Complaints against lending companies in the Philippines usually arise from one or more of these situations: excessive or unclear charges, harassment in collection, public shaming, misuse of personal data, unauthorized access to contacts, misleading loan terms, illegal lending operations, abusive online lending app practices, and refusal to provide proper records of a loan. The legal path depends on who the lender is, what exactly happened, and what remedy the borrower wants.

This article explains the Philippine legal framework, the proper agencies, the evidence to gather, the complaint process, and the remedies that may be available.

I. Start With the Most Important Question: Who Is the Lender?

Not all lenders are regulated in the same way. Before filing anything, identify the company correctly.

A lender may be any of the following:

1. Lending Company

This is a private corporation engaged in granting loans from its own capital. Lending companies are generally regulated by the Securities and Exchange Commission (SEC).

2. Financing Company

This is also regulated by the SEC, but its business structure may involve receivables, lease financing, and other financing arrangements beyond simple consumer loans.

3. Bank, Digital Bank, Rural Bank, Thrift Bank, or Cooperative Bank

Banks are generally under the Bangko Sentral ng Pilipinas (BSP).

4. Credit Cooperative

A cooperative is usually under the Cooperative Development Authority (CDA), depending on the issue.

5. Pawnshop

Pawnshops are subject to a different regulatory regime, typically involving the BSP and other applicable laws.

6. Online Lending App or Online Lender

This is often a lending company or financing company using a mobile app, but some operate illegally or without proper authority. These often trigger complaints involving the SEC, the National Privacy Commission (NPC), and in some cases law enforcement.

7. Unregistered or Informal “5-6,” Individual, or Syndicate

If the lender is not duly registered or is operating through fraud, threats, identity abuse, or extortion, criminal and regulatory remedies may apply.

The regulator matters because the wrong agency can delay your case.

II. The Main Grounds for Complaining

A complaint against a lending company in the Philippines may be based on any of the following:

A. Harassment and Abusive Collection

Examples:

Repeated threats
Insults and humiliation
Calling or messaging at unreasonable hours
Contacting your relatives, co-workers, or employers to shame you
Posting your name or photo publicly as a debtor
Threatening arrest for non-payment of debt
Sending obscene, defamatory, or menacing messages

A simple unpaid debt is ordinarily a civil matter. A borrower cannot be imprisoned merely for failure to pay a loan, absent a separate crime such as estafa under specific circumstances. Threatening a borrower with automatic arrest just because of unpaid debt is commonly abusive and misleading.

B. Violation of Data Privacy

Examples:

Accessing your phone contacts, photos, or files beyond lawful and informed consent
Sending debt notices to people in your contact list
Processing personal data without a valid legal basis
Excessive data collection
Failure to provide a privacy policy or proper consent mechanism
Using your data to shame or intimidate you

These issues often fall within the jurisdiction of the National Privacy Commission.

C. Unfair, Deceptive, or Opaque Loan Terms

Examples:

Hidden charges
Non-disclosure of effective cost of credit
Misleading representations about interest, penalties, or due dates
Charging amounts inconsistent with what was disclosed
Refusal to provide a statement of account

D. Illegal Lending Activity

Examples:

The lender is not registered
The company lacks proper authority
The app is operating without lawful approval
The company uses false identities, fake addresses, or shell operations

E. Defamation, Coercion, Threats, or Extortion

Examples:

Public accusation that you are a criminal
Sending edited photos
Threatening to expose sensitive information
Demanding payment through intimidation
Sending fake legal notices, fake warrants, or fake subpoenas

These can trigger criminal complaints, not just administrative complaints.

F. Unauthorized Deductions or E-Wallet / Account Abuse

Examples:

Taking payment without authority
Repeated auto-debit beyond agreement
Improper debiting after the loan is disputed
Use of unauthorized digital collection channels

III. The Basic Philippine Laws and Rules Commonly Involved

A complaint may rely on one or several laws, depending on the facts.

1. Lending Company Regulation Act of 2007

This law governs lending companies and their registration and regulation.

2. Financing Company Act of 1998

This applies when the respondent is a financing company.

3. SEC Rules, Circulars, and Memoranda

The SEC has issued rules on lending and financing companies, especially on:

registration and authority to operate,
disclosure obligations,
online lending app conduct,
and unfair debt collection practices.

