Vivares v. St. Theresa's College (2014): Facebook Photos and Privacy

Two minor students of St. Theresa's College in Cebu City, with others, took photos of themselves in their undergarments while changing for a beach party. A classmate uploaded the photos on her Facebook profile.

A computer teacher at the school learned about the photos from her own students. Using the school's computers, those students logged in to their Facebook accounts and showed her photos of the girls. The students also said the photos had at times been viewable by any Facebook user. The teacher reported the matter to the school's discipline officer. After an investigation, the school found that the girls had violated its Student Handbook and barred them from the graduation rites.

The parent of another sanctioned student filed a case for injunction, and the trial court issued a temporary restraining order allowing the students to attend graduation. The school still barred them, saying its motion for reconsideration of the order was unresolved.

The petitioners, parents of the students, then filed a petition for a writ of habeas data. They said the girls' Facebook accounts were set to "Friends Only," so the girls had a reasonable expectation of privacy, and that the school had saved and shown the photos without consent. The trial court issued the writ but later dismissed the petition, finding no violation of the right to privacy. The parents went to the Supreme Court.

Should a writ of habeas data issue? In particular, was there an actual or threatened violation of the students' right to privacy?

The Supreme Court denied the petition and affirmed the dismissal.

What habeas data is for. The writ of habeas data, created by a Supreme Court rule, protects a person's right to informational privacy. The Court said it is not limited to cases of extralegal killings and enforced disappearances. But it "will not issue on the basis merely of an alleged unauthorized access to information about a person." There must be a link between the right to privacy and the right to life, liberty or security.

Who can be a respondent. The school argued that it was not in the business of collecting data. The Court disagreed: "What matters is that the person or entity must be gathering, collecting or storing said data or information about the aggrieved party or his or her family."

Privacy on Facebook depends on the settings used. The Court recognized that a user who uses Facebook's privacy tools to limit who can see a post "should not be denied the informational privacy right which necessarily accompanies said choice." Since the default setting was "Public," it assumed the photos were viewable by everyone unless it was proved that the girls limited access.

"Friends Only" is not enough by itself. The Court said that "setting a post's or profile detail's privacy to 'Friends' is no assurance that it can no longer be viewed by another user who is not Facebook friends with the source of the content," because a friend can share the post or tag other people in it.

The school only received the photos. Even if the photos were visible only to friends, it was the girls' Facebook friends who showed them to the school. The Court said the school officials "were mere recipients of what were posted" and did not use any unlawful means to get them. The parents also failed to prove that the school reproduced or spread the photos; attaching them to a court memorandum in the injunction case was not a violation.

No proof of limited access. The records had only bare assertions that the girls used privacy settings. The Court said the result "may have been different" if it had been proved that access was limited to the uploader with the "Me Only" setting, or to a select few with the "Custom" setting.

Users must protect their own privacy. The Court said: "OSN users must be mindful enough to learn the use of privacy tools, to use them if they desire to keep the information private, and to keep track of changes in the available privacy settings." It found that the school did not violate the students' privacy rights when it enforced its disciplinary rules.

A writ of habeas data may be directed against any person or entity that gathers, collects or stores information about the aggrieved party, but it requires proof of an actual or threatened violation of the right to informational privacy; a social media user keeps that right only for posts whose visibility the user actually limited, and a "Friends" setting alone does not keep a post private from people who receive it from the user's friends.

Vivares is the Supreme Court's main early ruling on privacy and social media. It shows that a privacy claim over a post depends on what the user can prove about who was allowed to see it. It also confirms that habeas data can be used against private persons and entities, not only the government.

Vivares was not decided under Republic Act No. 10173, the Data Privacy Act of 2012, and does not interpret it. A complaint about the processing of personal data under that law follows a different route.

Here is a made-up illustration, with invented names. Bea posts a photo with her account set to "Friends." One of her friends, Carla, shares a screenshot with their teacher. Under the reasoning in Vivares, Bea may have a hard time showing that the teacher violated her privacy, because the teacher received the photo from someone Bea allowed to see it. If Bea had set the photo to "Me Only" and could prove it, Vivares says the result may have been different.

For related reading, see Can you be sued for cyber libel over a Facebook post?. For a case of your own, see where to find legal help.