Here’s a comprehensive legal explainer—Philippine context—on harassment of a borrower’s contacts by online lending apps (OLAs). I’ll cover the legal bases, who regulates what, what conduct is unlawful, remedies (civil, criminal, administrative), evidence you need, and practical, step-by-step actions.

What “harassment of contacts” usually looks like

“Shame campaigns”: Sending texts, chat messages, or calls to people in your phonebook (family, employer, colleagues) to pressure payment, sometimes with edited photos or defamatory statements.
Threats and coercion: Threats of arrest, criminal cases, workplace disclosure, posting on social media, or contacting HR.
Excessive/odd-hour calls: Repeated calls to you and your contacts, including from rotating numbers, VOIP, or anonymous accounts.
Data overreach: Apps require access to contacts, photos, and storage as a condition to disburse small loans, then use the data for collection.

Legal framework (Philippines)

1) Data protection & privacy

Data Privacy Act of 2012 (DPA; R.A. 10173) and its IRR

Lawful basis & proportionality: Collecting your entire phonebook or messaging third parties (your contacts) is typically not necessary for credit/collection and not covered by your consent—especially where consent is coerced (“take-it-or-leave-it” for a survival loan) or hidden in vague terms. Processing must be specific, legitimate, and proportionate to the purpose collected.
Unauthorized processing & misuse: Using contact data for public shaming or third-party disclosure is an unauthorized compatible use and can lead to administrative fines and criminal liability under the DPA.
Rights of data subjects: Right to be informed, object to processing, access data, rectification, erasure/blocking, and damages. You can demand the lender stop contacting your contacts and delete phonebook data not necessary for legitimate business needs.

National Privacy Commission (NPC)

Investigates privacy complaints, issues compliance orders (e.g., stop contacting contacts, delete unlawfully collected data), and can recommend prosecution for criminal DPA offenses.
Typical findings against abusive OLAs: lack of valid consent, disproportionate collection, improper disclosure, failure to implement security measures, and non-compliant privacy notices.

2) Consumer protection & abusive collection

Financial Products and Services Consumer Protection Act (R.A. 11765)

Covers banks, lending/financing companies, and other financial providers.
Prohibits abusive debt collection: harassment, threats, obscene/derogatory language, public shaming, contacting persons not the borrower except for limited, lawful location/skip-tracing under fair practices.
Empowers regulators (BSP, SEC, IC, CDA) to investigate, impose fines, order restitution, suspend or revoke licenses, and require corrective action.

SEC rules (lending & financing companies)

SEC supervises lending companies (R.A. 9474) and financing companies (R.A. 8556) and has issued rules prohibiting unfair debt collection practices, including shame lists, threats, profane/obscene language, and contacting persons other than the borrower except for narrow, legitimate purposes.
SEC has repeatedly ordered apps taken down, licenses revoked, and criminal cases referred for non-compliant online lenders.

Bangko Sentral ng Pilipinas (BSP)

Oversees banks, EMIs, and certain credit providers; has consumer protection standards that ban harassment and unfair collection. For BSP-supervised entities, you can file complaints directly with the bank and escalate to BSP if unresolved.

3) Penal laws & cyber offenses

Several provisions can apply to shame campaigns and threats:

Revised Penal Code (RPC):
- Grave threats / other light threats (e.g., threats of harm, baseless arrest).
- Grave coercion / unjust vexation (harassing conduct that unjustifiably annoys or compels).
- Slander/Libel (defamatory statements sent to contacts or posted online).
Cybercrime Prevention Act (R.A. 10175): Libel and threats committed through ICT (texts, chats, posts) may qualify as cyber offenses, which carry higher penalties.
Safe Spaces Act (R.A. 11313): Gender-based online harassment (if the content targets women/LGBTQ+ with sexualized insults, stalking, or doxxing).
Anti-Photo and Video Voyeurism (R.A. 9995) and Anti-Child Pornography (R.A. 9775) can be implicated where lenders circulate sexualized or child-related content (even as “edited images” used for coercion).