In practice, many borrower complaints against online lending apps are directed to the SEC because the SEC regulates lending and financing companies and has acted against abusive collection.

4. Data Privacy Act of 2012

This is central when the lender misuses personal information, accesses contacts, publicly discloses debts, or processes personal data unlawfully.

5. Civil Code of the Philippines

The Civil Code governs obligations and contracts, including loan relationships, damages, abuse of rights, moral damages, and other civil remedies.

Relevant concepts may include:

breach of contract,
bad faith,
abuse of rights,
damages for unlawful acts,
and recovery of amounts unduly collected.

6. Revised Penal Code

May apply if the acts amount to:

grave threats,
unjust vexation,
coercion,
slander/libel under older frameworks where applicable,
estafa in specific fraudulent loan contexts,
or other penal offenses.

7. Cybercrime Prevention Act

Where threats, harassment, extortion, or defamatory statements are made through electronic means, cybercrime implications may arise.

8. Safe Spaces and Other Protective Laws

In exceptional cases involving gender-based online abuse or related conduct, other statutes may also come into play.

9. Consumer Protection Principles

Depending on the loan product and the transaction structure, some consumer protection norms may be relevant, especially on disclosure and unfair practices.

10. BSP Rules

If the respondent is a bank or BSP-supervised institution, the complaint route may primarily be through the BSP rather than the SEC.

IV. Which Agency Should Receive the Complaint?

This is the most practical part of the process.

A. Securities and Exchange Commission (SEC)

File with the SEC when the respondent is:

a lending company,
a financing company,
an online lending app operator under a lending/financing company,
or a company suspected of operating without the required authority.

Go to the SEC especially for:

unfair debt collection,
abusive collection conduct,
illegal or unauthorized lending operations,
misrepresentation by a lending or financing company,
abusive online lending app practices,
and corporate/regulatory violations.

What the SEC can generally do

Receive and evaluate complaints
Investigate regulated entities
Require explanation from the company
Impose sanctions, suspensions, revocations, or other administrative penalties
Issue directives affecting the company’s authority to operate

The SEC is often the first stop for complaints against online lending companies.

B. National Privacy Commission (NPC)

File with the NPC when the issue is:

unauthorized access to phone contacts,
sending collection messages to third parties,
publication of borrower data,
unlawful processing of personal data,
inadequate consent,
breach of privacy rights,
or data security violations.

What the NPC can generally do

Investigate privacy complaints
Conduct compliance checks
Order corrective measures
Impose administrative sanctions where warranted
Address unlawful processing or misuse of personal data

When a lender shames the borrower by texting the borrower’s contacts, the NPC is often a key agency.

C. Bangko Sentral ng Pilipinas (BSP)

File with the BSP when the lender is a:

bank,
digital bank,
rural bank,
thrift bank,
or other BSP-supervised financial institution.

The BSP handles consumer assistance and complaints involving its supervised entities.

D. Cooperative Development Authority (CDA)

If the entity is a cooperative, the CDA may be the proper forum for regulatory or governance issues, depending on the dispute.

E. Department of Justice / Office of the Prosecutor

File a criminal complaint before the prosecutor’s office when the conduct includes:

threats,
coercion,
extortion,
cyber harassment,
unlawful disclosure,
fake legal processes,
or other criminal acts.

Administrative complaints and criminal complaints may proceed separately.

F. Philippine National Police (PNP) or National Bureau of Investigation (NBI)

Where immediate threats, extortion, identity misuse, or cyber harassment are involved, a complaint or report to law enforcement may be necessary, especially to preserve evidence and pursue criminal accountability.

G. Civil Courts / Small Claims / Regular Courts

If your goal is money recovery, damages, injunction, or a judicial declaration of rights, a civil action may be proper.

You may need court action when:

you want refund of unlawfully collected charges,
you seek damages for harassment or privacy violations,
you want to stop a specific unlawful act through injunction,
or the lender sues you and you need to defend yourself.

