NPC Issuance Wiki

CID CDO 25-001: In re: World App Processing of Personal Information

Issued Resolution

Resolution Text

IN RE: WORLD APP PROCESSING OF PERSONAL INFORMATION

x----------------------------------------------------x

BELARMINO, D.P.C.;

In his book The Five Types of Wealth, Sahil Bloom wrote, “What gets measured gets managed.” The collection, storage, and management of biometric data such as iris scans entail not mere measurement but dominion over human identity. The Philippine Data Privacy Act of 2012 requires that such processing observe, among others, the principles of proportionality (gathering only what is strictly necessary), and consent (ensuring that participation is informed, voluntary, and specific). Failure to meet these standards erodes public trust and violates the dignity that data protection seeks to uphold.

Facts

On 07 May 2025, the Complaints and Investigation Division (CID) submitted its application for the issuance of a Cease and Desist Order (CDO) against Tools for Humanity Corporation (TFH) in relation to the latter’s data privacy practices and processing of personal data in their application called “World App” and through their device called the “Orb”, allegedly violative of the General Data Privacy Principles under Section 11 and the Rights of the Data Subjects under Section 16 of Republic Act 10173, otherwise known as the Data Privacy Act of 2012 (DPA).1

On 09 May 2025, the Commission issued a Minute Resolution dated 08 May 2025 requiring TFH to comment on the CID’s application for a CDO and for the parties to appear before the Commission for a Clarificatory Hearing on 23 May 2025.2

On 19 May 2025, the Commission received a letter from TFH which provided an overview of the World Project and the World App.3

On 23 May 2025, the Clarificatory Hearing was conducted as scheduled.4 On 29 May 2025, the Commission issued the Minute Resolution dated 23 May 2025 directing TFH to submit relevant materials and documentation relating to the data processing practices involved in the operation and use of the World App and the Orb, as discussed in the Clarificatory Hearing conducted.5

On 08 June 2025, TFH submitted its Response to the Minute Resolution dated 23 May 2025 providing relevant documents requested during the Clarificatory Hearing.6

On 30 June 2025, through electronic mail, TFH informed the Commission that they were in the process of undertaking updates to their Privacy Policy.7 On the same date, they sent another email requesting an additional 30-day extension to supplement its earlier submission with updated and additional information.8

On 03 July 2025, in response to TFH’s email request dated 30 June 2025, the Commission issued the Minute Resolution partially granting TFH a non-extendible period of fifteen (15) calendar days from receipt of the Order to submit to the Commission any additional documents it deems necessary.9

On 18 July 2025, the Commission received TFH’s submissions through electronic mail, including a document captioned as “Supplemental Comment/Opposition” dated 18 July 2025.10

On 04 August 2025, the Commission issued the Minute Resolution directing the CID to submit any documents deemed necessary in relation to its application for a CDO within a non-extendible period of fifteen (15) calendar days from receipt of the Order.11

On 20 August 2025, the CID filed a Comment with Annexes dated 18 August 2025.12 Pursuant to the Minute Resolution dated 04 August 2025, the case was deemed submitted for the decision of the Commission.13

On 06 October 2025, the Commission issued the CDO dated 23 September 2025.14 Pursuant to this, on 08 October 2025, the Enforcement Division (EnD) issued a Compliance Letter to TFH.15

On 11 October 2025, WCPH Corporation (WCPHC) submitted a letter in response to the abovementioned Compliance Letter.16 On even date, TFH likewise submitted a Response Letter dated 11 October 2025.17

Now, before this Commission is the compliance of TFH, received last 16 October 202518, to the CDO dated 23 September 202519. The CDO was issued by this Commission on the ground of TFH’s data privacy practices and processing of personal data in violation of the General Data Privacy Principles under Section 1120 and the Rights of Data Subjects under Section 16 of the DPA21.

The dispositive portion of the CDO dated 23 September 2025 is as follows:

WHEREFORE, premises considered, TFH, and its local operator WCPH Corporation, is hereby ORDERED to CEASE and DESIST from the processing of personal information within the Philippines through the Orb and the World App.

This Cease and Desist Order covers the following:

  1. Making the World App available for download, whether through the Apple App Store, Google Play Store, or any other platform, and from any further use of the same within the jurisdiction of the Philippines;

  2. Conducting any form of identity verification using the Orb device in all verification locations, including but not limited to biometric scanning, registration, or processing activities associated with World ID; and

  3. Transferring, disclosing, or in any manner sharing any personal data that it has already collected or processed prior to the issuance of this Cease-and-Desist Order.

Additionally, TFH is ORDERED to SUBMIT the total number of Filipinos registered in the World App and verified through the Orb and to SUBMIT all the locations where they are currently operating.

