NPC Issuance Wiki

NPC 25-176: BSB v. Meta Platforms Inc. (Facebook Philippines)

Issued Resolution

Source

Source Tags

  • Motion for Reconsideration, Section 16, Rights of the Data Subject, Right to Ensure, Exhaustion of Administrative Remedies, Substantial Evidence, Social Media Account

Resolution Text

BSB,

Complainant,

-versus-

META PLATFORMS INC. (FACEBOOK PHILIPPINES),

Respondent.

NPC 25-176

For: Violation of the Data Privacy Act of 2012

x----------------------------------------------------x

RESOLUTION

BELARMINO, D.P.C.;

Before the Commission En Banc (Commission) is the Motion for Reconsideration (MR) filed by BSB (Complainant),1 assailing the Decision dated 14 October 2025 issued by the Legal and Enforcement Office (LEO).2

Facts

Pursuant to Section 3, Rule VIII of the 2021 National Privacy Commission (NPC) Rules of Procedure (ROP),3 as amended, which authorizes the LEO Director to dismiss a complaint outright on any of the grounds enumerated under Rule IV, Section 1, the LEO issued a Decision dismissing the complaint for “failing to present sufficient, clear and convincing evidence to hold the Respondent liable for the alleged violation of Data Privacy Act”.4

The dispositive portion of the Decision reads:

WHEREFORE, all premises considered, this complaint is hereby DISMISSED WITHOUT PREJUDICE to the refiling of the same complaint with the National Privacy Commission in accordance with the NPC Rules of Procedure and to the filing of civil, criminal, or administrative cases with the appropriate courts or bodies.

SO ORDERED.5

On 15 October 2025, the Complainant received the foregoing Decision through electronic mail.6 Under the 2021 NPC ROP, as amended, the Decision becomes final and executory fifteen (15) calendar days from notice thereof with proof of service on the adverse party.7 Thus, the Complainant had until 30 October 2025 to file his MR.

On 17 October 2025, the Complainant filed his MR via email and on 20 October 2025, he paid the required filing fee for a Motion for Reconsideration as required under National Privacy Commission (NPC) Circular 2023-01 (Schedule of Fees and Charges of the NPC).8

Accordingly, the MR is timely filed.

Issue

Whether the Complainant’s Motion for Reconsideration filed on 17 October 2025 should be granted.

Discussion

Under Section 5, Rule VIII of the 2021 NPC ROP, as amended, motions for reconsideration regarding decisions issued by the LEO must be filed with the LEO and subsequently endorsed to the Commission for resolution. Accordingly, the Motion for Reconsideration is now presented before the Commission En Banc.

The Commission resolves to deny the Complainant’s motion for lack of merit.

Upon careful review, the Commission finds that the arguments raised by the Complainant are mere reiterations of matters previously evaluated and resolved by the LEO. No new facts, issues, or legal grounds have been presented that would warrant a reversal or modification of the assailed Decision.

The Commission also deems it appropriate to address one of the issues raised in the MR, particularly the Complainant’s assertion of his alleged right to the permanent deletion or deactivation of Facebook accounts associated with his former mobile numbers. The Complainant avers:

The continued existence of these Facebook accounts, which still contain information directly identifying me, no longer serves any lawful or legitimate purpose. It constitutes a continuing privacy risk since I cannot exercise control or consent over those accounts. I therefore invoke my Right to Erasure (Right to Blocking or Deletion) under Section 16 (f) of the Data Privacy Act of 2012 (R.A. 10173), requesting the permanent deletion or deactivation of these accounts to prevent future unauthorized use of my personal data.9

Indeed, the Data Privacy Act of 2012 (DPA) recognizes the rights of data subjects, including the right to erasure. Section 16(e) of the DPA provides:

Section 16. Rights of the Data Subject. – The data subject is entitled to:

x x x

(e) Suspend, withdraw or order the blocking, removal or destruction of his or her personal information from the personal information controller’s filing system upon discovery and substantial proof that the personal information are incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes or are no longer necessary for the purposes for which they were collected. x x x10

Given that it is already established that data subjects have the right to request or order the deletion of their personal information, it is incumbent upon the Complainant to first establish, by substantial evidence, that the personal data he seeks to have deleted indeed pertains to him.