4) Telecom/tech angles

SIM Registration Act (R.A. 11934): Numbers used for harassment can be reported to telcos/NTC for blocking and investigation.
E-commerce & platforms: Abusive apps on app stores can be reported and delisted for policy violations (privacy, malware, harassment).

What conduct is unlawful (practical guide)

Contacting your contacts to disclose your debt or pressure payment—generally unlawful absent a clear, lawful basis. Even “location” inquiries are limited and must not disclose your debt or harass.
Using contact-list access (taken via app permissions) for debt shaming—unlawful under DPA and consumer protection standards.
Threats of arrest, public posting, workplace exposure—unlawful; arrest for civil debt is not a lawful threat.
Posting photos/memes/defamatory edits—libel/defamation and DPA breach.

Who regulates what (and where to complain)

NPC (privacy): unauthorized contact/disclosure to third parties; excessive data collection; denial of privacy rights requests.
SEC (lending/financing companies; non-bank OLAs): unfair collection; unlicensed lending; order to cease app operations; fines/revocation.
BSP (banks/EMIs/BSFIs): unfair collection by BSP-supervised institutions.
PNP-ACG / NBI-CCD: cybercrime complaints (threats, cyber-libel, extortion, doxxing).
DOJ / Prosecutors: criminal complaints for threats, coercion, libel, etc.
NTC / Telcos: number blocking/reporting for harassment campaigns.
Courts (civil): damages under Civil Code Articles 19, 20, 21 (abuse of rights and human relations).

Remedies and outcomes

Administrative (fastest in many cases)

NPC complaint → orders to stop contacting contacts, delete unlawfully held phonebook data, comply with privacy rights, and potential fines/criminal referral.
SEC complaint → investigation, cease and desist, app takedowns, fines, license revocation, referral for prosecution.
BSP complaint (if supervised entity) → sanctions and directed remediation.

Criminal

Cyber-libel, threats, coercion, unjust vexation—file with PNP-ACG/NBI then inquest or prosecutor’s office. Preserve digital evidence (see below).

Civil

Damages for abuse of rights: moral, exemplary, temperate damages; injunction to stop harassment; protection orders where gender-based online harassment is involved.

Evidence checklist (what to gather now)

Screenshots of messages (full threads if possible), call logs, timestamps, phone numbers, social media accounts/URLs, and metadata when available.
Statements from affected contacts: short written statements with dates, screenshots of what they received.
App permissions you granted; copies of the privacy notice and terms at the time you installed/borrowed.
Proof of loan: contract, disbursement, repayment receipts, your complaint emails.
Device forensics (optional): preserve original files; avoid deleting the app until you’ve exported evidence.

Step-by-step: how to respond if an OLA harasses your contacts

Secure your data
- Revoke app permissions (Contacts/Storage/SMS/Camera).
- Change passwords on email/social accounts reused in the app.
- Consider a factory reset only after exporting evidence.
Assert your rights in writing
- Send a Privacy Notice & Cease-and-Desist letter to the lender:
  - Withdraw consent to process your contacts’ data.
  - Demand erasure of your phonebook from their systems and vendors.
  - Instruct them to stop contacting third parties and limit communications to you via a single channel.
  - Ask for a data processing log and recipients list.
- Keep proof of delivery (email with read receipts or registered mail).
File complaints in parallel
- NPC: Privacy complaint (unauthorized disclosure/harassment of contacts).
- SEC: Unfair collection; identify the corporate name and app name (screenshots help).
- BSP: If it’s a bank/EMI; otherwise note “non-BSP supervised” in your SEC complaint.
- PNP-ACG/NBI: For threats, cyber-libel, extortion, doxxing. Attach evidence bundle.
- Telco/NTC: Number blocking and trace request.
Protect your contacts
- Provide them a short template: “I am not the borrower. I do not consent to this data processing. Cease contacting me. Further messages will be reported to the NPC/SEC/PNP-ACG.”
- Ask them to screenshot any further messages and forward to you.
Payment vs. harassment
- You can negotiate payment terms (if you truly owe) without conceding to unlawful collection. State you will only discuss through your chosen channel and that third-party contacts are off-limits.
- If you are a victim of identity theft or account takeover, state this explicitly and include a police blotter and identity theft report.

