COMMISSION DECISIONS/RESOLUTIONS/ORDERS

NPC 21-010 to NPC 21-015	MVC, et al. v. DSL Tags: Compliance with a Legal Obligation (Section 12 (c)), Jurisdiction, Motion for Reconsideration, Unauthorized Disclosure (Section 32)
NPC 21-167	MAF v. Shopee Philippines, Inc. Tags: Unauthorized Purposes (Section 28), Unauthorized Disclosure (Section 32), Proportionality, Principle of Accountability, Personal Information Processor, Legitimate Interest (Section 12 (f), Nominal Damages
NPC SS 22-001 and NPC SS 22-008	In re: Commission on Elections Tags: Unauthorized Access or Intentional Breach (Section 29), Sua Sponte Investigation, Breach Notification, Burden of Proof, Principle of Accountability, Security of Personal Information, Personal Information Controller, Personal Information Processor, Substantial Evidence, Concealment of Security Breaches Involving Sensitive Personal Information (Section 30); Scope of the DPA (Section 4); Sensitive Personal Information
NPC 19-030 and NPC 19-132	CL vs. DDZ and DM vs. DDZ Tags: Exhaustion of Remedies (Sec. 4 NPC Circular No. 16-04) ; Legitimate Interest ; Unauthorized Access or Intentional Breach (Section 29)
NPC 18-205	In Re: Medicard Philippines, Inc Tags: Compliance with the NPC Circular 16-03 (Personal Data Breach Management)
NPC SS 21-005	In Re: Oriente Express Techsystem Corporations (CASHALO) and its Responsible Officers Tags: Failure to substantiate allegations, transparency, legitimate purpose, proportionality, Unauthorized processing of personal information and sensitive personal information, Guidelines on the processing of personal data for loan-related transactions
NPC 18-142	MSH vs. RSF & TCC Tags: Indemnification, Right to rectification
NPC 19-278	JRO vs. MSMI Tags: Exception to the exhaustion of administrative remedies, Legitimate interest, Criteria for lawful processing of personal information
NPC 21-006	Wefund Lending Corp. Tags: Unauthorized Processing (Section 25), Legitimate interest (Section 12 f)), Extent of Liability (Section 34), Substantial Evidence, Gross Negligence, Sua Sponte Investigation, Temporary Ban, Legitimate Purpose, Proportionality, Transparency
NPC 21-096	AC v. ISG Tags: Outright Dismissal, Legitimate Purpose, Proportionality, CCTV Guidelines, Form and Content of the Complaint
NPC 21-064	GSS v Global Dominion Financing Inc. Tags: Outright Dismissal, Exhaustion of Remedies
NPC 19-465	GJJ v. Easy Peso Tags: Burden of proof, Electronic Evidence, Unauthorized Processing (Section 25), Contract of Adhesion
NPC 21-016	EDF v. BPI Tags: Burden of proof, Substantial Evidence
NPC 21-031	JCB v. FRL Tags: Exhaustion of remedies, Form and contents of the Complaint, Outright Dismissal, Defense of Legal Claims (Section 13 (f)), Malicious Disclosure (Section 31), Unauthorized Disclosure (Section 32)
NPC 21-032	JDB v. JME Tags: Exhaustion of remedies, Form and contents of the Complaint, Outright Dismissal, Defense of Legal Claims (Section 13 (f)), Malicious Disclosure (Section 31), Unauthorized Disclosure (Section 32)
NPC 19-142	MLF v. Grab Philippines Tags: Outright dismissal, Unauthorized Purposes (Section 28)
NPC CN 19-501	MEC vs. Robocash Finance Corporation Tags: Exception to the Exhaustion of Remedies; Failure to substantiate allegations; Substantial evidence.
NPC CN 19-187	JGO vs. Fynamics Lending, Inc (Pondo Peso) Tags: Quitclaim.
CID 18-D-009	JLB vs. Security Bank Corporation Tags: Substantial Evidence; Burden of proof and burden of evidence; Unauthorized Disclosure; Combination or Series of Acts; Security of Personal Information; Subcontract of Personal Information.
NPC 19-569	MPM vs. U-Peso.Ph Lending Corporation (Pera4U) Tags: Failure to substantiate allegations; Temporary Ban on Processing Personal Data.