In Gatmaytan v. Dolor,11 the well-established principle regarding the burden of the party alleging a fact is concisely restated:

As basic as the previously-discussed principles on appeal as a statutory privilege, finality of judgments, and service of papers, is the principle that “a party who alleges a fact has the burden of proving it.” A mere allegation will never suffice: “a mere allegation is not evidence, and he who alleges has the burden of proving the allegation with the requisite quantum of evidence.” Logically, a party who fails to discharge his or her burden of proof will not be entitled to the relief prayed for.12

Consistent with the LEO Decision, Complainant has the burden of proving by substantial evidence the allegations in the Complaint. The basic rule is that mere allegation is not evidence and is not equivalent to proof. Likewise, charges based on mere suspicion and speculation cannot be given credence.13 In this case, the Complainant failed to prove the same by substantial evidence.

The Complainant failed to substantiate that the mobile numbers referenced were his, or that he created or controlled the Facebook accounts allegedly linked to those numbers. The Complainant merely alleged, to wit:

My complaint involves Facebook accounts registered under my former mobile numbers (0939xxxxxxx and 0967xxxxxxx). These SIM cards have long been inactive-unused since around 2018 to 2023 and are no longer in my possession or control. When I inquired with my telecommunications provider, I was formally informed that these numbers are no longer found in their database, meaning the records have already been removed or cleared due to long-term inactivity.14

The Complainant, to support his claims, only attached —“(1) screenshots of the Facebook password reset page showing that the account is still linked to my old mobile number (0939xxxxxxx); (2) screenshots of SMS messages; (3) record book; (4) old sim (0967xxxxxxx); and (5) old conversation on messenger”.15 Such supporting evidence failed to specifically support that such Facebook accounts nor the mobile number associated to such was his and his personal information. Complainant’s own admission that the alleged accounts were not under his real name16 further undermines his claim. Consequently, the Complainant failed to present substantial evidence to prove that the accounts contain his personal data or that he is entitled to the relief sought.

Moreover, the Commission likewise notes the Complainant’s failure to comply with the requirement of exhaustion of administrative remedies under Section 2, Rule II of the 2021 NPC ROP, as amended, which provides:

No complaint shall be given due course unless it has been sufficiently established and proven that:

  1. the complainant has informed, in writing, the personal information controller (PIC), personal information processor (PIP), or concerned entity of the privacy violation or personal data breach to allow for appropriate action on the same; X X X

The NPC may waive any or all of the requirement of this Section at its discretion upon (a) good cause shown, properly alleged and proved by the complainant; or (b) if the allegations in the complaint involve a serious violation or breach of the Data Privacy Act of 2012, taking into account the risk of harm to the affected data subject17 X X X (Emphasis Supplied)

The Complainant merely alleged that he reported and requested the deletion of the said accounts to Facebook through its “support/ help center”,18 yet submitted no proof of such report or any written notification. Absent such proof, the Commission cannot determine whether the PIC, in this case, the Respondent, was given an opportunity to act on the matter or whether the PIC neglected or refused to address the Complainant’s request. Compliance with this procedural requirement is essential, as it allows the concerned entity to take corrective action without undue resort to regulatory intervention.

The Supreme Court has consistently held that procedural rules are integral to the orderly administration of justice. In Lazaro v. Court of Appeals, the Court declared:

Procedural rules are not to be belittled or dismissed simply because their non-observance may have resulted in prejudice to a party’s substantive rights. Like all rules, they are required to be followed except only for the most persuasive of reasons …19

In the present case, the Complainant failed to demonstrate any compelling reason or substantial justification that would justify a relaxation of the procedural rules or a waiver of the exhaustion requirement provided in the Section 2, Rule II of the 2021 NPC ROP, as amended.20 The Complainant presented no good cause nor any indication of a serious violation that would merit the Commission’s discretionary relaxation of procedural rules.

