DOJ Public Advisory on Online Lending Companies

April 23, 2021 DOJ PUBLIC ADVISORY ON ONLINE LENDING COMPANIES Department of Justice Office of Cybercrime INTRODUCTION This Public Advisory is issued by the Department of Justice (DOJ)-Office of Cybercrime (OOC) in response to the increasing number of reports received and endorsed to it involving unfair debt collection practices and cyber harassments by online lending companies (OLCs). HTcADC In particular, the reports alleged that certain OLCs are engaged in unfair debt collection practices and cyber harassments when its debtors fail to settle their account balances. Acts complained of include, but are not limited to, the following: a. Accessing the debtors' phone book/contacts list for purposes of sending them messages in the event of untimely and/or non-payment; b. Posting the debtors' personal and sensitive personal information online for purposes of shaming them; c. Threatening debtors with death and physical injuries if they fail to settle their account balances; and d. Using profane language through text message directly sent to the debtors and to the debtors' references for purposes of shaming them. In line with the policy of the State to protect and safeguard the integrity of computer, computer and communications systems, networks, and databases, and the confidentiality, integrity, and availability of information and data stored therein, from all forms of misuse, abuse, and illegal access, and to ensure that personal information in information and communications systems in the government and in the private sector are secured and protected, this Public Advisory is being issued to inform the public of the steps to be undertaken when they become victims of unfair collection practices committed by OLCs. This will likewise serve as a warning to the OLCs not to engage in unfair or unlawful acts in debt collection. LEGAL FRAMEWORK The following laws, rules and regulations are relevant in determining the appropriate case/s a complainant may file against an OLC, which engages in unfair debt collection and cyber harassment: a. Republic Act No. 10175 or the Cybercrime Prevention Act of 2012 Republic Act (R.A.) No. 10175 criminalizes the crime of illegal access, which it defined as the access to the whole or any part of a computer system without right. 1 "Without right" refers to either: (i) conduct undertaken without or in excess of authority; or (ii) conduct not covered by established legal defenses, excuses, court orders, justifications, or relevant principles under the law. 2 Any person found guilty of illegal access shall be punished with imprisonment of prision mayor or a fine of at least Two Hundred Thousand Pesos (Php200,000.00) up to a maximum amount commensurate to the damage incurred or both. 3 The same law reaffirms the crime of libel under Article 355 4 of the Revised Penal Code (RPC) committed through a computer system or any other similar means, which may be devised in the future. It imposes the penalty of prision correccional in its maximum period to prision mayor in its minimum period or a fine ranging from Six Thousand Pesos (Php6,000.00) up to the maximum amount determined by Court, or both, in addition to the civil action which may be brought by the offended party. When an OLC gains access to their debtors' phone book/contacts list for purposes of sending them messages in the event of untimely and/or non-payment, they are accessing to a computer system without right. While it may be true that the debtors initially consented to the OLC's mobile application, such consent is only limited to matters that would assist the OLC in the lawful and proportionate processing of the application for loan, nothing more, nothing less. Hence, for accessing in excess of authority, the OLC may be held liable for Illegal Access under Section 4 (a) (1) of R.A. No. 10175. On the other hand, when an OLC resorts to deliberate publishing of public and malicious imputation of a vice, defect, or crime, such as posting the words "magnanakaw, patay gutom, estafadora" against its debtors, and the same causes dishonor to the latter, they may be held liable for Cyber Libel under Section 4 (c) (4) of R.A. No. 10175. b. Republic Act No. 10173 or the Data Privacy Act of 2012 To safeguard personal information 5 and sensitive personal information 6 against abuse on the part of information processors, R.A. No. 10173 criminalizes certain acts, such as Unauthorized Processing of Personal Information and Sensitive Personal Information, Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes and Malicious Disclosure. Under Section 25 of the aforesaid law, the penalty of imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five Hundred Thousand Pesos (Php500,000.00) but not more than Two Million Pesos (Php2,000,000.00) shall be imposed on persons who process personal information without the consent of the data subject, or without being authorized under R.A. No. 10173 or any existing law. If the information processed pertains to sensitive personal information, the imposable penalty shall be imprisonment ranging from