In a landmark case, the Office of the Ombudsman Visayas has initiated an in-depth investigation into allegations of a data privacy breach involving Rene Y. Jayag, the OIC-Provincial Assessor of Bohol province.

The complaint, filed by former Provincial Administrator and ex-Bohol Board Member Alfonso “Ae” Rafols Damalerio II, accused Jayag of alleged unauthorized disclosure of sensitive personal information, potentially violating the Data Privacy Act of 2012.

In a statement, Damalerio expressed his concerns: “My family’s privacy has been compromised without our consent. This is not just about the unauthorized release of information; it’s about the fundamental right to privacy.”

The affidavit submitted by Damalerio to the Ombudsman narrates that no consent was given for the release of property tax declarations belonging to him and his family.

“The law is clear,” Damalerio stated, “Section 34 (a) (3) of the Implementing Rules and Regulations of the Data Privacy Act grants us the right to object to the processing of our data. We were never afforded that opportunity.”

On July 11, 2023, Leoncio “Toloy” Evasco Jr., chairman of the Office of Government Accountability and Review (OGAR) created by Governor Aris Aumentado, requested from Jayag a list of properties owned by Damalerio, his family members, and some associates, including tax declaration details and assessment values.

Without seeking Damalerio’s consent, Jayag provided OGAR the requested property details and tax declarations for Damalerio and the listed individuals on the same day, July 11, 2023, the Affidavit stated.

Damalerio alleged that Jayag’s disclosure of his and his family’s sensitive personal information (property ownership details) to a third party (OGAR) without their consent allegedly violates the Data Privacy Act of 2012.

Damalerio also alleged that Jayag’s action constitutes grave misconduct and seeks preventive suspension of Jayag pending investigation.

The complaint included supporting documents like the letters between OGAR and Jayag, property certifications issued by Jayag, and evidence of public ridicule via Facebook faced by Damalerio after the disclosure.

Details of Damalerio’s property were immediately posted on the Facebook account of Willy Ramasola, a member of now disbanded OGAR, the Affidavit pointed out.

“Respondent Jayag, the OIC Provincial Assessor, complied with the request without obtaining any consent from the complainant or those listed in the request,” according to the affidavit executed by Damalerio.

The released information included specific property details and assessed values, which fall under the definition of Sensitive Personal Information within the Data Privacy Act of 2012, Damalerio said.

The Data Privacy Act strictly prohibits the processing of Sensitive Personal Information unless specific exceptions apply, the complainant said.

In this case, none of those exceptions are relevant, said Damalerio.

The complainant did not consent, and there is no existing law or regulation mandating such disclosure, the Affidavit said.

In his complaint before the Ombudsman, Damalerio had sought criminal penalties against respondent Jayag as outlined in the Data Privacy Act which may include imprisonment and significant fines.

The complainant brings a charge of grave misconduct against the respondent, citing a willful disregard for the law and the complainant’s privacy rights.

Due to the severity of the charges and potential for the respondent to interfere with the case, Damalerio has also requested the Ombudsman the respondent’s preventive suspension during the investigation.

The Ombudsman’s office is considering the application of Administrative Order No. 07, Section 9, which allows for preventive suspension of an officer under investigation if the evidence of guilt is strong, according to Damalerio’s legal counsel.

“The charges against Mr. Jayag are serious and involve dishonesty, oppression, gross misconduct, or gross neglect in the performance of duty,” according to the complainant’s lawyer.

Meanwhile, in the affidavit complaint, it also referenced the case of Trade and Investment Development Corporation of the Philippines vs. Demigilio, which supports the validity of preventive suspension pending an investigation.

“An officer can be suspended without proof that they may unduly influence witnesses or tamper with evidence,” according to the said jurisprudence.

Damalerio’s legal counsel highlighted the repercussions of such breaches: “If found guilty, Mr. Jayag could face imprisonment of three to five years and fines between Php500,000.00 to Php2,000,000.00, as per Section 32 of the Data Privacy Act.”

On the other hand, as this develops, the Ombudsman Visayas has ordered submission of position papers of Jayag and Damalerio.

The Office of the Ombudsman Visayas had issued an order in the case of alleged unauthorized disclosure of sensitive personal information by Jayag.

The case, filed by Damalerio, accused Jayag of grave misconduct and it is now docketed as Ombudsman Case No: OMB-V-A-OCT-23-0278.

According to the order, both parties are directed to submit a verified position paper within 10 days to the Records Section of the Office of the Ombudsman Visayas.

The position paper is to contain the charges, defenses, and other claims contained in the affidavits and pleadings filed by the parties, along with any additional relevant affidavits and documentary evidence.

The Deputy Ombudsman for the Visayas, through the Director of Preliminary Investigation, Administrative Adjudication, and Prosecution Bureau – A (PIAAPB–A), will decide whether further proceedings are necessary after the submission of the position papers.

If deemed unnecessary, the case will be submitted for decision.

Otherwise, an order for a clarificatory hearing will be issued, the Order said.

This development comes as part of the ongoing investigation into Mr. Jayag’s conduct, where he is alleged to have released property tax declarations without the consent of Damalerio and his family, potentially breaching the Data Privacy Act of 2012.

DATA PRIVACY ACT

The Philippines Data Privacy Act, also known as Republic Act 10173, is a comprehensive privacy law that aims to protect privacy rights while promoting innovation and growth.

It requires consent for data processing, except in specific circumstances like contractual agreements, legal obligations, or protection of vital interests.

Sensitive personal information is strictly regulated, with exceptions for consent, legal requirements, and protection of individuals.

The law mandates agreements for data sharing, technical security safeguards, and the development of privacy programs by entities processing data.

Data subjects have rights to notice, choice, access, accuracy, and erasure of their data.

The Act applies broadly to individuals and entities processing personal information, with extraterritorial reach.

It emphasizes legitimate purposes and proportionality in data processing, requiring informed consent for collection and processing, especially for profiling and direct marketing.

The law reflects the Philippines’ commitment to privacy and security in the digital age.