A document can be important to your case. It may even help establish that the opposing party was previously involved in a similar dispute. But does that mean you can obtain it from someone with access to confidential government records and submit it as evidence?
Not necessarily.
In Spouses JG and AG v. Spouses CP and CC, NPC Case No. 23-036, November 13, 2023, the National Privacy Commission (NPC) found two individuals liable for unauthorized processing of personal and sensitive personal information under Section 25 of Republic Act No. 10173, or the Data Privacy Act of 2012.
The case involved an affidavit of desistance obtained from National Bureau of Investigation (NBI) records and subsequently used in a separate estafa complaint.
The ruling carries an important lesson for litigants and lawyers: having a legitimate reason to use evidence does not necessarily make the manner of obtaining that evidence lawful.
The Case: An Affidavit From Another Estafa Complaint
The controversy began when spouses CP and CC filed a syndicated estafa complaint against spouses JG and AG and several other individuals. The complaint was initially brought before the NBI and later endorsed to the Office of the City Prosecutor of Quezon City.
During the preliminary investigation, CP and CC submitted a Joint and Consolidated Reply-Affidavit referring to a previous syndicated estafa complaint filed by another person against JG and AG. Attached to their submission was an Affidavit of Desistance with Mutual Release and Quitclaim from that earlier case.
There was one important detail: CP and CC were not parties to the previous complaint. In their reply-affidavit, they acknowledged that they obtained the settlement document through persons who had access to NBI records.
JG and AG questioned how the document had been obtained and subsequently filed a complaint before the NPC. They alleged that their personal information, details of the earlier criminal proceedings, and the settlement documents had been accessed and disclosed without lawful authority.
Are NBI Investigation Records Protected by the Data Privacy Act?
Information contained in criminal investigation records may qualify as personal or sensitive personal information under Philippine law.
Section 3(l) of the Data Privacy Act classifies information relating to criminal proceedings, including allegations of offenses and the disposition of proceedings, as sensitive personal information.
In this case, the affidavit contained the complainants' names, addresses, marital status, and information concerning an earlier syndicated estafa complaint.
The NPC recognized that these details were protected by the Data Privacy Act. Accessing, obtaining, and using such records therefore required an applicable lawful basis.
Can Personal Information Be Used to Support a Criminal Complaint?
Yes, under appropriate circumstances. Section 13(f) of the Data Privacy Act permits processing necessary for the establishment, exercise, or defense of legal claims, among other recognized purposes.
This exception is important because pursuing a legitimate case may require documents containing another person's personal information. However, the NPC emphasized that the provision cannot be invoked without considering how the information was obtained. Personal data processing must still comply with the law's general principles, particularly legitimate purpose.
In other words, the existence of a legal dispute does not automatically authorize a party to obtain confidential records through improper means.
Why Did the NPC Find the Respondents Liable?
The decisive issue was the source of the affidavit. CP and CC admitted that the document had been obtained through persons with access to NBI records.
However, they failed to establish that those individuals were authorized to release the document. They also failed to demonstrate that obtaining and using the affidavit was otherwise permitted under the Data Privacy Act.
The NPC rejected their reliance on Section 13(f), explaining that processing information for legal claims must remain within lawful limits. A legitimate legal objective cannot, by itself, justify an unauthorized method of obtaining protected personal information.
The Commission found that the respondents had processed the complainants' personal and sensitive personal information without an adequate lawful basis.
Consequently, it held CP and CC liable for unauthorized processing under Section 25 of the Data Privacy Act.
What About the Requirement to Exhaust Remedies Before Filing an NPC Complaint?
The respondents also argued that the complaint should be dismissed because JG and AG had supposedly failed to exhaust the required remedies.
Under the NPC Rules of Procedure, complainants generally must first inform the concerned party in writing about the alleged privacy violation and allow an opportunity to address it.
The NPC found that JG and AG had already raised their objection in their Joint Rejoinder-Affidavit during the preliminary investigation. The Commission considered this sufficient written notice under the circumstances.
It further explained that the exhaustion requirement could be waived because the documents had already been submitted to the prosecutor's office, making the alleged disclosure difficult to remedy.
The case therefore proceeded to a determination on its merits.
NPC Recommends Prosecution for Unauthorized Processing
The NPC ultimately held spouses CP and CC liable under Section 25 of the Data Privacy Act.
It also forwarded the decision and pertinent records to the Secretary of Justice, recommending their prosecution for unauthorized processing of personal and sensitive personal information.
Notably, the NPC's ruling centered on unauthorized processing under Section 25. Although other alleged violations were raised, the Commission's dispositive ruling did not separately establish liability under Sections 28, 31, or 32.
What Does This Mean for Litigants and Lawyers?
The decision highlights the importance of examining not only whether evidence is relevant but also whether it was lawfully obtained.
Documents from government agencies, criminal investigations, and previous legal proceedings may contain sensitive personal information. Before acquiring or submitting these records, parties should verify whether they are entitled to obtain them and whether a lawful basis exists for their use.
The Data Privacy Act does not prevent legitimate litigation. However, the pursuit of a legal claim does not provide blanket authority to obtain or disclose protected records through unauthorized channels.
The ruling also does not automatically determine whether a particular document is admissible as evidence. That question remains subject to the applicable rules and the authority of the forum hearing the underlying case.
Need Legal Assistance With a Data Privacy Complaint?
Disputes involving confidential government records, criminal investigation documents, and the unauthorized processing of personal information require careful legal assessment.
Whether you believe your information was unlawfully obtained or you are facing a complaint involving documents used in legal proceedings, Cunanan Law Office provides legal assistance in Data Privacy Act cases, NPC proceedings, criminal defense, and related legal matters in the Philippines.
Contact Cunanan Law Office today at inquiries@mpeclaw.com or call (+63) 968-679-6617 to schedule a legal consultation.