Grave Threats and Defamation by a Former Employee: Employer Remedies in the Philippines

This guide is for Philippine employers and HR/legal teams navigating threats and reputational attacks from a former employee. It summarizes criminal, civil, contractual, and practical remedies under Philippine law. It is general information, not legal advice.

1) Quick map of the legal landscape

Threats (criminal)

Grave threats (Revised Penal Code, RPC, generally Arts. 282–285): threatening to commit a wrongful act amounting to a crime against a person, honor, or property. Penalties depend on whether the threat is conditional and/or the purpose was achieved.
Light/other threats: cover lesser forms (e.g., threats not amounting to a crime, threats with a weapon, etc.).
Blackmail/extortion: threats to publish or not publish something in exchange for money or advantage (e.g., “Pay me or I’ll post the files”) can fall under dedicated RPC provisions or combine with grave threats and theft/robbery/extortion theories.

Defamation (criminal & civil)

Libel (written/online) and slander (oral) under the RPC (Arts. 353–362).
Cyber libel under the Cybercrime Prevention Act (RA 10175) increases penalties by one degree and follows libel’s elements when committed through computer systems or social media.
Civil damages may be pursued separately (Civil Code Art. 33 for defamation, fraud, and physical injuries), with a lower burden of proof than criminal.

Privacy, data, and devices

Data Privacy Act (RA 10173): unauthorized access, use, disclosure, or retention of personal data obtained from the employer can be criminal and administrative.
Anti-Wiretapping (RA 4200): generally prohibits secretly recording private communications; distribution of such recordings can be independently criminal.
Cybercrime offenses (RA 10175): illegal access, data interference, identity theft, etc., may apply if systems or accounts were misused.

Contract and IP

Breach of confidentiality/NDA, non-disparagement, IP/trade secret misuse, return of company property: enforceable via civil actions for specific performance, injunction, and damages.
Unfair competition / passing off (IP Code) and unlawful solicitation (if contractually restricted and reasonable) may be relevant.

2) Elements and proofs you’ll need

A. Grave threats

A threat to inflict a wrong amounting to a crime (e.g., bodily harm, arson, property damage, hacking).
Intent to threaten (words, messages, gestures).
Conditional or not (e.g., “If you don’t pay, I’ll…”).
Achievement of purpose (affects penalty tiers). Evidence: call/message transcripts, emails, posts, witnesses, CCTV, device forensics, screenshots with URLs/timestamps, and chain-of-custody documentation.

B. Defamation (libel/slander/cyber libel)

Defamatory imputation injuring reputation or business standing.
Publication to a third person (in writing, online, or spoken).
Identifiability of the employer or officers.
Malice is generally presumed in libel; the accused may rebut with truth plus good motives and justifiable ends or privileged communication (e.g., fair comment on matters of public interest, communications in the performance of duty). Evidence: copies of posts/letters, platform URLs, reach/analytics if available, testimony of recipients/viewers, archival captures, notarial custodian affidavits.

C. Data/privacy/cyber offenses

Unauthorized access or disclosure of personal data or confidential data (client lists, HR files, trade secrets).
Use of stolen credentials or bypassing access controls. Evidence: system logs, access trails, admin audit logs, email headers, device images, SIEM exports.

3) Your remedy toolkit (what you can file and where)

A. Criminal remedies

Police/NBI blotter & incident report
- File with PNP (including Women and Children Protection Desk if employees are harassed) or NBI-Cybercrime Division for online conduct.
- Purpose: immediate documentation, coordination, and evidence preservation.
Criminal complaint with the Office of the City/Provincial Prosecutor
- For grave threats, libel/slander/cyber libel, data privacy, anti-wiretapping, cybercrime offenses.
- Attach Complaint-Affidavits from company officers and affected employees, plus documentary/forensic exhibits and custodian affidavits.
Subpoenas and preservation (via prosecutors/NBI/PNP)
- Seek preservation of logs, subscriber info, and content metadata from platforms/ISPs. Early law-enforcement involvement helps with chain of custody.