V. Common Situations and the Proper Complaint Route

1. The lender keeps threatening me and messaging my relatives

Primary agencies:

SEC
NPC
possibly PNP/NBI or prosecutor if threats are criminal

2. The lender accessed my contacts and sent them messages calling me a debtor

Primary agencies:

NPC
SEC

3. The lender is charging strange fees and refuses to explain them

Primary agencies:

SEC if lending/financing company
BSP if bank
civil action if refund/damages are sought

4. The online lending app might be illegal or unregistered

Primary agency:

SEC Possible additional action:
law enforcement if there is fraud or extortion

5. I am being publicly shamed on social media or in group chats

Primary agencies:

NPC
SEC
prosecutor/law enforcement where criminal liability may exist

6. The company threatens me with arrest for non-payment

Primary agencies:

SEC
prosecutor or police if accompanied by criminal threats or extortion

7. A bank or e-wallet lender is the one causing the problem

Primary agency:

BSP Additional:
NPC for privacy-related aspects

VI. Before Filing: Gather Evidence Properly

A complaint is only as strong as its documentation. Preserve evidence immediately.

A. Essential Documents

Gather as many of these as possible:

Loan agreement or screenshots of in-app terms
Promissory note, disclosure statement, amortization schedule
Official receipts, payment confirmations, transaction history
Screenshots of text messages, chat messages, emails, app notifications
Call logs
Screenshots of messages sent to your contacts, employer, or relatives
Social media posts or public shaming posts
Screenshots of the app permissions requested
Proof of charges deducted
Bank or e-wallet statements
Demand letters or collection letters
Names of collectors, contact numbers, email addresses
Company name, app name, SEC registration details if available
Affidavits of third persons who received collection messages
Medical or psychological records if harassment caused serious distress
Proof of lost job, reputational damage, or other actual injury

B. Preserve Metadata Where Possible

Do not rely only on cropped screenshots. Keep:

full screenshots showing dates and numbers,
original files,
URLs,
message headers where available,
download history,
and backup copies.

C. Make a Chronology

Prepare a timeline:

Date loan was taken
Amount released
Amount due
Payments made
Date harassment started
Who was contacted
What statements were made
What damage resulted

A clean chronology helps agencies act faster.

VII. Check Whether the Company Is Registered

Even without a formal search at the filing stage, you should identify:

exact legal name of the company,
trade name or app name,
address,
contact details,
and the names used by collectors.

If the company is operating under multiple names, list all of them. Many complaints fail because the borrower names only the app nickname, not the legal entity.

If you know the app name but not the corporation behind it, include both and state that the true corporate operator is to be determined from the regulator’s records.

VIII. Should You Send a Demand or Complaint Letter First?

Often, yes.

Before filing with an agency, it is useful to send a written complaint or demand letter to the company. This is not always mandatory, but it helps show:

you attempted to resolve the issue,
the company was notified,
and it failed or refused to correct its conduct.

Your letter may:

identify the loan,
describe the wrongful acts,
demand that harassment stop,
demand deletion or lawful treatment of personal data,
require a statement of account,
contest unlawful charges,
and request confirmation within a fixed period.

Send it through channels you can document:

email,
registered mail,
courier,
or in-app support with screenshots.

IX. How to Draft the Complaint

A legal complaint should be factual, organized, and restrained. Avoid emotional exaggeration. State facts that can be proved.

A. Basic Structure

Your complaint should contain:

1. Caption / Heading

State the agency and the parties.

Example: Complaint against [Company Name] for unfair debt collection practices, privacy violations, and related unlawful acts

2. Complainant Information

Full name
Address
Contact number
Email address

3. Respondent Information

Company name
App name
Address if known
Contact numbers / email / website
Names of collection agents if known

4. Statement of Facts

Tell the story in date order:

when you borrowed,
how much you received,
what was promised,
what you paid,
what happened next,
and why the conduct is unlawful.

5. Legal Grounds

State the laws or rules violated, such as:

unfair debt collection,
misuse of personal data,
abusive collection practices,
threats or coercion,
non-disclosure of charges.

6. Evidence

List annexes:

Annex “A” Loan agreement
Annex “B” Screenshots of messages
Annex “C” Payment receipts
Annex “D” Affidavit of third-party recipient
and so on

7. Relief Sought

State clearly what you want.

Possible remedies:

cease harassment,
stop contacting third parties,
delete unlawfully processed personal data,
provide full statement of account,
correct unlawful charges,
refund overpayments,
impose sanctions,
revoke authority if warranted,
or endorse for prosecution.

8. Verification / Affidavit

Many complaints are stronger when supported by a notarized affidavit or verified statement, especially if facts are contested.