NPC 18-074	ECV vs. CVF Tags: Exhaustion of Remedies, Unauthorized Processing of Sensitive Personal Information.
NPC 19-0048	GJ s. VMJ & MTP Tags: Exhaustion of Remedies, Burden of Proof, Legitimate Interest.
NPC 21-086	RTB v. East West Banking Corporation Tags: Fulfillment of a Contract (Section 12 (b))
NPC 19-134	VVC v. CJB Tags: Exhaustion of remedies, Consent, Contract of Adhesion, Unauthorized Processing (Section 25), Unauthorized Disclosure (Section 32)
NPC 18-109	ACN v DT Tags: Unauthorized Access or Intentional Breach (Section 29), Malicious Disclosure (Section 31)
CID 18-D-012	JBD vs. JI and VVV Tags: Unauthorized Processing (Section 25)
NPC 18-010	RLA V. PLDT Enterprise Tags: Personal Information Controller; Personal Information Processor; consent; legal obligation; good faith; processing for unauthorized purposes; unauthorized disclosure; gross negligence.
12-17-2020	FAT vs. XXX Tags: Exhaustion of remedies, Unauthorized disclosure of personal information, Rendition of Decision, Outright Dismissal.
12-17-2020	BGM vs. IPP Tags: Data subject’s right to access, criteria for lawful processing of personal information, legitimate interest, purpose, and proportionality, DPA should not be seen as curtailing the practice of law in litigation, restitution for the aggrieved party, and nominal damages.
NPC 19-910	IN RE: FLI OPERATING ABC ONLINE LENDING APPLICATION Tags: Transparency, Proportionality, Online Lending Application, Sua Sponte Investigation, Unauthorized Processing (Section 25), Incurring Criminal Liability, Consent, Retention of Personal Data, Personal Information Controller, Principle of Accountability, Processing for Unauthorized Purposes (Section 28), Extent of Liability (Section 34), Gross Negligence
NPC 19-621	AMP v HXXX Tags: Transparency, Online Lending Application, Substantial Evidence, Temporary Ban, Consent
11-19-2020	SCM vs. XXX Tags: Data privacy rights, Section (4) of the Data Privacy Act, unlawful processing, General Data Principles, privacy policy.
NPC 19-528	MNLC vs PXXX Corporation Tags: Proportionality, Jurisdiction, Exhaustion of Remedies, Consent, Legitimate Interest (Section 12 (f)), Unauthorized Processing (Section 25), Extent of Liability (Section 34), Nominal Damages
09-21-2020	CBI vs. XXX Tags: Burden of Evidence, Burden of Proof, Substantial Proof, Compliance to DPA, Rendition of Decision
07-23-2020	ECA vs. XXX Tags: Right to Data Privacy, Criteria for Lawful Processing of Personal Information, Appointing a DPO, Award, Nominal Damages, Principle of Transparency, Rendition of Decision, Unauthorized Processing
CID 17-005a	ECB vs. SSMSM Tags: Disclosure of the detailed record of calls to a certain mobile user.
NPC 19-1221	RABD v FXXX Tags: Online Lending Application, Sua Sponte Investigation, Substantial Evidence
NPC 19-1222	RBD vs. FCASH GLOBAL LENDING, INC. (FAST CASH) Tags: Online Lending Application, Sua Sponte Investigation, Substantial Evidence
06-18-2020	JGO vs. XXX Tags: Amicable settlement, Quitclaim .
