Filing

Complaints at
the National
Privacy
Commission
Atty. Francis Euston R. Acero
Complaints and Investigations Division
National Privacy Commission
 Statutory Source
Scope of the Rules of Procedure

Contents Form of Submissions

Contents of the Complaint
Exhaustion of Remedies
Filing Fees
Evaluation
Discovery
Comment
Further Investigation
Temporary Bans on Processing
The Investigator’s Report
The Commission’s Ruling
 Legal Bases for the Complaints Procedure

STATUTORY
SOURCES
Statutory • Data Privacy Act of 2012 (Republic Act
No. 10173)
Source – Sec. 7(b) Receive complaints, institute
investigations, facilitate or enable
settlement of complaints through the
use of alternative dispute resolution
processes, adjudicate, award indemnity
on matters affecting any personal
information, prepare reports on
disposition of complaints and resolution
of any investigation it initiates, and, in
cases it deems appropriate, publicize
any such report
• Implementing Rules and Regulations of
the Data Privacy Act of 2012
• NPC Memorandum Circular No. 16-04,
s. 2016
Statutory • Data Privacy Act of 2012 (Republic Act
No. 10173)
Source • Implementing Rules and Regulations of
the Data Privacy Act of 2012
– Rule II, Section 9. Functions. The
National Privacy Commission shall have
the following functions:
a. Rule Making. The Commission shall
develop, promulgate, review or amend
rules and regulations for the effective
implementation of the Act.

• NPC Memorandum Circular No. 16-04,

s. 2016
Statutory • Data Privacy Act of 2012 (Republic Act
No. 10173)
Source • Implementing Rules and Regulations of
the Data Privacy Act of 2012
– Rule II, Section 9. Functions. The
National Privacy Commission shall have
the following functions:
e. Complaints and Investigations. The
Commission shall adjudicate on
complaints and investigations on matters
affecting personal data: Provided, that In
resolving any complaint or investigation,
except where amicable settlement is
reached by the parties, the Commission
shall act as a collegial body.

• NPC Memorandum Circular No. 16-04,

s. 2016
Statutory • Implementing Rules, Rule III, Section 9(e):
– Receiving complaints and instituting
Source investigations regarding violations of the Act,
these Rules, and other issuances of the
Commission, including violations of the rights of
data subjects and other matters affecting
personal data;
– Summoning witnesses, and requiring the
production of evidence by subpoena duces tecum
for the purpose of collecting the information
necessary to perform its functions under the Act;
– Facilitating or enabling settlement of complaints
through the use of alternative dispute resolution
processes, and adjudicating on matters affecting
any personal data; and
– Preparing reports on the disposition of
complaints and the resolution of any
investigation it initiates, and, in cases it deems
appropriate, publicizing such reports.
Scope of the • Governs the following matters that may
be brought to the attention of the
Rules of National Privacy Commission:

Procedure – Requests for advisory opinions

– Complaints/Requests for investigations
FILING THE
COMPLAINT
 Form of • Requests can be made in any form.

Submissions – E-mail: complaints@privacy.gov.ph

– Post/Personal: Room B-02, DICT
Building, C.P. Garcia Ave., Quezon City
• For expedited processing of complaints:
– Make it in the form of an affidavit.
– Include the affidavits of your witnesses.
– Include copies of the evidence you will
use to substantiate your claims.
• Pleadings can also be filed
electronically, in PDF form.
 Contents • Specify the identity of the parties. The
data subject will always be considered
of the as the complainant.

Complaint • Be specific with the details of the

complaint:
– Identify the violation of the Data Privacy
Act, if possible.
– Include all correspondence with the
other parties.
– Include statements of what was done, or
what was not done to remedy the
situation.
Exhaustion • You need to give the PIC/PIP a chance to
correct the situation.
of Remedies – Need to show proof that the PIC/PIP
was informed in writing.
– Need to show proof that there was no
proper or timely action taken.
– Must file within six months from privacy
or security concern, or 30 days from the
last communiqué with the personal
information controller regarding the
claimed privacy or security concern,
whichever is earlier.
• Failure to comply with this requirement
will make the Commission treat this as a
request for an advisory opinion.
Filing Fees