Common defenses raised by OLAs—and how they fail

“You consented when you installed the app.” Consent must be freely given, specific, informed, and unambiguous. Coercive “all contacts or no loan” consent is suspect; blanket clauses don’t authorize third-party disclosure for shaming.
“We’re allowed for collection.” Collection activity must be fair, proportionate, and directed to the borrower, not to unrelated third parties. Contacting others to disclose your debt is rarely necessary or lawful.
“Legitimate interests.” Legitimate interest requires a balancing test; the fundamental privacy rights of uninvolved third parties generally prevail over the lender’s convenience.
“We only verified location.” Even skip-tracing must avoid disclosing debt, and repeated calls/messages or any shaming language becomes harassment.

Practical drafting aids

A. Sample cease-and-desist / privacy rights letter (short form)

Subject: Exercise of Data Privacy Rights; Demand to Cease Unlawful Collection Practices

I am the data subject and borrower under Account No. ______ (App: ______). You are not authorized to process or disclose any data from my device contacts. I withdraw consent for such processing and invoke my rights under the Data Privacy Act to object and to demand erasure of contact-list data and deletion of any copies held by your service providers. Effective immediately, cease contacting any person other than me. Limit communications to [email/number] during lawful hours. Within 10 days, provide: (1) the specific lawful basis for processing; (2) the recipients to whom my data and my contacts’ data were disclosed; (3) actions taken to erase unlawfully processed data; and (4) your internal policies on collection practices. Continued harassment will be reported to the NPC, SEC, and PNP-ACG and pursued as criminal and civil actions for damages.

Name / Signature / Date

B. Evidence log template

Date/Time | From Number/Account | To (You/Contact) | Channel (SMS/FB/Call) | Summary of content | Screenshot filename | Notes

Special considerations

Unlicensed lenders / rogue apps: If the operator is unregistered with the SEC or hides behind shell entities, report this explicitly; unregistered lending is itself sanctionable, and takedown orders are common.
Workplace risks: If they contact your employer, consider an HR advisory explaining the legal issues and that you’re pursuing NPC/SEC complaints; ask HR to direct collectors to your lawyer’s contact.
Mental health & safety: Persistent harassment can justify temporary relocation of contact details (change primary number), and, if threats escalate, seek assistance from barangay or PNP for blotter/protection.
Settlement clauses: Avoid admitting defamation-proof facts or granting blanket data processing consents. Any settlement should include non-contact guarantees and data deletion certificates.

FAQs

Is it a crime not to pay an online loan? Ordinary non-payment of civil debt is not a crime. Threats of arrest for simple non-payment are baseless and can themselves be unlawful.

Can they call my contacts “for verification”? Narrow verification is sometimes allowed without revealing your debt, but disclosure or pressure on third parties crosses into privacy and consumer-protection violations.

What if I already clicked “Allow contacts”? You can withdraw consent at any time. Past data use can still be unlawful if the purpose was excessive or abusive; future use must stop upon your objection.

Will regulators really act? Yes—privacy and securities regulators have repeatedly sanctioned OLAs for contact-harassment and unlawful processing. Provide clear evidence and identifiers (company/app name, numbers, screenshots).

Bottom line

In the Philippines, harassing your contacts for loan collection is generally unlawful under data privacy, consumer protection, and penal laws. You have strong remedies: cease-and-desist + NPC/SEC complaints, with criminal and civil options for serious misconduct. Document everything, assert your rights, and channel all communications through a controlled, lawful path.

If you want, I can tailor a filled-in complaint packet (NPC/SEC forms + your evidence log + a customized cease-and-desist letter) based on your details—no browsing needed.