The rise of Financial Technology (FinTech) in the Philippines has made credit more accessible than ever. However, this convenience has a dark side: the proliferation of predatory Online Lending Applications (OLAs). A common tactic used by these entities involves harassment, shaming, and the threat to publish a borrower’s sensitive personal information—a practice colloquially known as "debt shaming."

If you are facing these threats, you are not defenseless. The Data Privacy Act of 2012 (Republic Act No. 10173) provides a robust legal framework to hold these lenders accountable.

Understanding the Violation: Unauthorized Processing

When you download a lending app, it often requests access to your contacts, gallery, and social media accounts. Under the Data Privacy Act (DPA), this data must only be used for the specific purpose of credit scoring and loan processing.

Common violations include:

Accessing Contact Lists: Messaging your family, friends, or employers to inform them of your debt.
Public Shaming: Posting your ID, photo, or "wanted" posters on social media platforms.
Threats and Intimidation: Using personal data to harass or cause psychological distress.

These actions violate the principles of Transparency, Legitimate Purpose, and Proportionality. Using your data to shame you is never a legitimate purpose for debt collection.

Legal Remedies Under the Data Privacy Act

1. Filing a Formal Complaint with the NPC

The National Privacy Commission (NPC) is the primary agency tasked with enforcing the DPA. If an OLA misused your data, you could file a complaint for:

Unauthorized Processing: Processing personal data without the consent of the data subject or without being authorized by law.
Processing for Illegitimate Purposes: Using data for malicious purposes, such as harassment.
Malicious Disclosure: Intentionally disclosing false or sensitive information with the intent to cause harm.

2. Criminal Liability and Penalties

Under the DPA, violators face severe consequences. Depending on the specific violation, penalties can include:

Imprisonment: Ranging from one (1) to seven (7) years.
Fines: Ranging from ₱500,000 to ₱5,000,000.

Note: If the offender is a corporation (which most OLAs are), the penalty shall be imposed upon the responsible officers, and the company’s license to operate can be revoked.

3. Right to Damages

Section 34 of the DPA grants you the right to be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data. This allows you to seek civil damages in court.

Other Relevant Regulations

The NPC does not work alone. Other agencies provide complementary protections:

SEC Memorandum Circular No. 18 (Series of 2019): Prohibits unfair debt collection practices, specifically mentioning "contacting the persons in the borrower's contact list" and "posting the borrower's personal information on social media."
Cybercrime Prevention Act of 2012 (R.A. 10175): Threats and harassment via digital platforms may constitute Cyber Libel or Unjust Vexation.

Steps to Take If You Are Being Harassed

Document Everything: Take screenshots of the harassing messages, the profile of the sender, the date/time, and any social media posts made about you.
Cease and Desist: Inform the lender (via email or recorded chat) that they are violating the Data Privacy Act and SEC regulations and that you will take legal action.
Report to the NPC: Visit the NPC’s official website to file a formal complaint through their "Complaints and Investigation Division."
Report to the SEC: If the lender is a registered corporation, file a complaint with the Securities and Exchange Commission (SEC) for violations of fair collection practices.
Request Takedowns: Use the reporting tools on Facebook, X (Twitter), or Google to report posts that contain your private information or involve harassment.

Conclusion

Online lending apps are bound by the same laws as traditional banks. Debt is a civil obligation, but privacy is a fundamental right. Being in debt does not give a lender the right to strip you of your dignity or weaponize your personal data. By utilizing the Data Privacy Act, you can stop the harassment and hold predatory lenders accountable.

Would you like me to draft a formal "Cease and Desist" letter template that you can send to a lending company?