I. How Online Lending Apps Typically Work

App installation and permissions
- You download the app and grant permissions: contacts, photos, SMS, camera, microphone, location, etc.
- You submit personal data: name, address, IDs, selfies, employment details, income.
- The app often claims consent to:
  - Access and store your contact list
  - Access device info (IMEI, model, IP)
  - Track your usage and repayment behavior
Loan approval and terms
- Very fast approval (minutes).
- Small loan amounts with:
  - High interest
  - “Service fees” deducted upfront
  - Very short payment periods (7–30 days, often)
Collection phase
- If you pay late or default, some apps:
  - Call, text, and chat constantly
  - Message your family, friends, and coworkers
  - Threaten legal action, arrest, or public humiliation
  - Post or threaten to post your photo online
- This is where harassment and data privacy violations usually occur.

II. Common Abusive Collection Practices

Online lending apps often cross the line from legitimate collection to illegal harassment. Typical patterns include:

“Shame messaging” / contact blasting
- Texting or calling people in your contact list:
  - “Your friend is a scammer / criminal / fraudster.”
  - “This person is a delinquent debtor; please tell them to pay or we will file a case.”
- Creating group chats with your contacts and posting your photo and debt details.
Threats and intimidation
- Threats of:
  - Arrest by “NBI,” “CIDG,” or “police”
  - Criminal cases already allegedly filed
  - “Company agents” visiting your home or office
- Threats to disclose your debt to your employer or to HR.
Use of fabricated documents
- Fake “demand letters” or “court summons”
- Fake “subpoenas” or “warrants of arrest”
- Messages implying immediate legal consequences that are not realistic.
Unauthorized disclosure of personal data
- Sharing your:
  - Full name
  - Picture
  - Debt amount and due dates
  - ID images
- To your contacts, employer, or social media groups, often without your knowledge or consent.
Excessive, abusive communication
- Dozens or hundreds of calls/texts per day
- Calling in the middle of the night
- Use of insults, slurs, and demeaning language.

Many of these practices are not only unethical—they can be civil, criminal, administrative, and data privacy violations.

III. Legal and Regulatory Framework

A. Basic Civil Law Principles

The Civil Code sets broad standards on how people and companies must act:

Article 19: Everyone must, in the exercise of their rights, act with justice, give everyone his due, and observe honesty and good faith.
Article 20: Any person who, contrary to law, willfully or negligently causes damage to another shall indemnify the latter.
Article 21: Any person who willfully causes loss or injury to another in a manner contrary to morals, good customs, or public policy shall compensate the latter.
Article 26: Protects privacy and dignity; prohibits, among others:
- Prying into the privacy of another’s residence
- Meddling with or disturbing the private life
- Vexing or humiliating a person on account of their beliefs or status
- Similar acts

Implication for lending apps: Harassing calls, humiliation, and public “shaming” of debtors or their relatives can fall under these provisions and may justify claims for moral and exemplary damages.

B. Sector-Specific Laws and Regulation of Lenders

Lending and financing companies
- Lending Company Regulation Act (e.g., RA 9474) – regulates lending companies.
- Financing Company Act (e.g., RA 8556) – covers financing companies.
- These laws require lending companies to:
  - Register with the SEC (Securities and Exchange Commission)
  - Obtain a Certificate of Authority to operate
  - Comply with disclosure, reporting, and conduct rules
- The SEC has issued regulations and advisories specifically targeting online lending platforms and abusive collection practices, and has the authority to:
  - Suspend or revoke licenses
  - Issue cease-and-desist orders
  - Impose fines
Banks and other financial institutions
- If the app is run by a bank, e-money issuer, or other BSP-supervised entity, it is also subject to:
  - Bangko Sentral ng Pilipinas (BSP) regulations on fair dealing and collection practices
  - Financial consumer protection rules (see below)
Financial Products and Services Consumer Protection Act (FCPA)
- RA 11765, the FCPA, strengthens consumer protection for financial products, including digital loans.
- Core principles:
  - Right to fair and respectful treatment: No abusive, discriminatory, or oppressive behavior.
  - Right to privacy and data protection in financial transactions.
  - Right to redress: Clear complaint mechanisms.
- The BSP, SEC, and Insurance Commission can issue and enforce rules against abusive debt collection, such as:
  - Harassment or threats
  - Use of profanity or obscenities
  - Contacting persons not authorized by the borrower about the debt, except as allowed by regulation

C. Data Privacy: Data Privacy Act of 2012 (RA 10173)

The Data Privacy Act (DPA) is central to combating online lending harassment involving personal data.

1. Key concepts

Personal Information (PI): Any data from which a person can be identified (name, contact number, email, address, etc.).
Sensitive Personal Information (SPI): Includes government IDs, financial information, health data, and others.
Personal Information Controller (PIC): The lending company or app operator that decides how personal data is processed.
Personal Information Processor (PIP): A third party that processes data for the PIC (e.g., an outsourced collection agency).

