Overview

Harassing collection practices by some online lending apps (OLAs)—contact scraping, public “shaming,” incessant calls, and threats—aren’t just abusive; many are unlawful. In the Philippines, a cluster of laws and regulators cover this problem, led by the Data Privacy Act of 2012 (DPA, Republic Act No. 10173) and its Implementing Rules and Regulations (IRR), the Securities and Exchange Commission (SEC) for lending/financing companies, and other frameworks such as the Cybercrime Prevention Act (RA 10175) and the Revised Penal Code for specific offenses.

This article explains how the DPA applies to OLAs, what conduct is illegal, the regulators and fora you can approach, and a practical playbook of remedies—administrative, civil, and criminal—plus preservation-of-evidence tips and model notices you can adapt.

The Legal Landscape

1) Data Privacy Act (RA 10173)

Core principles (Sec. 11):

Transparency: Individuals must be told what data are collected, purposes, and recipients.
Legitimate Purpose: Processing must be compatible with stated, lawful purposes.
Proportionality / Data Minimization: Collect only what is necessary; use and retain only as needed.

Lawful bases (Secs. 12–13):

Typical basis claimed by OLAs is consent. Consent must be freely given, specific, informed, and evidenced—not bundled, coerced, or hidden behind dark patterns. Processing beyond loan evaluation/servicing (e.g., scraping all contacts/photos, blasting third parties) is generally not necessary to perform the loan contract and often falls outside valid consent.

Data subject rights (Sec. 16):

Right to be informed, to object to processing (especially for marketing or unlawful/irrelevant processing), to access and rectify, to erasure/blocking, to data portability, and to damages.

Offenses & liabilities (Secs. 25–34):

Unauthorized processing, negligent access, improper disposal, malicious disclosure, unauthorized disclosure, and concealment of security breaches may carry criminal penalties (imprisonment and fines). Civil damages and administrative sanctions can also apply.

Security measures (IRR):

Personal Information Controllers (PICs) and Processors (PIPs) must implement organizational, physical, and technical safeguards, maintain privacy notices, ensure breach management and retention/deletion protocols, and designate a Data Protection Officer (DPO).

Extraterritoriality (Sec. 6):

The DPA can apply even if the app operator is offshore, where processing involves Philippine residents or uses equipment in the Philippines.

2) SEC Regulation of Online Lending

OLAs operating as lending/financing companies must be registered and licensed under the Lending Company Regulation Act (RA 9474) and related rules. The SEC has also issued rules prohibiting unfair debt collection practices by lending/financing companies and online lending platforms—e.g., contact harassment, threats, profanity, public shaming, doxxing, contacting people in the borrower’s phonebook unrelated to the loan, and similar conduct. Violations risk fines, suspension/revocation of authority, and referral to other agencies (e.g., NPC for privacy violations, NBI/PNP for criminal acts).

3) Cybercrime & Penal Code

Cyber libel (RA 10175) if collectors publish defamatory statements online.
Grave coercion, unjust vexation, threats, and related offenses under the Revised Penal Code may apply to abusive messaging and intimidation.
Identity theft / illegal access may be implicated where accounts are hijacked or devices are compromised.

4) Telco / Messaging Layers

SIM Registration Act (RA 11934) can assist law enforcement in tracing numbers used for harassment.
Telcos provide spam-reporting and number-blocking channels; while not dispositive legally, they help mitigate harm and preserve evidence.

What Typical OLA Harassment Looks Like—and Why It’s Illegal

Conduct	Why It’s Likely Unlawful
Contact scraping (pulling entire phonebook)	Fails proportionality; consent often not valid (bundled/unclear). Contacts are third parties with independent rights; there’s no lawful basis to process their data for someone else’s debt.
Blast messages to family, coworkers, boss, “guarantors” you never named	Unauthorized disclosure of your debt status and personal data; malicious disclosure if done to shame/coerce; unfair collection under SEC rules.
Threats, slurs, profanity, reputation-shaming posts	Potential cyber libel, grave coercion/threats, unjust vexation; also unfair collection and DPA violations.
Incessant calls at odd hours	Unfair collection; may constitute harassment actionable civilly and administratively.
Withholding basic privacy information/DPO details	Violates transparency and the right to be informed.
Retention forever / refusal to delete when the purpose ends	Breaches proportionality and storage limitation; you may assert erasure/blocking.

