Mechanics for Complaints

 Who may complain?

 How to file a complaint?
 How does the NPC deal with complaints?
 How long does it take the NPC to act on a complaint?
 What happens when my complaint is upheld?
 What happens when my complaint is dismissed?

Who may complain?

Under Section 3, the following can file a complaint:

1. The National Privacy Commission (NPC), on its own initiative;

2. Those who have suffered a data privacy violation or personal data breach; and
3. Persons who are personally affected by a violation of the Data Privacy Act of 2012
(Republic Act No. 10173).

Persons who are the subject of the data privacy violation or personal data breach may
appoint a duly authorized representative to prosecute the complaint on their behalf.

Those who are not personally affected by a data privacy violation or personal data
breach may: (a) request for an advisory opinion on data protection matters; or (b)
inform the NPC of a data protection concern.

The NPC may monitor the subject organization or take such further action as may be
necessary.

Those who wish to file a complaint must comply with the rule of exhaustion of
remedies. This rule means that in filing the complaint, a complainant must be able to
show that there was an opportunity offered in good faith to have the respondent
comply with any legal obligations involving data protection and privacy.

Back To Top

How to file a complaint?

Formal complaints are made by filing a complaint-affidavit, together with copies of any
evidence and affidavits of any witnesses at any NPC office.

Complaints can also be made by electronic filing, by: (a) attaching these documents in
a specific e-mail sent to complaints@privacy.gov.ph; or (b) submitting a portable
electronic data storage device to any NPC office.

Electronic documents must digitally signed in and in .PDF format (if practicable), on
page sizes compliant with the Efficient Use of Paper Rule. If submitted in this digital
format, the NPC may charge fees for printing.

If submitting through a portable electronic data storage device, similar portable data
storage devices containing the same files must also be given to any opposing party so
named. One portable data storage device is equivalent to one copy.

If the portable data storage device is infected with malware, the documents will not be
considered as having been filed.

Back To Top

How does the NPC deal with complaints?

Once a complaint has been filed, an investigating officer will conduct the proceedings.
The investigating officer shall evaluate the complaint to determine whether its
allegations involve a violation of the Data Privacy Act or related issuances and if based
on its allegations, there is reason to believe that there is a privacy violation or personal
data breach.

The investigating officer shall then recommend to the Commission whether the
complaint shall be: (a) dismissed outright for want of palpable merit; (b) referred to the
respondent for comment and/or subject to discovery proceedings; (c) subject to further
monitoring or investigation; (d) treated as a request for an advisory opinion; or (e)
indorsed to the proper government agency with jurisdiction over the complaint.

The Commission may dismiss outright any complaint on the following grounds:

1. The complainant did not give the respondent an opportunity to address the
complaint, unless failure to do so is justified;
2. The complaint is not a violation of the Data Privacy Act or does not involve a
privacy violation or personal data breach;
3. The complaint is filed beyond the period for filing; or
 4. There is insufficient information to substantiate the allegations in the complaint or
the parties cannot be identified or traced.

Back To Top

How long does it take the NPC to act on a complaint?

If the subject of the complaint is a data breach that the private information controller
must report to the NPC, the NPC may already be acting on the matter before you even
file the complaint.

From the time complaints are received, the Complaints and Investigation Division,
through its Investigating Officers, shall conduct initial evaluations on complaints so
received within a reasonable time. Feedback may be expected within a few working
days.

From here, the entire process, up to final adjudication, should take four to six months.

If there is a request to have the NPC issue a temporary stop processing order so as to
enjoin the processing of any data, the NPC may issue an Order, after due hearing and
the payment of the proper bond. This process can happen from one to two weeks after
the filing of this request.

Back To Top

What happens when my complaint is upheld?

If your complaint is upheld, the case records will be brought to the Enforcement
Division of the Legal and Enforcement Office, NPC for the enforcement of civil damages,
fines, and other administrative sanctions, when appropriate.

If the NPC decides that the filing of criminal charges is warranted against certain
individuals following the filing and processing of a complaint, the NPC will forward the
case record to the Department of Justice and recommend their prosecution.

Back To Top

What happens when my complaint is dismissed?

If your complaint is dismissed, and it involves a violation of any other cybercrime law,
the NPC will forward your complaint to the appropriate law enforcement agency.

If the complaint is not upheld for lack of jurisdiction, and jurisdiction properly belongs
to the dispute settlement mechanism of another government agency, the NPC will
indorse your complaint to that agency for the conduct of further proceedings.

If the complaint is dismissed for lack of merit, you may file a Motion for
Reconsideration. Please state the grounds for the mistakes of fact or law that may be
present in the NPC’s decision.

In any event, any Decision made on a complaint may be appealed by any aggrieved
party by way of appeal to the Court of Appeals, within the proper period.