COMMISSION DECISIONS/RESOLUTIONS/ORDERS

NPC 21-086 RTB v. East West Banking Corporation
Tags: Lawful Criteria for Processing Personal Information; Fulfillment of a Contract.
NPC 19-134 VVC v. CJB
Tags: Exhaustion of remedies, Personal Data Sheet; Consent, Contract of adhesion.
06-01-2021 ACN v DT
Tags: Unauthorized Access, Intentional Breach, Malicious Disclosure, Lawful Critera to Process.
01-21-2021 JBD vs. JI and VVV
Tags: Unauthorized Processing under Section 25 of the DPA, Procedural due Process.
NPC 18-010 RLA V. PLDT Enterprise
Tags: Personal Information Controller; Personal Information Processor; consent; legal obligation; good faith; processing for unauthorized purposes; unauthorized disclosure; gross negligence.
NPC 18-010 RLA vs. PXE
Tags: Personal Information Controller; Personal Information Processor; consent; legal obligation; good faith; processing for unauthorized purposes; unauthorized disclosure; gross negligence.
12-17-2020 FAT vs. XXX
Tags: Exhaustion of remedies, Unauthorized disclosure of personal information, Rendition of Decision, Outright Dismissal.
12-17-2020 BGM vs. IPP
Tags: Data subject’s right to access, criteria for lawful processing of personal information, legitimate interest, purpose, and proportionality, DPA should not be seen as curtailing the practice of law in litigation, restitution for the aggrieved party, and nominal damages.
12-17-2020 IN RE: FLI OPERATING ABC ONLINE LENDING APPLICATION
Tags: Procedural due process, sua sponte investigation, power and mandate of the NPC, NPC’s power of original inquiry, acts that incur criminal liability, unauthorized processing of personal information and sensitive personal information under section 25 of the DPA, processing of personal information, personal information, informed consent, lawful criteria to process personal information, personal information controller, principle of accountability and concomitant obligations for Personal Information Controllers, noscitur a sociis, a statute must be so construed as to harmonize and give effect to all its provisions whenever possible, extent of liability, gross negligence
11-19-2020 AMP v HXXX
Tags: Criminal prosecution, temporary ban, Consent.
11-19-2020 SCM vs. XXX
Tags: Data privacy rights, Section (4) of the Data Privacy Act, unlawful processing, General Data Principles, privacy policy.
10-29-2020 MNLC vs PXXX Corporation
Tags: Jurisdiction, Exhaustion of remedies, Consent, Legitimate interest, Proportionality, Unauthorized Processing and Nominal Damages.
09-21-2020 CBI vs. XXX
Tags: Burden of Evidence, Burden of Proof, Substantial Proof, Compliance to DPA, Rendition of Decision
07-23-2020 ECA vs. XXX
Tags: Right to Data Privacy, Criteria for Lawful Processing of Personal Information, Appointing a DPO, Award, Nominal Damages, Principle of Transparency, Rendition of Decision, Unauthorized Processing
CID 17-005a ECB vs. SSMSM
Tags: Disclosure of the detailed record of calls to a certain mobile user.
06-25-2020 RABD v FXXX
Tags: Rendition of Decision, Rules of Procedure.
06-25-2020 RBD vs. FCASH GLOBAL LENDING, INC. (FAST CASH)
Tags: execution of the affidavit of desistance, sua sponte, rendition of decision
06-18-2020 JGO vs. XXX
Tags: Amicable settlement, Quitclaim .
06-09-2020 MHH v VCF SPFS
Tags: Processing, Sensitive Personal Information, Lawful Criteria for Processing.
06-09-2020 JRG v CXXX
Tags: Consent, Temporary Ban.
06-09-2020 JVA v UXXX
Tags: Transparency.
