Filing a Complaint Against Harassing Online Lending Apps in the Philippines
How to Invoke the National Privacy Commission, the Securities and Exchange Commission, and Other Remedies
Table of Contents
Why This Matters
Legal Foundations
- Data Privacy Act of 2012 (DPA) & NPC Rules
- SEC Regulation of Financing/Lending Companies
- Financial Products and Services Consumer Protection Act (RA 11765)
- Other Relevant Statutes (Revised Penal Code, Cybercrime Law, Consumer Act, etc.)
What Conduct Counts as “Harassment”
Where to Complain—and for What
- National Privacy Commission (NPC)
- Securities and Exchange Commission (SEC)
- Bangko Sentral ng Pilipinas (BSP)
- Philippine National Police Anti-Cybercrime Group (PNP-ACG)
- Department of Trade and Industry (DTI) & National Telecommunications Commission (NTC)
Step-by-Step: Filing With the NPC
Step-by-Step: Filing With the SEC
Evidence Checklist
Timeline & What to Expect
Potential Penalties Imposed on Violating Apps
Practical Tips to Protect Yourself Right Now
Frequently Asked Questions
Template: Sworn Complaint-Affidavit
Key Takeaways & Final Reminders
1. Why This Matters
Online lending apps (“OLAs”) have democratized short-term credit but many resort to abusive collection tactics—public shaming, threats, and unauthorized scraping of contact lists. These practices violate both privacy laws and specialized SEC rules. Victims now have clear pathways to relief thanks to a maturing regulatory framework that lets you invoke multiple agencies simultaneously.
2. Legal Foundations
| Law / Issuance | Key Provisions on Harassment |
|---|---|
| Republic Act 10173 – Data Privacy Act of 2012 | §16 (rights of data subjects), §25–26 (unauthorized processing and access). |
| NPC Rules of Procedure (2016) & Circular 16-01 | Outlines how to file complaints, mediation, and penalties (up to ₱5 million / imprisonment). |
| SEC Memorandum Circular Nos. 18-19 (2019), 26 (2022) | Limits data harvesting, bans contact-list harvesting & “shaming,” prescribes complaint process; violation may lead to certificate revocation. |
| Republic Act 11765 – Financial Products and Services Consumer Protection Act (2022) | §5 and §6 prohibit abusive collection practices; empowers SEC, BSP, and IC to adjudicate and impose hefty fines. |
| Bangko Sentral ng Pilipinas Circular No. 1160 (2023) | Integrates RA 11765 standards into lending operations of BSP-supervised firms and payment gateways. |
| Revised Penal Code & RA 10175 (Cybercrime) | Art. 287 (unjust vexation), Art. 282 (grave threats), §4(c)(1) RA 10175 (libel via ICT). |
| Consumer Act (RA 7394) | Deceptive or unconscionable sales acts. |
3. What Conduct Counts as “Harassment”
| Typical OLA Tactic | Why It’s Illegal |
|---|---|
| Bulk texting or calling all your phone contacts to shame you | Unauthorized processing (§25 DPA); contact-list harvesting banned by SEC MC 26-22. |
| Threatening jail or deportation for non-payment | Misrepresentation & grave threats (RPC Art. 282); unfair collection under RA 11765. |
| Publicly posting your name/debt on social media | Privacy violation; cyber-libel (RA 10175). |
| Excessive or late-night calls | Unfair debt-collection under SEC and RA 11765; possible violation of Anti-Telephone Harassment Act (RA 10929). |
4. Where to Complain—and for What
| Agency | When to Choose It | Main Outcomes |
|---|---|---|
| NPC | Any privacy violation (contact scraping, public shaming, illegal disclosure). | Cease-and-desist orders, fines, criminal referral, damages through mediation. |
| SEC (CGFD / EIPD) | App is a registered lending or financing company (or illegally unregistered). Focus on abusive collection or usurious charges. | Suspension/Revocation of license or app listing, fines, blacklisting from Google Play/App Store. |
| BSP | If the lender is a bank, e-money issuer, or uses a BSP-licensed payment aggregator. | Administrative sanctions, consumer redress under RA 11765. |
| PNP-ACG & NBI-CCD | There are threats, extortion, or cyber-libel. | Criminal investigation and prosecution. |
| DTI / NTC | Spam SMS, misleading advertisements. | Fines, blocking of SMS sender IDs. |
5. Step-by-Step: Filing With the NPC
Document Everything
- Take screenshots of messages, call logs, app permissions, and Google Play listing.
Complete the NPC Complaint-Assistance Form
- Available at complaints@privacy.gov.ph or via the NPC Citizen’s Action Center (NPC-CAS) portal.
Write a Sworn Complaint-Affidavit (see template below).
Attach Evidence (screenshots, IDs, proof of relationship if a relative is complaining).
E-mail or Upload to the portal within 15 days of the last offending act.
Await the NPC’s Assessment Notice (typically 10 working days).
Undergo Mediation (mandatory; 30-day window).