X. Sample Allegations You May Include

Depending on the facts, allegations may be framed like this:

The respondent engaged in unfair and abusive collection practices by threatening, humiliating, and harassing the complainant.
The respondent unlawfully processed and disclosed the complainant’s personal data by accessing contact information and sending collection messages to third parties.
The respondent failed to provide transparent and lawful disclosure of the actual charges, penalties, and net proceeds of the loan.
The respondent, through its agents, used intimidation and false threats of arrest to compel payment.
The respondent’s conduct caused humiliation, anxiety, reputational injury, and other actionable damage.

Keep allegations tied to proof.

XI. Filing With the SEC

For lending companies and financing companies, the SEC is often the principal administrative forum.

A. What to Include

Complaint letter or affidavit
Complete respondent identification
Evidence
Chronology
Contact information
Specific regulatory violations alleged

B. What the SEC Usually Looks For

Is the respondent an SEC-regulated entity?
Is there evidence of abusive collection?
Is the company using an online lending app?
Are there screenshots or records showing the conduct?
Are third parties being contacted?
Is the company misrepresenting its rights or authority?

C. Possible Outcomes

Referral for investigation
Notice to the company
Administrative proceedings
Sanctions or revocation-related action
Endorsement to other agencies where appropriate

The SEC process is administrative. It can discipline the company, but it may not by itself award the full range of civil damages a court can grant.

XII. Filing With the National Privacy Commission

This route is crucial where personal data abuse is involved.

A. Situations That Strongly Support an NPC Complaint

The app took access to your contacts and used them for collection
People in your phonebook received notices about your debt
The company disclosed your debt status publicly
The privacy consent was unclear, excessive, or coercive
The lender processed more data than necessary

B. What to Include

App name and company name
Description of permissions requested by the app
Screenshots of privacy policy if any
Screenshots from third parties who received messages
Timeline of data misuse
Copies of the exact messages sent
Explanation of why consent was absent, defective, or exceeded

C. Legal Theory

The complaint generally revolves around:

unlawful processing,
lack of valid consent,
excessive data collection,
unauthorized disclosure,
and violation of data subject rights.

D. Relief

You may ask that the company:

stop unlawful processing,
stop contacting third parties,
delete or restrict certain data,
correct privacy practices,
and be sanctioned administratively.

XIII. Filing a Criminal Complaint

Administrative complaints do not replace criminal cases where actual crimes were committed.

A. Common Criminal Angles

Depending on the facts, conduct may amount to:

grave threats,
unjust vexation,
coercion,
extortion,
identity misuse,
cyber-related offenses,
or unlawful disclosure tied to criminal statutes.

B. Where to File

Usually:

with the Office of the City/Provincial Prosecutor
or through assistance from the PNP or NBI

C. Evidence Standard at This Stage

You usually need enough evidence to establish probable cause, not proof beyond reasonable doubt yet.

D. Important Distinction

Failing to pay a debt is not by itself a crime. The criminal issue is not the unpaid debt; it is the unlawful conduct of the lender or collector, if any.

XIV. Filing a Civil Case for Damages

If the lender’s acts caused actual loss, humiliation, emotional distress, reputational harm, or violation of legal rights, a civil action may be considered.

A. Possible Civil Remedies

Actual damages
Moral damages
Exemplary damages
Attorney’s fees and litigation expenses
Injunction
Refund or restitution
Declaratory relief in proper cases

B. Legal Bases

Possible bases may include:

abuse of rights,
bad faith,
violation of contract,
tort-like wrongful conduct,
privacy-related injury,
or other Civil Code provisions.

C. When Civil Action Makes Sense

There is substantial harm
The administrative remedy is not enough
You need compensation
You need a court order restraining conduct
The lender’s misconduct is severe and documented

XV. What If the Lender Sues You First?

That does not erase your rights.

A borrower who is genuinely in default may still file or maintain complaints if the lender:

used unlawful collection methods,
violated privacy rights,
imposed unlawful charges,
or committed separate actionable wrongs.

You may owe money and still be a victim of illegal collection conduct. These issues are legally distinct.

XVI. Non-Payment Does Not Give the Lender Unlimited Rights

A common misconception is that once a borrower defaults, the lender may do anything to collect. That is false.

Even if the debt is valid, collection must still be lawful. The lender generally may pursue:

reminders,
demand letters,
negotiation,
lawful collection efforts,
and civil court action.