NPC 18-141	MHH v VCF SPFS Tags: Substantial Evidence, Intent to Process
NPC 19-450	JRG v CXXX Tags: Transparency, Substantial Evidence, Temporary Ban, Consent
NPC 19-498	JVA v UXXX Tags: Transparency, Consent, Substantial Evidence, Temporary Ban
NPC 19-498	JVA vs. U-PESO.PH LENDING CORPORATION (UPESO) Tags: Transparency Online Lending Application, Jurisdiction, Consent, Substantial Evidence, Temporary Ban
06-09-2020	BEM vs. GFC Tags: substantial evidence, quantum of proof required, rendition of decision
NPC 18-152	MRS vs. NATIONAL CONCILIATION AND MEDIATION BOARD (NCMB) AND DEPARTMENT OF LABOR AND EMPLOYMENT (DOLE) Tags: Exhaustion of remedies
NPC 18-155	HNT vs. EASTWEST BANK Tags: Alternative Dispute Resolution
NPC 18-066	B.Q.N. vs NUQ Inc Tags: Not all processing and disclosure of personal information are violations of the DPA, criteria for lawful processing, processing of personal information shall be permitted only if not otherwise prohibited by law, processing of information is permissible if the processing is necessary for compliance with a legal obligation to which the personal information controller is subject, principles of transparency, legitimate purpose, and proportionality
CID 18-E-040	KGR v. BB et al. Tags: Personal Information Controller, General Data Privacy Principles, Processing, Substantial Evidence
NPC 17-015	ID Y.S. v DS BANK Tags: Personal Data Breach Management, Who may file a complaint, Rights of Data Subjects
CID 17-K-003	KRL-v.-University Tags: Exhaustion of Remedies, Alternative Dispute Resolution, Privacy Impact Assessment, Accessing Due to Negligence (Section 26), Defense of Legal Claims (Section 13(f)) , Substantial Evidence
CID 17-K-003	KRL vs. TRINITY UNIVERSITY OF ASIA, AA, MC, NCB, RG GV, GCT, RR, MR, PB Tags: Exhaustion of Remedies, Alternative Dispute Resolution, Privacy Impact Assessment, Accessing Due to Negligence (Section 26), Defense of Legal Claims (Section 13(f)) , Substantial Evidence
CID 18-F-064	RBG vs. CB Tags: Substantial Evidence
NPC 19-258	CPM vs. CASHWAGON Tags: Outright Dismissal
08-15-2019	In Re: DATA BREACH INVOLVING THE COMELEC DATA PROCESSING SYSTEM IN WAO, LANAO DEL SUR Tags: Safekeeping, Concealment of Data Breach, Documentation
NPC 17-047	JV vs. JR Tags: Form and contents of the Complaint, Outright Dismissal
NPC 17-018	EA and TA v EJ Tags: Legitimate purpose, Proportionality, Unauthorized Processing (Section 25), Processing, Defense of Legal Claims (Section 13 (f))
	IBC vs. PBI Tags: Lawful Processing of Personal Information, Phishing, Right to Rectification, Right to Correct Personal Information

NPC 18-037	In re: Acesite (Phils) Hotel Corporation Tags: Privacy Impact Assessment
CID BN 17-020 & CID BN 17-029	In re: Breach Notification Report of Sun Life of Canada Tags: Personal Data Breach Management (NPC Circular 16-03)
NPC BN 18-085	In re: La Salle Greenhills School Tags: Privacy Impact Assessment
NPC CDO 22-001	CID vs. PH-Check.com Tags: Issuance of Cease and Desist Orders (NPC Circular No. 20-02) ; General Data Privacy Principles (Section 11) ; Rights of the Data Subject (Section 16)
NPC BN 22-094	In re: Equicom Savings Bank Tags: Personal Data Breach Management (NPC Circular 16-03) ; Mandatory breach notification; Postponement of notification
NPC BN 21-185	In re: Costa Crociere Tags: Personal Data Breach Management (NPC Circular 16-03) ; Mandatory breach notification; Determination of the Need to Notify; Alternative means of notification.