Further, in accordance with Section 9 of NPC Circular No. 20-02, TFH is hereby ORDERED to SUBMIT a comment on the Order and to file the same within ten (10) days from receipt hereof.

Finally, the Enforcement Division of the NPC is hereby tasked to ensure the implementation of this Order no later than seventy-two (72) hours from receipt of TFH and to submit to the Commission a report within forty-eight (48) hours after the completion of the implementation.

This Order is immediately executory upon receipt and shall remain in effect until lifted or modified by the Commission.

SO ORDERED.22

In compliance with the CDO above, TFH submitted two (2) versions of their Verified Comment, Confidential and Non-Confidential, dated 15 October 202523 and received by the Commission last 16 October 202524. On the procedural aspect, they argued therein that they demonstrated good faith compliance through the submitted verification and corporate authorizations.25 They also asserted that the requirement of a verification and board authorization should not be strictly applied in CDO proceedings.26 Moreover, they contended that the Commission had no authority to order the takedown of World App through a CDO.27

On the substantive aspect, TFH argued in their Comment that first, they ensured the consent they obtained from data subjects in the Philippines met the standard required under the DPA.28 They stated that the consent they obtained from the data subjects was specific, granular, freely given, and informed.29

Second, TFH claimed that the privacy notice was made before the issuance of the CDO and to uphold transparency within the meaning of the Philippine privacy law.30 They also said that they updated their DPIA as well to reflect the change in their controllership structure.31

Furthermore, they stated that they had previously revised their biometric consent process to ensure freely given, specific, and informed consent consistent with Philippine standards.32

Third, TFH averred that the processing of facial and iris images is the most privacy-preserving and proportionate means of achieving proof of unique personhood, demonstrably exceeding global industry practices and existing state-of-the-art methods.33

Fourth, TFH contended that they are explicitly affirming the rights of data subjects and is continuously improving procedures to ensure their effective exercise.34

Fifth, TFH argued that the totality of circumstances does not meet all requisites for the issuance of a CDO.35 They explained that the CDO is not necessary to safeguard the rights of data subjects, and their continuance of their acts will not result in grave and irreparable injury to data subjects.36 Further, they maintained that their processing activities are not detrimental to public interest.37

TFH declared that they remain fully committed to working with the Commission to address all concerns promptly and transparently.38

They prayed that the Commission to note the allegations, clarifications, and matters raised in their Comment, to issue an Order lifting the CDO against World App/Orb, and to set the instant case for a clarificatory hearing.39

WCPHC also submitted a Verified Comment, dated and received by the Commission on 16 October 2025, wherein they argued that the Commission violated their right to due process when it issued a CDO against them without allegedly affording them a meaningful opportunity to participate in the proceedings.40 Claiming further that had they been given a meaningful opportunity to defend itself, it would have been able to present credible evidence showing the validity of the actual implementation of the World App in the LGUs and that consent of the data subjects was validly obtained.41

Ultimately, WCPHC prayed that the Commission invalidate or lift, as to WCPHC, the CDO dated 23 September 2025.42

Subsequently, on 21 October 2025, the Commission issued the Order dated 20 October 2025 with the following dispositive portion:

WHEREFORE, TFH IS HEREBY ORDERED, that, within a non-extendible period of three (3) days from the date of receipt of this Order, it shall:

  1. IDENTIFY every document, annex, or portion thereof that appears in the “Confidential” version of the Comment or its attachments but is withheld or redacted from the “Non-Confidential” version; and

  2. For each item so identified, STATE the specific legal basis and brief factual justification for the confidentiality claim, citing the relevant provision of law or regulation, and SUBMIT the same to the Commission.

The submission shall be limited strictly to the foregoing identification and justification, and no other submissions, including supplemental arguments, annexes, or revisions, shall be accepted.

The submissions required under this Order are intended solely to clarify the record and shall be considered by the Commission in evaluating TFH’s Comment and determining whether to lift, modify, or extend the CDO. Any confidentiality claims submitted within the prescribed period shall be reviewed by the Commission to determine the appropriate treatment of the materials in the course of its evaluation.

Failure to comply within the prescribed period shall constitute a waiver of the claim of confidentiality, and any materials previously withheld or redacted shall be deemed non-confidential.