06-09-2020 JVA vs. U-PESO.PH LENDING CORPORATION (UPESO)
Tags: right to data privacy, criteria for lawful processing of personal information, general privacy principle of transparency; obligations of personal information controller, privacy as human right, burden of proof, rendition of decision, unauthorized processing, application for a temporary ban
06-09-2020 BEM vs. GFC
Tags: substantial evidence, quantum of proof required, rendition of decision
06-08-2020 MRS vs. NATIONAL CONCILIATION AND MEDIATION BOARD (NCMB) AND DEPARTMENT OF LABOR AND EMPLOYMENT (DOLE)
Tags: Exhaustion of remedies, grounds for outright dismissal
06-08-2020 HNT vs. EASTWEST BANK
Tags: voluntary settlement, grounds for dismissal, mandate of the Commission to settle disputes
NPC 18-066 B.Q.N. vs NUQ Inc
Tags: Not all processing and disclosure of personal information are violations of the DPA, criteria for lawful processing, processing of personal information shall be permitted only if not otherwise prohibited by law, processing of information is permissible if the processing is necessary for compliance with a legal obligation to which the personal information controller is subject, principles of transparency, legitimate purpose, and proportionality
CID 18-E-040 KGR v. BB et al.
Tags: Personal information controllers, processing, disposal, substantial evidence
NPC 17-015 ID Y.S. v DS BANK
Tags: Personal Data Breach Management, Who may file a complaint, Rights of Data Subjects
CID 17-K-003 KRL-v.-University
Tags: Exhaustion of remedies, Personal information, Alternative Dispute Resolution, violation of DPA that warrants a recommendation for prosecution
11-19-2019 KRL vs. TRINITY UNIVERSITY OF ASIA, AA, MC, NCB, RG GV, GCT, RR, MR, PB
Tags: Exhaustion of Remedies, Personal Information, Section 13 (f), DPA, Section 12 (f), DPA
11-19-2019 RBG vs. CB
Tags: Substantial Evidence
11-05-2019 CPM vs. CASHWAGON
Tags: Grounds for Dismissal
08-15-2019 In Re: DATA BREACH INVOLVING THE COMELEC DATA PROCESSING SYSTEM IN WAO, LANAO DEL SUR
Tags: Safekeeping, Concealment of Data Breach, Documentation
08-13-2019 JV vs. JR
Tags: Reasonable Expectation of Privacy, Reasonable and Appropriate Security Measures, Substantial Evidence
NPC 17-018 EA and TA v EJ
Tags: Principle of transparency, legitimate purpose and proportionality, exemption for the “establishment of legal claims”
IBC vs. PBI
Tags: Lawful Processing of Personal Information, Phishing, Right to Rectification, Right to Correct Personal Information

NPC 18-010 RLA V. PLDT Enterprise
Tags: Personal Information Controller, Personal Information Processor, consent, legal obligation, good faith, processing for unauthorized purposes, unauthorized disclosure, gross negligence
06-01-2021 In re: Bombardier Transportation Philippines, Inc.
Tags: Breach Notification, Accountability
04-29-2021 CCMC v QXXX
Tags: Security Incident Management Policy
03-25-2021 CID v. PNP
Tags: Cease and Desist Order
02-23-2021 MNLC vs PXXX Corporation
Tags: Temporary Ban on Processing, Public Interest
NPC BN 17-002 In re: Data Breach Involving the COMELEC Data Processing System in Wao, Lanao Del Sur
Tags: Data Breach Notification Report, general rule to notify the affected data subjects, security incident management policy, and security measures.
NPC BN 20- 049 In re: Health Delivery System, Inc.
Tags: Notification of the data subjects, Exemption from the notification requirement
NPC BN 18-223 In re: Hennes & Mauritz
Tags: Requirements of notification, When notification should be done? When delay is prohibited?
NPC BN 18-186 In re: Manila Shared Services Employees Credit and Savings Cooperative
Tags: Criteria when notification is required, Breach Notification, Reasonable and Appropriate Measures to Protect Personal Information
NPC 19-1201 D.N.T. v. K.K. et. al.
