How to File a Data Privacy Complaint With the NPC

The Data Privacy Act of 2012 (Republic Act No. 10173) gives every data subject the right to lodge a complaint before the Commission (Section 16), and gives the NPC the power to receive complaints, investigate, settle them through alternative dispute resolution, adjudicate and "award indemnity" (Section 7(b)).

Under Rule II, Section 1 of the 2021 NPC Rules of Procedure, as amended, these may file:

• The data subject affected by a privacy violation or data breach.
• A representative, if authorized by a special power of attorney.
• A parent or guardian for a minor or a person alleged to be incompetent. A birth certificate is enough proof for a parent; for a guardian, the court order naming the guardian.
• A non-resident citizen, such as an OFW, who has no authorized representative in the Philippines. The complaint must be notarized by the Philippine Embassy or Consulate, or carry an apostille certificate.

The NPC's own page adds that a representative of a company or other juridical entity needs a special power of attorney with a board resolution and secretary's certificate. Since NPC Circular No. 2024-01, several parties may join as complainants or respondents in one complaint.

Yes, as a rule. Rule II, Section 2 says no complaint "shall be given due course" unless the complainant shows that:

1. he or she informed the personal information controller, processor or concerned entity, in writing, of the privacy violation or breach, so it could act on it; and
2. the entity did not take timely or appropriate action, or did not respond "within fifteen (15) calendar days from receipt of written information from the complainant".

The NPC may waive this step at its discretion:

• for good cause shown, properly alleged and proved by the complainant; or
• when the complaint involves a serious violation of the Data Privacy Act, considering the risk of harm, including when there is grave and irreparable damage that only the NPC can prevent or reduce, when the respondent cannot give any plain, speedy or adequate remedy, or when the respondent's act is patently illegal.

Keep a copy of your letter and proof that the company received it. You will need to attach them.

Rule II, Section 3 sets the form:

• In writing, signed and verified. The complaint must be signed by you or your lawyer and "verified in the format prescribed under the Rules of Court".
• Your correspondence with the respondent. Attach "any and all correspondence" on the matter and a statement of what the respondent did, if anything, to show you complied with Section 2.
• Evidence. Copies of documents and affidavits of witnesses, if any.
• Certification against forum shopping. It must accompany the complaint.

A complaint that does not follow the required form and contents may be dismissed outright. The NPC page also accepts a filled-out and notarized complaints-assisted form instead of a verified complaint.

Rule II, Section 5 says a complaint "may be filed at any office of the NPC". The NPC page lists four ways: personally, by registered mail, by courier, or by e-mail as the Commission may authorize.

No action is taken on a complaint until the filing fee is paid, except when (Rule II, Section 4):

• the complainant is the government or a government agency or corporation with its own charter;
• the complainant is indigent, as defined in the Rules of Court or in an NPC advisory; or
• the NPC waives the fee upon motion, for good cause shown.

The NPC's fees advisory describes the steps: send the filled-out Service Request and Assessment Form (SRAF), with the notarized complaint form attached, to complaints@privacy.gov.ph; wait for the SRAF with the assessed amount; pay through the Link.Biz.Portal, naming the National Privacy Commission as merchant; then send the proof of payment to the e-mail addresses in the advisory. The pages read do not give the amount, so this page does not state one.

According to the NPC page, its Investigating Officers have 30 calendar days from receipt to give the complaint due course or dismiss it without prejudice. The NPC estimates that the whole process, up to final adjudication, "should take about ten to twelve months". For a data breach that the company must report, the NPC "may already be acting on the matter before you even file the complaint".

The Act punishes violations with both imprisonment and a fine. Some examples:

The maximum penalty applies when the personal information of at least 100 persons is harmed, affected or involved (Section 35). When the offender is a company, the penalty is imposed on the responsible officers who took part in, or by gross negligence allowed, the crime (Section 34). Restitution follows the Civil Code (Section 37).

Two exclusions come up often:

• Personal or household use. Section 3(h) excludes from the definition of a personal information controller "An individual who collects, holds, processes or uses personal information in connection with the individual's personal, family or household affairs."
• Journalism, art, literature and research. Section 4(d) excludes personal information processed for journalistic, artistic, literary or research purposes.

Courts have also dealt with privacy online outside the Data Privacy Act. In Vivares v. St. Theresa's College (G.R. No. 202666, 2014), a writ of habeas data case, the Supreme Court said a Facebook user who uses privacy tools keeps a right to informational privacy, but users "must be mindful enough to learn the use of privacy tools". That case did not apply the Data Privacy Act.

These are made-up examples to show how the rules work. They are not advice for any real case.

Ramon's bank sends his account statement, with his full name and balance, to another customer by mistake. Ramon writes to the bank about it and keeps the receiving copy. If the bank does not take proper action or reply within 15 calendar days, he may file a verified complaint with the NPC, attaching his letter.

A clinic throws patient records in an open trash bin outside. Improper disposal of sensitive personal information carries 1 to 3 years and ₱100,000 to ₱1,000,000 (Section 27(b)), and the maximum applies if 100 or more patients are affected (Section 35).

Joy's neighbor posts a photo of Joy's ID in a family group chat. A private individual acting in "personal, family or household affairs" is not a personal information controller under the Act, so the Data Privacy Act may not fit. Other laws may still apply.

If the problem is a lending app that messages your contacts, see Online lending app harassment.

You can file with the NPC yourself. Talk to a lawyer if the harm is serious, if you want the NPC to waive the 15-day step, if you also want to file a criminal case or claim damages in court, or if you are the company or officer facing the complaint.

If you cannot afford a lawyer, see Free legal help in the Philippines.