Online Lending Harassment and Data Privacy Violations: Filing Complaints Against OLA Apps in the Philippines

This article explains your rights, common violations by online lending applications (OLAs), and—most importantly—how to prepare and file complaints with the proper authorities in the Philippines.

1) Snapshot: What counts as “harassment” and a “privacy violation”?

Common abusive collection tactics

Threats of public shaming (“post ka namin sa Facebook/contacts mo”), doxxing, or arrest
Contacting family, friends, officemates taken from your phonebook
Repeated calls/messages at unreasonable hours, use of slurs/profanity
Fabricated “legal notices,” fake “subpoenas,” or pretending to be law enforcement

Common data-privacy abuses

Forcing access to your contacts, photos, SMS, location, microphone without a lawful purpose
Scraping and storing contact lists to pressure repayment
Sharing your personal data (or your contacts’ data) with third parties without consent
Keeping your data beyond what’s necessary, refusing deletion, or denying access to your data

2) The legal tools in your favor (Philippine framework)

Data Privacy Act of 2012 (DPA; R.A. 10173). Requires lawful, transparent, and proportionate processing of personal data and grants you rights to be informed, access, object, correct, and request erasure/blocking. Unlawful or unauthorized disclosure of personal information may trigger penalties. The National Privacy Commission (NPC) enforces compliance and may issue compliance orders, cease-and-desist orders, and recommend criminal prosecution.
Financial Consumer Protection Act of 2022 (FCPA; R.A. 11765). Prohibits abusive collection and unfair debt-collection practices; empowers regulators (e.g., SEC, BSP, IC) to sanction supervised entities, order restitution, and require remedial measures.
Lending Company Regulation Act (R.A. 9474) and SEC rules for OLAs. Lending/financing companies and their online platforms fall under Securities and Exchange Commission (SEC) oversight. SEC has issued rules against unfair debt collection, requiring proper disclosures and registration of online lending platforms. The SEC may suspend/revoke licenses and order take-downs of abusive apps.
Cybercrime Prevention Act (R.A. 10175) and Revised Penal Code. Threats, coercion, extortion, grave coercions, libel/cyber-libel, and unjust vexation may apply when OLAs shame or threaten borrowers online.
Other cross-cutting rules. SIM registration, e-commerce, and consumer-protection regulations may assist with evidence tracing and platform takedowns, but your two primary routes remain NPC (privacy) and SEC (lending/collection).

3) Evidence: what to preserve (before you complain)

Create a dedicated folder. Save originals plus screenshots.

App identity: exact app name, publisher/developer, download link, version, date/time installed.
Account trail: loan agreement, e-receipts, payment proofs, bank/e-wallet records.
Consent trail: permission prompts (contacts, storage, camera, SMS), in-app privacy policy, T&Cs.
Harassment logs: call logs, SMS, chat threads, voicemail/audio, caller IDs, dates/times.
Doxxing/shaming: screenshots of messages sent to your contacts, social posts, group chats.
Device info: phone model/OS, app permissions you granted/denied, any changes you made.
Witness statements: short written statements from contacts who were harassed (name, date/time, what was received).
Timeline: a one-page chronology (dates, who contacted whom, what was said/done).
Metadata where possible: export chat/email headers; keep files unedited.

Tip: Don’t delete the app until you’ve captured the evidence you need; revoke sensitive permissions after exporting proof.

4) Immediate self-help actions (hindi pa complaint)

Revoke app permissions (Contacts, Storage, SMS, Call Logs, Location, Microphone) in phone settings.
Block/report abusive numbers in your dialer and messaging apps.
Tell your contacts briefly: “My number may be used for harassing messages from a lending app. Please block/report.”
Stop negotiating under threats. If you will pay, do so only through official channels and keep receipts; never send IDs/selfies to random collectors.
Report the app on Google Play / App Store for “harassment” / “illegal collection.”
If your employer is being contacted, inform HR that you are handling the matter with authorities.