SO ORDERED.43

TFH submitted their Compliance to the previously mentioned Order dated and received by the Commission on 24 October 2025.44 Under the same, TFH explained that, “[i]n general, the information in the Annexes include trade secrets and other confidential information, which has been consistently held as privileged and/or confidential in nature.”45 They outlined the specific legal rights and/or obligations which constrain them to maintain the confidentiality of the information in the specified annexes.46 Further, they stressed the sensitivity of the information in the mentioned annexes, as it goes into the business and operations of TFH in the Philippines and/or contains sensitive personal information.47

TFH prayed that the Commission note their Compliance along with the corresponding identification and justification of the confidential portions of TFH’s Verified Comment and its annexes, and that the same be kept confidential and withheld from public disclosure.48

Thereafter, on 27 October 2025, the Commission received TFH’s Manifestation regarding the submission of apostilled documents dated 24 October 2025.49

In line with the foregoing, the Commission is now tasked to determine whether to extend or lift the issued CDO pursuant to Section 12, Rule II of NPC Circular No. 20-02:

Section 12. Decision on the Issued CDO. – If after giving the Adverse Party the opportunity to be heard, it appears that the applicant is entitled to have the act or practice enjoined and that there is a need for the extension of the issued CDO, the Commission shall extend its effectivity, otherwise, the same shall be lifted.

The decision whether to extend or lift the issued CDO shall be made no later than thirty (30) days from the expiration of the period for the Adverse Party to file a comment or the termination of the clarificatory hearing if one is held. In the event that the Commission fails to render its decision within the said period, the CDO shall be deemed automatically lifted.50

Discussion

I. TFH is a Personal Information Controller (PIC), WCPHC is a Personal Information Processor (PIP)

The Commission takes this opportunity to elucidate the relationship between TFH and WCPHC, and to further provide education on the relationship between a PIC and a PIP.

Under Section 3 of the DPA, the Personal Information Controller (PIC) and Personal Information Processor (PIP) are defined as follows:

(h) Personal information controller refers to a person or organization who controls the collection, holding, processing or use of personal information, including a person or organization who instructs another person or organization to collect, hold, process, use, transfer or disclose personal information on his or her behalf.

xxx

(i) Personal information processor refers to any natural or juridical person qualified to act as such under this Act to whom a personal information controller may outsource the processing of personal data pertaining to a data subject.51 (Emphasis supplied)

To simplify the above quoted provision, a PIC refers to a natural individual or juridical entity who has control and decision over the collection, holding, processing, or use of personal information or sensitive personal information, or who instructs another to process the information on its behalf.

On the other hand, a PIP is a natural individual or juridical entity that processes personal information or sensitive personal information on behalf of, and under the instruction of, a PIC. The PIP does not make decisions about the purpose or means of processing; rather, it performs specific data processing related tasks.

Herein, TFH is undoubtedly the PIC, while WCPHC Group is clearly the PIP of TFH. TFH determines both the purpose and means of processing personal data, specifically the collection, storage, use, and handling of data in the World App and the biometric data processed through the Orb to achieve its declared objective of establishing the proof of unique personhood of an individual. TFH serves as the PIC for both the World App and the Orb, as it exercises control over these systems — determining the why (the purposes for which personal data, including iris scans and facial images, are processed) and the how (the manner, means, and system by which such processing is carried out). TFH likewise issues the instructions, policies, and training materials governing the verification procedures conducted through the Orb.

In its Comment, WCPHC stated that under its agreement with TFH, “WCPHC Group is obligated to, among others, promote the World project, educate users about the World protocol, assist users in the verification process, maintain the Orb in good working condition, and study and implement policies and training materials provided by TFH.”52 Further, TFH provides the educational and operational materials used by WCPHC in the field, while WCPHC merely implements and follows these TFH-developed guidelines in performing its local functions.53

Accordingly, TFH has outsourced to WCPHC the collection of iris scans and facial images as part of the verification process using the custom TFH developed device called the Orb. Outsourcing refers to the delegation of specific services or functions by contracting another entity to perform them, rather than doing so internally.54 This arrangement is consistent with WCPHC’s own representation that it is a separate and distinct juridical entity from TFH, that its engagement did not create an employment relationship, and that its personnel act as independent contractors.55

Thus, WCPHC performs an operational role in the collection of iris scans and facial images. It does so under the control, supervision, and instruction of TFH, which determines the overarching purpose and means of processing. Hence, WCPHC functions as a PIP performing specific processing activities on behalf of and under the authority of TFH, the PIC.

In its submitted Comment, WCPHC emphasizes that it is a local operator,56 however, it is imperative to note that its failure to identify itself as a PIP does not bind the Commission, as whether an entity is a PIC or PIP is identified not by its label but by what it does relative to the data processing. The determinative factor in classifying an entity as a PIC or a PIP lies in the control exercised by the PIC and the absence of such control on the part of the PIP.