Who Can Help: Venues & Regulators

National Privacy Commission (NPC): Privacy complaints (DPA violations) against the OLA as PIC/PIP, including unlawful processing/disclosure, invalid consent, and failure to honor rights.
Securities and Exchange Commission (SEC): Complaints against lending/financing companies and OLPs for unfair debt collection and for operating without authority.
Law Enforcement (NBI-CCD / PNP ACG): Cybercrime complaints (e.g., cyber libel, threats, identity theft), with your evidence pack.
Courts (Civil/Criminal): Suits for damages under the Civil Code (Arts. 19, 20, 21—abuse of rights, tort), and criminal cases under the DPA, RPC, or RA 10175.
Telco/Platform Channels: Report abusive numbers/accounts; request preservation where possible.

Remedies and Strategy (Step-by-Step)

Step 1 — Preserve & Organize Evidence

Screen-record and screenshot calls, texts, voicemails, in-app notices, social media posts, and messages to your contacts.
Export metadata (numbers, timestamps, URLs, profile IDs).
Keep a timeline (date, time, incident, persons affected, impact).
Ask contacts who were messaged to forward copies and provide brief affidavits (even simple sworn statements).
Save the app’s privacy notice, loan agreement, and consent screens (or lack thereof).

Step 2 — Exercise Your DPA Rights

Send the OLA (to its DPO or support address in the privacy notice) a Rights Request/Demand to:

Cease and desist from contacting third parties and from any processing beyond loan servicing.
Provide a full data inventory (what they collected, sources, recipients, and purposes), and the lawful basis relied upon for each.
Erase/block unlawfully obtained or no-longer-necessary data (especially your phonebook/contacts).
Provide security and breach logs related to the processing.
Confirm the name and contact details of the DPO.

If they ignore you or respond inadequately, that supports escalation to the NPC.

Step 3 — File an NPC Complaint

Grounds: unauthorized processing, unauthorized/malicious disclosure, failure to honor rights, invalid consent, absence of proportionality, and inadequate security measures.
Attach your evidence pack, copies of your rights request and their response (or non-response), and affidavits from contacted third parties.
Relief you can seek: Cease-and-desist orders, compliance orders, administrative fines, and referral for criminal prosecution.

Step 4 — Complain to SEC (if a lending/financing company or OLP)

Allege unfair debt collection practices (harassment, shaming, contacting third parties, threats), misrepresentation, and any licensing issues.
Provide identical evidence; ask for suspension/revocation and penalties.

Step 5 — Consider Criminal & Civil Actions

Criminal: Cyber libel, threats/coercion, DPA offenses. Coordinate with NBI/PNP or a prosecutor; your NPC complaint can run in parallel.
Civil: Claim moral, exemplary, and actual damages for privacy invasion, reputational harm, emotional distress, and lost income opportunities (e.g., workplace embarrassment). Cite abuse of rights (Art. 19) and torts (Arts. 20, 21).

Step 6 — Mitigation

Block and report abusive numbers/accounts; inform your contacts about the harassment and ask them not to engage.
If your employer or HR was contacted, give them a brief memo explaining the harassment is unlawful and being addressed.
Consider a police blotter for record-keeping if threats were made.

Practical Templates (Adapt/Shorten as Needed)

A) Data Privacy Cease-and-Desist / Rights Request (Email)

Subject: Exercise of Data Subject Rights and Demand to Cease Unlawful Processing

Dear Data Protection Officer, I am asserting my rights under the Data Privacy Act of 2012 regarding your processing of my personal data through your online lending app.

Cease and Desist: Immediately stop processing my data beyond what is strictly necessary for legitimate loan servicing, including scraping/using my phone contacts and contacting third parties.

Information & Access: Identify all personal data you processed about me; the source of each; all recipients (including third parties messaged about me); purposes; and the specific lawful basis relied upon.

Erasure/Blocking: Delete data not necessary for the stated lawful purpose—particularly my contact list and any third-party data collected from my device—and confirm in writing.