Tags: Commission’s power to facilitate or to enable settlement of complaints through alternative dispute resolution processes, rights of the Data Subject, Right to Access, PIC, is required to develop, implement, and review policies and procedures, to ensure that the aforesaid policies and procedures shall enforce and effectively implement the provisions of the DPA, including those pertaining to the rights of data subjects, definition of data subject
NPC BN 18-037 In re: Acesite (Phils.) Hotel Corporation
Tags: Personal data breach, availability breach, Security incident, Scope of mandatory breach notification
NPC BN 18-183 In re: Sun Life Canada (Phil.) Inc
Tags: Personal Data Breach Management
NPC BN 17-038 In re: Tuitt Philippines
Tags: Documentation, Proof of measures undertaken to prevent recurrence of incident, Security Incident Management Policy, Unauthorized disclosure of Wifi credentials
NPC BN 17-032 In Re: Social Security System
Tags: Documentation, data breach management, organizational, physical, and technical security measures, data privacy policies, Notification to the Commission, Security of Personal Information
12-17-2020 In re: E-Science Corporation
Tags: Notification of Affected Data Subjects, Breach Notification
12-17-2020 In re: Batangas Bay Carriers, Inc.
Tags: Breach Notification, Notification of Data Subjects
11-26-2020 In Re: Commission on Elections (COMELEC)
Tags: Breach Notification, Sensitive Personal Information;
09-21-2020 In re: Batangas Bay Carriers, Inc.
Tags: Breach Notification, Notification of Data Subjects
09-10-2020 In re: Breach Notification Report of Sun Life of Canada
Tags: Breach notification, Compliance
09-10-2020 JCR vs. GLOBE TELECOM, INC.
Tags: Guidelines for technical security measures
08-20-2020 In re: National Privacy Commission
Tags: Breach Notification, Sensitive Personal Information
CID 17-K-004 CBI vs. XXX
Tags: Substantial compliance, Burden of proof and burden of evidence, Compliance to the Data Privacy Act, Reasonable security measures
NPC BN 17-025 In re: Jobstreet (formerly CID BN 17- 025)
Tags: Security measures, Personal Data Breach Management, Documentation, Security of Personal Information
NPC BN 18-217 In re: Infosys BPM-Philippines
Tags: Initial Breach Notification, Personal Data Breach, Unauthorized Disclosure, Requirements of Notification
NPC BN 20-141 In re: Home Credit Consumer Finance Philippines, Inc.
Tags: Notification of Data Subjects, obligation of the Personal Information Controller
NPC BN 20-208 In re: COMELEC
Tags: Criminal Investigation as a ground for exemption or postponement of notification, Difference between Initial and Full Breach report
CID BN 19-067 In re: University of the East
Tags: When notification to the Commission should be done?, Procedure on which the personal information controller (PIC) must follow in notifying the affected data subjects affected by a personal breach, content of Data Breach Notification Report, alternative means of notification
CID BN 17-039 In re: Sun Life of Canada
Tags: Notification and other requirements, general rule to notify the affected data subjects, Notification to the Commission, Documentation, Measures undertaken to prevent the recurrence of breach, exemption from notification
NPC 16-005 N.I.H. vs WSQ Medical Center et. al.
Tags: The power of Commission to facilitate or enable settlement through the use of alternative dispute resolution processes, Compromise Agreement
CID BN 18-081 In re: Philippine Seven Corporation
Tags: Security of Personal Information, notification and other requirements
NPC BN 20-170 In re: Travelpeople Ltd., Inc.
Tags: Notification of data subjects of data breaches is the general rule, The data subjects shall be notified within seventy-two (72) hours upon knowledge of or reasonable belief by the personal information controller or personal information processor that a personal data breach has occurred, exemption or postponement will only be allowed in exceptional circumstances under Section 18(B) of NPC Circular No. 16-03, when notification is required, conditions necessitating mandatory breach notification, ransomware, interpretation of the DPA
NPC BN 20-167 In re: TravelServices, Inc.
