The Commission resolves to DISMISS the Complaint of RTB against East West Banking Corporation (EWBC). The Commission AWARDS nominal damages, in the amount of Fifteen Thousand Pesos (P15,000.00), to RTB for EWBC’s failure to fulfill its obligation as a Personal Information Controller under Section 11 (c) of the Data Privacy Act of 2012.
The existence of a lawful basis to process personal information must be properly applied based on the factual conditions of the case. Here, EWBC was remiss in its obligation as a Personal Information Controller (PIC) despite the lawful criterion to process based on the fulfillment of a contract. More so, it failed to exercise extraordinary diligence as is expected from a banking institution.
Section 11 of the DPA requires PICs, such as EWBC, to ensure that the personal information of the data subject is kept up to date:
Section 11. General Data Privacy Principles. – The processing of personal information shall be allowed, subject to compliance with the requirements of this Act and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.
Personal information must, be:
(c) Accurate, relevant and, where necessary for purposes for which it is to be used the processing of personal information, kept up to date; inaccurate or incomplete data must be rectified, supplemented, destroyed or their further processing restricted;
As a PIC, EWBC should have complied with its obligation under Section 11 (c) of the DPA and practiced proper record-keeping. Corollary to this, it should have been mindful of the corresponding deposit dates of the post-dated checks that RTB submitted. Its inadvertence to deposit a post-dated check on the designated date resulted in the unnecessary disclosure of RTB’s personal information to EWBC’s third-party collection agency.
EWBC also failed to strictly comply with the provisions of Section 29 of the Terms and Conditions attached to the Promissory Note with Chattel Mortgage when it did not provide RTB a written notice of its intention to designate a third-party collection agency to conduct debt collection.
EWBC was sorely remiss in its duty to exercise the diligence required from it as a banking institution. Had EWBC complied with its obligations under Section 11 (c) of the DPA and the loan contract, then it would not have unnecessarily disclosed RTB’s personal information.
Nonetheless, EWBC’s carelessness is insufficient to warrant a recommendation for its prosecution. After all, EWBC’s processing of RTB’s personal information is still based on a lawful basis to process under Section 12 (b) of the DPA.
EWBC’s actions and consequently, the third-party collection agency’s inaccurate use of RTB’s personal information, however, justify an award of nominal damages.
ADM PRIVACY WEBSITE 