The classification of WCPHC as a PIP by the Commission is supported by several factual and legal indicators drawn from the record. First, WCPHC does not determine the purpose for which personal data is collected or processed:

TFH, as the entity that developed and operates the World App, the Orb, and the World ID system, determined the overall purpose, design, and technical parameters of data processing which included the capture, encryption, and momentary storage (and subsequent deletion) of data. The WCPHC Group’s participation, in contrast, was limited to providing operational and logistical support within the Philippines. No is data collected, stored, or processed.57 (Emphasis supplied)

The overarching purpose—to establish proof of unique personhood was conceived, designed, and operationalized entirely by TFH. WCPHC merely facilitates activities that enable this objective, such as user verification, logistics, and field assistance.58 In this respect, and consistent with Section 3 (h) and (i) of the DPA, WCPHC executes but does not control or define these operations.

Second, WCPHC performs all its functions strictly in accordance with TFH’s directions, policies, and training materials. WCPHC is obligated to, among others, “to study and implement policies and training materials provided by TFH.”59 It implements pre-approved educational materials, follows TFH’s prescribed verification workflow, and possesses no discretion to modify the Orb’s functions, data flow, or retention protocol. This is consistent with Rule X, Section 44 (b) (1) of the Implementing Rules and Regulations of the DPA (IRR), which provides that a PIP shall act only upon the documented instructions of the PIC.

Third, WCPHC lacks any independent authority to process data. It cannot collect additional categories of data, retain or delete data on its own initiative, or disclose data to third parties. All such determinations rest solely with TFH, as reinforced by Section 21 of the DPA, which establishes that the PIC remains responsible for personal data processed by a third party on its behalf.

Fourth, WCPHC’s functions are operational in nature rather than decisional. Its activities include the operation and maintenance of Orbs, on-site assistance during iris scanning, coordination of verification logistics, and the local implementation of TFH’s training and policy materials—all of which are execution-level tasks devoid of independent decision-making.

During the Clarificatory Hearing held on 23 May 2025, RJW, who was introduced as a member of the operating partner of TFH, categorically stated that WCPHC’s sole purpose is to act as an operating partner for TFH:

JSB: Right. Could you give us a very brief background of the nature of your company?

RJW: Sure. The purpose of the company is again, its sole purpose is to act as an operating partner for Tools for Humanity and World in the Philippines.

JSB: Right. So it was specifically established and registered for tools for humanity for purposes of operationalizing Tools for Humanity in the Philippines?

RJW: Yes.60 (Emphasis and underlining supplied)

Fifth, the contractual relationship between TFH and WCPHC confirms this relationship. The agreement expressly provides that WCPHC is not an employee of TFH but an independent contractor performing specific tasks under the terms and policies prescribed by TFH.61 This arrangement reflects an outsourcing structure consistent with the definition of a PIP under Section 3 (i) of the DPA.62

Sixth, WCPHC operates entirely through TFH-owned infrastructure and systems, primarily through the Orb and its software. These are both TFH-developed and TFH-controlled, and the biometric data captured are transmitted directly to TFH’s backend servers without independent storage or management by WCPHC. This demonstrates that WCPHC lacks control over the technological means of processing.

Finally, under Section 21 of the DPA63, TFH, as the PIC, remains accountable for all personal data processed by a third party on its behalf. Even though WCPHC takes part in the collection of biometric data, the legal and operational control, as well as ultimate accountability, rest with TFH. Taken together, these circumstances conclusively establish that WCPHC functions as a PIP performing data processing activities on behalf of and under the authority and control of TFH, the PIC.

Now that the respective roles of TFH, as PIC, and WCPHC, as PIP, have been established, the Commission takes this opportunity to explain the importance of these roles in the context of due process. Under the DPA and its IRR, the PIC bears primary responsibility and accountability for all personal data processing activities carried out on its behalf, whether performed directly or through a processor.64

Accordingly, notice to the PIC is deemed notice to its PIP, as the latter acts only under the authority, instruction, and control of the former. This principle ensures procedural fairness while preserving the integrity of regulatory proceedings by recognizing that the PIC cannot evade responsibility through outsourcing arrangements.

Under Rule X, Sections 43 and 44 of the IRR of the DPA, a PIC may outsource or subcontract the processing of personal data to a PIP, provided that the arrangement is governed by a binding contract or legal act that obliges the PIP to act only upon the documented instructions of the PIC, and to implement appropriate safeguards consistent with the DPA and other issuances of the Commission.65 This regulatory framework establishes a relationship of control and delegation, in which the PIP’s authority to process personal data is wholly derived from, and limited by, the PIC’s mandate. Consequently, the PIP has no independent legal personality in relation to the data processing purpose and merely acts as an extension of the PIC’s processing operations.

