chose to voluntarily admit and claim it as his own.37

JTL also claimed that the shared information did not constitute sensitive personal information as defined under Section 3 (l) of the DPA.38 He emphasized that the screenshots submitted to the investigating panel did not contain any information in relation to the “sexual life of a person as there was no amorous relationship” between him and RVB.39 Thus, he concluded that there was no sensitive personal information involved.40

JTL stated that “[g]ranting for the sake of argument that there was personal information involved”, it was still justified under the DPA, as the information was necessary for pursuing legal claims and protecting his lawful rights.41 He discussed the three requisites for processing based on legitimate interest and argued that these were met in this case:

In the case of GBA vs. SBG (NPC Case No. 20-317, October 13, 2022), the Commission has identified the three (3) requisites for processing based on legitimate interest, to wit:

  1. The legitimate interest is established;
  2. The processing necessary to fulfill the legitimate interest that is established; and
  3. The interest is legitimate or lawful and it does not override fundamental rights and freedoms of data subjects.42

For the first requisite, JTL argued that his legitimate interest is established under Section 13 (f) of the DPA, which allows the processing of sensitive personal information if it is “necessary for the protection of lawful rights and interests in court proceedings, or the establishment, exercise, or defense of legal claims.”43

JTL cited the case of JCB vs. JME, where the NPC held that the protection of lawful rights and interests is considered a legitimate interest under Section 12(f) of the DPA.44 JTL argued that he had “a cause of action to file [a] sexual harassment administrative case against the complainant,” making the processing of personal information necessary to protect his lawful rights.45

For the second requisite, JTL contended that the processing of the screenshots and information was necessary in fulfilling the legitimate interest of filing a sexual harassment complaint.46 By presenting these screenshots, JTL sought to substantiate his allegations and provide evidence to support his claims before the investigation panel.47 He also emphasized that the screenshots were not shared indiscriminately but only with those authorized by law to investigate the matter.48

Finally, for the third requisite, JTL argued that his interest in filing a complaint for sexual harassment is lawful and sanctioned under Republic Act No. 7877, the Anti-Sexual Harassment Act of 1995.49 This Act “mandates the employer or head of office to prevent sexual harassment acts and to provide procedures for the resolution, settlement, or prosecution” of such acts.50

JTL claimed that by meeting all three requisites, the processing of personal information was lawful and necessary to establish his legal claim against RVB.51

On 10 June 2024, RVB submitted his Reply.52 He denied the allegation that he is abusing the DPA to escape liability.53 He stated that he has “filed a complaint in the proper forum seeking just and equitable relief under the circumstances” and that he does not have the power to misuse the law.54

RVB also denied creating a hostile work environment, describing JTL’s allegations as “self-serving.”55 He referenced the KMC’s Notice of Decision, which “concluded there was no finding of sexual harassment or workplace harassment.”56

RVB also refuted JTL’s argument that the screenshots cannot ascertain his identity.57 He alleged that his phone number is known to the company, making it possible to identify him.58 He confirmed that he did not deny ownership of the number.59

RVB stated that the conversation contains sensitive personal information and was exchanged with a reasonable expectation of privacy.60 Citing jurisprudence, he argued that the reasonableness of this expectation depends on whether the individual exhibited an expectation of privacy and whether society recognizes this expectation as reasonable.61

He contended that “the element of legal interest pursued by the personal information controller or by a third party or parties to whom the data is disclosed is not established.”62 He argued that the allegation that he committed sexual or work harassment remains unproven and was dismissed due to lack of prosecution and evidence.63 He also claimed that JTL, being an information security professional, should have known the data privacy law but instead was negligent in sharing information.64

In his Rejoinder dated 14 June 2024, JTL reiterated his claims in his Comment.65 In addition, he claimed that RVB attempted to “delude” the NPC by attaching screenshots of the conversation that are impossible to read.66

JTL shared alleged contents of their exchanges and mentioned that he even failed to capture some of the messages.67 He claimed that unless he gave in to RVB’s wishes and said words of endearment, the latter would not stop pestering him.68 He further stated that his employment was always on the line since the complainant is his immediate superior who decides whether he could keep his job.69 JTL claimed that RVB is “retaliatory, frivolous and vexatious,” and that the filing of the case was designed to harass him.70

Issue

Whether JTL is liable under Section 26 of the DPA (Access Due to Negligence).

Discussion

The Commission finds that JTL is not liable for violating Section 26 of the DPA (Access Due to Negligence).

