High cost of claiming damages under the Data Privacy Act of 2012

According to a survey commissioned by the National Privacy Commission (NPC), public awareness and knowledge of Republic Act No. 10173 (i.e., "Data Privacy Act of 2012" or "DPA") grew from 13% in 2017 to 25% in 2021. This is a welcome development. More people are becoming conscious of their rights as data subjects. That said, it also means the number of complaints filed against erring Personal Information Controllers (PICs) and Personal Information Processors (PIPs) will also continue to increase in the coming years. If you don’t see any problem with this, read on.

Under the DPA, an individual may claim indemnity for damages that he or she sustains as a result of a violation of his or her rights as a data subject. It may be in the form of actual or compensatory damages, moral damages, exemplary or corrective damages, liquidated damages, nominal damages, and temperate or moderate damages. The most common is the first, which is awarded to satisfy or recompense a complainant for the loss or injury sustained. It may include the actual expenses incurred by the complainant in filing and maintaining the case, such as fees paid to a lawyer, transportation costs for attending hearings before the NPC, payment for photocopying documents, and filing fees.

Interestingly, however, out of the 36 cases decided by the NPC from 2018 to 2021 (as published on its website), the only type of damages that the NPC has awarded to a complainant is nominal damages.  Nominal damages may be awarded in cases where a person's right is violated, but there is no proof of actual loss. The highest amount awarded? PhP50,000.00.

If you think that is hardly worth the effort, you are probably not alone.

Neither the DPA, its Implementing Rules and Regulations (IRR), nor the 2021 NPC Rules of Procedure require that the parties be assisted by a lawyer in a case filed before the NPC. This seems to suggest that filing a case is not that complicated. Unfortunately, that’s not exactly accurate.

To initiate a case, a complainant may download and fill out the Complaints-Assisted Form available on the NPC website. Certain portions of the document require the complainant to provide his or her personal information, as well as details relating to the respondent. The accomplished Form will then have to be notarized. A copy must be sent to the respondent and the NPC, along with all supporting documents. This is the easy part.

Other portions of the Form require some knowledge about the DPA, such as identifying the personal information processed by the respondent and the DPA provisions violated. In these items, it is easy to provide inaccurate or wrong information or omit crucial ones. The complainant would be best served by a lawyer or at least someone familiar with the law. After all, if the Form is not filled out properly and/or the supporting documents are incorrect or inadequate, it would be easy for the respondent to seek the outright dismissal of the complaint.

With a lawyer around, one would benefit from valuable advice regarding case building, as well as help in navigating the technical provisions of the NPC’s Rules. This would include guidance on the supporting documents needed to strengthen one’s case. If a complainant wants to claim damages other than nominal damages, there must be evidence to substantiate the claim. For instance, to support a claim for actual damages, copies of receipts for the expenses incurred relative to the case would be necessary. If losses were sustained or expenses incurred, documents proving the amount of losses or expenses should also be available.

Here and in several other aspects, legal assistance is invaluable. Oftentimes, however, it also not cheap. This probably explains why it is often the respondents that can afford to secure such services.

More often than not, the respondent in cases concerning data privacy is a corporation or business entity represented by an external counsel or an in-house lawyer. In 17 of the 36 cases decided by the Commission, the respondent was represented by external counsel. In the rest, many of the respondents were business entities, like banks and lending companies that have their in-house counsels. It is then no surprise that 29 out of the total number of cases were decided against the complainant. Only in one was the complainant represented by a lawyer.

But that is just half of the story. Equally concerning is the typical outcome of the cases filed so far with the NPC.

Of the seven cases where the NPC sided with the complainant, nominal damages were awarded in five.  In some of them, the NPC stated that the complainant failed to present proof of any actual loss or damages sustained.

Taking all these together (i.e., high cost of securing legal services vis-à-vis the dismal prospect of receiving an adequate monetary award), there appears to be little incentive for an aggrieved data subject to pursue a case before the NPC. PhP50,000.00 is rarely enough to cover a lawyer's fees, let alone the filing fees payable to the NPC. Worse, based, so far, on the decisions of the NPC, the complainant would already be lucky if he or she were awarded such an amount. In one case, the award was only PhP1,000.00 for each complainant.

Needless to say, there will be little use for data subjects to become fully aware of their rights if the cost of vindicating them is too prohibitive. It then behooves the NPC to always to be mindful that the parties to a case are almost always never on equal footing, especially in terms of resources. In the cases it has resolved, many of the complainants were simply ordinary employees with very limited resources. Relaxing the rules may be something the NPC should be looking into, particularly when it comes to the awarding of damages.