Amount Claimed Filing Fee

Cannot be determined ₱600.00
₱0.00 – ₱100,000.00 ₱500.00
₱100,000.01 - ₱150,000.00 ₱800.00
₱150,000.01 - ₱200,000.00 ₱1,000.00
₱200,000.01 - ₱250,000.00 ₱1,500.00
₱250,000.01 - ₱300,000.00 ₱1,750.00
₱300,000.01 - ₱350,000.00 ₱2,000.00
₱350,000.01 - ₱400,000.00 ₱2,250.00
Above ₱400,000.00 ₱2,250.00 plus ₱10.00 for next ₱1,000.00
claimed over ₱400,000.00
Evaluation The NPC may dismiss the complaint
outright:
/Triage 1. Complainant did not give opportunity to
address the complaint.
2. The complaint does not involve a violation
of the Data Privacy Act
3. The complaint was filed too late
4. There is insufficient information to
substantiate allegations
 The
Discovery
Process

Discovery is the compulsory disclosure, by

a party to an action, of relevant documents
referred to by the other party.
 THE
E-DISCOVERY
PROCESS
E-Discovery • If the complaint is sufficient in form and
substance, the NPC will call for a discovery
conference, the parties will discuss:
(1) Any issues relating to the preservation of the
information;
(2)Form in which each type of the information
will be produced;
(3) Period within which the information will be
produced;
(4)Method for asserting or preserving claims of
privilege or of protection of the information;
(5) Method for asserting or preserving
confidentiality and proprietary status of
information relating to a party or person not
a party to the proceeding; and
(6)Allocation among the parties of the expense
of production.
• When done, the parties will submit a
Discovery Conference Report
E-Discovery • On motion, at any point in the
proceedings, the NPC may issue an Order
governing discovery.
• The Order will cover the same grounds as
the Discovery Conference Report:
1. Any issues relating to the preservation of
the information;
2. Form in which each type of the information
will be produced;
3. Period within which the information will be
produced;
4. Method for asserting or preserving claims of
privilege or of protection of the information;
5. Method for asserting or preserving
confidentiality and proprietary status of
information relating to a party or person not
a party to the proceeding; and
6. Allocation among the parties of the expense
of production.
DUE COURSE
Comment • Chance for the respondents to respond
to the allegations of the complainant
• Due ten days after the investigator
issues an Order acknowledging the
Discovery Conference Report
• Includes the affidavits of the
respondents and that of their witnesses
• Includes any evidence the respondents
want to be appreciated in their favor
 Further • May include site visits

Investigations • The investigator may ask either party to

provide more information, more
affidavits, or more evidence, without
necessarily giving an advantage to
either party
• When done, the investigator will issue
an Order decreeing the case submitted
for resolution
Temporary • Requires a summary hearing

Ban on • Must be a showing that the person

seeking the ban on processing is
Processing entitled to that relief
• There must be payment of a bond, in an
amount to be set by the investigator.
• If at the end of the proceedings the ban
is justified, the ban may be made
permanent.
RESOLUTION
 The • Addressed to the Commission

Investigator’s • Includes the investigator’s findings of

Report fact, and his recommended outcomes,
including but not limited to:
– Bans on processing
– Amount of damages to be awarded
– Persons recommended for prosecution
– Fines to be imposed
 The • The Commission may adopt the findings

Commission’s and recommendations of the

investigator or call its own hearings
Ruling • The Commission may require the
further submission of legal briefs, or
memoranda.
• The Commission decides as a collegiate
body, and promulgates the binding
Decision.
• The Commission will ensure the
confidentiality of the data submitted.
• Decisions of the Commission may be
appealable to the Court of Appeals.
Key Points

• Complaints may be filed by data subjects, persons injured

by a violation of the Data Privacy Act, or by the Commission
on its own initiative.
• The Commission has the power to award damages
• If the complaint is given due course, parties will be made
subject to compulsory discovery processes.
• Parties may ask for a temporary ban on processing, which
may be made permanent.
• Appeals can be made only by way of appeal by Rule 43 of
the Rules of Court to the Court of Appeals.
Thanks for listening!

FIN