A person who, through negligence and without proper authorization, allows access to personal or sensitive personal information is liable under Section 26 of the DPA (Access Due to Negligence). It provides:

Section 26. Accessing Personal Information and Sensitive Personal Information Due to Negligence. (a) Accessing personal information due to negligence shall be penalized by imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Two million pesos (Php2,000,000.00) shall be imposed on persons who, due to negligence, provided access to personal information without being authorized under this Act or any existing law.

(b) Accessing sensitive personal information due to negligence shall be penalized by imprisonment ranging from three (3) years to six (6) years and a fine of not less than Five hundred thousand pesos (Php500,000.00) but not more than Four million pesos (Php4,000,000.00) shall be imposed on persons who, due to negligence, provided access to personal information without being authorized under this Act or any existing law.71

To be held liable under Section 26 of the DPA (Access Due to Negligence), the following elements must be present:

  1. There is personal information or sensitive personal information;
  2. The personal or sensitive personal information was accessed;
  3. The access was not authorized under the DPA or any existing law; and
  4. The unauthorized access was due to gross negligence.

In this case, the first and second elements are present as there was access to RVB’s mobile number during the investigation of the administrative case.

Section 3 (g) of the DPA defines personal information as follows:

Section 3. Definition of Terms. Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

…

(g) Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.72

While a mobile number by itself is not automatically considered personal information under the DPA, it can be classified as such if it is information from which the identity of the individual is apparent, or can be reasonably and directly ascertained by the one holding the information, or when combined with other information, allows for the direct and certain identification of an individual.73 Determining whether a mobile number is personal information is contextual and requires assessing the totality of circumstances.

In this case, RVB’s mobile number is considered personal information as far as JTL is concerned since he himself knew that the mobile number belonged to RVB. Aside from this, given the context in which the screenshots showing the mobile number were provided, RVB’s identity could also be reasonably and directly ascertained by KMC from the mobile number even without correlating it with any other information found in the screenshots.

Further, RVB’s mobile number, when associated with other data in the screenshots or within the context of the workplace, could reasonably lead to his identification. The fact that the mobile number is known within the company and can be linked to RVB’s identity supports the argument that the mobile number, in combination with other information, constitutes personal information under the DPA.

It is undisputed that JTL shared these screenshots containing RVB’s mobile number with the investigation panel, thereby granting them access to RVB’s personal information. The act of sharing these screenshots constitutes “access,” since the information was viewed and used by the panel members during the pendency of the administrative case against RVB.

The third element requires that the access to personal or sensitive personal information was not authorized under the DPA or any other existing law. Here, the access was based on lawful criteria under Sections 12 and 13 of the DPA. Thus, this element is not present.

Section 13 (f) of the DPA provides a lawful basis for processing sensitive personal information when it is “necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims.”74 This lawful basis for processing can be applied to personal information and treated as processing necessary for the purpose of legitimate interest under Section 12 (f) of the DPA.75

The processing of RVB’s personal information, which was included in the screenshots, was necessary for Respondent to defend his lawful rights in the administrative proceedings. This processing falls within the scope of legitimate interest under Section 12 (f) of the DPA, which allows for the lawful processing of personal information when it is necessary for legitimate interest, provided that these interests are not overridden by the fundamental rights and freedoms of the data subject.76

For lawful processing of personal information based on legitimate interest, the following requisites under Section 4 of the Guidelines on Legitimate Interest must also be complied with:

Section 4. Requisites for Processing Based on Legitimate Interest; Legitimate Interest Assessment. Processing based on legitimate interest requires the fulfillment of the following conditions:

A. The legitimate interest is established;

B. The means to fulfill the legitimate interest is both necessary and lawful; and

C. The interest is legitimate and lawful, and it does not override fundamental rights and freedoms of data subjects.77

The requisites for processing personal information based on legitimate interest are established in this case.

First, JTL’s legitimate interest is established. The screenshots were necessary to establish the allegations he made against RVB in an administrative proceeding for sexual harassment before the company.

Second, the processing of RVB’s personal information, specifically the inclusion of the screenshot with his mobile number in evidence, was both necessary and lawful. This was integral for providing context and supporting JTL’s claims, and its use was appropriately limited to the investigation panel, an authorized body.

Third, the processing did not override RVB’s fundamental rights and freedoms, as it was carefully controlled and directly relevant to the legal claims that JTL had to make.