NPC BN 18-006	In re: Business World Inc. Tags: Mandatory Breach Notification, Notification of Data Subjects
NPC BN 18-045	In re: University of the Philippines – Visayas Tags: Mandatory Breach Notification, Security Incident
NPC BN 18-179	In re: ABS-CBN Corporation Tags: Mandatory Breach Notification, Notification of Data Subjects, Security of Personal Information
NPC 21-010 to NPC 21-015	MVC, et al. v. DSL Tags: Compliance with a Legal Obligation (Section 12 (c)), Jurisdiction, Motion for Reconsideration, Unauthorized Disclosure (Section 32)
NPC 19-030 and NPC 19-132	CL vs. DDZ and DM vs. DDZ Tags: Motion for Reconsideration ; Consolidation of Cases
NPC 19-278	JO vs MSM, Inc. Tags: Finality of the case, Failure to substantiate allegations
NPC 19-909	In Re: FCASH Global Lending, Inc., Operating Fastcash Lending Application Tags: NPC Rules of Procedure, Exhaustion of Administrative Remedies, Litis Pendentia, Amicable Settlement and Alternative modes of dispute resolution, Liability of Corporate officers
NPC 19-438	RPR v. Edukasyon.ph Tags: Procedures in Security Incident or Personal Data Breach, Security Incident Management Policy, Notification of Data Subjects, Personal Information Controller
NPC 19-001	In re: Department of Foreign Affairs (DFA) – Passport Breach Tags: Security of ersonal Information; Technical Security Measures
NPC 16-004	CBP v. Orani Water District Tags: Personal Information Controller, NPC Mandate, Consent, Legitimate Purpose, Notification of Data Subjects
NPC 21-086	RTV v. East West Banking Corporation Tags: Nominal Damages
NPC BN 19-115	In re: Sun Life of Grepa Financial, Inc Tags: Compliance with the NPC Circular 16-03 (Personal Data Breach Management)
NPC BN 18-069	In re: Professional Regulations Commission (PRC) Tags: Personal data breach; Logbook policy of government agencies
CID BN 18-086	In re: Tulay sa Pag-Unlad, Inc Tags: Notification to the Commission and affected data subjects
NPC 18-038	FGP vs. Maersk Global Center Philippines, Ltd. Tags: Right to access, Nominal damages
NPC 19-605	GMT vs Fcash Global Lending, Inc (Fast Cash) Tags: General Data Privacy Principles, Legitimate Interest, Processing of Personal Information for Unauthorized Purpose, Substantial Evidence, Extent of Liability, Nominal Damages, Exhaustion of Remedies
NPC BN 17-048	In re: Social Security System Tags: Compliance with the NPC Circular 16-03 (Personal Data Breach Management)
CID BN 17-034	In re: Breach Notification Report of Philippine National Bank (PNB) Tags: Compliance with the NPC Circular 16-03 (Personal Data Breach Management)
NPC 18-010	RLA V. PLDT Enterprise Tags: Personal Information Controller, Consent, Processing Necessary for Compliance with a Legal Obligation (Section 12 (c)), Processing for Unauthorized Purposes (Section 28), Malicious Disclosure (Section 31), Unauthorized Disclosure (Section 32), Gross Negligence
NPC BN 21-078	In re: Bombardier Transportation Philippines, Inc. Tags: BBreach Notification, Principle of Accountability, Procedures in Security Incident or Personal Data Breach, Notification of the Commission, Notification of Data Subjects
CID 18-K-200	CCMC v QXXX Tags: Breach Notification, Security Incident Management Policy
03-25-2021	CID v. PNP Tags: Cease and Desist Order
02-23-2021	MNLC vs PXXX Corporation Tags: Temporary Ban on Processing, Public Interest
NPC BN 17-002	In re: Data Breach Involving the COMELEC Data Processing System in Wao, Lanao Del Sur Tags: Data Breach Notification Report, general rule to notify the affected data subjects, security incident management policy, and security measures.
NPC BN 20- 049	In re: Health Delivery System, Inc. Tags: Notification of the data subjects, Exemption from the notification requirement
NPC BN 18-223	In re: Hennes & Mauritz Tags: Requirements of notification, When notification should be done? When delay is prohibited?