2. Lawful processing

A lending app may process your personal data only if it has a legal basis, such as:

Your valid, informed consent
Processing necessary for the performance of a contract (e.g., to grant and manage the loan)
Compliance with a legal obligation
Legitimate interests of the PIC or a third party, balanced against your rights

Even when a legal basis exists, processing must still obey the principles of:

Transparency
Legitimate purpose
Proportionality

Problem with many apps:

Vague, overly broad consent (“we can contact anyone in your phone book…”)
Processing contact data of third parties (your relatives/friends) who never gave consent
Use of these contacts for harassment or public shaming, not for a legitimate and proportionate purpose.

3. Rights of the data subject (you and your contacts)

Under the DPA, data subjects have the right to:

Be informed about how their data is collected and used.
Access their personal data.
Rectify inaccurate data.
Object to processing based on consent or legitimate interest.
Erase or block data under certain conditions.
Data portability (for some types of processing).
File a complaint and recover damages for violations.

This means:

You can object to the use of your contacts, photos, or other data for shaming or harassment.
Your contacts who receive threatening or shaming messages containing their data (or yours) can also complain as data subjects.

4. When collection becomes a data privacy violation

Online lending app behavior may violate the DPA when they:

Collect or use contacts’ numbers without a valid legal basis.
Process personal data beyond what is necessary for the loan (e.g., contacting dozens of unrelated contacts).
Disclose your debt to third parties without your consent or other valid basis.
Fail to implement security measures that prevent unauthorized access or leakage of your data.
Treat data subject requests (for access, erasure, objection) with indifference or hostility.

These can lead to administrative penalties and, in some cases, criminal liability (fines and imprisonment) for responsible officers.

D. Criminal Liability

Abusive collection might constitute crimes under the Revised Penal Code and other penal laws, especially when coupled with online dissemination.

Some possible offenses (depending on the specific acts and evidence):

Libel / Slander
- Publicly accusing someone of being a “scammer,” “thief,” or similar, in messages to many people or social media, can be:
  - Libel (written/online)
  - Slander (oral)
- If done through online platforms, it may also fall under cyber libel as covered by the Cybercrime Prevention Act (RA 10175).
Grave threats or light threats
- Threatening to injure, kill, or commit a wrongful act against the borrower or their family can be criminal.
Grave coercion
- Using violence, intimidation, or threats to compel a person to do something against their will (e.g., “Pay today or we will send armed men or post your nude photos”).
Cybercrime-related offenses (RA 10175)
- Cyber libel
- Illegal access or data interference (if they hack or illegally access your accounts)
- Other computer-related crimes, depending on the conduct.

In serious cases, you may file a criminal complaint with the police, NBI, or prosecutor’s office.

IV. Civil Remedies for Victims

A borrower (and sometimes their contacts) can pursue civil actions against abusive lenders.

Damages under the Civil Code
- Moral damages for mental anguish, fright, serious anxiety, social humiliation, and similar injury.
- Exemplary damages to set an example and deter other offenders.
- Actual damages for expenses (lost income, medical expenses from stress-related illness, etc.), if proven.
Reduction of unconscionable interest and charges
- Although the Usury Law ceilings were lifted, Philippine courts may reduce unconscionable interest rates and penalty charges.
- If the interest or penalties are shockingly high, a court may declare them void or reduce them to a reasonable level.
Injunction / restraining orders
- In appropriate cases, a court may be asked to:
  - Order the lender to stop contacting your contacts.
  - Order the deletion or non-use of certain data.
  - Prohibit publication or continued dissemination of defamatory content.
Small claims
- If the dispute involves only a limited amount of money (within the current small claims threshold), you may seek relief without a lawyer through the small claims procedure, especially if the issue is about repayment amounts or unlawful charges.

V. Administrative Remedies

A. Complaining to the National Privacy Commission (NPC)

The NPC enforces the Data Privacy Act.

You can complain if:

Your personal data was misused, improperly disclosed, or processed without your consent or legal basis.
The lender refused to address your privacy-related concerns.

Typical steps:

Document evidence
- Screenshots of messages, call logs, chat conversations.
- Copies of the app’s privacy policy and consent forms (if available).
- Any written communication with the company.
Initial contact / request to the company
- Many procedures expect you to first attempt to resolve the issue with the Personal Data Protection Officer (DPO) of the company, if known.
- Send a written complaint asserting your rights under the Data Privacy Act.
Filing a complaint with NPC
- Prepare a written complaint form and attach evidence.
- Describe the acts:
  - Unlawful disclosure to contacts
  - Harassment
  - Failure to honor your data subject rights
- NPC can:
  - Order the company to correct or stop unlawful processing
  - Impose fines or recommend prosecution
  - Issue advisory opinions and guidelines that can support your case.