In his submissions, RVB contended that since the administrative case against him was ultimately dismissed, there was no valid legal claim, and therefore, no lawful basis existed for processing his personal information.78

This argument is untenable. The dismissal of the proceedings does not negate the existence of a lawful basis for processing the personal information. The determination of a lawful basis for processing under Section 13 (f) of the DPA is not dependent on the outcome of the case but rather on whether the processing had lawful basis at the time it was conducted. In this instance, the processing was lawful because it was necessary to support JTL’s claims in the administrative proceeding, regardless of the eventual outcome of the case.

The Commission only determines whether the processing of personal data is necessary in relation to the lawful rights and interests sought to be protected or the legal claims that are sought to be established, exercised, or defended. The Commission does not rule on the admissibility of evidence, its materiality, relevance, or probative value to a particular case outside its jurisdiction,79 or the propriety of the legal strategy employed by parties in legal proceedings.80

The evidentiary value of the information processed is a separate consideration from the establishment of a lawful basis for processing. The lawful basis is established by the necessity of the processing for the defense of legal claims, not by the effectiveness or success of the evidence presented.

Given that the processing of RVB’s personal information was lawful following Section 13 (f) in relation to Section 12 (f) of the DPA, the access to this personal information was lawful. Therefore, the third element, which requires that the access be without lawful basis, is not present.

Since the third element is not present, JTL is not liable for violating Section 26 of the DPA (Access Due to Negligence).

Notwithstanding the foregoing, the Commission takes this opportunity to admonish the LEO for outrightly dismissing the complaint on substantive grounds in its 08 March 2024 Decision.81

The LEO’s interpretation of Section 1 (3) of Rule IV of NPC Circular 2021-01 (2021 NPC Rules of Procedure) and its decision to dismiss the complaint outright is not only misguided but also a blatant overreach of its authority.

Section 1 (3) of Rule IV of the 2021 NPC Rules of Procedure provides:

Section 1. Outright dismissal, when allowed. Within thirty (30) calendar days from receipt of the complaint, the investigating officer may give the complaint due course or dismiss the complaint without prejudice, on any of the following grounds:

…

  1. The complaint does not pertain to a violation of the Data Privacy Act of 2012 or does not involve a privacy violation or personal data breach.82

An investigating officer may dismiss a complaint outright if it “does not pertain to a violation of the [DPA] or does not involve a privacy violation or personal data breach.”83 This provision is intended to apply only when it is clear from the face of the complaint itself that no privacy violation has occurred.

As the Commission explained its Order dated 18 April 2024:

[A] complaint does not involve a privacy violation when the allegations in the complaint, assuming they are true, do not set forth a violation of the DPA, its IRR, or other issuances of the Commission. Such complaints are considered “without a privacy issue” and are outside the Commission’s jurisdiction. It further explained “privacy violation” as follows:

A privacy violation pertains to the processing of personal information in violation of a person’s reasonable expectation of confidentiality or privacy or in violation of any law, rules, or regulation relating to the protection of personal data, such as the DPA.84

The Commission reiterates that it is beyond the LEO’s authority to decide on substantive issues, such as the presence or applicability of a lawful basis to process personal data, in cases filed before the NPC.

The LEO overstepped the boundaries of its role when it decided that the complaint “does not involve a privacy violation” because JTL lawfully processed personal information. In dismissing the complaint outright on this ground, not only did the LEO perform a function reserved for the Commission, but it also deprived RVB of a proper adjudication of his claims.

WHEREFORE, premises considered, the Commission resolves that the Complaint filed by RVB against JTL is hereby DISMISSED for lack of merit.

This is without prejudice to the filing of appropriate civil, criminal, or administrative cases before any other forum or tribunal, if any.

SO ORDERED.

City of Pasay, Philippines. 01 August 2024.

Sgd.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

Sgd.

JOHN HENRY D. NAGA Privacy Commissioner

Sgd.

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

RVB

Complainant

JTL

Respondent

LEGAL AND ENFORCEMENT OFFICE

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Complaints -Assisted Form, 19 January 2024 ,at 3, in RVB v. JTL , NPC 24-005 (NPC 20 24 ). ↩