The lender generally may not lawfully resort to:

threats,
public humiliation,
indiscriminate contacting of third parties,
unauthorized data disclosure,
fake legal notices,
coercion,
or extortionate tactics.

XVII. Key Issues in Online Lending App Complaints

Online lending complaints have distinctive patterns.

1. Very Short Terms and Heavy Effective Costs

Some apps structure loans so that the released amount is far less than the face amount due because of service fees, processing fees, and similar deductions. This raises disclosure and fairness issues.

2. App Permissions

Some apps request broad access to:

contacts,
camera,
storage,
location,
or other personal data.

Permission granted by the phone does not automatically mean all later uses are lawful. Philippine privacy law still requires lawful, proportionate, and transparent processing.

3. Debt Shaming as a Collection Method

This is one of the most complained-about practices and is often central to both SEC and NPC complaints.

4. Anonymous Collectors

Many use aliases, rotating numbers, or unverifiable identities. Preserve all numbers, user IDs, and message headers.

5. Multiple Loans Through Interconnected Apps

Some borrowers discover that apps are linked or use common collection teams. Identify all related entities where possible.

XVIII. Common Mistakes Borrowers Make

1. Admitting Facts Carelessly in Panic

Do not sign new documents or confess to amounts you do not understand just to stop harassment.

2. Deleting Messages

Preserve evidence before blocking or uninstalling an app.

3. Paying Without Demanding an Accurate Statement

You should know exactly what amount is principal, what is interest, what is penalty, and what other charges are being claimed.

4. Filing in the Wrong Forum

Complaining to the wrong agency may waste time.

5. Using Only Emotional Claims

Agencies act on evidence, dates, documents, and specific acts.

6. Ignoring Privacy Aspects

Borrowers often complain only about threats and forget the separate privacy violations.

7. Naming Only the App, Not the Company

Always identify the legal entity where possible.

XIX. What Remedies Can You Realistically Expect?

The answer depends on the forum.

Through the SEC

You may obtain:

administrative action,
investigation,
sanctions against the company,
and regulatory intervention.

Through the NPC

You may obtain:

privacy investigation,
corrective orders,
and possible sanctions for unlawful data processing.

Through Prosecutors / Criminal Process

You may obtain:

criminal investigation,
filing of charges if probable cause is found,
and penal consequences if convicted.

Through Civil Court

You may obtain:

damages,
injunction,
refund,
and enforceable civil relief.

No single route does everything. Serious cases often require parallel remedies.

XX. Can You File Multiple Complaints at the Same Time?

Yes, if the facts justify them.

For example:

SEC complaint for unfair debt collection,
NPC complaint for misuse of personal data,
criminal complaint for threats or extortion,
civil action for damages.

These are not necessarily duplicative because they protect different rights and serve different purposes.

The key is consistency. Your facts, dates, and evidence should align across all filings.

XXI. What If the Company Is Unregistered or Hard to Trace?

That often strengthens the need for a regulatory and law-enforcement response.

Do the following:

identify the app name,
preserve screenshots from the app store,
capture the website,
keep receipts and account names used for payment,
record the e-wallet, bank, or merchant accounts receiving funds,
keep numbers and email addresses used by collectors.

Even if the exact corporate identity is unclear, regulators may be able to trace the operator from submitted materials.

XXII. Should You Keep Paying While Complaining?

That depends on the debt and the dispute.

If the debt is valid but collection is abusive

The borrower may still need to address the debt, negotiate, or pay what is lawfully due, while separately pursuing complaints for unlawful collection conduct.

If the amount is disputed

Document the basis of your dispute and request a full statement of account.

If you plan to withhold payment entirely

Understand that this may expose you to civil collection or a collection suit if the debt is legitimate. A complaint against abusive conduct is not automatically a defense to the debt itself, although it may support counterclaims or separate remedies.

XXIII. Can the Lender Contact Your Employer, Friends, or Relatives?

As a rule, that is highly problematic when done for shaming, pressure, or unrelated disclosure.

There may be rare situations where limited third-party contact is legally defensible for narrow and legitimate purposes, but broad disclosure of a person’s debt to unrelated contacts is exactly the sort of conduct that often generates serious privacy and collection complaints.

If the lender mass-messages your contacts, that is a strong warning sign.