three (3) years to six (6) years and a fine of not less than Five Hundred Thousand Pesos (Php500,000.00) but not more than Four Million Pesos (Php4,000,000.00). CAIHTE Further, Section 28 of the same law provides that persons processing personal information for purposes not authorized by the data subject, or otherwise authorized under R.A. No. 10173 or under existing laws shall be penalized by imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five Hundred Thousand Pesos (Php500,000.00) but not more than One Million Pesos (Php1,000,000.00). If the information processed for unauthorized purposes pertains to sensitive personal information, the imposable penalty shall be imprisonment ranging from two (2) years to seven (7) years and a fine of not less than Five Hundred Thousand Pesos (Php500,000.00) but not more than Two Million Pesos (Php2,000,000.00). On the other hand, any personal information controller or personal information processor or any of its officials, employees or agents, who, with malice or in bad faith, discloses unwarranted or false information relative to any personal information or personal sensitive information obtained by him or her, shall be subject to imprisonment ranging from one (1) year and six (6) months to five (5) years and a fine of not less than Five Hundred Thousand Pesos (Php500,000.00) but not more than One Million Pesos (Php1,000,000.00). 7 Similar to the explanation in the immediately preceding section, an OLC that gains access to their debtors' phone book/contacts list for purposes of sending them messages in the event of untimely and/or non-payment may be held liable for Unauthorized Processing of Personal Information and Sensitive Personal Information, Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes under Sections 25 and 28 of R.A. No. 10173, respectively. In addition, when an OLC engages in the act of posting online their debtors' personal information or personal sensitive information obtained by virtue of the loan application for purposes of shaming them, the same may constitute the crime of Malicious Disclosure under Section 31 of R.A. No. 10173. c. Revised Penal Code Depending on the allegations made by the complainant, OLCs engaged in unfair debt collection practices may be held liable for any of the crimes of grave 8 or light 9 threats, grave 10 or light 11 coercions, or unjust vexation 12 in relation to Section 6 13 of R.A. No. 10175. For instance, a debtor may be threatened with death, physical injuries and/or the public disclosure and sharing of his/her personal information online with the caption "scammer." These are clearly constitutive of the crime of grave threats that is defined as the act of any person who shall threaten another with the infliction upon the person, honor or property of the latter or of his family of any wrong amounting to a crime. Further, since the threat was committed by, through and with the use of information and communications technology (ICT), Section 6 of R.A. No. 10175 comes into play. Accordingly, the imposable penalty becomes one (1) degree higher than that provided for under the RPC. d. Securities and Exchange Commission Memorandum Circular No. 18, Series of 2019 14 In light of the complaints received by the Securities and Exchange Commission (SEC) against Financing Companies (FCs) and Lending Companies (LCs) that allegedly harass borrowers and employ abusive, unethical, and unfair means to collect debts, Memorandum Circular (M.C.) No. 18, Series of 2019, was issued prohibiting unfair debt collection practices. Unfair debt practices include the use of obscenities, insults or profane language; publication of the names and other personal information of the borrowers; and the use of any false representation or deceptive means to collect or attempt to collect any debt or to obtain information concerning a borrower, among others. 15 The same M.C. provides that for purposes of collection, FCs and LCs shall keep strictly confidential the data on the borrower, except under certain circumstances. 16 LCs and FCs found to be violating the M.C. face penalties 17 ranging from: LCs FCs First Offense Php25,000.00 Php50,000.00 Second Offense Php50,000.00 Php100,000.00 Third Offense Subject to the facts, circumstances and gravity of the offense, the SEC, at its discretion, may impose a fine of not less than twice the fine for the second offense but not more than One Million Pesos (Php1,000,000.00); or suspension of lending and financial activities for a period of sixty (60) days; or Revocation of Certificate of Authority to operate as FC or LC. In sum, if the above-discussed common modus operandi of the OLCs are committed by LCs and FCs, then the latter may be held liable for violating SEC M.C. No. 18, Series of 2019, without prejudice to any other penalties that may be imposed by the SEC under R.A. No. 11232 or the Revised Corporation Code of the Philippines, and all other relevant laws, rules, and regulations. aScITE ADVISORY In view of the foregoing, the general public is hereby apprised of the following actions one may institute against OLCs that engage in unfair debt collection practices and cyber harassments, to wit: ACTS COMPLAINED OF LAW/S VIOLATED WHERE TO FILE Unauthorized access of the complainant's mobile phonebook/directory/contact. Illegal Access under R.A. No. 10175 If the identity of the offender is known : Office of the Prosecutor where the offense or any of its elements is committed, where any part of the computer system used is situated, or where any of the damage caused to a natural or juridical person took place. 