The contractual and statutory duty of the PIC to oversee its PIP, ensure adherence to instructions, and guarantee compliance with the DPA implies that any regulatory directive, inquiry, or order addressed by the NPC to the PIC is binding upon its PIP engaged in the outsourced processing. This interpretation preserves due process, as it ensures that both the PIC and PIP are apprised of and bound by the same proceedings, without requiring duplicative notices that could otherwise frustrate the accountability structure established under Rule X of the IRR of the DPA.66 In effect, the PIC’s receipt of notice triggers its obligation to inform and cause compliance by its PIP, consistent with its continuing accountability under Section 21 of the DPA.67

Rule X, Section 44(b)(8) of the IRR specially mandates the PIP to “make available to the personal information controller all information necessary to demonstrate compliance with the obligations laid down in the DPA, and allow for and contribute to audits, including inspections, conducted by the personal information controller or another auditor mandated by the latter.”68 This provision reflects that the accountability and oversight of responsibility flow downward from PIC to PIP, but the duty to report and inform flows upward from PIP to PIC. Hence, in case where a PIP, and not a PIC, receives a regulatory notice, inquiry, or order from the Commission, the PIP has a corresponding obligation to promptly inform its PIC. The reason being that the PIP processes data on behalf of the PIC, and the PIC remains legally accountable under Section 21 of the DPA. From a due process perspective, this ensures that the PIC is kept aware of any proceedings or actions involving its outsourced PIP. Thus, the Commission’s regulatory notice to either the PIC or PIP is effectively a notice to both, since their obligations are interlinked by law and contract. This prevents a PIC from claiming lack of notice or awareness of proceedings involving its PIP, and likewise prevents a PIP from claiming lack of notice or isolation from its PIC’s accountability which is exactly WCPHC’s assertion in its comment.

The Commission likewise cautions that allowing a PIP to invoke lack of due process merely because notice was served upon the PIC—to whom it is contractually and legally bound—would create a dangerous precedent. Such a view would permit PIPs to evade oversight and accountability by exploiting procedural formalities, despite their actions being executed under the authority and supervision of the PIC, as the PIP acts only upon the PIC’s documented instructions. To hold otherwise would not only fragment the accountability structure established by the DPA but also frustrate enforcement and undermine the principle that the PIC remains responsible for all data processing carried out on its behalf, unless the PIP goes beyond its authority and acts as a PIC. Hence, the Commission affirms that notice to the PIC satisfies the requirement of due process for its PIP, consistent with the law’s intent to preserve a unified chain of responsibility in an outsourced data processing.

To add, WCPHC, in its Comment, cited an established jurisprudence recognizing that procedural process includes, among others, the right to actual or constructive notice of the institution of proceedings which may affect a respondent’s legal rights.69 This clearly supports the foregoing discussion that in a unified chain of responsibility, the notice to the PIC is a constructive notice to its PIP.

Assuming arguendo and only for the very limited purpose of argument that a separate notice to PIP is required, in this case a separate notice to WCPHC, the Commission has given WCPHC an opportunity to be heard before it issued its CDO dated 23 September 2025. The essence of procedural due process is embodied in the basic requirement of notice and a real opportunity to be heard. In administrative proceedings, such as in the case at bar, procedural due process simply means the opportunity to explain one’s side or the opportunity to seek a reconsideration of the action or ruling complained of.70 “To be heard” does not mean only verbal arguments in court; one may be heard also through pleadings.71 Where opportunity to be heard, either through oral arguments or pleadings, is accorded, there is no denial of procedural due process.72 Further, the standard of due process that must be met in proceedings before administrative tribunals allows a certain latitude as long as the element of fairness is not ignored.73

WCPHC, in its Comment, argued that the Commission issued the CDO against it without an opportunity to present its side, whether through oral hearing or written submission.74 That it resorted to availing the remedy to file a comment which must first be construed to cure the grave violation of its right to procedural process75 as held in the cited cases stating that “the mere filing of [a] motion cannot cure a grave violation of due process when the party was never given a meaningful opportunity to be heard on the merits or to the specific evidence used against him”.76 To support the mentioned doctrinal pronouncement, WCPHC further cited Fontanilla v. Commissioner Proper.77

While WCPHC remained silent regarding the presence of its representative at the Clarificatory Hearing held on 23 May 2025, the records unequivocally show that the Commission acknowledged the presence of its representative, RJW, and was afforded a meaningful opportunity to be heard.78 Therefore, the cases cited by WCPHC do not find application in the present case, as they pertain to situations in which a party was denied any opportunity to be heard – a circumstance clearly not present in this case.

During the Clarificatory Hearing held on 23 May 2025, the Commission inquired from DKR, the duly authorized representative of TFH, regarding the identity and role of their local partner/s in the Philippines.79 In response, RJW and JPZ were introduced as representatives of the said local operating partner, to wit:

JSB: You have a local partner here in the Philippines, right? Do you have any local partners in the Philippines or third-party providers in the Philippines?