XXIV. Can the Lender Have You Arrested for Non-Payment?

Ordinarily, no, not merely because you failed to pay a debt.

A debt default is generally enforced through lawful collection and civil remedies. Threats of instant arrest, fake warrants, or fake subpoenas are common intimidation tactics and may themselves be unlawful.

That said, a borrower should not confuse this with situations involving a distinct criminal accusation based on separate facts. The mere existence of debt, however, does not automatically equal criminal liability.

XXV. How Detailed Should the Complaint Be?

Detailed enough to be actionable, but not chaotic.

A strong complaint usually includes:

one clear narrative,
exact dates,
names and numbers,
copies of proof,
a short explanation of the laws violated,
and a precise statement of the remedies sought.

Overly long complaints full of repetition are less effective than organized, evidence-based submissions.

XXVI. Suggested Documentary Package

A well-prepared complaint packet may contain:

Complaint-affidavit
Government ID
Loan agreement / app screenshots
Statement of charges and payments
Screenshots of harassment
Screenshots from third-party recipients
Proof of privacy intrusion
Demand letter and proof of sending
Chronology of events
Annex index

Label every annex clearly.

XXVII. A Practical Complaint Theory for Most Online Lending Cases

In many online lending disputes, the complaint has three layers:

Layer 1: Regulatory

“The company engaged in unfair and abusive collection practices.”

Layer 2: Privacy

“The company unlawfully processed and disclosed my personal data.”

Layer 3: Civil/Criminal

“The company’s conduct caused damage and may amount to threats, coercion, extortion, or other unlawful acts.”

This layered approach helps match the facts to the proper remedies.

XXVIII. If You Are a Lawyer, Paralegal, or Advocate Handling the Complaint

For professional handling, the strongest approach is usually to:

identify the exact legal entity,
separate the debt issue from the collection-conduct issue,
plead privacy violations with specificity,
attach third-party affidavits,
preserve original electronic evidence,
and assess whether parallel administrative, civil, and criminal actions are warranted.

For online lending app cases, evidence from recipients in the borrower’s contact list is especially powerful.

XXIX. Model Reliefs That May Be Requested

Depending on the forum, the complainant may ask for:

immediate cessation of harassment and abusive collection;
cessation of third-party contact and disclosure;
deletion, blocking, or lawful handling of personal data;
submission of a proper statement of account;
investigation and sanctions against the company and its officers;
suspension or revocation of authority to operate where warranted;
endorsement for criminal investigation;
refund of unlawful charges or overpayments;
award of damages and attorney’s fees in the proper court;
and such other relief as may be just and equitable.

XXX. Final Practical Framework

When deciding how to proceed, use this checklist:

Step 1

Identify the lender:

SEC-regulated lending/financing company?
BSP-supervised bank?
cooperative?
unknown or illegal operator?

Step 2

Identify the wrong:

abusive collection?
privacy violation?
hidden charges?
threats?
public shaming?
unauthorized deduction?

Step 3

Preserve evidence:

screenshots,
contracts,
statements,
messages,
witness affidavits.

Step 4

Send a written complaint or demand where useful.

Step 5

File in the correct forum:

SEC for lending/financing company misconduct
NPC for personal data misuse
BSP for banks and BSP-supervised institutions
Prosecutor / PNP / NBI for criminal acts
Civil court for damages or injunction

Step 6

Keep the legal issues distinct:

debt validity,
collection legality,
privacy rights,
civil damages,
criminal liability.

Conclusion

To file a complaint against a lending company in the Philippines, the borrower must first determine the lender’s legal identity and regulator, then match the misconduct to the proper remedy. In most cases involving lending companies and online lending apps, the SEC is the principal administrative forum for abusive collection and regulatory violations. When the complaint involves unauthorized use of contacts, disclosure of debt to third parties, or other misuse of personal information, the National Privacy Commission is often the correct or additional forum. Where threats, coercion, or extortion are involved, the borrower may also pursue criminal remedies. When the borrower seeks compensation, refund, or injunctive relief, a civil action may be necessary.

The central rule is simple: a valid debt does not legalize invalid collection methods. A lender may pursue payment, but only through lawful, proportionate, and rights-respecting means. In Philippine law, borrowers remain protected against harassment, abusive debt collection, and unlawful processing of personal data, even when they are in default.