Security Measures: Describe the organizational/technical measures used to secure my data, and provide relevant logs.

DPO Details: Confirm the name and contact details of your DPO.

Treat this as an urgent request. If you fail to substantially comply within 15 days, I will file complaints with the NPC and SEC and pursue other remedies.

Sincerely, [Name] [Mobile/Email] [Date]

B) Third-Party Affidavit (Someone They Messaged)

I, [Name], of legal age, state: (1) On [date/time], I received [a call/message/post] from [app/collector name/number] stating [content]. (2) I am not a party to any loan and did not consent to receive such data. (3) The message caused [embarrassment/concern/damages]. Attached are screenshots. I attest to the truth of the foregoing.

C) Employer/HR One-Pager

Context: A third party is illegally disclosing my alleged debt status to co-workers and supervisors.
Law: The DPA and SEC rules prohibit contacting third parties unrelated to the loan and shaming tactics.
Action: I have issued a cease-and-desist, filed/ am filing with the NPC/SEC, and preserved evidence.
Ask: Please disregard these messages; direct any further communications from them to me or Legal.

Consent Pitfalls Frequently Used by OLAs (and How to Counter)

Bundled consent in long, dense terms: not “freely given” or “specific.”
“Access to contacts for verification” claims: rarely necessary; proportionality fails.
Retroactive consent (“by using the app you agree to contact your phonebook”): invalid for third-party data; your contacts never consented.
Impossible withdrawal: Refusing to honor the right to object/erasure is unlawful.
Security theater: Boasts of encryption but no DPO, no breach plan, and indiscriminate retention.

Evidence Tips & Litigation Prep

Keep original files plus hashes (if you can) to show integrity.
Use a contemporaneous journal of incidents and impacts (sleep loss, anxiety, HR issues).
If posts are public, capture the URL, date/time, and who can view; use archive PDFs or full-page screenshots.
For calls/voicemails, log caller ID, duration, and audio when lawful to record.

Common Defenses (and Rebuttals)

“You consented.” → Only to necessary processing for the loan; third-party shaming is outside purpose and basis. Consent must be free, informed, specific, and evidenced—not coerced or bundled.
“We need contacts to verify.” → Verification can be done by IDs, selfies, credit data, or direct references you explicitly nominate. Bulk scraping entire phonebooks is not proportionate.
“They were guarantors.” → Only if you expressly designated them with their informed consent. Otherwise, they are third parties with their own rights.
“Overseas entity.” → DPA’s extraterritorial reach and SEC authority can still apply when Philippine residents or infrastructure are involved.

Remedies Matrix (At a Glance)

Problem	Primary Venue	Secondary
Harassing calls/messages; shaming; contacting contacts	SEC (unfair collection), NPC (disclosure)	NBI/PNP (threats/libel), Civil courts
Unauthorized contact scraping; refusal to delete	NPC	Civil courts
Defamation online (posts, group messages)	NBI/PNP (cyber libel)	Civil damages
Operating without proper license	SEC	NPC (privacy), law enforcement
Data breach/leak	NPC (breach management)	Civil/criminal actions

Frequently Asked Questions

Q: I did default. Does that make their tactics legal? A: No. Debt collection must still comply with the DPA, SEC rules, and criminal laws. Default is not a license to harass or disclose to third parties.

Q: Can I revoke consent? A: Yes, particularly for processing not essential to the loan contract. They must honor objection and erasure requests where lawful.

Q: Can my contacts sue? A: Yes. They are data subjects with their own rights and claims for damages due to unauthorized disclosure.

Q: What if the app is foreign? A: DPA may still apply; the SEC can act if they operate as an OLA targeting Philippine users. Platforms and telcos can also be enlisted.

Final Notes

This guide is general information, not legal advice. For a live matter—especially if threats, public posts, or employer contact are ongoing—consider consulting Philippine counsel to calibrate filings (NPC, SEC, criminal complaints) and maximize cease-and-desist impact.
The fastest relief often comes from a well-documented NPC/SEC filing paired with platform/telco reports and a clear cease-and-desist letter.
Above all: document, demand, escalate—and keep the pressure on through the proper legal channels.