Your contacts who receive harassing messages about you may also file their own complaints since their data (phone numbers, names) is being processed and misused.

B. Complaining to the Securities and Exchange Commission (SEC)

If the online lending app is a lending or financing company or operates as one:

You may file a complaint with the SEC for:
- Abusive collection practices
- Operating without the proper registration or Certificate of Authority
- Violations of lending/financing regulations, including unfair and unreasonable practices.
The SEC can:
- Summon the company to explain
- Impose fines
- Suspend or revoke its authority to operate
- Issue public advisories warning the public against abusive or illegal apps.

In some cases, the SEC has ordered specific apps to stop collection, delete data, or cease operations.

C. Complaining to the BSP (if applicable)

If the lender is a BSP-supervised institution (e.g., a bank or a particular type of financing company under BSP), you may file a complaint with the BSP’s consumer assistance channels.

BSP rules demand fair treatment and prohibit harassment and abusive collection practices.
BSP can:
- Require the institution to respond to and correct the situation
- Impose supervisory sanctions.

VI. Practical Steps for Borrowers Facing Harassment

If you are currently being harassed by an online lending app:

Preserve evidence
- Save screenshots of messages, call logs, and group chats.
- Record dates and times of calls and texts.
- Ask contacts who receive harassment messages to screenshot and forward them.
Do not engage with abusive collectors
- Avoid escalating arguments.
- If you must respond, do so calmly and briefly:
  - State that harassment and disclosure to third parties are illegal.
  - Ask for the name of the company, agent, and supervisor.
  - Inform them you are documenting the harassment and considering legal action.
Secure your device and accounts
- Review app permissions:
  - Revoke unnecessary access if technically possible.
- Change passwords for emails and social media accounts.
- Consider uninstalling the app after you have secured needed evidence.
Send a written demand / objection
- To the company’s email or DPO (if listed):
  - Cite your right to data privacy and fair treatment.
  - Demand they:
    - Stop contacting your contacts
    - Stop using your data for harassment
    - Delete or restrict processing of certain data
  - Inform them you may file complaints with the NPC, SEC, BSP, or law enforcement.
Plan your repayment strategy
- If you legitimately owe money, the principal obligation remains, even if their collection methods are illegal.
- You can:
  - Negotiate reasonable terms.
  - Question excessive interest and penalties.
  - Seek advice on whether charges are unconscionable.
- Be cautious of “reloan” or “rollover” offers that trap you in a cycle of debt.
File formal complaints
- NPC – for data privacy violations
- SEC – for abusive practices of lending or financing companies
- BSP – if the entity is BSP-regulated
- Law enforcement / prosecutors – for crimes like threats, libel, coercion, etc.
Seek legal and psychological support
- Consider consulting:
  - A private lawyer
  - Public Attorney’s Office (if qualified)
  - Legal aid clinics or NGOs focused on digital rights or consumer protection
- Harassment can be emotionally exhausting. Mental health professionals, trusted family, or support groups can help you cope.

VII. Rights and Remedies of Your Contacts

Often, the most painful part is that your family, friends, and co-workers get dragged into the harassment.

They also have rights:

Data privacy rights
- Their phone numbers and names are their personal data, not the lender’s.
- They can:
  - Object to processing.
  - Demand that their numbers be deleted and no longer contacted.
  - File their own NPC complaint.
Protection against defamation and harassment
- If collectors send lies or defamatory statements about you that also affect them, they might have grounds for civil actions (damages) or criminal complaints depending on the content.
Practical steps for contacts
- Do not pay on your behalf out of fear of threats, unless it is genuinely your mutual decision.
- Block numbers if necessary.
- Save screenshots and other evidence if they plan to support your complaint or file their own.

VIII. Key Takeaways

Debt does not erase your rights. Even if you owe money, collectors cannot lawfully harass, defame, or expose you or your contacts.
Abusive collection is multi-layer illegal. Harassing conduct may violate:
- The Civil Code (human relations and privacy)
- Financial consumer protection laws and regulations
- The Data Privacy Act
- Criminal laws (libel, threats, coercion, cybercrime)
Data privacy is a powerful weapon. Online lending harassment often relies on misuse of data—contact lists, photos, IDs. The Data Privacy Act gives you and your contacts concrete rights and remedies.
Regulators are part of the solution. The NPC, SEC, BSP, and law enforcement can all play roles in stopping abusive apps and holding them accountable.
Evidence is crucial. Screenshots, call logs, and written communications often make the difference in complaints and cases.
Pay what you truly owe, challenge what is illegal. You may still have to pay the legitimate principal of your loan, but you can challenge unlawful fees, unfair terms, and illegal collection tactics.

If you’d like, I can help you next by:

Turning this into a shorter explainer you can share with affected friends or coworkers, or
Drafting a sample complaint letter to an online lender or a sample NPC/SEC complaint based on a hypothetical scenario.