Introduction

The rapid rise of FinTech and Online Lending Platforms (OLPs) in the Philippines has democratized access to emergency credit. However, this convenience has been heavily overshadowed by an aggressive collection scheme colloquially known as "debt-shaming" or contact-list harassment.

When applying for quick loans, many digital lending applications require borrowers to grant permissions to access their smartphone’s contact lists, galleries, location data, and SMS logs. When a borrower defaults or delays payment, collector agents exploit this data—texting or calling family, friends, employers, and even casual acquaintances to shame the borrower, demand payment, or falsely claim that these third parties are "co-makers" or "guarantors."

Under Philippine law, this practice is not just unethical; it is a serious breach of data privacy, consumer protection, and criminal statutes.

The Regulatory and Legal Framework

The unauthorized harvesting and use of a borrower’s phone contacts are strictly regulated by a combination of legislation and administrative circulars issued by the National Privacy Commission (NPC) and the Securities and Exchange Commission (SEC).

1. Republic Act No. 10173: The Data Privacy Act of 2012 (DPA)

Online lending apps operate as Personal Information Controllers (PICs). The DPA dictates that personal data must be collected for specified, explicit, and legitimate purposes and processed fairly and lawfully.

Lack of Legal Basis: A borrower’s contact list contains the personal information of other individuals who have not given their consent to be processed or contacted by the lending app.
Proportionality Principle: Accessing an entire contact list is disproportionate and unnecessary for evaluating a borrower's creditworthiness.

2. NPC Circular No. 20-01 (as amended by NPC Circular No. 2022-02)

This directive directly targets online lending transactions:

Prohibition on Contact Harvesting: OLPs are barred from harvesting or saving a borrower's phone or social media contact lists for debt collection or harassment.
Excessive Permissions: Apps cannot mandate persistent access to a phone’s camera, location, or contacts. Permissions for Know-Your-Customer (KYC) verification must be temporary, and the app must prompt the user to turn them off once verified.

3. SEC Memorandum Circular No. 18, Series of 2019

The SEC regulates the operational conduct of lending and financing companies. This circular explicitly outlines Prohibited Acts in the Debt Collection, stating that lenders or third-party collection agencies may only contact the borrower or their formally designated guarantors/co-makers. Contacting random individuals in a contact list is deemed an "unfair collection practice."

Recent Regulatory Updates: Joint public advisories issued by the Department of Information and Communications Technology (DICT), NPC, and SEC reiterate that contacting individuals on a borrower's contact list—other than those formally designated as guarantors—is strictly illegal and subject to immediate institutional crackdowns.

Prohibited Practices and Specific Violations

Lending applications routinely cross into illegal territory through several distinct mechanisms:

Unauthorized Disclosure: Informing third parties about the borrower's debt or delinquency without consent.
Misrepresentation: Falsely informing contact-list individuals that they were listed as references, co-makers, or character witnesses.
Threats and Coercion: Employing vulgar language, death threats, or falsely claiming that law enforcement or government authorities are en route to arrest the borrower.
Online Defamation / Debt-Shaming: Creating fake social media profiles or posting the borrower's government IDs and photos online to induce public humiliation.

Penalties and Sanctions

Errant online lenders face overlapping administrative, civil, and criminal liabilities in the Philippines.

Regulator / Law	Nature of Violation	Maximum Penalties / Sanctions
National Privacy Commission (NPC)	Unauthorized Processing of Personal Information (Sec. 25, DPA)	1 to 3 years imprisonment; Fines from ₱500,000 to ₱2,000,000 (Up to 6 years and ₱4,000,000 if sensitive data is leaked).
Securities & Exchange Commission (SEC)	Violation of SEC MC No. 18 (Unfair Collection Practices)	Administrative fines ranging from ₱100,000 to ₱1,000,000 per violation; Suspension or Revocation of the Certificate of Authority (CA) to operate.
Revised Penal Code & Cybercrime Law (R.A. 10175)	Grave Threats, Coercion, Unjust Vexation, and Cyberlibel	Imprisonment depending on the felony; Civil liabilities for moral and exemplary damages.

Legal Remedies: Step-by-Step Guide for Victims

If an online lending app begins harassing a phone's contact list, the victim must take systematic legal steps rather than simply ignoring the messages or deleting the application.

Step 1: Preserve and Document Evidence

Regulatory bodies require airtight documentation.

Take screenshots of all harassing text messages, Viber/WhatsApp chats, or social media posts. Ensure the sender's mobile number or handle is clearly visible.
Log the times and frequency of the calls.
Have contacted family members or friends forward the exact messages they received, along with a brief written statement confirming they never consented to be a reference.

Step 2: Revoke App Permissions

Go to the smartphone's settings, locate the specific lending application, and manually toggle off permissions for Contacts, Storage/Photos, Location, SMS, and Camera.

Step 3: Formal Demand to the Lender (The 15-Day Rule)

Under NPC rules, a complainant should ideally reach out to the lender’s Data Protection Officer (DPO) first. Send a formal email demanding they cease processing and contacting third parties. The company has 15 days to address the grievance. Note: If the app is unregistered, illegitimate, or the threat constitutes immediate physical or reputational danger, this step can be bypassed.

Step 4: File Official Complaints with Regulators

To the NPC: If the lender fails to comply within 15 days, file a formal complaint via the NPC Complaints Portal (complaints@privacy.gov.ph). The NPC can issue Cease and Desist Orders (CDOs) and recommend criminal prosecution to the Department of Justice (DOJ).
To the SEC: File an official e-Complaint via the SEC portal (complaints.sec.gov.ph) against the corporation managing the app for violating SEC MC No. 18.
To Law Enforcement: If the tactics escalate to death threats, extortion, or public defamation (cyberlibel), file a report directly with the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or the National Bureau of Investigation Cybercrime Division (NBI-CCD).

Crucial Legal Distinction: Civil and criminal liability for harassment attaches independently of the debt itself. While an online lender's illegal collection tactics constitute actionable offenses, the underlying civil obligation to pay the principal loan remains. Borrowers are advised to settle valid outstanding principals through legitimate channels while aggressively pursuing legal remedies against the harassment.