FACTS:
A customer (Sender) of GCash erroneously transferred money to another GCash account instead of transferring the money to her own account. The Sender asked for the home address of the Recipient to resolve the situation. GCash, in an attempt to balance the interest of the data subjects responded with the name and the registered email address.
The Sender deemed that the email address and name insufficient and insisted that the PIC divulge the home address of the Recipient. The Sender claims that its purpose is to send a copy of her complaint to the Recipient who allegedly failed to return the funds to her.
GCash hesitates to give in to the sender’s request considering that Gcash already gave the name and email address of the Recipient to the Sender. Also, GCash posits that the Sender’s right to access does not involve the disclosure of the Recipient’s home address.
ISSUES:
Whether or not the Sender can use legitimate interest as basis for the request of the home address of the Recipient.
NPC Ruling:
No.
In MAF v. Shopee, the National Privacy Commission (NPC) adopted the three-part test above and provided the following conditions for processing based on legitimate interest: Processing based on legitimate interest requires the fulfillment of the following conditions: (1) the legitimate interest is established; (2) the processing is necessary to fulfill the legitimate interest that is established; and (3) the interest is legitimate and lawful and it does not override the fundamental rights and freedoms of data subjects. (emphasis ours)
Applying the foregoing to the current matter, it appears that while the Sender was able to establish her legitimate interest, the scenario presented do not appear to satisfy the other two (2) requirements.
To elaborate, the Sender’s established legitimate interest is to recover the amount that was wrongfully sent to the Recipient. However, the disclosure of the Recipient’s home address is not completely necessary for the Sender to file a complaint since Section 16, Rule 14 of the Rules of Court allows for the service of summons when a defendant’s whereabouts are unknown.(emphasis ours)
In addition, it cannot be said that the disclosure of the home address would be proportional to the legitimate interest sought to be protected since the Sender was already provided with the name and registered email address of the Recipient. Such information will permit the Sender to pursue her available remedies. To allow the disclosure of the home address in the given scenario would unnecessarily tilt the balance of rights in favor of the Sender which may possibly result in extreme detriment to the Recipient. It must be borne in mind that the Recipient is also a data subject who possesses privacy rights as well. (emphasis ours)
In sum, the Recipient’s right to privacy in his or her home is afforded protection under the Constitution and the law. This includes the right to be secure in his or her own abode or physical space at any time.
It is also necessary to clarify that the Sender’s request for the Recipient’s home address cannot be considered as a data subject request. As contemplated by law, data subject requests are only limited to details on the processing of the personal information of the data subject himself/herself. These requests do not extend to personal information concerning another data subject.
ADM PRIVACY WEBSITE 