Timing matters: Some speech offenses have short prescriptive periods (libel under the RPC traditionally 1 year from publication). Cyber libel and special-law offenses can have different prescriptive rules. Act quickly; compute prescription conservatively.

B. Civil remedies

Independent civil action for defamation (Art. 33, Civil Code)
- Sue for actual, moral, exemplary damages, and attorney’s fees.
- Standard is preponderance of evidence (lower than criminal).
- Useful even if you choose not to file (or after) a criminal case.
Breach of contract / unfair competition / IP/trade secrets
- Enforce NDAs, non-disparagement, return of property, non-solicitation (if reasonable in scope, time, geography).
- Remedies: damages, specific performance, replevin (to recover devices/documents), accounting, and injunction (see note on speech below).
Injunctions & TROs
- Courts may enjoin ongoing unlawful conduct (e.g., use/disclosure of confidential data, impersonation, access to systems).
- Prior restraint concerns make courts cautious about orders that broadly gag speech; however, targeted orders to remove unlawfully obtained data or stop continuing torts (like misusing trade secrets or doxxing personal data) are more viable.

C. Administrative & regulatory

National Privacy Commission (NPC): file complaints for unauthorized processing/disclosure of personal data. The NPC can issue compliance orders and penalties.
Labor agencies: generally do not have jurisdiction once the employee has separated, except for residual employment claims.
Platform remedies: report to Facebook, X/Twitter, YouTube, TikTok, LinkedIn, etc., for defamation, harassment, doxxing, non-consensual recording, or IP/privacy violations. Attach court orders if obtained.

4) Strategy: choosing the right path (and in what order)

Phase 0 — Safety & containment

Protect people: security assessments, access bans to premises, escorts if needed.
Disable access: revoke accounts, rotate credentials/API keys, wipe or recover devices through MDM (observe due process if personally owned).
Litigation hold: freeze retention policies; image devices; preserve chats, emails, and logs.

Phase 1 — Evidence build

Forensically capture posts/messages (screens + page source/headers if possible).
Record publication dates/times/time zones; identify audiences and recipients.
Prepare Affidavits (corporate representative, IT custodian, HR, witnesses).
Maintain chain-of-custody for digital evidence.

Phase 2 — Demand & platform action

Send a cease-and-desist/demand letter (defamation, threats, NDA, data, devices).
Simultaneously report to platforms to remove content and preserve data.

Phase 3 — File the right cases

Criminal (grave threats, libel/cyber libel, privacy, wiretapping, cybercrimes).
Civil (Art. 33 defamation damages; contract/IP violations; injunctions).
NPC complaint if personal data is involved.

Phase 4 — Communications

If you must respond publicly, keep to verifiable facts, avoid malice, and ground statements in qualified privilege (e.g., protecting corporate and stakeholder interests). Approvals via counsel and media policy.

5) Special scenarios

“Pay or I’ll post” (extortion/blackmail): consider grave threats, Art. 356-type extortion, and robbery/extortion angles; do not negotiate cash without counsel and law enforcement coordination.
Leaked HR files or client lists: pursue Data Privacy Act violations, cybercrime (illegal access, data interference), and breach of NDA/trade secrets with injunctive relief.
Secret recordings: assess Anti-Wiretapping exposure; platforms will often remove non-consensual recordings.
Whistleblowing claims: truth can be a defense only with good motives and justifiable ends; trade secrets and personal data remain protected. Build a clean factual record to rebut “public interest” claims.
Former employee abroad: you can still file in the Philippines (jurisdiction can attach where publication or harm occurred), leverage platform takedowns and service of process via counsel’s cross-border strategy.