NPC BN 18-186	In re: Manila Shared Services Employees Credit and Savings Cooperative Tags: Criteria when notification is required, Breach Notification, Reasonable and Appropriate Measures to Protect Personal Information
NPC 19-1201	D.N.T. v. K.K. et. al. Tags: Commission’s power to facilitate or to enable settlement of complaints through alternative dispute resolution processes, rights of the Data Subject, Right to Access, PIC, is required to develop, implement, and review policies and procedures, to ensure that the aforesaid policies and procedures shall enforce and effectively implement the provisions of the DPA, including those pertaining to the rights of data subjects, definition of data subject
NPC BN 18-037	In re: Acesite (Phils.) Hotel Corporation Tags: Personal data breach, availability breach, Security incident, Scope of mandatory breach notification
NPC BN 18-183	In re: Sun Life Canada (Phil.) Inc Tags: Personal Data Breach Management
NPC BN 17-038	In re: Tuitt Philippines Tags: Documentation, Proof of measures undertaken to prevent recurrence of incident, Security Incident Management Policy, Unauthorized disclosure of Wifi credentials
NPC BN 17-032	In Re: Social Security System Tags: Documentation, data breach management, organizational, physical, and technical security measures, data privacy policies, Notification to the Commission, Security of Personal Information
NPC BN 20-124	In re: E-Science Corporation Tags: Breach Notification, Notification of Data Subjects
NPC BN 20-157	In re: Batangas Bay Carriers, Inc. Tags: Breach Notification, Notification of Data Subjects, Substantial Evidence, Mandatory Breach Notification
NPC BN 20-208	In Re: Commission on Elections (COMELEC) Tags: Breach Notification, Notification of Data Subjects, Notification of the Commission
NPC BN 20-157	In re: Batangas Bay Carriers, Inc. Tags: Breach Notification, Notification of Data Subjects, Notification of the Commission
CID BN 17-021	In re: Breach Notification Report of Sun Life of Canada Tags: Breach Notification, Notification of Data Subjects, Exhaustion of remedies
NPC 17-K-001	JCR vs. GLOBE TELECOM, INC. Tags: Technical Security Measures
NPC BN 20-149	In re: National Privacy Commission Tags: Breach Notification, Notification of Data Subjects, Mandatory Breach Notification, Exemption from Notification Requirements
CID 17-K-004	CBI vs. XXX Tags: Substantial compliance, Burden of proof and burden of evidence, Compliance to the Data Privacy Act, Reasonable security measures
NPC BN 17-025	In re: Jobstreet (formerly CID BN 17- 025) Tags: Security measures, Personal Data Breach Management, Documentation, Security of Personal Information
NPC BN 18-217	In re: Infosys BPM-Philippines Tags: Breach Notification, Notification of the Commission
NPC BN 20-141	In re: Home Credit Consumer Finance Philippines, Inc. Tags: Notification of Data Subjects, obligation of the Personal Information Controller
NPC BN 20-208	In re: COMELEC Tags: Breach Notification, Notification of Data Subjects, Notification of the Commission, Alternative Means of Notification
CID BN 19-067	In re: University of the East Tags: When notification to the Commission should be done?, Procedure on which the personal information controller (PIC) must follow in notifying the affected data subjects affected by a personal breach, content of Data Breach Notification Report, alternative means of notification
CID BN 17-039	In re: Sun Life of Canada Tags: Notification and other requirements, general rule to notify the affected data subjects, Notification to the Commission, Documentation, Measures undertaken to prevent the recurrence of breach, exemption from notification
NPC 16-005	N.I.H. vs WSQ Medical Center et. al. Tags: The power of Commission to facilitate or enable settlement through the use of alternative dispute resolution processes, Compromise Agreement
CID BN 18-081	In re: Philippine Seven Corporation Tags: Security of Personal Information, notification and other requirements
NPC BN 20-170	In re: Travelpeople Ltd., Inc. Tags: Notification of data subjects of data breaches is the general rule, The data subjects shall be notified within seventy-two (72) hours upon knowledge of or reasonable belief by the personal information controller or personal information processor that a personal data breach has occurred, exemption or postponement will only be allowed in exceptional circumstances under Section 18(B) of NPC Circular No. 16-03, when notification is required, conditions necessitating mandatory breach notification, ransomware, interpretation of the DPA