18 If the identity of the offender is unknown : The complaint may be filed before either the National Bureau of Investigation (NBI)-Cybercrime Division (CCD) or the Philippine National Police (PNP)-Anti-Cybercrime Group (ACG) for the conduct of investigation. The use or threat of violence or other means to harm the physical person, reputation, or property of any person. Grave or light threats, grave or light coercions, or unjust vexation under the RPC, as the case may be, in relation to Section 6 of R.A. No. 10175 The use of obscenities, insults, or profane language the natural consequence of which is to abuse the borrower, and publishing the same online. Cyber Libel under R.A. No. 10175 Unjust Vexation under the RPC in relation to Section 6 of R.A. No. 10175 Malicious disclosure or publication of names and other personal information and sensitive personal information of borrowers who allegedly refuse to pay debts. Malicious Disclosure under R.A. No. 10173 National Privacy Commission (NPC) Contacting the persons in the borrower's contact list other than those who were named as guarantors or co-makers. Unauthorized Processing of Personal Information and Sensitive Personal Information and Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes under R.A. No. 10173 NPC Complaints for the above-mentioned actions may be filed simultaneously. If any of the aforementioned acts is committed by an LC or FC, a complaint may also be filed simultaneously before the SEC pursuant to M.C. No. 18, Series of 2019. The general public is likewise encouraged to report erring OLCs to the following government agencies: PHILIPPINE NATIONAL POLICE-ANTI-CYBERCRIME GROUP Email Address: [emailprotected] Mobile No.: (+63) 998-598-8116 Telephone Nos.: (+632) 8414-1560 Website: https://acg.pnp.gov.ph/main/ E-Complaint: https://acg.pnp.gov.ph/eComplaint/ Facebook: https://www.facebook.com/anticybercrimegroup NATIONAL BUREAU OF INVESTIGATION-CYBERCRIME DIVISION Email Address: [emailprotected] Address: Office of the Cybercrime Division National Bureau of Investigation 5th Floor V-tech Tower 1257 Gregorio Araneta Ave. cor. Maria Clara Street, Sto. Domingo Ave. Quezon City Website: https://www.nbi.gov.ph NATIONAL PRIVACY COMMISSION Email Address: [emailprotected] Telephone No.: (+632) 8234 2228 Website: https://www.privacy.gov.ph/ SECURITIES AND EXCHANGE COMMISSION Email Address: [emailprotected] Telephone No.: (+632) 8818-6047 Website: https://www.sec.gov.ph/ For your guidance and information. (SGD.) ATTY. CHARITO A. ZAMORA Officer-in-Charge DOJ Office of Cybercrime Footnotes 1. Section 4 (a) (1), Republic Act (R.A.) No. 10175. 2. Section 3 (h), R.A. No. 10175. 3. Section 8, R. A. No. 10175. 4. Article 355. Libel means by writings or similar means. A libel committed by means of writing, printing, lithography, engraving, radio, phonograph, painting, theatrical exhibition, cinematographic exhibition, or any similar means, shall be punished by prision correccional in its minimum and medium periods or a fine ranging from 200 to 6,000 pesos, or both, in addition to the civil action which may be brought by the offended party. 5. Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual. (Section 3 (g), R.A. No. 10173) 6. Sensitive personal information refers to personal information: (1) About an individual's race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; (2) About an individual's health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or cm-rent health records, licenses or its denials, suspension or revocation, and tax returns; and (4) Specifically established by an executive order or an act of Congress to be kept classified. (Section 3 (l), R.A. No. 10173) 7. Section 31, R.A. No. 10173. 8. Article 282, Revised Penal Code (RPC). 9. Article 283, RPC. 10. xArticle 286, RPC. 11. Article 287, RPC. 12. Ibid. 13. All crimes defined and penalized by the Revised Penal Code, as amended, and special laws, if committed by, through and with the use of information and communications technologies shall be covered by the relevant provisions of this Act: Provided, That the penalty to be imposed shall be one (1) degree higher than that provided for by the Revised Penal Code, as amended, and special laws, as the case may be. (Section 6, R.A. No. 10175) 14. Accessed on 25 March 2021 at https://www.sec.gov.ph/wpcontent/uploads/2019/10/2019MCNo18.pdf . 15. Section 3, Securities and Exchange Commission (SEC) Memorandum Circular (M.C.) No. 18, Series of 2019, 19 August 2019. 16. Section 3, SEC M.C. No. 18, Series of 2019, 19 August 2019. 17. Section 5, SEC M.C. No. 18, Series of 2019, 19 August 2019. 18. Section 21, R.A. No. 10175.