Investigation & Decision
- If mediation fails, the Complaints and Investigation Division (CID) conducts formal investigation; you may be asked for clarifications.
Possible Outcomes
- Compliance Order (stop processing, delete data, pay damages).
- Administrative Fines (up to ₱5 million per infraction).
- Criminal Referral to DOJ for prosecution (penalties include 1–6 years’ imprisonment).
6. Step-by-Step: Filing With the SEC
Verify Registration
- Check SEC’s Lending Companies and Financing Companies List to confirm the entity.
Prepare a Sworn Complaint stating violations of SEC MC 26-22 & RA 11765.
Attach Evidentiary Annexes (the same ones you used for NPC).
Submit via e-mail to cgfd@sec.gov.ph (for registered entities) or epd@sec.gov.ph (for scams/illegal lenders).
SEC Show-Cause Order
- The company must answer within 5 days; non-response accelerates sanctions.
Hearing / Clarificatory Conference (optional).
Disposition
- Fines up to ₱1 million + ₱10,000/day of continuing violation.
- Suspension or revocation of Certificate of Authority (CA).
- Expulsion from app stores (coordinated with NTC & DICT).
7. Evidence Checklist
- ☑️ Screenshot of the Loan Agreement & App Permissions
- ☑️ Screenshots of Threatening Messages (with visible timestamps).
- ☑️ Call Recording or Log (Android/ iOS log + affidavit identifying caller).
- ☑️ Bank Statements / Payment Receipts (to show amount owed vs. demanded).
- ☑️ Photo ID (complainant).
- ☑️ Special Power of Attorney (if filing for someone else).
8. Timeline & What to Expect
| Stage | NPC | SEC |
|---|---|---|
| Initial Review / Docketing | 10 working days | 5 working days |
| Mediation / Show-Cause | 30 days | 5–15 days |
| Formal Investigation | 60-90 days | 30-60 days |
| Decision & Penalties | 90-120 days total | 60-120 days total |
Appeals: NPC decisions may be appealed to the Commission en banc, then Court of Appeals. SEC orders may be appealed to the SEC En Banc, then CA under Rule 43.
9. Potential Penalties on Violating Apps
| Regulator | Administrative Fine | Other Sanctions |
|---|---|---|
| NPC | Up to ₱5 million per violation + damages to complainant | Cease-and-desist; data-deletion order; publication of decision. |
| SEC | Up to ₱1 million + ₱10k/day | CA suspension/revocation; blacklisting; disgorgement. |
| BSP | Up to ₱200k per day under RA 7653 & RA 11765 | Suspension of operations, disqualification of directors. |
| Courts (Criminal) | Imprisonment 1–6 years; fines | Criminal record; civil damages. |
10. Practical Tips to Protect Yourself Right Now
- Restrict App Permissions—revoke contact-list access in Settings > App Info.
- Notify Contacts—explain potential spam ahead of time; it blunts shaming attempts.
- Block & Record Calls—use built-in call blocker but keep logs for evidence.
- Pay Through Traceable Channels Only—G-Cash or bank transfer with reference number.
- Never Give Additional Personal Data after default; you owe the debt, not unlimited privacy.
- Check SEC’s Advisories Regularly before borrowing.
11. Frequently Asked Questions
Q: Will filing with NPC suspend debt collection? A: No. It only restrains unlawful processing of your data. Legitimate collection—without harassment—may continue.
Q: Can I sue for damages myself? A: Yes. Use the NPC decision or SEC order as evidence in a civil action for moral/exemplary damages under Art. 2219 Civil Code.
Q: I am not the borrower but I’m being harassed. Can I complain? A: Absolutely. You are a data subject whose information was processed without consent.
12. Template: Sworn Complaint-Affidavit
Republic of the Philippines City / Province of ________
I, [Name], Filipino, of legal age, residing at ________, after having been duly sworn in accordance with law, depose and state:
- Parties and Contact Details…
- Statement of Facts (chronological)…
- Violations Alleged (cite §§ of DPA, SEC MC 26-22, RA 11765)…
- Evidence Annexes (A to __)…
- Reliefs Prayed (cease-and-desist, deletion of personal data, fines, etc.).
IN WITNESS WHEREOF, I have hereunto set my hand this ___ day of ______ 20__, at __________.
[Name] Affiant
SUBSCRIBED AND SWORN to before me…
13. Key Takeaways & Final Reminders
- Document first, complain second. Evidence is the backbone of every NPC/SEC case.
- You may file simultaneous complaints; the agencies do coordinate.
- The Data Privacy Act covers how they harass you; the SEC covers who is harassing you.
- Even if you still owe the debt, harassment and privacy violations are never lawful means of collection.
- Deadlines run quickly—15 days for NPC complaints—so act promptly.
- Consider seeking counsel if the amount at stake or the harassment is severe; some Integrated Bar of the Philippines chapters run free legal aid desks.
This article is for informational purposes only and does not constitute legal advice. For advice on your specific situation, consult a Philippine lawyer or the relevant regulatory agencies.