5) Where to file complaints (who handles what)

A) National Privacy Commission (NPC) — Data privacy violations

Use NPC when the OLA scraped/used your contacts, disclosed your data, or processed it beyond lawful purpose.

What to file

Complaint-Affidavit describing violations of the DPA (unlawful processing, unauthorized disclosure, failure of security measures, refusal to honor rights).
Annexes: the evidence set above, plus valid ID.
Proof you first tried to resolve with the company’s DPO (Data Protection Officer)—e.g., an email demanding cessation, deletion, and a response. NPC generally expects a prior attempt unless there’s imminent harm.

What to ask NPC to order

Cease-and-desist against further harassment and contact-list use
Deletion/blocking of unlawfully obtained data (your data and your contacts’)
Copy of all data the OLA holds about you (access request)
Administrative fines/penalties as applicable and referral for prosecution, if warranted

B) Securities and Exchange Commission (SEC) — Abusive collection / illegal OLA

Use SEC if the entity is a lending/financing company (or pretending to be one), especially for:

Unregistered/illegal lending app
Unfair collection tactics (shaming, threats, contacting contacts)
Misleading interest/fees, opaque terms, fake legal notices

What to file

Investor/Financial Consumer Complaint describing unfair collection and app details
Evidence of harassment and proof the entity is operating via the app
Request for: investigation, take-down of the app, sanctions, and public advisory if appropriate

C) PNP Anti-Cybercrime Group / NBI Cybercrime Division — Crimes (threats, extortion, cyber-libel)

File a criminal complaint if you received threats of harm, extortion, or if the OLA published defamatory posts or sent them to your contacts.

What to bring

Your affidavit, ID, and original evidence (devices/messages)
Names/numbers/handles, dates/times, and any URLs or groups used for shaming

D) Bangko Sentral ng Pilipinas (BSP) — If the lender is a bank/e-money issuer/microfinance entity under BSP

If the collector represents a BSP-supervised entity (not common for fringe OLAs), lodge a financial consumer complaint with BSP. If unsure whether BSP or SEC supervises the entity, you can file with both; agencies coordinate.

6) Step-by-step: filing a strong NPC privacy complaint

Send a DPO notice (email/letter to the company’s Data Protection Officer).
- Subject: Data Privacy Complaint; Demand to Cease Unlawful Processing and Delete Data
- Ask them to: (a) stop contacting you/your contacts; (b) delete contact-list data; (c) explain their legal basis; (d) provide a copy of all your data; (e) confirm actions within 15 calendar days.
- Attach screenshots proving the abuse.
If unresolved or ignored, draft your Complaint-Affidavit:
- Parties (you vs. company/app)
- Facts (clear timeline with dates)
- Specific DPA breaches: lack of lawful basis, excessive collection, unauthorized disclosure, failure to implement security measures, refusal to honor rights
- Reliefs sought: cease-and-desist, deletion/blocking, access to data, penalties, damages as appropriate
- Attach Annexes (A: IDs; B: screenshots; C: call logs; D: witness statements; E: copy of DPO notice and proof of service).
Filing & service
- File per NPC’s prescribed mode (e-filing/physical). Ensure your affidavit is properly signed and, if required, notarized.
- Serve a copy on the respondent as instructed by NPC rules.
During proceedings
- Respond to clarifications/mediation.
- Keep all communications; do not compromise your data rights in settlement without written commitments.

7) Step-by-step: filing a strong SEC unfair-collection complaint

Identify the entity
- Company name on the app, any corporate information, addresses, and social pages.
- Note if multiple “brands” map to one company.
Describe unfair collection
- Who contacted you, how often, exact words (quote abusive lines), and who among your contacts was messaged.
- Show app permissions and any forced consent screens.
Attach proof
- Screenshots, call/SMS logs, harassment to contacts, loan contract/receipts, app listing page.
- Include a prayer for: investigation, sanctions, and take-down of the app.
Parallel actions
- Report the app to platform stores; include your SEC case reference if available to speed takedowns.