Accordingly, the Complainant must first establish that he exercised his right to order the deletion or removal of his personal data under Section 16(e) of the DPA directly against the Respondent. Only upon showing by substantial evidence that Complainant’s request was denied on the basis of any company policy or verification process, or left unacted upon without valid reason or justification, may the Complainant properly seek recourse by filing a complaint against the Respondent before the Commission.

In view of the foregoing, and as resolved during the Adjudication Meeting held on 20 November 2025, the Commission hereby rules as follows:

WHEREFORE, premises considered, the Commission resolves to DENY the Motion for Reconsideration filed by the Complainant, BSB on 17 October 2025 and AFFIRMS the Decision of the Legal and Enforcement Office dated 14 October 2025.

This is without prejudice to the refiling of the same complaint with the National Privacy Commission in accordance with the NPC Rules of Procedure, and without prejudice to the filing of civil, criminal, or administrative cases with the appropriate courts or bodies.

SO ORDERED.

City of Quezon, Philippines.

20 November 2025

JOSE AMELITO SUTTON BELARMINO II

Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA

Privacy Commissioner

NERISSA N. DE JESUS

Deputy Privacy Commissioner

Copy furnished:

BSB

Complainant

META PLATFORMS INC.

(FACEBOOK PHILIPPINES)

Respondent

LEO, CID, END, GRU

National Privacy Commission

Footnotes

Footnotes

  1. Motion for Reconsideration filed by Complainant BSB, received by the Commission via email on 17 October 2025. ↩

  2. BSB v. Meta Platforms Inc. (Facebook Philippines), NPC 25-176, dated 14 October 2025. ↩

  3. Rule VIII, Section 3, 2021 Rules of Procedure of the National Privacy Commission, As Amended. ↩

  4. BSB v. Meta Platforms Inc. (Facebook Philippines), NPC 25-176, dated 14 October 2025. ↩

  5. BSB v. Meta Platforms Inc. (Facebook Philippines), NPC 25-176, at p.6, dated 14 October 2025. ↩

  6. Records, Delivery Receipt, NPC 25-176. ↩

  7. Rule VIII, Section 5, 2021 Rules of Procedure of the National Privacy Commission, As Amended. ↩

  8. MYEG Payment Confirmation, Reference Number 4BYTBYGJU7 dated 20 October 2025, MYEG Payment 735110172025709043 dated 17 October 2025. ↩

  9. Motion for Reconsideration filed by Complainant BSB on 17 October 2025. ↩

  10. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, Section 16 (e), Chapter IV (2012). ↩

  11. Gatmaytan v. Dolor, G.R. No. 198120, 20 February 2017. ↩

  12. Id. ↩

  13. BSB v. Meta Platforms Inc. (Facebook Philippines), NPC 25-176, at p.6, dated 14 October 2025. ↩

  14. Motion for Reconsideration filed by Complainant BSB on 17 October 2025. ↩

  15. Complaint-Affidavit executed by Complainant BSB on 17 September 2025. ↩

  16. Complaint-Affidavit executed by Complainant BSB on 17 September 2025. ↩

  17. Rule II, Section 2, 2021 Rules of Procedure of the National Privacy Commission, As Amended. ↩

  18. Complaint-Affidavit executed by Complainant BSB on 17 September 2025. ↩

  19. Gabriel Lazaro v. Court of Appeals, G.R. No. 137761, 06 April 2000. ↩

  20. Rule II, Section 2, 2021 Rules of Procedure of the National Privacy Commission, As Amended. ↩

Backlinks

  • No backlinks found