Tags: The data subjects shall be notified within seventy-two (72) hours upon knowledge of or reasonable belief by the personal information controller or personal information processor that a personal data breach has occurred., exemption or postponement will only be allowed in exceptional circumstances under Section 18(B) of NPC Circular No. 16-03, when notification is required, conditions necessitating mandatory breach notification, ransomware, interpretation of the DPA
NPC BN 20-101 In re: De La Salle Health Sciences Institute (DLSHSI)
Tags: Definition of security incident and data breach, Forms of personal data breach
NPC BN 20-044 In Re: RITM
Tags: Breach Notification, Personal data Breach
NPC 18-028 ANM vs MDMC Inc.
Tags: Who may file a complaint , Rights of Data Subjects
NPC 19-908 In re: Unipeso Lending Company, Inc.
Tags: Litis Pendentia, The power of the Commission to investigate on its own initiative, Time to plead, Application of Fresh Period Rule, Appeal
11-18-2019 MNLC vs PXXX Corporation
Tags: Violation in Section 25(b) of the DPA 2012, Unlawful collection of Sensitive Personal pursuant to Section 16(f) of the DPA, Exhaustion of remedies, General Data Privacy Principles, Criteria for Lawful Processing of Personal Information and Sensitive Personal Information
08-09-2019 ODC vs. ODB & EA
Tags: Substantial Evidence, Transparency, Updating Terms & Conditions
07-25-2019 MFS vs. RJJ AND SJJ
Tags: Motion for Reconsideration, On-site Examination

06-16-2021 IN RE: PILIPINAS2022.PH Initiated As A Sua Sponte NPC Investigation Into The Possible Data Privacy Violations Committed By Pilipinas2022.ph
Tags: Filing of Application for CDO, functions and power of the National Privacy Commission, sua sponte, the grounds to be established by the applicant for the Commission to issue a CDO
CID 18-J-162 In re Facebook Forced Logout
Tags: Jurisdiction of NPC, mandate of NPC, extraterritorial application of the DPA, content of the Data Breach Notification Report
CID BN 19- 034 In Re: Rokko & Associates, Inc.
Tags: Content of the Data Breach Notification Report, notification to the Commission.
NPC BN 20-044 In Re: RITM
Tags: Data Breach Response Team
NPC BN 20-116 In re: Saint Louis University
Tags: Contents of the notification to the affected data subjects, notification requirements under Section 18 (C) of NPC Circular No. 16-03
04-15-2021 In re: BPI Philam Life Assurance Corporation
Tags: Breach Notification, Request for Extension
12-17-2020 IN RE: LISENSYA.INFO Initiated as an Independent NPC Investigation into the Possible Data Privacy Violations Committed by the website LISENSYA.INFO.
11-12-2020 IN RE: LISENSYA.INFO Initiated as an Independent NPC Investigation into the Possible Data Privacy Violations Committed by the website LISENSYA.INFO.
11-05-2020 BOA v HXXX
Tags: Discovery of Electronically- Stored Information
10-20-2020 IN RE: FAMILYHAN CREDIT CORPORATION Initiated as an Independent NPC Investigation into the Possible Data Privacy Violations Committed by Familyhan Credit Corporation
Tags: Sua sponte investigation, Section 26, and Section 30 of the DPA.
05-21-2020 JBD vs. JI and VVV
Tags: Exhaustion of remedies, grounds for outright dismissal, best evidence rule, distinction between agent and personal information controller, substantial evidence, unauthorized processing, sensitive personal information
02-03-2020 In Re: GRAB PH SELFIE VERIFICATION AND IN-VEHICLE AUDIO AND VIDEO RECORDINIG CEASE AND DESIST