DKR: Yes, we have an operating partner, JSB who is on the ground in the Philippines and with the two gentlemen here are the representatives of that operating partner.

JSB: May I know the names of the operating partners?

RJW: Yes, present here in the room are RJW and JPZ.80 (Emphasis supplied)

During the same hearing, the representatives of WCPHC were likewise afforded the opportunity to expound on the nature, background, and business operations of their company. It was clarified that WCPHC’s primary and sole purpose is to serve as the local operating partner of TFH, functioning in accordance with the latter’s directives and operational framework, stating:

JSB: Right. While we’re waiting for them, I wanted to ask your partners, DKR. Are they a company or they are just individuals?

RJW: We are a company, Your Honor. We have an entity. We have completed this registration. It’s WCPH corporation.

JSB: So that’s registered in the Philippines.

RJW: In the Philippines, in the City of Mandaluyong.

JSB: Right. So that’s also registered with the Securities and Exchange Commission.

RJW: Yes, we are registered with the SEC. We completed our BIR registration as well.

JSB: Right .

DKR: And yeah, and once we’ve completed all of these, we are also under your guidance. Also looking to register with the NPC, if that’s deemed to be something that is needed.

Later in the same hearing:

JSB: Right. Could you give us a very brief background of the nature of your company?

RJW: Sure. The purpose of the company is again, its sole purpose is to act as an operating partner for Tools for Humanity and world in the Philippines.

JSB: Right. So it was specifically established and registered for Tools for Humanity for purposes of operationalizing Tools for Humanity in the Philippines.

RJW: Yes.81

Given these circumstances, the contention of WCPHC that it was not afforded the opportunity to present its case is devoid of factual and legal basis. The records clearly demonstrate that WCPHC actively participated during the Clarificatory Hearing held on 23 May 2025, where it was given the opportunity to speak, clarify, and submit documents necessary for the resolution of this case.82 Hence, WCPHC cannot plausibly claim lack of notice or denial of due process when it was physically present, represented by its officers, and accorded a real and reasonable opportunity to be heard.

Indeed, due process cannot be invoked by a party who, despite said opportunity, failed to act or avail itself of the remedies open to it. The constitutional guarantee of due process is meant to ensure fairness—not to shield negligence or inaction. As consistently held by the Supreme Court of the Philippines, “the essence of due process is simply the opportunity to be heard.”83 It is not violated where a party is given the chance to present its side but fails to do so. Thus, WCPHC cannot now fault the Commission for its own failure to respond or comply, as the denial of due process cannot be predicated on a party’s deliberate choice or neglect. To sustain WCPHC’s claim would set a perilous precedent where a PIP having been notified by its PIC and even present in the very proceedings could later argue lack of due process by simply asserting technical non-notification. Such a view would distort the concept of administrative due process and defeat the very accountability structure established under the DPA, its IRR and issuances, which hold the PIC and its PIP to a unified standard of responsibility and cooperation as extensively discussed earlier.

Further, indeed WCPHC is correct when it stated that the Commission is empowered to issue an ex parte CDO pursuant to NPC Circular No. 20-02, known as the Rules on the Issuance of Cease and Desist Orders (Rules on the Issuance of CDO)84, in relation to Section 7 (c) of the DPA.85 Under these provisions, the Commission may motu proprio or upon complaint, issue an ex parte order when all of the following concur:

  1. the Adverse Party is doing, threatening or is about to do, is procuring to be done, some act or practice in violation of the DPA, its IRR, or other related issuances;

  2. such act or practice is detrimental to national security or public interest, or the CDO is necessary to preserve and protect the rights of a data subject; and

  3. the commission or continuance of such act or practice, unless restrained, will cause grave and irreparable injury to a data subject.86

Hence, if an ex parte CDO was issued against TFH, WCPHC, as the PIP of TFH, would be legally bound to cease all verification activities through the Orb in compliance with the CDO.

This outcome demonstrates the accountability structure established under the DPA, where the PIC remains primarily responsible for ensuring lawful processing and for the acts of its processors, while the PIP is likewise bound to act only upon the PIC’s lawful instructions. The suspension of WCPHC’s verification activities, as a consequence of the CDO directed at TFH, therefore illustrates the operational interdependence between the two entities and reinforces that accountability under the DPA extends beyond contractual boundaries to all processing activities carried out within the PIC-PIP relationship. While the Commission appreciates WCPHC’s assertion that the issuance of an ex parte CDO was not the Commission’s intention, the foregoing conclusion nevertheless stands.