8) Template language you can reuse

A) DPO Notice (send before NPC complaint)

Subject: Data Privacy Complaint re: OLA Harassment — Demand to Cease, Delete Data, and Provide Access Dear Data Protection Officer, I am a data subject under R.A. 10173. Your personnel/agents have accessed and used my contact list and disclosed my personal data for debt-collection harassment. This processing lacks a lawful basis and violates the principles of transparency, proportionality, and purpose limitation. I hereby exercise my rights to (1) object to further processing; (2) access and obtain a copy of all personal data you hold about me (including sources, recipients, and retention periods); and (3) erasure/blocking of unlawfully obtained data, including my contact list and any data shared with third parties. Demand: Within 15 calendar days, please (a) confirm cessation of all contact-list–based collection; (b) delete/block the data and confirm in writing; (c) provide a complete copy of my data and privacy policy; and (d) identify your legal basis for processing and all data recipients. Failure to comply will compel me to elevate to the National Privacy Commission and other authorities. Sincerely, [Name], [Mobile], [Email], [Address]

B) Witness Statement (for harassed contacts)

I, [Name], received messages/calls on [date/time] from [number/account] claiming to be from [App/Company], demanding payment from [Borrower]. The message threatened [describe], and included [screenshot attached]. I do not consent to the use of my data. [Signature/Date]

9) Your rights against abusive OLAs (quick guide)

Right to be informed & to object: You can refuse non-essential permissions and demand a lawful basis for any processing.
Right to access & data portability: Ask for a copy of your data and how it’s used/shared.
Right to rectification and erasure/blocking: Demand deletion of unlawfully obtained data (especially scraped contacts).
Right to damages: You may claim actual and, in some cases, nominal/moral damages in appropriate forums.

10) Practical FAQs

Q: The collector says they’ll “post me online” today unless I pay. A: Document the threat (screenshots/recording), do not send extra personal data, and file with PNP/NBI for threats/extortion and with NPC/SEC for privacy and unfair-collection violations. Include the exact words used.

Q: They already messaged my boss and team. A: Collect evidence (your boss’s screenshots) and add these to your NPC/SEC filings; this strengthens the case for unauthorized disclosure and unfair collection. Inform HR that you have active complaints.

Q: I granted contact permission when installing. Am I stuck? A: No. Consent must be informed, freely given, specific, and limited to a legitimate purpose. Contact-list scraping to shame you is not a legitimate collection purpose. Withdraw consent and demand deletion.

Q: Do I need to finish paying first before complaining? A: No. Abuse is actionable regardless of loan status. Keep paying only through official channels if you choose to—harassment and privacy violations are separate issues.

Q: Can I sue for damages? A: Yes—administrative complaints (NPC/SEC) can run alongside civil and/or criminal actions. Consult counsel for damages strategy while regulators handle enforcement.

11) Checklist (print-ready)

Evidence folder complete (see Section 3)
DPO notice sent; 15-day clock tracked
NPC complaint-affidavit drafted with annexes
SEC complaint filed (if lending/collection abuses)
PNP/NBI report filed (if threats/extortion/defamation)
App store report submitted
Employer/HR informed (if workplace contacted)
Permissions revoked; numbers blocked; contacts warned

12) Cautions

Never share selfies with ID, ATM/OTP codes, or full bank screenshots beyond official portals.
Beware of “fixers” offering takedown for a fee.
Keep copies of everything you submit; use consistent filenames and dates.
If you fear immediate harm, prioritize a police blotter and protective measures.

13) Closing note

Harassment and privacy abuse by OLAs are not “part of borrowing.” Philippine law prohibits shaming, threats, and unlawful processing of your (and your contacts’) data. With a disciplined approach to evidence, notifying the DPO, and filing with NPC/SEC (plus PNP/NBI where crimes are involved), you can stop the abuse, trigger sanctions, and protect yourself and your network.