NPC BN 20-167	In re: TravelServices, Inc. Tags: The data subjects shall be notified within seventy-two (72) hours upon knowledge of or reasonable belief by the personal information controller or personal information processor that a personal data breach has occurred., exemption or postponement will only be allowed in exceptional circumstances under Section 18(B) of NPC Circular No. 16-03, when notification is required, conditions necessitating mandatory breach notification, ransomware, interpretation of the DPA
NPC BN 20-101	In re: De La Salle Health Sciences Institute (DLSHSI) Tags: Definition of security incident and data breach, Forms of personal data breach
NPC BN 20-044	In Re: RITM Tags: Breach Notification, Personal data Breach
NPC 18-028	ANM vs MDMC Inc. Tags: Who may file a complaint , Rights of Data Subjects
NPC 19-908	In re: Unipeso Lending Company, Inc. Tags: Litis Pendentia, The power of the Commission to investigate on its own initiative, Time to plead, Application of Fresh Period Rule, Appeal
NPC 19-528	MNLC vs PXXX Corporation Tags: Proportionality, Temporary Ban, Consent
08-09-2019	ODC vs. ODB & EA Tags: Substantial Evidence, Transparency, Updating Terms & Conditions
07-25-2019	MFS vs. RJJ AND SJJ Tags: Motion for Reconsideration, On-site Examination

NPC BN 21-180	In Re: Enchanted Kingdom Inc. Tags: Personal Data Breach Management (NPC Circular 16-03) ; Obligations of the Personal Information Controller to notify; Mandatory notification; Postponement of Notification
NPC BN 21-097	In re: PowerVision EAP Inc Tags: Personal Data Breach Management (NPC Circular 16-03) ; Notification of Data Subjects ; Extension for submission of Documents
	Tags:
NPC BN 18-179	In re: ABS-CBN Corporation Tags: Mandatory Breach Notification, Notification of Data Subjects, Security of Personal Information
NPC 21-010 to NPC 21-015	MVC, et al. v. DSL Tags: Compliance with a Legal Obligation (Section 12 (c)), Jurisdiction, Motion for Reconsideration, Unauthorized Disclosure (Section 32)
NPC 19-438	RPR v. Edukasyon.ph Tags: Procedures in Security Incident or Personal Data Breach, Security Incident Management Policy, Notification of Data Subjects, Personal Information Controller
NPC 19-001	In re: Department of Foreign Affairs (DFA) – Passport Breach Tags: Security of ersonal Information; Technical Security Measures
NPC 16-004	CBP v. Orani Water District Tags: Personal Information Controller, NPC Mandate, Consent, Legitimate Purpose, Notification of Data Subjects
06-16-2021	IN RE: PILIPINAS2022.PH Initiated As A Sua Sponte NPC Investigation Into The Possible Data Privacy Violations Committed By Pilipinas2022.ph Tags: Filing of Application for CDO, functions and power of the National Privacy Commission, sua sponte, the grounds to be established by the applicant for the Commission to issue a CDO
CID 18-J-162	In re Facebook Forced Logout Tags: Jurisdiction of NPC, mandate of NPC, extraterritorial application of the DPA, content of the Data Breach Notification Report
CID BN 19- 034	In Re: Rokko & Associates, Inc. Tags: Content of the Data Breach Notification Report, notification to the Commission.
NPC BN 20-044	In Re: RITM Tags: Data Breach Response Team
NPC BN 20-116	In re: Saint Louis University Tags: Contents of the notification to the affected data subjects, notification requirements under Section 18 (C) of NPC Circular No. 16-03
NPC BN NO. 21-054	In re: BPI Philam Life Assurance Corporation Tags: Breach Notification, Notification of Data Subjects, Request for Extension
12-17-2020	IN RE: LISENSYA.INFO Initiated as an Independent NPC Investigation into the Possible Data Privacy Violations Committed by the website LISENSYA.INFO.
11-12-2020	IN RE: LISENSYA.INFO Initiated as an Independent NPC Investigation into the Possible Data Privacy Violations Committed by the website LISENSYA.INFO.
NPC 18-130	BOA v HXXX Tags: Electronic Evidence
NPC SS 20-001	IN RE: FAMILYHAN CREDIT CORPORATION Initiated as an Independent NPC Investigation into the Possible Data Privacy Violations Committed by Familyhan Credit Corporation Tags: Sua Sponte Investigation, Cease and Desist Order, Concealment of Security Breaches Involving Sensitive Personal Information (Section 30)
CID 18-D-012	JBD vs. JI and VVV Tags: Exhaustion of Remedies, Unauthorized Processing (Section 25), Submission of Additional Information
02-03-2020	In Re: GRAB PH SELFIE VERIFICATION AND IN-VEHICLE AUDIO AND VIDEO RECORDINIG CEASE AND DESIST