Accordingly, it is indisputable that the notice and due process afforded to TFH effectively extend to WCPHC, given that both entities operate within a unified chain of responsibility in an outsourced data processing arrangement. Consequently, WCPHC is legally bound to comply with and suspend all its operations pursuant to the CDO dated 23 September 2025, given that it functions as TFH’s delegated PIP, and is subject to the same regulatory directives and orders imposed upon its PIC, TFH. Lastly, the duty to ensure receipt and compliance with regulatory mandates and orders rests upon TFH, being the PIC. Such responsibility cannot be imputed to the Commission, as the PIC bears primary accountability under the DPA for ensuring that all obligations and directives are duly observed and implemented. Nonetheless and for administrative prudence, the Commission is providing WCPHC a copy of this Resolution to facilitate coordination with TFH, its PIC.

II. TFH’s processing is unnecessary and excessive

The Commission, in its CDO dated 23 September 2025, has already explained in detail the reasons why TFH’s processing of biometric data specifically the iris scans and facial images of data subjects violated the principle of proportionality, among others.87 The same reasoning still stands. However, TFH’s assertions in its Comment must be addressed, particularly that:

xxx the defined purpose of the Orb’s biometric processing is not only to confirm whether an individual is a human, but also to provide a system capable of verifying whether that individual is a unique human, and to do so in a way that does not require revealing identifying characteristics about the particular individual.88 (Emphasis supplied)

Thus, it is now paramount to elaborate on why the claimed purpose to verify an individual is a unique human is necessary.

According to TFH, the processing of iris scans and facial images aims to provide a system capable of verifying whether an individual is a unique human, in a manner that does not require revealing identifying characteristics about a particular person.89 TFH further claims that it

City of Pasay, Philippines. 30 October 2025.

JOSE AMELITO S. BELARMINO II Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

GAC Counsel for Respondent

NAN Senior Director and Head of Government Relations & Public Policy

NTM Associate General Counsel

JPW Data Protection Officer

AAC Counsel for WCPH Corporation

CID Enforcement Division General Records Unit

National Privacy Commission

Footnotes

  1. Application for the Issuance of the Cease and Desist Order dated 07 May 2025. ↩

  2. Minute Resolution CID CDO No. 25-001, dated 08 May 2025. ↩

  3. Letter dated 19 May 2025 signed by TFH in relation to CID CDO No. 25-001. ↩

  4. Clarificatory Hearing CID CDO No. 25-001, Adju-25-00178, 23 May 2025. ↩

  5. Minute Resolution dated 23 May 2025, CID CDO 25-001. ↩

  6. TFH Response Letter dated 08 June 2025 in compliance to Minute Resolution dated 23 May 2025. ↩

  7. See email from NM dated 30 June 2025 at 12:43 pm. ↩

  8. See email from NM dated 30 June 2025 at 6:23 pm. ↩

  9. Minute Resolution dated 08 May 2025, CID CDO 25-001. ↩

  10. TFH’s Supplement Comment/Opposition (To the National Privacy Commission [NPC] Complaints and Investigation Division’s [CID] Application for Issuance of Cease-and-desist Order dated 07 May 2025) dated 18 July 2025. ↩

  11. Minute Resolution dated 04 August 2025, CID CDO No. 25-001. ↩

  12. NPC CID’s Comment (to the 19 May 2025, 8 June 2025, and 18 July 2025 Submissions and all and the declarations made by Tools for Humanity during the Clarificatory Hearing and Onsite Visit Conferences) dated 18 August 2025. ↩

  13. Minute Resolution dated 04 August, CID CDO No. 25-001. ↩

  14. Cease and Desist Order dated 23 September 2025 CID CDO No. 25-001. ↩

  15. NPC Enforcement Division Compliance Letter to TFH dated 08 October 2025. ↩

  16. TFH’s response letter dated 11 October 2025 to NPC Enforcement Division Compliance letter dated 08 October 2025 ↩

  17. Id. ↩

  18. Electronic Filing, sent to adjudication@privacy.gov.ph on 16 October 2025 at 10:17pm. ↩

  19. Cease and Desist Order (CDO) In the matter of World App Processing of Personal Information dated 23 September 2025. ↩

  20. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, Section 11, Chapter III (2012). ↩

  21. Id at Section 16. ↩

  22. Cease and Desist Order (CDO) In the matter of World App Processing of Personal Information dated 23 September 2025. ↩

