In the Philippines, the rise of Financial Technology (FinTech) and Online Lending Applications (OLAs) has led to an increase in reports regarding unfair debt collection practices. These practices often involve harassment, threats, and the unauthorized disclosure of sensitive personal information. Borrowers are not defenseless; several laws and administrative regulations provide mechanisms for redress.

1. Governing Laws and Regulations

The legal framework protecting borrowers from abusive lending practices is primarily composed of the following:

Republic Act No. 10173 (Data Privacy Act of 2012): This is the primary law protecting personal information. It prohibits the unauthorized processing, disclosure, and malicious use of data (e.g., accessing a borrower's contact list to blast messages to their friends and family).
SEC Memorandum Circular No. 18 (Series of 2019): Issued by the Securities and Exchange Commission (SEC), this circular explicitly lists "Prohibition on Unfair Debt Collection Practices." It defines what constitutes harassment and unethical behavior.
Republic Act No. 3765 (Truth in Lending Act): Requires lenders to provide full disclosure of interest rates, fees, and charges.
Revised Penal Code (RPC): Certain acts of harassment may fall under Grave or Light Coercion, Grave or Light Threats, or Unjust Vexation.
Republic Act No. 10175 (Cybercrime Prevention Act of 2012): Relevant if the harassment involves online identity theft, cyber-libel, or unauthorized access to computer systems.

2. What Constitutes Harassment and Unauthorized Disclosure?

Under SEC MC No. 18 and the Data Privacy Act, the following acts are considered illegal or unethical:

Unfair Debt Collection Practices

Threats of Violence: Using or threatening to use physical harm against the borrower, their reputation, or their property.
Profanity and Insults: Using obscene or profane language to humiliate the borrower.
Disclosure of Names: Publicly posting the names of "delinquent" borrowers on social media or in public spaces.
Excessive Contact: Calling or messaging at unreasonable hours (e.g., between 10:00 PM and 6:00 AM), unless the borrower gave prior consent.
Misrepresentation: Falsely claiming to be a lawyer, a court representative, or a government official to intimidate the borrower.

Data Privacy Violations

Contact List Blasting: Accessing the borrower's phone contacts without a legitimate purpose and informing those contacts about the borrower's debt.
Unauthorized Processing: Using personal data for purposes other than what was agreed upon in the loan contract.
Social Media Shaming: Creating group chats or posts involving the borrower’s friends and family to coerce payment.

3. Step-by-Step Filing Process

If you are a victim of these practices, you can file formal complaints with the following agencies:

A. Securities and Exchange Commission (SEC)

The SEC has jurisdiction over the operations of lending and financing companies.

Gather Evidence: Collect screenshots of harassing texts, call logs, emails, and social media posts.
Verify Registration: Check the SEC website to see if the OLA is a registered Lending or Financing Company. If they are not registered, they are operating illegally.
File a Formal Complaint: Use the SEC's online complaint portal or email the Corporate Governance and Finance Department (CGFD). Provide a notarized complaint-affidavit detailing the violations of SEC MC No. 18.

B. National Privacy Commission (NPC)

The NPC handles violations of the Data Privacy Act.

Notice to the Lender: Generally, the NPC requires that you first notify the company's Data Protection Officer (DPO) of your grievance.
File a Complaint: If the company ignores you or fails to remedy the breach, file a formal complaint with the NPC. Highlight the "Unauthorized Disclosure" and "Malicious Disclosure" of your personal information.
Remedy: The NPC can order the deletion of your data and recommend the prosecution of the company's officers.

C. National Bureau of Investigation (NBI) / PNP Anti-Cybercrime Group (PNP-ACG)

If the harassment involves threats to life or cyber-libel:

Report to Authorities: Visit the NBI Cybercrime Division or the PNP-ACG.
Technical Assistance: They can assist in tracking the perpetrators and securing digital evidence for criminal prosecution under the Cybercrime Prevention Act.

4. Summary Table of Violations and Agencies

Violation Type	Specific Act	Primary Agency
Harassment	Threats, insults, late-night calls	SEC
Data Breach	Contact list blasting, shaming	NPC
Criminal Acts	Grave threats, Coercion, Libel	NBI / PNP / Prosecutor
Illegal Lending	Operating without SEC license	SEC

5. Important Considerations for Borrowers

Payment Liability: Filing a complaint regarding harassment does not automatically extinguish the legal obligation to pay the principal loan. However, it can lead to the suspension or revocation of the lender's license and the removal of illegal penalties.
Cease and Desist: The SEC has the power to issue Cease and Desist Orders (CDO) against OLAs that are found to be persistent violators.
Documentation: Always keep a digital backup of all interactions. Do not delete threads, as these are your primary evidence in a legal proceeding.