The right to file a complaint with the National Privacy Commission
If you feel that your personal information has been misused, maliciously disclosed, or improperly disposed, or that any of your data privacy rights have been violated, you have a right to file a complaint with the NPC.
Who may complain?
Under Section 3, the following can file a complaint:
The National Privacy Commission (NPC), on its own initiative;
Those who have suffered a data privacy violation or personal data breach; and
Persons who are personally affected by a violation of the Data Privacy Act of 2012 (Republic Act No. 10173).
Persons who are the subject of the data privacy violation or personal data breach may appoint a duly authorized representative to prosecute the complaint on their behalf.
Those who are not personally affected by a data privacy violation or personal data breach may: (a) request for an advisory opinion on data protection matters; or (b) inform the NPC of a data protection concern.
The NPC may monitor the subject organization or take such further action as may be necessary.
Those who wish to file a complaint must comply with the rule of exhaustion of remedies. This rule means that in filing the complaint, a complainant must be able to show that there was an opportunity offered in good faith to have the respondent comply with any legal obligations involving data protection and privacy.
How to file a complain?
Formal complaints are made by filing a complaint-affidavit, together with copies of any evidence and affidavits of any witnesses at any NPC office.
Complaints can also be made by electronic filing, by: (a) attaching these documents in a specific e-mail sent to complaints@privacy.gov.ph; or (b) submitting a portable electronic data storage device to any NPC office.
Electronic documents must digitally signed in and in .PDF format (if practicable), on page sizes compliant with the Efficient Use of Paper Rule. If submitted in this digital format, the NPC may charge fees for printing.
If submitting through a portable electronic data storage device, similar portable data storage devices containing the same files must also be given to any opposing party so named. One portable data storage device is equivalent to one copy.
If the portable data storage device is infected with malware, the documents will not be considered as having been filed.
How does the NPC deal with complaints?
Once a complaint has been filed, an investigating officer will conduct the proceedings. The investigating officer shall evaluate the complaint to determine whether its allegations involve a violation of the Data Privacy Act or related issuances and if based on its allegations, there is reason to believe that there is a privacy violation or personal data breach.
The investigating officer shall then recommend to the Commission whether the complaint shall be: (a) dismissed outright for want of palpable merit; (b) referred to the respondent for comment and/or subject to discovery proceedings; (c) subject to further monitoring or investigation; (d) treated as a request for an advisory opinion; or (e) indorsed to the proper government agency with jurisdiction over the complaint.
The Commission may dismiss outright any complaint on the following grounds:
The complainant did not give the respondent an opportunity to address the complaint, unless failure to do so is justified;
The complaint is not a violation of the Data Privacy Act or does not involve a privacy violation or personal data breach;
The complaint is filed beyond the period for filing; or
There is insufficient information to substantiate the allegations in the complaint or the parties cannot be identified or traced.
How long does it take the NPC to act on a complaint?
If the subject of the complaint is a data breach that the private information controller must report to the NPC, the NPC may already be acting on the matter before you even file the complaint.
From the time complaints are received, the Complaints and Investigation Division, through its Investigating Officers, shall conduct initial evaluations on complaints so received within a reasonable time. Feedback may be expected within a few working days.
From here, the entire process, up to final adjudication, should take four to six months.
If there is a request to have the NPC issue a temporary stop processing order so as to enjoin the processing of any data, the NPC may issue an Order, after due hearing and the payment of the proper bond. This process can happen from one to two weeks after the filing of this request.
What happens when my complaint is upheld?
If your complaint is upheld, the case records will be brought to the Enforcement Division of the Legal and Enforcement Office, NPC for the enforcement of civil damages, fines, and other administrative sanctions, when appropriate.
If the NPC decides that the filing of criminal charges is warranted against certain individuals following the filing and processing of a complaint, the NPC will forward the case record to the Department of Justice and recommend their prosecution.
What happens when my complaint is dismissed?
If your complaint is dismissed, and it involves a violation of any other cybercrime law, the NPC will forward your complaint to the appropriate law enforcement agency.
If the complaint is not upheld for lack of jurisdiction, and jurisdiction properly belongs to the dispute settlement mechanism of another government agency, the NPC will indorse your complaint to that agency for the conduct of further proceedings.
If the complaint is dismissed for lack of merit, you may file a Motion for Reconsideration. Please state the grounds for the mistakes of fact or law that may be present in the NPC’s decision.
In any event, any Decision made on a complaint may be appealed by any aggrieved party by way of appeal to the Court of Appeals, within the proper period.