6) Evidence checklist (print & use)

URLs, handles, message IDs; full-screen captures with timestamps and profile links.
Copies of posts/messages in native format (HTML/PDF export), including headers.
Witness statements on what they saw/heard and when.
IT logs: login/access trails, IPs, device IDs, audit logs, MDM reports.
Copies of employment agreement, NDA, separation/quitclaim, policy manuals, IT AUP, and asset handover forms.
Corporate docs proving authority (Secretary’s Cert, board authority, representative’s ID).
Notarized Complaint-Affidavits and Custodian Affidavits.

7) Cease-and-desist / demand letter (skeleton)

Re: Unlawful Threats, Defamation, and Misuse of Confidential Information We write in behalf of [Company] regarding your [dated posts/messages] which contain defamatory statements and unlawful threats and disclose confidential/personal data. Demand is hereby made that within 24 hours you: (1) cease and desist from further publication and threats; (2) remove identified content/links; (3) return all company devices/data; and (4) preserve all relevant evidence. Failing compliance, we will file criminal complaints (grave threats, libel/cyber libel, privacy/cybercrimes) and civil actions (damages, injunctions), and seek relief from the National Privacy Commission and relevant platforms. This is without prejudice to our other rights and remedies. [Counsel/Authorized Officer]

8) Venue, timing, and procedural notes

Venue for libel: special rules allow filing where material was first published/printed or where the offended party resided at the time (Article 360 RPC framework). Venue for cyber libel has followed libel concepts adapted to online publication; consult counsel for the most strategic venue.
Prescription: move fast. Libel traditionally 1 year; cyber and special-law offenses can differ. Compute conservatively and file early.
Barangay conciliation: many speech/cyber offenses are exempt (because penalties exceed thresholds or involve government/internet platforms), but check locally before filing in court.
Injunctive relief & speech: courts avoid prior restraint; frame relief around unlawful conduct (misuse of confidential data, impersonation, stalking, doxxing) rather than broad bans on speech.

9) Internal posture: prevent, deter, and respond

Tight off-boarding: immediate account revocation, device return, exit certifications, reminders of NDA/non-disparagement.
Policy hygiene: clear Social Media Policy, Media Response Plan, Incident Response SOP, and Litigation Hold procedure.
Training: managers know to escalate threats immediately; staff know not to engage online.
Insurance: check cyber/media liability for defense and crisis-comms coverage.
Documentation: keep a contemporaneous log of events, decisions, timestamps, and copies of all takedown tickets.

10) FAQs

Can we get a court order to stop the posts immediately? Sometimes—but broad “gag” orders risk prior restraint issues. You have stronger odds on removing unlawfully obtained data, stopping impersonation, or compelling return of company property. Pair court filings with platform takedowns.

Is truth a complete defense for the ex-employee? Not always. For libel, truth must come with good motives and justifiable ends; purely spiteful “truths” that invade private life can still be actionable.

Do we need to choose civil or criminal? You can pursue both. An Art. 33 civil suit for defamation is independent of the criminal case and uses a lower burden.

What if the threats are anonymous? File with NBI/PNP for forensic tracing and preservation. Subpoenas to platforms/ISPs often require law-enforcement or prosecutorial involvement.

11) One-page playbook (condensed)

Safety & containment → revoke access; secure premises; litigation hold.
Evidence → capture/forensic preserve; affidavits; chain of custody.
Demand & takedown → C&D letter; platform and NPC complaints if data involved.
File → criminal (grave threats, libel/cyber libel, privacy/cybercrime); civil (Art. 33; NDA/IP; injunction).
Comms → fact-based, counsel-cleared; avoid malice; support employees.
Follow-through → coordinate with law enforcement; monitor compliance; enforce judgments or settlements.

Final notes

Laws evolve (especially on cyber and privacy). Venue and prescription rules for online offenses are nuanced.
Work with counsel early to sequence remedies, compute prescription, protect privilege, and avoid counter-defamation exposure.

If you want, I can adapt this into a step-by-step checklist tailored to your company (industry, size, contracts you use, and the exact behavior you’re seeing).