  23. TFH’s Comment dated 15 October 2025, in compliance with NPC CDO dated 23 September 2025. ↩

  24. Electronic Filing, sent to adjudication@privacy.gov.ph on 16 October 2025 at 10:17pm. ↩

  25. TFH’s Comment dated 15 October 2025, at par. 51, in compliance with NPC CDO dated 23 September 2025. ↩

  26. Id at par. 53. ↩

  27. Id at par. 67. ↩

  28. Id at par. 74. ↩

  29. Id at par. 75. ↩

  30. Id at par. 127. ↩

  31. TFH’s Comment dated 15 October 2025, at par. 139, in compliance with NPC CDO dated 23 September 2025. ↩

  32. Id at par. 142. ↩

  33. Id at par. 152. ↩

  34. Id at par. 155. ↩

  35. Id at par. 164. ↩

  36. Id at par. 167. ↩

  37. TFH’s Comment dated 15 October 2025, at par. 169, in compliance with NPC CDO dated 23 September 2025. ↩

  38. Id at par. 180. ↩

  39. Id at p. 46. ↩

  40. WCPHC’s Comment dated 16 October 2025, at par. 28. ↩

  41. Id at par. 38. ↩

  42. Id at p. 40. ↩

  43. Order, In the Matter of World App Processing of Personal Information dated 20 October 2025. ↩

  44. Compliance (Re: Order dated 20 October 2025) dated 24 October 2025. ↩

  45. Id at par. 4. ↩

  46. Id at par. 6. ↩

  47. Id at par. 7. ↩

  48. Id at p. 9. ↩

  49. Manifestation of Tools for Humanity (Re: Submission of Apostilled Documents) dated 24 October 2025. ↩

  50. NPC Circular No. 20-02, known as the Rules on the Issuance of Cease and Desist Order of the National Privacy Commission, Section 12. ↩

  51. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, Section 3 (H), Chapter I (2012). ↩

  52. WCPHC’s Comment dated 16 October 2025, at par. 7. ↩

  53. Id at par. 46. ↩

  54. Implementing Rules and Regulations of the Data Privacy Act of 2012, Rule X; Cambridge Dictionary, Available at https://dictionary.cambridge.org/us/dictionary/english/outsourcing (last accessed 07 November 2025) ↩

  55. WCPHC’s Comment dated 16 October 2025, at par. 31. ↩

  56. Id. ↩

  57. Id. at par. 39. ↩

  58. Id. ↩

  59. Id. at par. 7. ↩

  60. See Transcription, Clarificatory Hearing CID CDO No. 25-001, Adju-25-00178, 23 May 2025. ↩

  61. WCPHC’s Comment dated 16 October 2025, at par. 31. ↩

  62. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, Section 3 (i), Chapter I (2012). ↩

  63. Id. Section 21. ↩

  64. Id. Section 21; Implementing Rules and Regulations of the Data Privacy Act of 2012, Rule XII. ↩

  65. Implementing Rules and Regulations of the Data Privacy Act of 2012, Rule X, Section 43 and 44. ↩

  66. Implementing Rules and Regulations of the Data Privacy Act of 2012, Rule X. ↩

  67. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, Section 21, Chapter VI (2012). ↩

  68. Implementing Rules and Regulations of the Data Privacy Act of 2012, Rule X, Section 44 (b)(8). ↩

  69. WCPHC’s Comment dated 16 October 2025, at par. 34. ↩

  70. Sharon Flores-Concepcion v. Judge Liberty Castaneda, Regional Trial Court, Branch 67, Paniqui, Tarlac, A.M. No. RTJ-15-2438 [Formerly OCA I.P.P No. 11-3681-RTJ], (September 02, 2020); Haydee C. Casimiro v. Filipino T. Tandog, G.R. No. 146137, (June 08, 2005). ↩

  71. Id. ↩

  72. Id. ↩

  73. Id at par. 36. ↩

  74. Id. ↩

  75. WCPHC’S Comment dated 15 October 2025, at par. 35.3. ↩

  76. Id at par. 35.4 to 35.5. ↩

  77. See Transcription of Clarificatory Hearing dated 23 May 2025, at p. 12. ↩

  78. Clarificatory Hearing dated 23 May 2025. ↩

  79. See Transcription of Clarificatory Hearing dated 23 May 2025, at p. 12. ↩

  80. See Transcription of Clarificatory Hearing dated 23 May 2025, at p. 57 to 58. ↩

  81. Id. ↩

  82. Minette Baptista v. Rosario Villanueva, G.R. No. 194709, (July 31, 2013). ↩

  83. NPC Circular No. 20-02 or the Rules on the Issuance of Cease and Desist Orders of the National Privacy Commission. ↩

  84. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, Section 7 (c), Chapter II (2012). ↩

  85. NPC Circular No. 20-02 or the Rules on the Issuance of Cease and Desist Orders of the National Privacy Commission, Section 4. ↩

  86. Cease and Desist Order (CDO) In the matter of World App Processing of Personal Information dated 23 September 2025. ↩

  87. TFH’s Comment dated 15 October 2025, at par. 148, in compliance with CDO dated 23 September 2025. ↩

  88. Id. ↩

  89. Id, at par. 152.2. ↩

Backlinks