Batnag: Resibo? It could be a resibo against you if you're not careful

FOR those who like to post screenshots of conversations to prove that they're not lying, be careful. That "resibo" could be used as evidence against you.

You could be violating data privacy laws, if the screenshot of the conversation contains personal data. The penalties range from P500,000 to as much as P4 million, depending on the violation committed.

The National Privacy Commission (NPC) was asked if taking screenshots of a private conversation, and then sending it to someone else, violates the Data Privacy Act of 2012 (DPA). In an advisory opinion issued on November 4, 2020, the NPC said it could be, depending on what the screenshot captured. If the information involved personal data -- personal information such as a name or an address, or sensitive personal information like school or medical records -- then the sender could be held liable for unauthorized processing, which would mean at least a P500,000 fine and a jail term of at least one year.

Sending the screenshot to another person, the NPC said, is considered processing. For it to fall under the scope of Philippine data privacy laws, however, there must be personal data involved -- "if the conversation/screenshot itself allows for the identification of the parties."

"If it is simply the content of the conversation, with names and other identifiers redacted or cropped out of the conversation, it might not be within the scope of the DPA," the NPC said in its Advisory Opinion 2020-043.

The complete opinion could be found in the NPC website (https://www.privacy.gov.ph/wp-content/uploads/2020/12/Redacted-Advisory-Opinion-No.-2020-043.pdf)

Personal information is defined under the DPA as "any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual."

Sensitive personal information, which is more protected under the law, is defined as "personal information: about an individual's race, ethnic origin, marital status, age, color and religious, philosophical or political affiliations; about an individual's health, education, genetic or sexual life, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and specifically established by an executive order or an act of Congress to be kept classified."

Unauthorized processing of personal information is punishable with a fine ranging from P500,000 to P2 million, and a jail term ranging from one year to three years. Sensitive personal information basically refers to information that could be used to harass, shame, or discriminate against a person; unauthorized processing of such information has a higher penalty, ranging from P500,000 to P4 million, and imprisonment from three years to six years.

One other factor to consider is whether the "processing" -- the taking and sending of the screenshot -- was in connection with the sender's personal, family, or household affairs, as stated in Section 3(h)(2) of the DPA. "In such cases, the person is not considered as Personal Information Controller (PIC), and hence, to a certain extent, such processing is generally excluded from the scope of the DPA."

If personal data were involved, one can file a complaint with the NPC. The NPC has the power to conduct an investigation and, if needed, recommend to the Justice Department the filing of a complaint before the proper court.

Take note that these are just data privacy laws we're talking about. Remember the wiretapping case of Ramirez v. Garcia? Ramirez filed a complaint against Garcia alleging that she was "insulted and humiliated" and, to support her claim, provided a transcript of the conversation, which was based on a tape recording of said conversation. Garcia filed a complaint against Ramirez for allegedly violating the Anti-Wiretapping Act, saying it was illegal for Ramirez to secretly tape their conversation.

The Supreme Court said it was illegal for anyone, whether part of the conversation or not, to make a secret recording using a tape recorder. A soft copy of the Supreme Court ruling can be found in this link: https://lawphil.net/judjuris/juri1995/sep1995/gr_93833_1995.html.

So take note: reposting that "resibo" may do more than prove the other person's culpability; it may also serve as evidence against you, should reposting it happen to be in violation of a law.

(Dana Batnag heads the policy and risk management section in the data privacy office of a financial service institution. She may be contacted at yourdataprotectionofficer@protonmail.com)

Related Stories

No stories found.
SunStar Publishing Inc.
www.sunstar.com.ph