  2. Decision, 08 March 2024, in RVB v. JTL ,NPC 24-005 (NPC 2024). ↩

  3. -KRL -v-Trinity -Decision -PSD10Aug2020.pdf (last accessed 05 August 2024). ↩

  4. Id. ↩

  5. Id. ↩

  6. Id. at 3. ↩

  7. Id. ↩

  8. Id. Annexes . ↩

  9. Complaints -Assisted Form, 19 January 2024, Annexes ,in RVB v. JTL , NPC 24-005 (NPC 2024). ↩

  10. Id. ↩

  11. Id. ↩

  12. Id. ↩

  13. Id. ↩

  14. Id. at 3. ↩

  15. Complaints -Assisted Form, 19 January 2024, Annexes ,in RVB v. JTL , NPC 24-005 (NPC 2024). ↩

  16. Id. ↩

  17. Id. ↩

  18. Id. ↩

  19. Id. at 3 . ↩

  20. Id. ↩

  21. Decision, 08 March 2024, at 2, in RVB v. JTL , NPC 24-005 (NPC 2024). ↩

  22. Id. at 4. ↩

  23. Motion for Reconsideration, 26 March 2024, in RVB v. JTL , NPC 24-005 (NPC 2024). ↩

  24. Id. at 1 . ↩

  25. Id. ↩

  26. Id. at 2. ↩

  27. Id. ↩

  28. Order ,18 April 2024, in RVB v. JTL , NPC 24-005 (NPC 2024). NPC 24-005 ↩

  29. Comment ,04 June 2024 ,in RVB v. JTL , NPC 24-005 (NPC 2024). ↩

  30. Id. at 5 . ↩

  31. Id. ↩

  32. Id. at 6 . ↩

  33. Id. ↩

  34. Id. ↩

  35. Comment ,04 June 2024 , at 6, in RVB v. JTL , NPC 24-005 (NPC 2024). ↩

  36. Id. ↩

  37. Id. ↩

  38. Id. at 7 . ↩

  39. Id. ↩

  40. Id. NPC 24-005 ↩

  41. Comment ,04 June 2024 , at 7, in RVB v. JTL , NPC 24-005 (NPC 2024). ↩

  42. Id. ↩

  43. Id. at 8 . ↩

  44. Id. ↩

  45. Id. ↩

  46. Id. ↩

  47. Comment ,04 June 2024 , at 8, in RVB v. JTL , NPC 24-005 (NPC 2024). ↩

  48. Id. NPC 24-005 ↩

  49. Id. ↩

  50. Id. ↩

  51. Comment ,04 June 2024 ,in RVB v. JTL , NPC 24-005 (NPC 2024). ↩

  52. Reply ,10 June 2024 ,in RVB v. JTL , NPC 24-005 (NPC 2024). ↩

  53. Id. at 2 . ↩

  54. Id. ↩

  55. Id. ↩

  56. Id. ↩

  57. Id. ↩

  58. Reply ,10 June 2024 , at 2, in RVB v. JTL , NPC 24-005 (NPC 2024). ↩

  59. Id. ↩

  60. Id. NPC 24-005 ↩

  61. Id. ↩

  62. Id. at 3 . ↩

  63. Id. ↩

  64. Reply ,10 June 2024 , at 3, in RVB v. JTL , NPC 24-005 (NPC 2024). ↩

  65. Rejoinder ,10 June 2024 , at 2, in RVB v. JTL , NPC 24-005 (NPC 2024). ↩

  66. Id. at 4 . ↩

  67. Id. at 5 . ↩

  68. Id .at 6 . ↩

  69. Id. ↩

  70. Id. NPC 24-005 ↩

  71. Id. §26 .NPC 24-005 ↩

  72. Id. § 3 (g) . ↩

  73. Id. ↩

  74. Id. §13 (f). ↩

  75. KRL v . Trinity University of Asia, AA, MC, NCB, RG GV, GCT, RR, MR, PB, CID Case No. 17 -K-003, ↩

  76. Data Privacy Act 0f 2012, §12 (f). ↩

  77. National Privacy Commission, Guidelines on Legitimate Interest , Circular No. 07 , Series of 20 23 ↩

  78. Motion for Reconsideration, 26 March 2024, at 2, in RVB v. JTL , NPC 24-005 (NPC 2024). ↩

  79. RJC v. DL, NPC 22-012, 10 November 2022, at 8, available at https://privacy.gov.ph/wp-content/uploads/2023/08/NPC-22-012-2022.11.10-RJC-v.-DL-Decision.pdf (last accessed 05 August 2024). ↩

  80. Id .at 11 . ↩

  81. Decision, 08 March 2024, in RVB v. JTL , NPC 24-005 (NPC 2024). ↩

  82. National Privacy Commission, 2021 Rules of Procedure of the National Privacy Commission ↩

  83. Id. NPC 24-005 ↩

  84. Order ,18 April 2024, at 4, in RVB v. JTL , NPC 24-005 (NPC 2024). ↩

Backlinks

  • No backlinks found