What happens when you submit medical documents to your employer for an SSS sickness benefit claim, only to discover weeks later that an important form is missing?
For employees recovering from surgery or illness, dealing with missing paperwork can be frustrating. Apart from delaying a benefits application, it raises concerns about how employers handle documents containing personal and medical information.
In SLC v. Concentrix Phils., NPC Case No. 21-173, August 12, 2024, the National Privacy Commission (NPC) addressed this issue and ordered Concentrix Philippines to pay an employee ₱10,000 in nominal damages.
Interestingly, the NPC dismissed the complaint for improper disposal of personal information under Section 27 of the Data Privacy Act. So why was the company still ordered to pay damages?
The Case: An Employee's Missing SSS Sickness Form
The controversy began in June 2021, when SLC, then an employee of Concentrix, underwent surgery and applied for SSS sickness benefits.
Following instructions from the company's Human Resources department, she submitted the required documents, including medical records and SSS forms. She also prepared a checklist and informed her manager that the documents had been submitted.
Weeks later, however, an HR representative emailed her about a missing SSS Undertaking Form. SLC promptly complied and believed that her application could finally proceed.
Unfortunately, another problem emerged. When she followed up again, she was informed that her SSS Sickness Notification Form was missing and that her reimbursement form was unsigned.
SLC insisted that she had submitted the documents and even checked them before leaving them at the office reception. She questioned why the company had waited more than a month before telling her that another important form was supposedly missing. Eventually, she requested the return of her documents so she could process her claim herself.
When the documents were returned, the disputed form was still missing. Feeling that her personal information had not been properly handled, SLC filed a complaint before the NPC.
Did Concentrix Violate the Data Privacy Act by Losing the Document?
Not necessarily. The complaint alleged improper disposal of personal information under Section 27 of Republic Act No. 10173, or the Data Privacy Act of 2012.
This provision addresses situations where personal or sensitive personal information is improperly discarded, abandoned, or disposed of in a manner that exposes it to unauthorized access or disclosure.
The NPC explained that establishing improper disposal requires more than showing that a document can no longer be located. There must be sufficient evidence that the information was actually discarded, abandoned, or disposed of improperly, such as being placed in an area accessible to the public or in a container for trash collection.
In this case, SLC presented a reception routing slip, a checklist of requirements, and email exchanges with HR personnel. However, these documents did not conclusively establish that Concentrix received the specific missing form. More importantly, they did not prove that the company improperly discarded or disposed of it.
For this reason, the NPC dismissed the complaint for improper disposal under Section 27.
Why Was Concentrix Still Ordered to Pay ₱10,000?
Although the NPC found insufficient evidence of improper disposal, it identified a separate problem: Concentrix failed to demonstrate that it had adequate procedures for receiving, tracking, and safeguarding employee documents.
Under Section 20 of the Data Privacy Act, organizations that control personal information must implement reasonable and appropriate organizational, physical, and technical security measures.
These obligations extend to paper documents, not just electronic records.
The NPC examined how Concentrix handled SLC's SSS application. One HR representative initially informed her that only the undertaking form was missing. Another representative later reported that the SSS Sickness Notification Form was also unavailable.
The Commission found this sequence concerning. If the disputed form had been missing during the initial evaluation, why was the employee not informed at that time? The company also failed to establish a reliable system for confirming which documents had been received and when they were transferred between personnel.
The NPC emphasized that Concentrix, as the organization responsible for handling the records, was better positioned to demonstrate the existence of adequate document-tracking procedures. Its inability to do so revealed deficiencies in its handling of employee information.
Employers Must Protect Paper Records, Too
One of the most important lessons from the decision is that data privacy compliance is not limited to protecting computers, databases, or online accounts.
Paper documents can contain equally sensitive information.
In SLC's case, the submitted records included documents relating to her surgery, medical treatment, identity, and SSS benefits. Such information requires appropriate safeguards because mishandling it may expose employees to privacy risks.
The NPC explained that Concentrix should have maintained reliable procedures for tracking the receipt, processing, transfer, and storage of employee documents.
A company handling sensitive records should be able to determine what documents were received, who handled them, where they were stored, and what happened when they were transferred. Without these controls, even routine HR transactions may expose employees to unnecessary risks.
Does an Employer Need to Be Convicted of a Data Privacy Offense Before Damages May Be Awarded?
No. The NPC distinguished liability for improper disposal under Section 27 from an organization's separate obligations under Section 20.
Although SLC failed to establish the specific offense of improper disposal, the Commission found that Concentrix had not fulfilled its obligation to implement adequate safeguards for the personal information it processed.
The NPC therefore awarded ₱10,000 in nominal damages. Nominal damages are awarded to recognize that a legal right has been violated, rather than to compensate for a specific financial loss.
In this case, the award recognized the employee's right to expect that her personal information would be handled securely.
What Should Employers and HR Departments Learn From This Decision?
The ruling provides a practical reminder for companies, government offices, and HR departments that regularly receive documents containing personal information.
Whether employees are applying for SSS benefits, submitting medical certificates, updating personnel records, or providing identification documents, organizations should maintain clear procedures for handling those records.
A reliable document-management process should include proper acknowledgment of receipt, controlled access, secure storage, and accountability when records are transferred between employees or departments.
The central lesson is straightforward: an organization cannot simply deny receiving a missing document when it cannot demonstrate that it had adequate procedures to track and safeguard the information entrusted to it.
Need Legal Assistance With Employee Data Privacy or HR Compliance?
Missing employee records, mishandled medical documents, and inadequate document-management procedures can expose organizations to data privacy complaints and potential liability.
If you are an employee whose personal information may have been mishandled, or an employer seeking assistance with Data Privacy Act compliance, HR data protection, Privacy Impact Assessments, or complaints before the National Privacy Commission, Cunanan Law Office provides legal assistance in data privacy compliance and related proceedings in the Philippines.
Contact Cunanan Law Office today at inquiries@mpeclaw.com or call (+63) 968-679-6617 to schedule a legal consultation.